PRIVACY POLICY

Last Updated: May 1, 2023

Highgate Hotels, L.P., its subsidiaries, and its affiliates (referred to herein as “we”, “our”, or “us”) recognize the importance of protecting the personal information we may collect from guests, visitors and any other individual or entity (“Users”, “you”, or “your”). This Privacy Policy applies to our data collection and privacy practices when we collect personal information through your use of the website, including https://www.romerhotels.com, software and applications accessible on or by any top-level domain owned by us that contain a link to this Privacy Policy (each, a “Site” and collectively the “Sites”), through our social media pages that we control, through email messages that we may send to you, and when you visit or stay as a guest at one of our properties or purchase related services (collectively, the “Services”). Please note that this Privacy Policy excludes services that state that they are offered under a different privacy policy.

Specifically, our Privacy Policy covers the following topics:

• Site Terms of Use
• Information We Collect
• Cookies and Similar Technologies
• How We Use Information We Collect
• Our Legal Basis for Collecting Personal Information
• When You Choose Not to Provide Personal Information
• Our Retention of Your Personal Information
• Sharing Personal Information
• International Transfer
• Privacy Rights
• Jurisdiction-Specific NoticeEEA, UK, and Switzerland Residents
• Your Marketing Choices
• Links to Other Websites
• How We Protect Personal Information
• Children’s Privacy
• Privacy Policy Modifications 
• How to Contact Us
   

Please familiarize yourself with our privacy practices. As one of our guests or as a visitor using the Sites or Services, you understand and agree that we collect, use and disclose your Personal Information (as defined below) in accordance with this Privacy Policy.

Residents in the European Economic Area ("EEA"), United Kingdom ("UK") and Switzerland should refer to the body of this Privacy Policy as well as the "Jurisdiction- Specific Notices" section below for additional information that may be applicable to them. Residents of California should refer to the body of this Privacy Policy as well as the Privacy Notice for Californians.

Site Terms of Use 
By accessing or using the Sites in any manner, you also agree to be bound by our Terms of Use (the “Agreement”). Please read the Agreement carefully. If you do not accept all of the terms and conditions contained in or incorporated by reference into the Agreement, please do not use the Sites.

Information We Collect 
We collect Personal Information to provide better Services to all our guests and visitors. We use the term “Personal Information” to refer to any information that identifies, relates to, or describes an identified or identifiable natural person. Common examples of Personal Information include: full name, email address, information about your device, and certain metadata.

The Personal Information which we collect includes, but is not limited to, the following circumstances and data elements:

