Privacy Policy

GBI Express is committed to protecting your privacy and will never, under any circumstances, disclose your information to a third party.

1.INTRODUCTION

This Privacy Policy explains how and why Gulf Hotels Group BSC, including its subsidiaries and Affiliates (collectively referred to as "GHG," "We," "Us," or "Our"), collects, Processes, transfers, uses, discloses and safeguards Your Information when You engage with Our Services. These Services include using Our website, downloading and using our Application(s), staying at Our hotels, dining at Our restaurants, or utilizing other facilities (such as spas, gyms, event spaces, and other amenities), as well as engaging with Us through sales, marketing, or events.

By using Our Services, You agree to the Processing of Your Information in accordance with this Privacy Policy and applicable law. If You do not agree with any part of Our policies and practices, You are prohibited from using Our Services and must discontinue use immediately.

Through this Privacy Policy, You will understand how and why We collect Your Information, what data We collect, how We use it, who We share it with, and other important details regarding Your Information.

This Privacy Policy covers, but is not limited to, Information collected through:

(a) Our website;

(b) Our Application(s);

(c) Third parties;

(d) Direct correspondence You provide (e.g., booking inquiries, feedback forms);

(e) Text messages, emails, and other electronic communications;

(f) Software applications We make available on or through Our computers or mobile devices;

(g) Our social media pages and apps linked to Our website or Application(s);

(h) Contracts, invoices, customer data, and letters;

(i) During Your stay at Our hotel (e.g., booking details, room preferences, payment information, guest requests);

(j) When You use Our restaurants, bars, spas, gyms, event spaces and other facilities (e.g., reservations, dietary preferences, event planning information);

(k) From CCTV cameras and security systems within Our premises to ensure Your safety.

2. DEFINITIONS

The definitions provided below are relevant to this Privacy Policy, which is prepared in accordance with the Personal Data Protection Law. Any terms not explicitly defined within this Privacy Policy shall be interpreted according to their meanings as outlined in the Personal Data Protection Law, where applicable.

3. WHAT DOES THIS PRIVACY POLICY RELATE TO?

This Privacy Policy specifically pertains to Your use of Our Services. It outlines how Your Information is handled when You engage with Us, including but not limited to interactions through Our website, hotels, restaurants and various amenities.

4. DOES THIS PRIVACY POLICY APPLY TO LINKS TO OTHER WEBSITES?

While using Our Services, You may encounter links to websites or applications managed by other organizations, such as Social Media Platforms or technology providers (e.g., Apple, Google). This Privacy Policy does not apply to any third-party websites, services or applications linked to or from Our Services.

The inclusion of these links does not imply Our endorsement, and We are not responsible for the data collection, usage or security practices of these third parties. If You click on a third-party link, You will be directed to that third party's site, which may collect Information about You and have its own privacy policies. We strongly advise You to review these privacy policies before interacting with them, as We have no control over and assume no responsibility for their content or practices.

5. WHAT INFORMATION DO WE COLLECT?

The extent of the Information We collect and Process will depend on the Services You utilize. We collect Your Information in the following ways:

• directly, When You provide Us with Information, such as during bookings, registrations, inquiries, email correspondence, feedback submissions, purchases, orders, joining mailing lists or loyalty programs, opening accounts and completing surveys; and

• indirectly, through your browsing activity while using Our Services; and

• from third party sources.

We collect several types of Personal Information to effectively deliver Our Services. This includes but is not limited to: identification details like Your name, date of birth, and identification numbers (such as passport or ID numbers) to verify Your identity; financial information, such as payment details and billing information, to securely Process transactions; personal details, including gender, nationality, and preferences, to enhance Your experience with Us; contact details like email addresses, phone numbers, and delivery or mailing addresses are used to communicate with You about bookings, orders and inquiries; health-related information, such as medical conditions, allergies, or dietary needs, where necessary to provide suitable accommodations and services; technical data like IP addresses and browsing behaviour to ensure website functionality and security; cookies data which helps Us remember Your preferences; profile and marketing information allows Us to customize offers and communications; and / or CCTV data is collected to ensure the safety and security of Our premises.

