Privacy Policy

Montage Hotels & Resorts, LLC (“Montage”) respects the privacy of all our guests, and we are committed to protecting privacy through our compliance with this policy. This policy describes the type of information we may collect from our guests and private members, and our practices for collecting, using, maintaining, protecting, and disclosing that information.

Montage, its parents, subsidiaries, related companies and other controlled affiliates (collectively, “Montage,” “we,” “us,” and “our”) collect personal information about you, including information related to our hotel and resort properties (“Hotel(s)”) and any residential projects that may be associated therewith (“Residences,” and together with Hotel(s), collectively, “Properties”) subject to this privacy policy. Our privacy policy applies solely to Montage digital properties, websites, mobile applications, and digital services that are owned, controlled and operated by Montage Hotels & Resorts, LLC and its affiliates, and to our offline services available at the Properties listed here (collectively, the “Website”).

By accessing or using any Website or Properties, you acknowledge, consent, and agree to the privacy practices contained in this statement and related links in the context of the collection and use of personal information and/or registering for any of our product or services. Please note that this statement does not apply to our processing of personal information on behalf of and subject to the instructions and policies of third-parties such as airlines, travel services, car rental companies, marketing partners, corporate customers, and other similar services providers.

1. CATEGORIES OF INFORMATION COLLECTED

This privacy policy applies to information we collect off-line and on this Website, Digital Access, and our Properties, including, name, telephone, email address, billing, home or business address, nationality, date of birth, gender, payment card information, private membership identification numbers, passport information or other government-issued identification information, preferred language, geolocation, additional guest names, travel itinerary, corporate travel planner contact information, including name, title, company, business phone, email and address, travel agent number and name, airline partner name and number, vehicle identification number, images or footage captured by property-based cameras, internet or online network activity information, IP address, session id, booking engines, streaming service usage, prior guest stays or interactions, goods and services purchased, special service, amenity requests, and room preferences, social media account ID, profile photo and other data publicly available, or data made available by linking your social media to loyalty accounts.

2. CATEGORIES OF INFORMATION WE COLLECT THROUGH AUTOMATIC DATA COLLECTION TECHNOLOGIES

As you navigate through and interact with our Website or use Digital Access, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

• Details of your visit to our Website or use of Digital Access (“usage data”), including traffic data, location data, logs, and other communication data and resources that you access and use on the Website.
• Information about your computer and internet connection, including your IP address, operating system, unique device ID, referral URLs and browsing type.

The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will use cookies when you direct your browser to our Website.
• Flash Cookies. Certain features of our Website may use local stored objects (Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Website. Flash cookies are not managed by the same browser settings as are used for browser cookies.
• Web Beacons. Pages of our Website and our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

Our digital services may also host ads through third-party advertising technology. In the course of serving our advertisements to you, unique third-party persistent cookies, clear gifs or beacon gifs may be placed on your computer or device to help manage our online advertising, recognize when a device visits our Websites, learn which ads bring users to our Websites, and track whether a reservation is made. The information our ad-serving providers and we collect through this technology is not personally identifiable but is used to create an anonymous profile which allows the ad-serving provider to serve ads targeted towards you and your interests across the ad-serving network.

We permit our Website visitors to opt-out of certain targeted advertising practices and information sales and sharing practices (Montage does not sell personal information). Our universal opt-out mechanism or global privacy control mechanism (GPC) is provided by a third-party service provider. You may opt-out of certain targeted advertising practices [here].

Artificial Intelligence Use Disclosure

Some services available on Montage platform and our internal processing may rely on machine-based technology solutions that enable computers, computer systems, and digital devices to process, create, and enhance algorithms that learn, read, write, categorize, classify, predict, engage, interact, generate, play, analyze, make recommendations, influence physical, real or virtual environments, and imitate with apparent accuracy and/or suggestive superiority, where the output representing these activities are made to appear comparable to humans performing similar tasks or services by accessing and processing available historical and current data and re-iterative processing for purposes of producing and improving such activities, outputs, and apparencies (“AI”). Our acceptable use policies and procedures that govern our use of AI, prohibit the technology from being used to generated content that is discriminatory or harmful. AI is not used by our platform to make employment related decisions.

