HAWAIIAN HOTELS & RESORTS PRIVACY POLICY

Our Core Beliefs Regarding User Privacy and Data Protection

• User privacy and data protection are human rights
• We have a duty of care to the people within our data
• Data is a liability, it should only be collected and processed when absolutely necessary
• We loathe spam as much as you do!
• We will never sell, rent or otherwise distribute or make public your personal information

Relevant Legislation

Along with our business and internal computer systems, this website is designed to comply with the following national and international legislation with regards to data protection and user privacy:
EU General Data Protection Regulation 2018 (GDPR)

Hawaiian Hotels & Resorts, which includes Royal Lahaina Resort, Royal Kona Resort, Lahaina Inn, and Kaanapali Ocean Inn and their affiliates value your right to privacy. We have compiled this privacy policy to provide details about how your personal information is collected and used by us. Personal Information is any information that identifies you or would enable someone to contact you, which may include your name, email address, phone number and other non-public information that is associated with such information. It does not include aggregate information, anonymous information or any other non-personally identifiable information.

What Personal Information Do We Collect?

If you make a reservation through our website, through our reservations center, or check in as a guest at one of our properties, we ask for your title, name, address, email address, phone number, credit card number and expiration date, and the name(s) of other registered guests in your party. This allows us to secure your reservation and notify you of the status of the reservation.

If you're a travel agent participating in our Hawaiian Hotels & Resorts Travel Agent program, we ask for your name, email address, phone number, travel agency name, travel agency manager name, travel agency address, and ARC/IATA/TRUE/CLIA number.

If you are participating in our Royal Rewards Loyalty program, we ask for your name and email address.

If you are a guest and log on for Wi-Fi access, we may ask for your name and email address.

If you subscribe to receive information from us via email sign-up on our websites, we ask for your email address.

If you fill out a request for proposal or reservation form on our website we ask for your name, email address and phone number to correspond with you about the information you are requesting.

You may access, review, correct or delete the personal information you give us by sending us an email at webmaster@hawaiianhotels.com.

How We Use the Information You Provide

We will use your Personal Information to provide personalized services either with your consent or because we have a legitimate interest to do so. Personal Information you provide at our request is used to:

• To personalize your experience and to allow us to deliver the type of content and product offerings in which you are most interested
• To improve our website (we continually strive to improve our website offerings based on the information and feedback we receive from you)
• Contact you to confirm a reservation or to contact you in the event there are questions about any information you submit to us
• To facilitate and fulfill reservations and process payment
• To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs)
• To follow up after correspondence with us (live chat, email, or phone inquiries)
• Send administrative information, confirmations and/or pre-arrival messages, marketing communications and promotional offers, as well as periodic customer satisfaction, or quality assurance surveys, and with other related product or customer service information.

Note: If at any time you would like to unsubscribe from receiving communications from us, you may opt-out and revoke that permission at any time by emailing us at webmaster@hawaiianhotels.com.

Information we automatically collect and how we use that information

Site visitation tracking

Like most websites, this site uses Google Analytics (GA) to track user interaction. We use this data to determine the number of people using our site, to better understand how they find and use our web pages and to see their journey through the website. Although GA records data such as your geographical location, device, internet browser and operating system, none of this information personally identifies you to us. GA also records your computer's IP address, which could be used to personally identify you, but Google does not grant us access to this. We consider Google to be a third-party data processor (see section below).

GA makes use of cookies, details of which can be found on Google's developer guides. Our website uses the analytics.js implementation of GA. Disabling cookies on your internet browser will stop GA from tracking any part of your visit to pages within this website.

Disabling cookies on your internet browser will stop GA from tracking any part of your visit to pages within this website.

In addition to Google Analytics, this website may collect information (held in the public domain) attributed to the IP address of the computer or device that is being used to access it.

Blog

Should you choose to add a comment to any posts that we have published on blog sites, the name and email address you enter with your comment will be saved to this website's database, along with your computer's IP address and the time and date that you submitted the comment. This information is only used to identify you as a contributor to the comment section of the respective blog post and is not passed on to any of the third-party data processors detailed below. Only your name and email address that you supplied will be shown on the public-facing website.

Your comments and its associated personal data will remain on this site until we see fit to either remove the comment or remove the blog post.

Should you wish to have the comment and its associated personal data deleted, please email us here using the email address that you commented with.

If you are under 16 years of age you MUST obtain parental consent before posting a comment on our blog.

NOTE: You should avoid entering personally identifiable information to the actual comment field of any blog post comments that you submit on this website.

Contact forms and email links

Should you choose to contact us using the contact form on our Contact us page, none of the data that you supply will be stored by this website or passed to / be processed by any of the third party data processors defined in section below. Instead the data will be collated into an email and sent to us over the Simple Mail Transfer Protocol (SMTP). Our SMTP servers are protected by TLS (sometimes known as SSL) meaning that the email content is encrypted before being sent across the internet. The email content is then decrypted by our local computers and devices.

Email newsletter

If you choose to join our email newsletter, the email address that you submit to us will be forwarded to Constant Contact who provides us with email marketing services. We consider Constant Contact to be a third-party data processor (see section below). The email address that you submit will not be stored within this website's own database or in any of our internal computer systems.

Your email address will remain within Constant Contact's database for as long as we continue to use their services for email marketing or until you specifically request removal from the list. You can do this by unsubscribing using the unsubscribe links contained in any email newsletters that we send you or by requesting removal via email. When requesting removal via email, please send your email to us using the email account that is subscribed to the mailing list.

If you are under 16 years of age you MUST obtain parental consent before joining email newsletter.

How do we protect your information?

We implement a variety of security measures to help maintain the safety of your personal information when you reserve a booking or enter, submit, or access your personal information. We use generally accepted standards governing administrative, technical and physical measures to protect your personal information. For example, credit card information provided through our online reservations forms is encrypted and measures have been taken to secure our server from any unauthorized access. Despite these measures, the confidentiality of any communication or material transmitted to or from us cannot be guaranteed to be 100% secure.

After a transaction, your personal information may be kept on file in order to archive reservation data, help improve the customer experience, and for other business purposes. We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide services to you (for example, for as long as you have an account with us or keep using our services)
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them)
• Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation or regulatory investigations)

Third-party disclosure

We do not sell, trade, or otherwise transfer to outside parties your Personal Information. This does not include website hosting partners and other parties who assist us in operating our website, conducting our business, or serving our users, so long as those parties agree to keep this information confidential. We may also release information when its release is appropriate to comply with the law, enforce our site policies, or protect ours or others' rights, property, or safety.

However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising, or other uses.

Third Party Data Processors

We use a number of third parties to process personal data on our behalf. These third parties have been carefully chosen and all of them comply with the legislation set out in section above.

• Google (Privacy policy)
• Twitter (Privacy policy)
• Microsoft (Privacy policy)
• Facebook (Privacy policy)
• Instagram (Privacy policy)
• Constant Contact (Privacy policy)
• Sabre (Privacy policy)

Cookie Policy

This policy covers the use of cookies and other technologies. The types of cookies we use fall into 3 categories:

Essential cookies and similar technologies

These are vital for the running of our services on our websites and apps. Without the use of these cookies parts of our websites would not function. For example, session cookies allows a navigation experience that is consistent and optimal to user's network speed and choice of device.

Analytics cookies and similar technologies

These collect information about your use of our websites and apps, and enable us to improve the way it works. For example, analytics cookies show us which are the most frequently visited pages. They also help identify any difficulties you have accessing our services, so we can fix any problems. Additionally, these cookies allow us to see overall patterns of usage at an aggregated level.