5.1. Information Collected from You

The Information We request and collect will depend on Your interactions with Us and the Services used. You are required to provide Information unless explicitly stated otherwise. All Information provided must be true, complete and accurate, and You must notify Us of any changes.

We collect Information directly from You when You engage with Us, whether through Our website, Applications, in person or via other forms of communication (email, online forms, telephone, postal mail or via Social Media Platforms). This may occur when Information when downloading, registering, using features, or making in-app purchases within Our Applications, or during registration, applying for Our Services or products, subscribing to Our publications, completing surveys and / or interacting with Our staff and / or Social Media Platforms.

While using Our Services, We may ask You to provide Us with Information, including:

• Full name

• Phone numbers

• Home, billing and delivery addresses

• Email addresses

• Contact or authentication data

• Debit/credit card numbers

• Contact preferences

• Sensitive Personal Information, such as biometric data

• Payment data necessary to process payments, such as payment instrument number and security code.

5.2. Information Automatically Collected

When You visit or use Our Services, We automatically collect certain Information that does not reveal Your specific identity. Types of Information We collect include:

• Log and Usage Data: This includes service-related, diagnostic, usage and performance information Our servers collect when You access or use Our Services, recorded in log files. This data may include Your IP address, device information, browser type, version and settings, and details about Your activity (date/time stamps, pages viewed, searches, features used), along with device event information (system activity, error reports, and hardware settings).

• Device Data: Information about the Device used to access Our Services, which may include Your Device’s identification numbers, application identification numbers, location, browser type and version, hardware model, manufacturer, operating system, Internet service provider, IP address (or proxy server), language preferences, referring URLs and other technical data.

5.3. Information Collected From Other Sources

We may collect Information from public databases, marketing partners, Social Media Platforms, Affiliate programs, data providers and other external sources to enhance Our ability to provide You with relevant marketing, offers, promotions and services. This Information may include mailing addresses, job titles, email addresses, phone numbers, user behavior data, IP addresses and social media profiles. If You interact with Us on a Social Media Platform using Your Social Media Account, We may receive additional Information, such as Your name, email address and gender, depending on Your privacy setting

6. HOW AND WHY WE PROCESS YOUR INFORMATION?

We Process Your Information for various purposes depending on how You interact with and utilize Our Services. These purposes include:

• To provide, improve, administer and maintain Our Services, including monitoring usage ensuring functionality, and maintaining the security of Our website and Applications.

• To facilitate user registration and account management.

• To process and deliver Your Services, including managing orders, payments, fees and charges, as well as collecting and recovering amounts owed to Us.

• To communicate with You, provide details of requested services and respond to inquiries, including sending push notifications and alerts related to updates, promotions, or service information within Our Applications.

• To enable user-to-user communications within Our offerings.

• To enable Us to fulfil Our contractual obligations to third parties and our Affiliates. • To manage Our relationship with You, including notifying You about changes to Our terms or privacy policy and requesting feedback through reviews or surveys.

• To send You marketing and promotional communications based on Your preferences. You can opt out of Our marketing emails at any time. For more information, see "What Are Your Legal Rights In Relation To Your Information?" below.

• To administer and protect Our business and this website, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data. • To use data analytics for enhancing Our website, products/services, marketing, customer relationships and overall experiences.

• To make suggestions and recommendations regarding goods or Services that may interest You. • To protect Our Services, including fraud monitoring and prevention.

• To identify trends to enhance Our understanding and improvement of Our Services. • To conduct checks for verifying Your identity and preventing fraud against You or Us. • To exercise, defend or enforce Our legal rights or engage in legal proceedings.

• To contact You via email, phone calls, SMS, WhatsApp or other electronic communication methods regarding updates or informative communications about functionalities, products or contracted services, including necessary security updates.

• To comply with legal and regulatory obligations applicable to Our business

• To comply with court or regulatory orders and requests.

• To conduct studies to assess the effectiveness of Our promotional campaigns

• To perform statistical analyses to better understand Our customers and users.

We may also Process Your Information with Your consent for other purposes, including:

• Sending You relevant marketing materials based on Your preferences, including tailored offers related to Your interests and the services You use.

• Forming a view of which Services may interest You by analyzing data such as identification, contact details, technical information and profile data.