3. HOW WE COLLECT INFORMATION

• Through this Website, Registration at Properties and Digital Access
• Through automated business operations and customer experiences
• Through digital applications made available by us or our travel services partners for use on or through computers and mobile devices
• Through our social media pages that we control
• Through email messages that we send you

When you visit or stay as a guest at one of our properties, we collect other information in addition to your Personal Information in accordance with the law, and to serve you better. This information may in personalized preferences such room choice and other personalized amenities.

4. WHY WE COLLECT AND HOW WE USE INFORMATION

We use your personal data to fulfill the business and operational purposes for which it was collected, or as otherwise set forth in this policy. This following chart provide a general overview of the business purposes for our collection of personal information and reasons for such collection:

Last Modified: December 26th, 2019

You may opt out of receiving any SMS and MMS messages, promotional or marketing emails at any time by contacting us directly or by following the “opt out” or “unsubscribe” links in such emails. We may, however, continue to contact you with relevant information about your past or upcoming reservations with us, open transactions, and status of membership account. We may use the usage data we collect for any reason we deem appropriate, including to improve, maintain, and operate our Websites and services.

5. SHARING OF INFORMATION

We will not sell any of your personal data to any outside organization. We may disclose aggregated information about our customers, and information that does not identify any individual, without restriction. We may disclose Personal Information that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates
• To contractors, service providers, and other third parties we use to support our business and who are bound by contractual obligations to keep Personal Information confidential and use it only for the purposes for which we disclose it to them, as for example payment processors and customer support contractors
• To a buyer or other successor in the event of a merger, divestiture, restricting, reorganization, dissolution, or other sale or transfer of some or all of Montage’ assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Montage about our customers is among the assets transferred.
• To fulfill the purpose for which you provide it
• For any other purpose disclosed by us when you provide the information
• With your consent
• To carry out the permitted uses described in the “WHY COLLECT AND HOW WE USE INFORMATION” section of this policy

We may also disclose your Personal Information:

• To comply with any court order, lawful discovery request, or legal process, including to respond to any government or regulatory request
• To enforce or apply our terms of use and other agreements, including for billing and collection purposes
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Montage, our customers, or others.

6. LINKS TO THIRD PARTY WEB SITES AND GENERATED DATA

Please be aware that third-party websites available through links on our Websites each have separate privacy and data collection practices. We have no control, responsibility or liability for these third-party websites or their applicable policies or content. Montage cannot ensure or warrant the security of any information you disclose on third-party sites.

We reserve the right to combine personal information we collect on our digital platforms with data generated, collected or received from other sources including our partners and third-party services providers. If we combine any non-personal information with personal information that is covered by this Privacy Policy, the combined information will be treated as personal information pursuant to this Privacy Policy as long as it remains combined. We may store personal information for as long as needed for the purposes indicated in this Privacy Policy (which may be indefinitely) or for such period as may be permitted or required by law. We may anonymize information that we have generated, collected or otherwise obtained and use that information in connection with interest-based advertising, to create audience segments and/or for other online advertising purposes. Non-personal information (including anonymized information and other non-personal information that maybe generated, or that is automatically collected as you navigate through and use our digital platforms and Apps) is not subject to this Privacy Policy, and we can use and share such non-personal information without restriction for any lawful purpose, including without limitation for business and marketing purposes.

7. NOTICE AT COLLECTION

We collect the following categories of personal information:

• Website and Digital Access – Internet or other electronic network activity information, including information regarding your interaction with websites, applications, or advertisements, IP address, session ID, booking engine.

We collect this type of information to provide you with targeted advertisements on marketing efforts including media, email, and mobile, to optimize our Website and Digital Access properties, support marketing efforts and to perform analytics to improve business operations. We will retain this information the period of time consistent with browsing preference and as required to meet of business obligations,

• Making Reservations – Name, additional names and aliases, telephone number, address, email address, preferred language, membership, payment card information, membership identification numbers, corporation name and number, travel service account numbers, airline partner numbers, preferred language.

