This Statement sets out the online privacy policy of Alrov Mamilla 2006 Ltd.

(“Alrov”, “Alrov Hotels”, “we”, “us”, “ourselves”) refers to:

• Alrov Mamilla 2006 Ltd.
• David Citadel Hotel, Jerusalem
• Mamilla Hotel, Jerusalem

We respect the privacy of our customers and business partners, and treat personally identifiable information provided by them as confidential. We will collect, use and store such information with all due care and diligence, in accordance with all applicable laws in the countries in which we operate. Alrov Mamilla 2006 Ltd. and the applicable local management entities as set forth above are “Data Controllers” for the data they each collect and process. Alrov Mamilla 2006 Ltd. is also the Data Controller for gathering all the data collected and processed by us and on our websites.

The contact details for each Data Controller are the following:

• Alrov Mamilla 2006 Ltd., 46 Rothschild Blvd., Tel-Aviv 6688312, Israel, and by e-mail: [email protected].
• For customers using the services of David Citadel Hotel, 7 King David St., Jerusalem 9410119, Israel, and by e-mail: [email protected]

www.thedavidcitadel.comBottom of Form

• For customers using the services of Mamilla Hotel, 11 King Solomon St., Jerusalem 9418238, Israel, and by e-mail: [email protected]

www.mamillahotel.com

This Statement explains what information we collect, how we use it, and how this can benefit your experience of our web sites. Please take a moment to read the sections below.

1. WHAT INFORMATION ABOUT YOU DO WE COLLECT?

We only collect adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimization’);

We therefore collect your information only to operate effectively and provide you with the best experiences with our services.

The specific kind of information collected will depend on the context of your interactions with us, and the services you use. The following are examples of the information that may be collected:

• Contact information (name, email address, mailing address, phone number, fax number, and passport number);
• Payment information (payment card: numbers and expiry date upon PCI DSS rules, billing address, and bank account information);
• Demographic data (age, gender, country, and preferred language);
• Information related to your reservation, stay, or visit at Alrov Hotels (date of arrival and departure, and goods and services purchased);
• Information necessary to fulfill your special requests and/or specific accommodations (preferences, leisure activities, accompanying guest name, and number of children and ages);
• Loyalty program member information;
• Information collected through security systems (closed circuit television systems – CCTV and electronic card key); and
• Non-personally identifiable information about you (the use and interaction with our websites, communication preferences, aggregated data relative to your stays, and responses to promotional offers and surveys).

We collect this information in the following ways:

• Information provided by you: We receive and store information you enter on our website or give us in any other way, including:
  • use our online reservations
  • stay as a guest at hotels
  • subscribe to our newsletters or request a brochure
  • submit enquiries and feedback forms
  • correspondence with us – interaction with our employees limited to legitimate interest
  • respond to surveys, promotions and other communications
  • submit a job application

You decide how much information to share with us in most cases, but not sharing required information may limit your ability to engage in certain activities, such as payment information required to complete your reservation. If you submit any personal information relating to another person (e.g., if you make a reservation for another individual), you represent that you are authorized by that person to do so and to permit us to use the information in accordance with this Privacy Policy. You also represent that the information you provide is accurate.

• Automatic Information: When you use or interact with our website and/or use any apps that we may make available on our website, we receive and store information generated by your activity and information automatically collected from your browser or mobile device. For example, like many websites, we obtain certain information when your web browser accesses our website including your IP address, browser type, operating system, mobile network data, pages viewed and access times. This information helps us to communicate with our customers and better understand them.
• Security Systems: When you visit our properties, information may be collected about you through such properties’ closed circuit television systems (CCTV), electronic key cards and other security systems.
• Information from other sources: We may receive information about you from other Third Parties. This may include information from your travel agent, loyalty program, credit card, and other Third Parties.
• Age Limitations: Alrov Mamilla 2006 Ltd. does not knowingly collect personally identifiable information from any person under the age of 18. Alrov Hotels may collect personally identifiable information from people under the age of 18 as part of the guest registration process, but always with the consent of such person’s parent or guardian.