If you express an interest in obtaining additional information about our Services, request customer support, use the "Contact Us" or similar features on our Site, register to use our Sites or Services or create an account, or download certain content, we may require that you provide to us your personal identifiers, such as your name, phone number, or email address, professional or employment-related information, such as your organization's name, and in some instances, you may elect to provide us with contact information, such as location and address information;
If you sign up to receive marketing emails, we will collect your personal identifiers, such as your name and email address;
If you report a problem or have a question about our Services, you may provide us with contact information, such as a phone number, or personal identifiers, such as an email address;
If you decide to stay at one our hotels, we may collect:Personal identifiers and travel-related information, such as your frequent flyer number, preferred airlines, rental car providers, and travel history;
 Demographic information, such as your date of birth, gender, number of children;
Financial and billing information, such as billing name and address, business title, work contact address, credit card number or debit card number;
Inferences and preferences, such as information about your travel preferences or relating to your reservation, such as the properties you have visited, your arrival and departure dates and any special requests you may make, your guest preferences (including those relating to amenities, facilities, housekeeping and room preference), vehicles you may bring to the properties, on-property services that you may request (including concierge services, health clubs, spa services, activities, child care services, equipment rental, and restaurant or room delivery services);
Audio and visual information, such as information collected through the use of a close circuit television system
If you or your organization plans an event or meeting at one our hotels, we may collect Personal Information related to the event or meeting such as the guest list and information about the guests at your event;
If you use and interact with our Sites or emails, we automatically collect information about your device and your usage of our Sites or emails through cookies, web beacons or similar technologies, Internet or other electronic network activity information (such as Internet Protocol (IP) addresses or other identifiers), please see the “Cookies & Similar Technologies” section, below for more information;
If you use and interact with our Sites or emails, we and our service providers may collect geolocation information, including through use of IP addresses to understand the locations from which you are accessing the Services.
If you voluntarily submit certain information to our Services, such as filling out a survey about your guest experience or entering a contest or promotion, we collect the information you have provided as part of that request;
For business contacts, we may receive your contact information, such as your personal identifiers (including your name and email address) and/or professional or business-related information (including your business address or telephone number), through our online or offline interactions with you, such as when we work together on a project or discuss opportunities to work together. We may send you emails or call you with information about our business dealings, news, or marketing information to communicate with you for business purposes; and
We do not generally collect Sensitive Personal Information unless it is voluntarily provided by you. We only process Sensitive Personal Information in your jurisdiction to the extent permitted by applicable law. You are not required to provide us with any of your Sensitive Personal Information, and choosing not to do so will not prevent you from purchasing any Services from us.
If you provide us or our service providers with any Personal Information relating to other individuals, you represent that you have the authority to do so and acknowledge that it will be used in accordance with this Privacy Policy. If you believe that your Personal Information has been provided to us improperly, or to otherwise exercise your rights relating to your Personal Information, please contact us by using the information set out in the “How to Contact Us” section below.
We obtain the categories of Personal Information listed above from the following categories of sources:
Directly from our guests or their agents. For example, from information that our guests provide to us in order to reserve a room at a resort location.
Indirectly from our guests or their agents. For example, through information we collect from our clients in the course of providing Services to them.
Directly and indirectly from activity on our Sites. For example, from website usage details that are collected automatically. In addition, like many companies, we use “cookies” which are small text files a website can use to recognize repeat users, facilitate the user’s ongoing access to and use of the site and to track usage behavior of, for example, the webpages you visit.
From social media websites, platforms, or networks, such as Facebook, Twitter, LinkedIn, YouTube, Instagram, TikTok and Pinterest, that you use in connection with our Sites.
From third parties that assist us in providing certain transactions and services (e.g. reservations, online travel agencies, payment processing, hosting), even though it appears that you may not have left our Site.

 Cookies and Similar Technologies 
We and our partners use various technologies to collect and store information when you visit one of our Sites or Services, and this may include using cookies or similar technologies to identify your browser or device. We also use these technologies to collect and store personal identifiers (such as your IP address), Internet or other electronic network activity information (such as your browser characteristics, device IDs and characteristics, operating system version, and language preferences) and information concerning your usage of our Sites (including the link you used to reach a given webpage) when you interact with our Site or services from our partners, such as advertising services. Our third party advertising and analytics partners include Google and similar partners.

The technologies we use for this automatic data collection may include:

Cookies. A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our services.
Web Beacons. Pages of our services or our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags and single-pixel gifs) that permit us, for example, to count Users who have visited those pages or opened an e-mail and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
Clickstream Data. Clickstream data is information collected by our computers when you request Web pages from the Sites. Clickstream data may include information such as the page served, the time spent viewing the page, source of the request, type of browser making the request, the preceding page viewed and similar information. Clickstream data permits us to analyze how visitors arrive at the Sites, what type of content is popular, what type of visitors in the aggregate are interested in particular kinds of content on the Sites.

You may have certain choices when it comes to how we use your data and we want to provide you with information to make the choices that are right for you.