We collect this type of information to look up and verify your reservation, to confirm and execute on your reservation, send communications for marketing purposes and regarding your reservations via text message, email or voice phone communications, send you marketing communication via email and direct mail, perform analytics in order to provide you with personalized offers and content, perform analytics to improve business operations, determine eligibility for promotional or special rates and offers, process payments, process transactions with our business partners, share your information across or brand and product and service lines, optimize our services, provide premium services to you, and to detect and prevent fraud. We will retain this information the period of time consistent with your membership and reservation activities and preferences, and as required to meet of business obligations.

• Enrolling in Memberships and Guest Programs – Name, telephone number, address, email address, email subscription preferences, opt-out preferences, preferred language, payment card information, corporation name and number, travel service account numbers, airline partner numbers, preferred language.

We collect this type of information to administer your membership in our exclusive programs, verify your account, send you communications relating to your membership, send you marketing communications, perform analytics and personalize offers and promotions, to optimize our business, process payments, share information across our brands and product and service lines, and to detect and prevent fraud. We will retain this information the period of time consistent with your membership activities and preferences, and as required to meet our business obligations.

• At Property Check-In – Name, payment card information, additional guest names, and government-issued ID, such as passport information.

We collect this type of information to verify your reservation, receive payment for your reservation, execute your reservation, comply with applicable laws that require the collection of certain type of information, to verify membership, guest assistance, to send you communications at the end of your stay. We will retain this information the period of time consistent with your reservation activities, membership activities, transactions requirements, preferences, and as required to meet our business obligations.

• Electronic or Digital Applications Check-In – Payment card information and precise geolocation.

We may collect this information via Digital Access, such as the MI Mobile App, in order to receive payment for your reservation, execute your reservation, personalize your experience, enable access to room assignment Property facilities, and support and guest assistance. We will retain this information the period of time consistent with reservation activities and guest assistance requirements, as required to meet our business obligations.

8. WHERE PERSONAL INFORMATION IS PROCESSED

Montage International is based in the United States, and personal data is collected worldwide (including within the European Economic Area, United Kingdom, and other regions around the world) and may be transferred to the United States for processing and storage.

9. SMS, MMS TEXT MESSAGING AND PUSH NOTIFICATION

Our services may include certain features and services that may be available via your mobile phone, including, without limitation: (a) the ability to receive information and reply to messages via in-app push notifications, and to send content and messages using text messaging (Mobile Texts), and (b) the ability to access our services from your mobile phone (Mobile Web) (collectively, the “Mobile Services”). We do not charge for Mobile Services. Your carrier’s normal messaging, data and other rates and fees will still apply. Certain Mobile Services may be incompatible with your carrier or mobile device. By providing us with your mobile number and using the Mobile Services you explicitly consent and agree that we may communicate with you regarding the Website and our partners by in-app push notifications, SMS, MMS, text message or other electronic means to your mobile device and that certain information about your usage of the Mobile Services will be communicated to us. In connection with the Mobile Services we may send communications to your mobile device regarding us or other parties.

10. RETENTION OF PERSONAL INFORMATION.

Generally, we will keep your personal information while you have an account with us or while we are providing services to you. Thereafter, we will keep your personal information for as long as is necessary:

• To ensure that we can complete transactions related to services;
• To respond to any questions, complaints or claims made by you or on your behalf;
• To improve our business operations;
• To show that we treated you fairly; or
• To keep records required by law.

We will not retain your personal information for longer than necessary for the purposes set out in this policy. Different retention periods apply for different types of personal information and the reasons for processing. In the event that your personal information is deidentified, or anonymized, we will not make any efforts to reidentify such information.

11. SECURITY OF PERSONAL DATA

We are committed to the security of your personal data. We use commercially reasonable technical measures to protect personal data in our possession, and our Website uses secure socket layer (SSL) encryption technology to help protect the privacy of credit card information, name, address, email and other sensitive information you provide to us.