2. HOW DO WE USE YOUR INFORMATION?

We collect your information only to operate effectively and provide you with the best experiences with our services.  We collect, use, and disclose the information it collects for the following purposes:

• Fulfillment of reservation and other purchases: We may process information relating to transactions that you enter into with us and/or through our website (“transaction data”). The transaction data may be processed for the purpose of completing your room reservation, supplying the purchased goods and services, customizing our services to your preferences, seeking your feedback on your stay at our properties, and keeping proper records of those transactions.
• Guest Relations: To offer hospitality services and goods based on your preferences and prior stays at one of our properties. The information may be used for future voluntary loyalty programs operated by us.
• Response to inquiries: We may process information contained in or relating to any communication that you send to us (“correspondence data”). The correspondence data may include the communication content and metadata associated with the communication (such as groups, meetings and events). The correspondence data may be processed for the purposes of communicating with you and record-keeping.
• Internal Business Purposes: For our internal business purposes, developing new products, enhancing the website, improving our services, identifying usage trends and visiting patterns, determining the effectiveness of our promotions, evaluating Third Parties performance (such as Travel Agencies), predicating our yield and occupancy, and meeting contractual obligations.
• Administrative and other communications: To send you important information regarding our website, changes to our terms, conditions, and policies, or other administrative information (e.g., information about your travel reservations, such as confirmation emails).
• Marketing and promotions: To communicate news and promotions to you regarding Alrov Mamilla 2006 Ltd. related products and services we think may be of interest to you; including Spa & Gym, Bars and Restaurants.
• Safety and security: To maintain your safety and security as well as that of other guests and staff, while you visit at Alrov Hotels.
• Our legal duties: To comply with legal and regulatory requirements or demands in accordance with applicable law, regulations, or other legal process.

The legal basis for processing your personal information is made up of one or more of the following reasons:

• Your consent.
• Providing the services, you have requested.
• Compliance with applicable laws, regulations or other legal process.
• Legitimate Business Interest.

3. WHAT ABOUT COOKIES?

To enhance your experience on our web site, some of our web pages may use “cookies”. Cookies, by themselves, do not tell us your personally-identifiable information unless you choose to provide this information to us (by, for example, registering for one of our services). However, once you choose to furnish the site with your personally-identifiable information, this information may be linked to the data stored in the cookie.

We use cookies to understand site usage and to improve the content and offerings on our sites. We may use cookies to personalize your experience at our web pages and to offer you relevant products, programs, or services as well as interest-based or targeted advertising.

Your browser may give you the ability to control cookies, certain browsers can be set to avoid cookies collection. However, if you block cookies, certain features on our website may not work.

4. WHO ARE THE RECIPIENTS OF YOUR PERSONAL DATA?

Your personal data being confidential, only persons duly authorized by us can access your personal data, apart from their possible transmission to the bodies in charge of a control or inspection in accordance with the applicable regulations.

All persons who have access to your personal data are bound by an obligation of confidentiality.

These persons include the staff authorized within the company and its affiliates. Our service providers may also be required to process personal data strictly necessary for the performance of the services we entrust them with (mission, electronic and postal dissemination, logistics and catering, etc.).

As a luxury hotel management company and with a presence within a few locations in Israel, it is essential that we share information in order to provide you with and to maintain the best possible service. The specific kind of information we share will depend on the context of your interactions with Alrov Mamilla 2006 Ltd., and the services you use. Accordingly, your personal information may be shared with the following parties insofar as reasonably necessary for the purposes, and on the legal bases, set out in this policy:

• Alrov Mamilla 2006 Ltd. properties in order to provide better hospitality experience based upon your preferences and prior stays;
• A representative or travel advisor that has supplied us with your personal information (for example, your travel agent, personal assistant, employer or spouse who has provided us with your details);
• Third parties who process it for us, based on our instructions and in compliance with our Privacy Policy and any other appropriate confidentiality and security measures. Processing by Third Parties will be taken in order to provide rich and secure experience for your stay. Sharing information with Third Parties will be supported by a Data Processing Agreement which includes GDPR Addendum to define the liabilities;
• Our marketing and advertisement partners to provide you with more-relevant ads on our site and to encourage you to return to our site. These partners will not use your data for any other purpose than our legitimate interest of direct marketing and you will always have the right to object.

5. DOES ALROV MAMILLA 2006 LTD. TRANSFER INFORMATION OVERSEAS?

Any data processing is held within EU and Israel Borders including processing by our Third Parties. If any of our Third Parties will require, for any reason, to transfer information outside those borders, the request will be examined by us.

In this specific case, be sure that we will verify that appropriate measures have been put in place to ensure that your personal data benefits from an adequate level of protection (in particular through standard contractual clauses of the European Commission, the Internal Company Rules or the Data Protection Shield set up between the European Union and the United States).

6. HOW SECURE IS YOUR INFORMATION?

We implement reasonable administrative, organizational and technical safeguards and security measures to protect personal information from unauthorized access, disclosure, destruction or alteration, accidental loss, misuse or damage. We regularly review and monitor such safeguards and security measures.