Interest-Based Ads and Other Online Advertising. Visit http://www.networkadvertising.org or http://www.aboutads.info to learn more about your options for opting out of interest-based advertising. For more information on various opt-out options, please see our Cookie Policy. We do not guarantee that all of the third parties we work with will honor the elections you make using those options. Please also keep in mind that even if you opt-out of receiving ads tailored to your apparent interests, you will continue to see online ads, but the ads that you see therefore may be less relevant to your interests.
Mobile Devices. Your mobile device may offer settings relating to cookies, pixel tags, Flash cookies, and other similar technologies. We encourage to you to visit your device’s help menu to learn about your options to limit tracking when using your device. For some information on controlling your mobile choices, click here.
Social Media Platforms and Networks. We encourage you to review your privacy options and settings with the social media platforms and networks you use to understand what choices you have about sharing information from those platforms and networks with us.

We do not respond to Do Not Track (DNT) signals, except that our systems and Services will respond to global privacy controls as required by applicable law. However, some third party sites do keep track of your browsing activities when they serve you content, which enables them to tailor what they present to you. If you are visiting such sites, your browser may include controls to block

and delete cookies, web beacons and similar technologies, to allow you to opt out of data collection through those technologies.

How We Use Personal Information We Collect 
We use your Personal Information in ways that are compatible with the purposes for which it was collected or authorized by you, including for the following purposes:

To present, operate or improve the Site and Services, including analysis of Site activity;
To inform you about Services and products available from us;
To fulfill the services, reservations and transactions that you, or anyone involved in the process of making your travel arrangements, request from us, including facilitating your requests to plan and purchase hotel accommodations or other travel services such as transportation and to reserve dining, lounge and spa services;
To authorize access to our Sites and Services;
To validate your identity or verify communications from you;
To offer and administer programs;
To customize or tailor your experience of the Services;
To manage, store and enhance guest data and preferences;
To communicate about, and administer your participation in, special programs, surveys, contests, online campaigns, online programs, sweepstakes, prize draws and other offers or promotions, and to deliver pertinent emails;
To send you confirmations, updates, security alerts, and support and administrative messages and otherwise facilitate your use of, and our administration and operation of, the Services;
For marketing purposes, including but not limited to, facilitating interest-based advertising, creating traveler profiles, creating custom audiences to target online and mobile advertising, sending integrated marketing messages across channels and devices, personalizing email marketing that we send to you, sending you other promotional materials, and notifying you about special promotions, offers, events or opportunities that may be of interest to you;
To improve our customer service, conduct customer satisfaction, market research, and quality assurance reviews;
To respond to and support users regarding their use of the Sites and Services;
To process applications for employment that you submit through the Sites;
To administer general recordkeeping;
To comply with all applicable legal requirements;
To investigate possible fraud or other violations of our Terms of Use or this Privacy Policy and/or attempts to harm our guests or visitors.
For any other purpose that is disclosed to you at the point of collection of the personal information, for any purpose for which you provide your prior consent, or for any other lawful purpose.

Except where prohibited by applicable law or regulation, we may combine information collected through one source with information obtained through other resources. We also may supplement the information we collect with information obtained from third parties. We will treat any information that we combine with your personal information as Personal Information pursuant to this Privacy Policy.

We may use your Personal Information in furtherance of our legitimate interest to provide you with the Services offered by us. We may also use your information to manage our contractual relationship with you or to comply with our legal obligations.

To the extent we rely on consent for the processing of your Personal Information, we will seek such consent at the time we collect your personal data. We may also use the Personal Information we obtain about you in other ways for which we provide specific notice at the time of collection.

Our Legal Basis for Collecting Personal Information 
Whenever we collect Personal Information from you, we may do so on the following legal bases:

Your consent to such collection and use;
Out of necessity for the performance of an agreement between us and you, such as your agreement to use our Services or your request for Services;
Our legitimate business interest, including but not limited to the following circumstances where collecting or using Personal Information is necessary for:
Intra-organization transfers for administrative purposes;
Product development and enhancement, where the processing enables us to enhance, modify, personalize, or otherwise improve our Services and communications for the benefit of our visitors and guests, and to better understand how people interact with our Sites;
Fraud detection and prevention;
Enhancement of our cybersecurity, including improving the security of our network and information systems; and
General business operations and diligence;

Provided that, in each circumstance, we will weigh the necessity of our processing for the purpose against your privacy and confidentiality interests, including taking into account your reasonable expectations, the impact of processing, and any safeguards which are or could be put in place. In all circumstances, we will limit such processing for our legitimate business interest to what is necessary for its purposes.