12. CHILDREN UNDER THE AGE OF 18

Our Websites and services are not intended for children under 18 years of age. and we do not knowingly solicit or collect personal data from children. No one under age 18 may provide any Personal Information to us. If we are notified or discover that a child under the age of 18 has submitted Personal Information to us, we will not sell such information, and we will take reasonable steps to delete the information.

13. STATE DATA PROTECTION LAW COMPLIANCE

We do not sell personal information. Under several new state data protection laws, consumers have the following rights regarding personal data we have collected about you. For purposes of this section only, “personal data” means any information that is linked or reasonably linkable to an identified or identifiable natural person and excludes employment data, personal data that cannot be attributed to an individual without the use of additional information, and de-identified data or publicly available information. Under these laws consumers have the right to request any of the following information from us regarding personal information collected about you:

• The right to know (i.e., the right to confirm whether we are processing your personal data). This information includes:
  • The categories of personal information collected about you.
  • The categories of sources from which the personal information is collected.
  • The business or commercial purpose for collecting or selling personal information.
  • The categories of third parties with whom we share personal information, if any.
  • The specific personal information collected about you.
  • For personal information sold or disclosed to a third party for a business purpose, you have a right to know the categories of personal information about you that we sold and the categories of third parties to whom the personal information was sold; and the categories of personal information that we disclosed about you for a business purpose.
• The right to access (i.e., the right to access your personal data processed by us);
• The right to a copy (i.e., the right to obtain a copy of your personal data that you have previously provided to us in a portable and readily usable (if technically feasible) format);
• The right to correct inaccuracies (i.e., the right to correct inaccuracies in your personal data based on the nature of the data and the purposes of the processing);
• The right to deletion: (i.e., the right to request us to delete your personal data provided to us);
• The right to opt out of the: (1) sale or limit the use of sensitive personal information, (2) processing of your personal data for certain purposes, including, profiling in furtherance of a decision that produces a legal or similar significant effect concerning the consumer, or (3) targeted advertising.
• The right to appeal adverse decisions regarding your request exercise any of the foregoing rights.

We will provide this information free of charge up to two (2) times in any twelve (12) month period within 45 days of receiving your verifiable request (including verification of your identity and your California residency), subject to delays and exclusions permitted by law. Specific personal information about you or your account that is categorized as sensitive or confidential may be redacted.

We will not discriminate against you if you choose to exercise any of these rights. You may exercise the rights described above by clicking “Personal Data Request” at the bottom of this page and following the instructions. We may require verification of your identity before further processing your request. In certain instances, we may be permitted by law to decline some or all of such request.

You or your agent may exercise your data privacy rights here: Calling +1 (888) 914-9661 / Pin Number: 958385 or Completing a Data Access Request form found here.

Appeals Process

Subject to our obligations under state law to verify the identity of individuals making certain requests, please note that it will be the extremely rare case where a consumer’s request will be denied. If we are unable to complete your requests fully for any of the reasons above, we will provide you additional information about the reasons that we could not comply with your request. In some instances, this will require us to provide links to your state’s Attorney General’s Office or other similar state consumer protection agencies or departments in order to further appeal our decision. Those links can be found [here] and [here].

14. EUROPEAN ECONOMIC AREA (EEA) RESIDENTS AND UNITED KINGDOM (UK), and Similar APPLICABLE JURISDICTIONS

Data Controller
The data controller for the information you provide or that is collected by Montage or its affiliates is:

Montage International
3 Ada Parkway, Suite 100
Irvine, California 92618

Legal Basis for Processing Personal Information We process personal information only where we have an applicable legal basis. Depending on the processing activity, those legal bases may include performance of a contract or steps taken at your request, compliance with legal or regulatory obligations, our legitimate interests or those of a third party where those interests are not overridden by your rights and interests, consent where required by law or where we otherwise ask for it, and the establishment, exercise, or defense of legal claims. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing based on consent before withdrawal. If you withdraw consent, we may continue to process personal information where another legal basis applies, including to complete open transactions, provide requested services, comply with legal obligations, maintain appropriate business records, prevent fraud, or protect legal rights.

