BEST WESTERN INTERNATIONAL, INC. PRIVACY POLICY Best Western International, Inc. and its subsidiaries (collectively, "BWI") are committed to taking measures to respect and protect your privacy. This privacy policy sets forth the measures we take with regard to how we use, protect and allow others to view your personal information. In particular, BWI is committed to complying with all applicable data privacy regulations, including the European Community Directive on Data Protection, commonly referred to as the "EU Privacy Directive" and Canada's Personal Information Protection and Electronic Documents Act ("PIPEDA"), as well as other applicable data privacy regulations. BWI has chosen to comply with a number of international regulations by joining the US Department of Commerce's "Safe Harbor" program. BWI's implementation of the Safe Harbor requirements satisfies its obligations under PIPEDA and the EU Privacy directive. In order to join the Safe Harbor Program, we have submitted certain certifications to the US Department of Commerce and details of such certifications may be found at the following website: http://web.ita.doc.gov/safeharbor/shlist.nsf/webPages/safe+harbor+list. Our privacy policy addresses certain principles dictated by the Safe Harbor Program and consistent with the EU Privacy Directive and PIPEDA: Notice, Choice, Onward Transfer, Security, Data Integrity, Access and Enforcement. Further information about how we address these privacy principles is provided below. 1. Notice The purpose of this section is to notify you about the manner and the purposes for which BWI may collect and transfer certain personal information. This privacy policy should be read in its entirety because anyone who submits personal information to BWI has certain rights regarding the use, collection and transfer of such personal information. BWI maintains centralized reservations systems, a worldwide accessible website, call centers and database computers in the United States as well as in other locations around the world which are intended to help BWI conduct business and to facilitate the operation and maintenance of a central reservations system and its frequency marketing program known as "Gold Crown Club International" ("GCCI"). The central reservations system and GCCI are maintained for the benefit of its member hotels and properties ("BWI Properties") as well as for BWI "Affiliates" which are entities which operate groups of various BWI Properties outside of the United States. BWI Properties and Affiliates are independent entities not owned or controlled by BWI and may or may not be located in European Union member countries, Canada or countries whose privacy protection laws have been deemed "adequate" pursuant to the EU Privacy Directive, PIPEDA or other applicable regulations. BWI may collect certain personal information from and about individuals which can be identified with such specific individual, including without limitation, contact and payment information ("Personal Information") about customers who (i) wish to stay or make reservations at BWI member properties; (ii) purchase Travel Cards (stored value cards redeemable for stays at BWI member properties) which may be used or transferred to third-party recipients for stays at BWI member properties; or (iii) are the users of Travel Cards. Direct customers, Travel Card purchasers and users shall hereinafter collectively be referred to as "Travelers". Personal Information about Travelers may be collected through our websites, by our call centers or may be passed on to us by BWI Properties, Affiliates or other third parties. Personal Information about Travelers is collected so that Travelers can make reservations at BWI Properties and so that BWI Properties can receive and have updated reservation information about Travelers who wish to stay at such BWI Properties. Some of a Traveler's Personal Information (such as a credit card number) may be stored to facilitate the making of future reservations by such Traveler. Only that Personal Information which is reasonably required to facilitate travel reservations is collected and shared between BWI, BWI Properties and Affiliates as outlined above. Personal Information for Travelers will be transferred from BWI to BWI Properties and Affiliates. BWI may collect Personal Information from Travelers who are also members of the GCCI program ("GCCI Customers") so that BWI can perform certain administrative tasks necessary for the administration and operation of the GCCI program such as the following: (1) allow GCCI Customers to earn rewards, points or credit ("GCCI Points") for staying at various BWI Properties; (2) allow other BWI Properties and Affiliates to be aware of the GCCI Points earned by GCCI Customers so that such BWI Properties or Affiliates can redeem GCCI Points; (3) allow BWI Properties and Affiliates to receive and share Personal Information for GCCI Customers as necessary in order for such BWI Properties and/or Affiliates to satisfy contractual obligations among and between various BWI Properties and/or Affiliates. GCCI Customers' Personal Information may be collected through our various websites, by our call centers or may be passed on to us by BWI Properties, Affiliates or other third parties. BWI may transfer Personal Information to BWI Properties and Affiliates as a part of BWI administering the GCCI program as outlined above. BWI distributes Personal Information about GCCI Customers to third parties for the purpose of having such third parties compile information about the type and frequency of use of the GCCI program by such GCCI Customers as well as to allow such third parties to conduct data processing for BWI and to engage in communications on behalf of BWI with GCCI Customers. BWI may also distribute Personal Information to airline companies upon request of the GCCI Customer, in order to allow a GCCI Customer to earn frequent customer points with such airline companies. Examples of these types of third parties include Direct Options and Cendyn. BWI may send marketing information about BWI, BWI Properties or the GCCI program as well as marketing information about offers or information about third party products and services to GCCI Customers and Travelers based upon the Personal Information BWI has collected for such GCCI Customers and Travelers. BWI performs certain of its administrative tasks through the use of several wholly owned subsidiaries ("BWI Subsidiaries") which generally operate within the same facilities as BWI, employ personnel who are also BWI employees and use the same equipment to store and process Personal Information as BWI. This privacy policy applies to and is adhered to by the BWI Subsidiaries. BWI may share or transfer Personal Information with BWI Subsidiaries while performing the tasks described in this privacy policy. To