When You Choose Not to Provide Personal Information 
Your provision of Personal Information is required in order to use certain Services and programs. In some instances, if you do not to provide such Personal Information, you may not be able to access and use our Services, or parts of our Services.

Our Retention of Your Personal Information 
We use and retain your Personal Information for as long as necessary to fulfill the purpose for which it is being processed, to carry out legitimate business interests, as well as on the basis of applicable legal requirements (such as applicable statutes of limitation).

After expiry of the applicable retention periods, your Personal Information will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of such data.

Sharing Personal Information 
We may disclose any of the categories of Personal Information listed above for our business and commercial purposes as described below.

Service providers. We disclose Personal Information to service providers that we use to support our business for a business purpose, including verifying your identity when making a payment, performing core services (such as reservations, billing, credit card processing, customer support services, customer relationship management, property management, accounting, auditing, processing insurance claims, administering sweepstakes, surveys, advertising and marketing, analytics, email and mailing services, data storage, and security) related to the operation of our business and/or the Services, the operation of our properties and properties operated under our family of trademarks, the provision of services at those properties, the processing and fulfillment of your reservations and requests, and making certain functionalities available to our users; when we disclose Personal Information for these reasons, we enter into a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except for the purposes set forth in the contract;
Our affiliates. We disclose Personal Information with our affiliates in our group of companies, and any successors thereto in the normal course of our business operations, for business purposes such as to communicate with you and to promote and provide our Services. In this regard, Personal Information may be shared with one of our affiliates for use in providing a service to us;
Owners and franchisees. We disclose Personal information to owners and franchisees of properties that we manage but do not own, the owners and operators of properties that we license, and the owners and operators of residential properties operated under our family of trademarks, who may use that information for the purposes disclosed in or consistent with the terms of this Privacy Policy, including without limitation those uses identified in the “How We Use Your Information” section above and to provide you with information or Services relating to those properties, as well as marketing information relating to their products, services, and real estate and other opportunities;
New owner and/or manager of a hotel or other property previously operated or licensed by us or our affiliates. We may disclose Personal Information following a change in management or ownership of the hotel or other property;
Strategic business partners. We may disclose Personal Information to strategic business partners who provide goods, services and offers that enhance your experience at our properties, or that we believe will be of interest to you, such as personalized and unique travel experiences;
Third parties. We may disclose Personal information to third parties to whom you or your agents authorize us to disclose your Personal Information in connection with the Services we provide to you. These third parties include accommodation and food service providers, transportation services, health club, spa, concierge and other outlets and similar vendors in order to provide our services and programs to you;
Enterprise accounts. We may disclose your Personal Information when an enterprise account is created, such as your employer when they manage an enterprise account.
Also, we may disclose your Personal Information for legal reasons. Specifically, we will share Personal Information with companies, organizations or individuals outside of us if access, use, preservation or disclosure of the information is reasonably necessary to:

Fulfill any purpose for which you provide it;
Meet any applicable law, regulation, legal process or enforceable governmental request;
Enforce applicable Terms of Use, including investigation of potential violations;
Detect, prevent, or otherwise address fraud, security or technical issues;
Protect against harm to the rights, property, assets or safety of our group, our guests or the public, content found on the Services, or to protect the Services from unauthorized use or misuse, as required or permitted by law;
Facilitate a business transfer, such as to a buyer or other successor in the event of merger, acquisition, consolidation, divestiture, change in control, dissolution or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which Personal Information held by us about our guests and users will be among the assets to be transferred, and any such successor may use your information for the same purposes set forth in the Privacy Policy.
For any other purpose disclosed when you provide the information; and,
When we obtain your consent to do so.
We attempt to notify visitors and guests about legal demands for their Personal Information when appropriate in our judgment, unless prohibited by law or court order or when the request is an emergency. We may dispute such demands when we believe, in our discretion, that the requests are overbroad, vague or lack proper authority, but we do not promise to challenge every demand.