We may utilize functions to remember the Information You use on Our Services to:

a) Remember Information to avoid re-entry during Your visit;

b) Provide customized content and information; and

c) Determine the effectiveness of Our Services.

We reserve the right to use, Process, store or disclose Information received via the Services for purposes such as responding to Your requests, facilitating purchases and orders, complying with applicable laws, addressing law enforcement inquiries, protecting against liability and ensuring the security and integrity of Our Services.

We will not sell, lease, transfer, share or permit access to Your Personal Information or Sensitive Personal Information with any third parties other than as described in this Privacy Policy.

We may also Process Your Information for additional purposes with Your consent or as legally permitted. If We use Your data for a purpose that differs from the original intent, We will ensure that it aligns with that purpose or notify You to obtain Your consent.

7. WHAT HAPPENS IF YOU FAIL OR REFUSE TO PROVIDE REQUIRED INFORMATION?

If We are legally obligated to collect Your Information or require it to deliver the Services, and You fail to provide the requested Information, We may be unable to proceed with or fulfill the Services. In such instances, We may have to cancel the Services and will promptly notify You of this decision.

PURPOSE FOR WHICH WE USE YOUR PERSONAL DATA

8. WITH WHOM DO WE SHARE YOUR PERSONAL DATA?

We may share Your Information in the following situations:

- With Service Providers and Partners: We may transfer Your Information to third-party service providers, agents, subcontractors or organizations engaged to assist Us in delivering services. This includes, but is not limited to, cloud service providers, IT service providers, insurance providers, professional advisors and agents acting on Our or Your behalf.

- Business Transfers. Your Information may be shared during negotiations or in connection with any merger, financing, acquisition, divestiture, restructuring, reorganization, dissolution or sale of some or all of Our assets, including those of Our Affiliates.

- With Affiliates: We may share Your Information with our Affiliates, including subsidiaries, joint venture partners, franchisors, licensors and other entities under common control to facilitate seamless service delivery across our group.

- With Business Partners: We may share Your Information with business partners to provide specific products, Services, promotions or delivery to You.

- With Other Users: If You share Information or interact publicly with other users, be aware that such Information may be viewed by all users and may be publicly distributed outside Our Services.

- Other Third Parties: We may share Your Information with third parties, including marketing agencies, website hosts and analytics providers, to assist in delivering Our Services. This includes entities like Google Analytics for tracking usage and Google Maps APIs for location-specific requests.

- Law Enforcement and Regulatory Agencies. We may disclose Your Information when compelled by law, in response to valid requests from public authorities or courts of law, or to comply with legal obligations or regulatory orders.

- Other Transfers: With Your consent, We may disclose Your Information to any other party as needed to fulfill Our obligations or enhance Your experience with Our Services.

9. CAN YOU PROVIDE PERSONAL DATA ABOUT OTHERS?

If You share Information about another individual with Us or Our service providers, You confirm that You have the necessary authority to do so. This includes obtaining their consent to share their details with Us and authorizing You to act on their behalf. You must also ensure that the individual receives a copy of this Privacy Policy and understands and accepts how We will use their Information as described herein.

10. IS YOUR INFORMATION SECURE?

The security of Your Information is important to Us. We have implemented appropriate technical and organizational measures to safeguard the Processing of any Information We handle. Access is limited to authorized personnel who require it for their job functions, all bound by confidentiality obligations to prevent unauthorized access, disclosure, alteration or misuse.

Despite Our efforts to secure Your Information, please be aware that no method of transmission over the internet or information storage technology can be guaranteed to be 100% secure. While We strive to use commercially acceptable means to protect Your Information, We cannot guarantee its absolute security. We cannot promise or guarantee that hackers, cybercriminals or other unauthorized third parties will not be able to defeat Our security and improperly collect, access, steal or modify Your Information.

The transmission of Information to and from Our Services is at Your own risk, and We recommend accessing Our Services within a secure environment. If You have any concerns about the security of Your Information, please contact Us (see Section 16, 'How to Contact Us').

11. HOW LONG WILL WE KEEP YOUR INFORMATION?

We will retain Your Information only as long as necessary to provide Our Services, fulfill the purposes outlined in this Privacy Policy and / or comply with applicable laws. This includes retaining Information for legal obligations, maintaining records, resolving disputes, preventing fraud and abuse and enforcing Our agreements and policies.