serve you better, we may combine information you give us online, at BWI Properties, through the mail, or in any other way. We may also combine that information with publicly available information and information we receive from others or cross-reference. We use that combined information for the purposes described in this privacy policy. Although unlikely, in certain instances we may disclose your personally identifiable information when we have reason to believe that it is necessary to identify, contact or bring legal action against persons or entities who may be causing injury to you, to BWI or to others. We may also disclose your personally identifiable information when we believe the law requires it. BWI takes special care to protect the safety and privacy of children. Our web sites are general audience sites. We do not permit anyone under the age of 13 to register with us, enter the GCCI program or make hotel reservations. We also do not send email correspondence to anyone who tells us that they are under the age of 13. Children under the age of 13 should always ask their parents or guardians for permission before providing any personal information to anyone online. We urge parents and guardians to participate in their children's online activities and use parental control or other web filtering technology to supervise children's access to the web. Our web sites and emails may use "cookies" and other computer code processes, such as "web beacons". These are small amounts of computer code that interact with your computer, browser or email. Generally, we use cookies to remind us of who you are, tailor our services to suit your personal interests, to process your reservations or requests, track your status in our promotions, contests and sweepstakes, and/or to analyze your visiting patterns. You can generally set your browser to not accept cookies or to notify you when you are sent a cookie, giving you the chance to decide whether or not to accept it. We may contract with third parties who may use cookies or web beacons on our websites and collect information on our behalf. These third parties are prohibited by our contracts with them from sharing that information with anyone other than us or other third parties providing services to us. 2. Choice All Travelers, GCCI Customers and anyone else who submits Personal Information to BWI may choose to not have any of their Personal Information submitted or transferred to third parties in accordance with the terms of this privacy policy. Please see below for further details. If you do not wish for your Personal Information to be disclosed to any third parties, besides BWI Affiliates, and BWI Properties, please let us know through our Customer Relations Department. The contact information for the BWI Customer Relations Department is located at the end of this privacy policy. Within a reasonable time after receiving your request to not distribute your Personal Information to such third parties, we will cease any distribution to such third parties. Please be aware that if you choose to not have your Personal Information distributed to such third parties, then we may not be able to provide all of the available GCCI services to you or such services may not be delivered as quickly. If you do not wish for your Personal Information to be disclosed to BWI Affiliates or BWI Properties, please let us know through our Customer Relations Department. The contact information for the BWI Customer Relations Department is located at the end of this privacy policy. Within a reasonable time after receiving your request to not distribute your Personal Information to BWI Affiliates or BWI Properties, we will cease any distribution of your Personal Information to any BWI Affiliates or BWI Properties. Please keep in mind that if BWI cannot disclose or share your Personal Information to our BWI Affiliates or BWI Properties, we may be unable to provide you with all or certain reservation services, other services or GCCI related benefits. 3. Sensitive Information BWI will only collect sensitive Personal Information related to your health if you submit such type of Personal Information and such sensitive Personal Information will only be used by BWI in order to allow us to help you obtain special accommodations or other health related benefits at a BWI Property. This type of Personal Information will be submitted to BWI Properties and Affiliates only if necessary for us to facilitate the reservation of a room at one of the BWI Properties which will help meet your health needs. If you do not want us to collect and use such type of Personal Information, please do not submit such type of Personal Information to us. 4. Onward Transfer Please note that our descriptions of our activities under the "Notice" and "Choice" principles above describe certain transfers of Personal Information that BWI will be making to third parties. BWI wants all individuals who submit Personal Information to BWI to understand that anyone who submits Personal Information, by submitting such Personal Information and checking the appropriate box which indicates that such individual is consenting to the use and transfer of Personal Information in accordance with this privacy policy, authorizes certain data transfers of such Personal Information to BWI Properties, BWI Subsidiaries and/or other third parties ("Transfer Recipients") for use of such Personal Information by Transfer Recipients in accordance with the description provided in the "Notice" section. Transfer Recipients may not necessarily be in the European Union, Canada or countries which have been deemed by the European Union and/or Canada to have "adequate" data protection laws, and may be in territories like the United States where an equivalent level of data protection is not granted. 5. Security BWI has conducted an internal review of its data collection and processing practices and the security measures it has implemented and believes that such security measures provide reasonable precautions against the unauthorized access, disclosure, alteration or destruction of Personal Information that BWI collects. BWI's Systems Architecture group has also conducted an internal review of its computer network and its data protection measures and believes that it has implemented a reasonable level of technology and software to protect against the loss of Personal Information. Such measures include without limitation, the following: the use of several firewalls to separate user network traffic from server network traffic; the use by BWI web applications of SSL encryption whenever sensitive information is being accessed; the use of the Secure File Transfer Protocol (SFTP) when exchanging data with third parties so that files, usernames and passwords are encrypted; the use of intrusion detection software at eleven different points in the internal BWI network and the use of virus protection software on BWI's e-mail servers and client computers. BWI has also implemented certain physical security measures to protect against the unauthorized access to Personal Information. All server rooms are protected through a keycard system that checks user privileges against a central database and these server rooms are locked at all times. 