When disclosure of data to third parties is necessary and authorized, we ensure that these third parties guarantee the same level of data protection as that offered to them by us and requires contractual guarantees so that the data are exclusively processed for the purposes you have previously accepted, and with the required confidentiality and security.

7. HOW LONG WILL ALROV MAMILLA 2006 LTD. KEEP YOUR INFORMATION?

We will only keep your personal data for as long as we need to fulfil the purposes we collected it for, including for satisfying any legal, accounting, or reporting requirements.

To decide how long we should keep your personal data for, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or sharing of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our guests and customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes.

In some circumstances we may remove your identity from your personal data (so that it can no longer be associated with you) for statistical purposes, in which case we may use this information indefinitely without further notice to you.

8. WHAT CAN YOU DO IF YOU HAVE ANY QUESTIONS OR CONCERNS OR WANT TO ACCESS YOUR PERSONAL DATA?

Our Data Protection Officer will be happy to answer any concerns or queries you may have relating to the use or storage of your personal data. Your principal rights under the European Union General Data Protection Regulation are:

• The right to information on the processing of your personal data –

We strive to provide you with concise, transparent, understandable and easily accessible information on the conditions for processing your personal data, in clear and simple terms.

• The right to access, rectify, delete your personal data –

The right of access allows you to obtain from us confirmation that your personal data have or have not been processed as well as the conditions of such processing, and to receive an electronic copy (for any additional copy, we are entitled to demand payment of any reasonable fees based on the administrative costs incurred).

You also have the right to obtain from us, as soon as possible (and by default within 30 days), the rectification of your personal data.

Finally, subject to the exceptions provided by applicable law (e.g.: retention necessary to comply with a legal obligation), you have the right to ask us to delete, as soon as possible, your personal data, when one of the following grounds applies:

• Your personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
• You wish to withdraw your consent on which the processing of your personal data was based and there is no other basis justifying such processing;
• You consider and can establish that your personal data has been unlawfully processed;
• Your personal data must be deleted in accordance with a legal obligation.
• The right to restrict the processing of your personal data –

The applicable regulations provide that this right may be invoked in certain cases, in particular the following:

• When you dispute the accuracy of your personal data;
• When you consider and can establish that the processing of personal data is unlawful but you oppose the deletion of personal data and demand instead that the processing be limited;
• When we no longer need your personal data but they are still necessary for you to establish, exercise or defend your legal rights;
• When you object to the processing that would be based on the legitimate interest of the controller, during the verification whether the legitimate grounds pursued by the controller prevail over those of the person in question.
• The right to data portability –

When the processing is based on your consent or a contract, this right to portability allows you to receive the personal data you have provided to us with in a structured, commonly used format, and to transmit this personal data to another data controller without us hindering it. When technically possible, you may request that this personal data be transmitted directly to another controller by us.

• The right to lodge a complaint with a supervisory authority –

If, despite our effort to preserve the confidentiality of your personal data, you feel that your rights are not respected, you have the right to lodge a complaint with a supervisory authority. A list of control authorities is available on the European Commission’s website.

• The right to withdraw consent –

When we process your personal data on the basis of your consent, this latter may be withdrawn at any time using the means provided for this purpose (procedure indicated below of this Policy). On the other hand, and in accordance with applicable law, the withdrawal of your consent is only valid for the future and cannot therefore call into question the lawfulness of the processing carried out before this withdrawal.

• The right to decide the fate of your personal data after your death –

Finally, you have the right to organize the fate of your personal post-mortem data through the adoption of general or specific guidelines.  We are committed to respecting these guidelines. In the absence of directives, we recognize the possibility for heirs to exercise certain rights, in particular the right of access, if it is necessary for the settlement of the deceased’s estate; the right to object to the closure of the deceased’s user accounts; and the right to object to the processing of their data.

9. HOW TO CONTACT US

You may exercise any of these rights in relation to your personal data by contacting our Data Protection Officer – Mr. Moshe Revivo. Our Data Protection Officer can be contacted by email at [email protected] and by post at Alrov Mamilla 2006 Ltd., 46 Rothschild Blvd., Tel-Aviv 6688312, Israel.

Please also contact us if you have any question about our privacy policy.

10. WHAT ABOUT LINKED WEBSITES?

The linking of third party websites to this website does not indicate any association with or endorsement by us. We do not assume responsibility or liability for any content presented by or contained on any independent web site, including, but not limited to, any advertising claims or marketing practices.

11. CHANGES TO THIS PRIVACY POLICY

This privacy policy will be subject to change from time to time. The effective date of this current privacy policy is set out at the end of this document.

Effective Date: 24th May 2018