When Your Personal Information is no longer needed and We are not legally required to keep it, We will either delete or anonymize it. If deletion is not feasible, We will securely isolate it until deletion is possible.

Usage data is generally retained for shorter periods, except when necessary for improving Our Services or enhancing security. Anonymized data may be retained for extended periods for research, historical or analytical purposes.

In the event of legal claims or disputes, We may retain Your Information until the end of the applicable retention period or until the claims are resolved.

12. WHERE IS YOUR INFORMATION PROCESSED AND TRANSFERRED?

Your Information, including Personal Information, is Processed at Our offices, which may involve storage and transfer to cloud services or computers located outside Your country, including data centres in Bahrain. Data protection laws in these locations may differ from those in Your jurisdiction. By using Our Services and submitting Your Information, You consent to this transfer.

We may also transfer Your Information outside the Kingdom of Bahrain to enhance our Services and comply with our legal and contractual obligations. No transfer will occur unless adequate controls are in place.

13. WHAT ARE YOUR LEGAL RIGHTS IN RELATION TO YOUR INFORMATION?

You have several rights concerning the Information We collect and process. You may request access to, amend or delete Your Information. If You have an account with Us, You can update Your Information by signing into Your account and visiting the account settings section. Alternatively, You can contact Us for assistance. However, in some cases, We may need to retain certain Information for legal reasons, including compliance with applicable laws, resolving disputes or enforcing Our rights or agreements.

You may withdraw Your consent for any Processing requiring it at any time. This will not affect the legality of any Processing carried out before Your withdrawal. You also have the right to request details about the Information We hold, the purposes for Processing it, and how it is managed. You may object to the Processing of Your Information for direct marketing purposes, and We will cease such communications upon receiving Your request. Nevertheless, We may retain certain Information for fraud prevention, troubleshooting, investigations or compliance with legal obligations.

You will not have to pay a fee to access Your Information or exercise any of Your rights. However, We may charge a reasonable fee if Your request is unfounded, repetitive or excessive. In such cases, We may refuse to comply with Your request. We may also request specific information to confirm Your identity and ensure Your right to access Your Information, which helps protect against unauthorized disclosure.

If You believe Your rights have been violated or Your Information has been unlawfully Processed, You have the right to file a complaint. We encourage You to contact Us with any concerns about the handling

of Your Information so that We can address them promptly. You also have the right to file a complaint with the Personal Data Protection Authority (PDPA). However, We would appreciate the opportunity to resolve Your concerns directly before involving the PDPA, so please contact Us first.

14. DO WE USE COOKIES?

We use Cookies and similar tracking technologies to enhance Your experience on Our website and improve Our Services. Cookies are small files placed on Your Device that allow Us to track activity and store information. While You can set Your browser to refuse Cookies, doing so may limit Your access to certain features, such as personalized settings and faster browsing. Our use of Cookies includes both Session Cookies, which are deleted when You close Your browser, and Persistent Cookies, which remain on Your Device. Essential Cookies enable core functions like reservations and account management, while Functionality Cookies remember Your preferences for a more personalized experience. Additionally, We use Cookies to remember if You have accepted Our Cookie policy for future visits.

We also use web beacons (small electronic files in emails and web pages) to collect data on website traffic and monitor email engagement, helping Us analyze the effectiveness of Our Services and communications.

By using Our Services, You consent to the use of these technologies unless You disable them in Your browser settings.

15. UPDATES TO THIS POLICY

We may update this Privacy Policy from time to time to reflect changes in how We Process Your Information or to comply with new legal requirements. Any updates will be indicated by an updated "Last Updated" date and will become effective immediately upon posting on this page. We encourage You to review this Privacy Policy periodically to stay informed of any updates.

16. HOW TO CONTACT US

If You have any questions or comments about this Privacy Policy, please contact Us at: Gulf Hotels Group BSC

Email: [email protected]

Postal address: P.O. Box 580, Manama, Kingdom of Bahrain

Physical Address: Office 1001, Building 15, Road 3801, Block 338, Manama / Al Qudaibiya, Bahrain

Bahrain Tel: (+973) 17746446