International Transfer
We have centralized some of our data processing activities in accordance with applicable laws, and as a result, we may, directly or indirectly through our organization and affiliates, and through third-party entities around the world, process, store, and transfer the information you provide, including your Personal Information, as described in this Privacy Policy. Specifically, the information and Personal Information that we collect may be transferred to, and stored at, a location outside of your jurisdiction. For example, if you book a stay at a one of our properties outside of the United States, the Personal Information gathered during the booking process will be transferred to that location. The jurisdiction where your Personal Information will be processed may or may not have laws that seek to preserve the privacy of Personal Information. Your Personal Information may also be processed by staff operating outside of your jurisdiction who work for us or for one of the organizations outlined in this Privacy Policy in connection with the activities outlined in this Privacy Policy. By submitting your Personal Information to the Sites or visiting one of our properties, you agree to this transfer, storing or processing. We will take all steps necessary to ensure that your Personal Information is treated securely and in accordance with this Privacy Policy. We have put in place commercially reasonable technical and organizational procedures to safeguard the information and Personal Information we collect on the Sites and at our properties.

Privacy Rights 
You may have certain privacy rights relating to your Personal Information and we will comply with restrictions and any requests you submit as required by applicable law. For example, you may have the right to review, correct, and delete personal information we have about you, or to consent or withdraw consent to certain uses or sharing of personal information. You may also have the right to not be discriminated against for exercising your privacy rights. Also, whenever you choose to be a guest or visitor at one of our managed properties, we aim to provide you with choices about how we use your Personal Information. If you are a California resident, see our Privacy Notice for Californians, and if you are located in the EEA, UK or Switzerland, see our Jurisdiction-Specific Notices below for additional information as to how to exercise rights under the laws of those jurisdictions. If you are located outside those jurisdictions and seek to exercise your rights under the law of another jurisdiction, please contact us as indicated in the “How to Contact Us” section below.

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information, including asking you to provide information and follow procedures so that we can verify your identity (and the applicable jurisdiction). The verification steps we take may differ depending on your jurisdiction and the request. Where possible, we will attempt to match the information that you provide in your request to information we already have on file to verify your identity. If we are able to verify your request, we will process it. If we cannot verify your request, we may ask you for additional information to help us do so.

We will respond to your request within the time period required by applicable law. However, we may not always be able or required to comply with your request, in whole or in part, and we will notify you in that event.

Jurisdiction-Specific Notices

EEA, UK, and Switzerland Residents
The European Union’s General Data Protection Regulation (“GDPR”), and corresponding legislation in the UK and Switzerland, provide EEA, Switzerland and UK residents with certain rights in connection with Personal Information you have shared with us. If you are residents in these areas, you may have the following rights:

The right to be informed. You are entitled to be informed of the use of your Personal Information. This Privacy Policy provides such information to you.
The right of access. You have the right to request a copy of your Personal Information which we hold about you.
The right of correction. You have the right to request correction or changes of your Personal Information if it is found to be inaccurate or out of date.
The right to withdraw consent. You have the right to withdraw a previously given consent for processing your Personal Information for a specific purpose.
The right to be forgotten. You have the right to request us, at any time, to delete your Personal Information from our servers and to erase your Personal
Information when it is no longer necessary for us to retain such data. Note, however, that deletion of your Personal Information will likely impact your ability to use our services.