International Transfers and Transfer Safeguards

This Website and Digital Properties are hosted and operated in the United States.  However, we and our service providers may store information about users and other individuals in the United States, or we may transfer it to, and store it within, other countries.

Some countries where personal information is processed may not provide the same level of protection as the laws of the European Union, the United Kingdom, or your home jurisdiction. Where required by applicable law, we use appropriate safeguards for international transfers, which may include adequacy decisions, standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, contractual commitments with service providers, or other lawful transfer mechanisms. You may contact us using the details below for additional information about the safeguards applicable to your personal information.

For users located in the EEA or UK, your information may at times be accessible by Montage personnel, affiliates, or service providers located worldwide, including in countries that have not been deemed to provide an adequate level of data protection. We will make reasonable efforts to ensure that cross-border processing is conducted in accordance with this Privacy Policy and applicable data protection laws.

You or your authorized agent may exercise your data privacy rights by calling +1 (888) 914-9661 / Pin Number: 958385, completing a Data Access Request form found here, emailing us at privacy@montage.com, or writing to us at the address below. You do not need to use the words “GDPR,” “U.K. GDPR,” “data subject access request,” or any other specific phrase for your request to be valid, provided that your request makes clear that you are seeking to exercise your rights in relation to your personal information. We may request information reasonably necessary to verify your identity or your agent’s authority before processing the request.

Data Privacy Rights Statement

If you reside in U.K. or the European Economic Area (EEA) you may have the following additional rights under the respective implementations of the GDPR as applicable:

• The right to access (i.e., the right to be provided with a copy of your personal information);
• The right to rectification (i.e., the right to require us to correct any mistakes in your personal information);
• The right to be forgotten (i.e., the right to require us to delete your personal information – in certain situations);
• The right to restriction of processing (i.e., the right to require us to restrict processing of your personal information – in certain circumstances, e.g., if you contest the accuracy of the data);
• The right to data portability (i.e., the right to receive the personal information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party – in certain situations);
• The right to object (e.g., the right to object to your personal information being used for direct marketing, and in certain other situations, to object to our continued processing of your personal information, e.g., processing carried out for the purpose of our legitimate interests);
• The right, by a written notice, to require the data controller within 21 days to cease, or not to begin, processing any personal data in connected to the data subject, on the ground that  the processing purpose is causing or is likely to cause substantial damage or distress to the data subject or another, and the damage or distress is or would be unwarranted.
• The right to withdraw consent (i.e., where processing is based on your consent, you have the right to withdraw that consent – without affecting the lawfulness of processing based on consent before its withdrawal);
• The right to information regarding consent (i.e., to obtain information about the possibility or providing or denying your consent and the consequences of such consent or denial of consent); and
• The right not to be subject to automated individual decision-making (i.e., the right not to be subjected to a decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you).

You or your agent may exercise your data privacy rights here: Calling +1 (888) 914-9661 / Pin Number: 958385 or Completing a Data Access Request form found here.

We will respond to requests to exercise GDPR or U.K. GDPR rights without undue delay and, in any event, within one month after receiving the request or, where identity verification is reasonably required, within one month after receiving the information needed to verify the request. Where permitted by law, we may extend the response period by up to two additional months if the request is complex or if you have submitted multiple requests. If we extend the response period, we will notify you within the initial one-month period and explain the reason for the extension.

We generally provide responses free of charge. Where permitted by applicable law, we may charge a reasonable fee or refuse to act on a request if the request is manifestly unfounded or excessive, including because of its repetitive character. We may also limit or withhold information where disclosure would adversely affect the rights and freedoms of others or where another lawful exemption or restriction applies. If we decline all or part of a request, we will explain the reason where required by law and inform you of available complaint or appeal rights.

We will not discriminate against you if you choose to exercise any of these rights. You can exercise your rights under the U.K. GDPR or GDPR by contacting us as follows:

Email: privacy@montage.com (to help route your request, you may include “GDPR” or “U.K. GDPR” in the subject line, as applicable)

Mail:
Montage International
3 Ada Parkway, Suite 100
Irvine, California 92618
Attention: Privacy Department

The U.K. GDPR and GDPR also gives individuals the right to lodge a complaint with a supervisory authority, in the European Union (or European Economic Area) state where you work, normally live, or where any alleged infringement of data protection laws occurred.

MEXICO RESIDENTS AND MEXICAN DATA PROTECTION RIGHTS

If you are located in Mexico or your personal information is processed in a manner subject to Mexican data protection law, you may exercise your rights of access, rectification, cancellation, and opposition (the “ARCO Rights”) with respect to your personal information, as provided under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares and its applicable regulations.

Access means the right to know whether we process your personal information and to obtain access to such information and applicable information about the processing. Rectification means the right to request correction of inaccurate, incomplete, or outdated personal information. Cancellation means the right to request that we delete or block personal information when legally appropriate. Opposition means the right to object to the processing of personal information for specific purposes where permitted by law.

To exercise ARCO Rights, you or your duly authorized representative may submit a request by completing the Data Access Request form found here, emailing us at privacy@montage.com, calling +1 (888) 914-9661 / Pin Number: 958385, or writing to Montage International, Attention: Privacy Department, 3 Ada Parkway, Suite 100, Irvine, California 92618. Montage’s Privacy Department is responsible for receiving and processing ARCO Rights requests.

Your ARCO Rights request should include: your name; a domicile or other means for receiving our response and related notices; documents sufficient to verify your identity; if the request is made through a representative, documents sufficient to verify the identity and authority of the representative; a clear and precise description of the personal information with respect to which you seek to exercise an ARCO Right, except for access requests; a description of the ARCO Right you seek to exercise or the specific action you request; and any other information or document that may help us locate the relevant personal information. For rectification requests, please identify the correction requested and provide documentation supporting the requested change where applicable. For cancellation or opposition requests, please describe the reasons for the request where applicable. For access requests, please identify your preferred delivery format.

If a request is incomplete or we need additional information to process it, we may ask you once, within the period permitted by applicable law, to provide the missing information or documentation. The response period may be paused until you respond. If you do not provide the requested information within the legally applicable period, the request may be deemed not submitted.

We will communicate our determination regarding an ARCO Rights request within twenty days after receiving a complete request. If the request is granted, we will make the determination effective within fifteen days after communicating our response. Where permitted by law and justified by the circumstances, these periods may be extended once, and we will notify you of the extension and the reasons for it within the applicable response period.

The exercise of ARCO Rights is generally free of charge. You may be responsible only for legally permitted costs of reproduction, certification, or delivery, if any. We will not make a paid service the only method available to submit an ARCO Rights request.

We may deny all or part of an ARCO Rights request where permitted by law, including where the requester or representative is not duly accredited; the personal information is not in our possession; a legal impediment applies; responding would harm the rights of a third party; a competent authority has restricted the relevant right; or the requested rectification, cancellation, or opposition has already been completed. If we deny all or part of a request, we will explain the reason for our decision within the legally applicable response period and inform you of available rights to challenge the response before the competent authority.

Where required by Mexican law, this Privacy Policy also serves as a privacy notice for Mexico. The categories of personal information we process, the purposes for processing, the transfers and disclosures we may make, the means to limit use or disclosure, and the procedures for exercising rights are described in this Privacy Policy. Some information we collect, such as government-issued identification information, payment information, precise geolocation, images or footage captured by property-based cameras, and information related to service preferences or accommodations, may be subject to heightened protection depending on the circumstances. We will seek consent where required by applicable Mexican law, including for secondary purposes or sensitive personal information where applicable.

15. CHANGES TO THIS POLICY

We may update this policy from time to time. We will always post the then-current version of this policy on our Websites, and will indicate at the top of the policy the date on which the latest version took effect. Please review this policy from time to time to stay updated on our privacy practices.

16. CONTACT

If you have any questions, comments and complaints about Montage’s data practices can be sent to our data protection office by sending an email to privacy@montage.com or writing us at: Montage International, Attention: Privacy Department, 3 Ada Parkway Suite, 100 Irvine, California 92618.