The right to object (opt-out). You have the right to opt-out of certain uses of your Personal Information, such as direct marketing, at any time.
The right to data portability. You have the right to a “portable” copy of your Personal Information that you have submitted to us. Generally, this means your right to request that we move, copy or transmit your Personal Information stored on our servers or information technology environment to another service provider’s servers or information technology environment.
The right to refuse to be subjected to automated decision making, including profiling. You have the right not to be subject to a decision and insist on human intervention if the decision is based on automated processing and produces a legal effect or a similarly significant effect on you.
The right to lodge a complaint with a supervisory authority. You have the right to lodge complaints about our data processing activities by filing a complaint with us or with the relevant Supervisory Authority. A list of Supervisory Authorities is available here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.
For additional information from the European Commission concerning data protection and your rights, see: https://ec.europa.eu/info/law/law-topic/data- protection/reform/rights-citizens_en.

Your Marketing Choices 
In addition to the marketing choices described in the Cookies and Similar Technologies section above, you can opt-out of receiving marketing emails from us by sending us an email stating your request to Privacy@romerhellskitchen.com. If we or one of our service providers acting on our behalf have sent you a promotional email, you may use the “unsubscribe” link or send us a return email asking to be omitted from future email distributions. Please keep in mind that opting out of marketing emails may impact our ability to allow you access to certain offers, benefits and features. Please also note that even if you opt out of receiving certain marketing emails, that opt-out may not apply to other transactional or legal communications that you may continue to receive from us, such as customer service messages, messages about your account or transactions with us, notices about our policies and terms, and emails responding to your communications with us or requests for information that we receive from you.

Notwithstanding anything else in this Privacy Policy, please note that we always reserve the right to contact you in the event of a change in this Privacy Policy, or to provide you with any service related notices.

Links to Other Websites 
The Sites may contain links to webpages operated by parties other than us. We do not control such websites and are not responsible for their contents or the privacy policies or other practices of such websites. Our inclusion of links to such websites does not imply any endorsement of the material on such websites or any association with their operators. Further, it is up to the User to take precautions to ensure that whatever links the User selects or software the User downloads (whether from this Site or other websites) is free of such items as viruses, worms, trojan horses, defects and other items of a destructive nature. These websites and services may have their own privacy policies, which the User will be subject to upon linking to the third party’s website. We strongly recommend that each User review the third party’s terms and policies.

If you have any questions about the privacy practices of other websites, you should contact the relevant parties controlling these websites for more information.

How We Protect Personal Information 
We maintain administrative, technical and physical safeguards designed to protect the user's Personal Information and other information against accidental, unlawful or unauthorized destruction, loss, alteration, access, disclosure or use.

Although we take reasonable steps designed to protect your Personal Information, please be advised that no security system or means of transmitting data over the Internet can be guaranteed to be entirely secure (including without limitation with respect to computer viruses, malicious software and hacker attacks).

Children’s Privacy 
The Services are not designed or intended to be used by anyone under the age of 18. If you are under the age of 18 (or a minor in the jurisdiction in which you are accessing our Sites or Services), do not use the Services, make reservations or other purchases via the Services, use any interactive features of the Services, or post any Personal Information to our Sites or submit any Personal Information via the Services. We do not knowingly or intentionally gather Personal information about children who are under the age of 16. If a child has provided us with Personal Information, a parent or guardian of that child may contact us to have the information deleted from our records. If you believe that we might have any information from a child under age 16 in the applicable jurisdiction, please contact

us Privacy@romerhellskitchen.com. If we learn that we have inadvertently collected the Personal Information of a child under 16, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible and cease the use of that information in accordance with applicable law.

Privacy Policy Modifications 
Our Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post any privacy policy changes on this page and, if the changes are material, we will provide a more prominent notice (including, for certain services or programs, email notification or privacy policy changes) for a reasonable period of time. Nevertheless, you should review this Privacy Policy from time to time to be sure you are aware of the most recent version.

How to Contact Us
If you have any questions, comments or concerns about this Privacy Policy, or if you would like to exercise the choices discussed above, please contact us:

Via e-mail: Privacy@romerhellskitchen.com.