6. Data Integrity BWI has conducted an internal review of its data collection and processing practices and believes that only that Personal Information is collected and processed which is required in order for BWI to provide services for or to fulfill its contractual obligations with Travelers, GCCI Customers, BWI Properties and BWI Affiliates. BWI will be implementing a periodic review of its data collection and processing practices to ensure that it only collects or processes Personal Information which is required in order for BWI to provide services for or to fulfill its contractual obligations with Travelers, GCCI Customers, BWI Properties and BWI Affiliates. 7. Access BWI will make a good faith attempt to allow all Travelers, GCCI Customers or others who BWI collects Personal Information from, to have the opportunity to view the Personal Information it has collected for such individuals, to the extent required by applicable regulations. BWI may make certain Personal Information available through an on-line program, website or procedure ("On-Line Procedure") for inspection by the individual associated with such Personal Information. If Personal Information is available through the On-Line Procedure devised by BWI, the Personal Information can only be reviewed through such On-Line Procedure. The On-Line Procedure will also contain information about how to request any corrections or deletions of any erroneous Personal Information. Information about the availability of On-Line Procedures for viewing certain types of Personal Information is generally available at the website or on the printed materials where such type of Personal Information was first submitted. If BWI has not set up an On-Line Procedure to allow the viewing of Personal Information, then those Travelers, GCCI Customers or others who submitted Personal Information to BWI for use by BWI can review the Personal Information collected for them by contacting the BWI Customer Relations department through the contact information provided below. BWI will make all corrections and/or deletions of erroneous Personal Information brought to its attention within a reasonable time period and as required by applicable data privacy regulations. To the extent permissible and in compliance with applicable data privacy regulations, BWI shall make all corrections and/or deletions of erroneous Personal Information in a manner which does not impose undue burden or expense on BWI. 8. Enforcement BWI engages in self-assessment on a periodic basis in order to determine its continued compliance with the requirements of the Safe Harbor program, PIPEDA and the terms of this privacy policy. When engaging in a self-assessment review, BWI engages an outside law firm to help coordinate its review of its then current data collection practices and at a minimum, at least one representative from BWI's finance, information services, technology services and marketing groups or divisions is involved in the self-assessment. 9. Dispute Resolution All Travelers, GCCI Customers or others who submit Personal Information to BWI and who feel that BWI has mishandled their Personal Information in violation of the Safe Harbor requirements and/or PIPEDA ("Disputing Party") should contact BWI through its Customer Relations department (with such contact information provided below) with a written description of their complaint. After receiving such written description, a representative from BWI's Customer Relations department will contact the Disputing Party to set up a time and manner to discuss the Disputing Party's complaint. BWI is interested in addressing all legitimate complaints about its adherence to the Safe Harbor and/or PIPEDA, and believes that a Disputing Party and BWI should make a good faith effort to engage in communications to work out or settle any of a Disputing Party's complaints. If these good faith efforts fail to resolve the dispute, then the Disputing Party shall have the opportunity to make use of an independent, dispute resolution procedure. Currently, BWI is a member of the BBBOnline Dispute Resolution Program and has agreed to allow Disputing Parties to bring privacy complaints against BWI pursuant to the rules and procedures of such program. Any Disputing Parties who wish to lodge a complaint through the BBBOnline Dispute Resolution Program will be provided with information from BWI about how to proceed with lodging a complaint. If BWI agrees to adopt the services of another independent, dispute resolution procedure, it will do so only after revising its privacy policy to reflect such new procedure and by informing all Disputing Party's of such change. A Disputing Party and BWI may agree to use an independent dispute resolution body or procedure to resolve disputes about BWI's compliance with the Safe Harbor and/or PIPEDA upon mutual written agreement of both parties. 10. Remedies If it is determined by an independent dispute resolution body or procedure that BWI has engaged in behavior not in compliance with the requirements of the Safe Harbor and/or PIPEDA, BWI may be ordered to engage in actions necessary to reverse or correct any actions taken by BWI which were in violation of the Safe Harbor and/or PIPEDA and which were harmful to the Disputing Party. BWI may also be required to take all actions deemed necessary for BWI to be in compliance with the Safe Harbor and/or PIPEDA in the future. BWI's non-compliance with the Safe Harbor and/or PIPEDA may be reported to the appropriate governmental authorities if BWI has engaged in a pattern of persistent failure to comply with the Safe Harbor and/or PIPEDA. 11. Links to Third Party Sites Our web sites may contain links to web sites operated and maintained by third parties, over which we have no control. Privacy policies on such linked sites may be different from our privacy policy. You access such linked sites at your own risk. You should always read the privacy policy of a linked site before disclosing any personal information on such site. BWI reserves the right to modify this privacy policy at any time without prior notice. The privacy policy posted on this Web site will be the current version dated with the last revision date. Any changes will apply to all information collected by BWI, including previously collected information. Users are responsible to regularly review these terms and conditions. User's continued use following any such changes shall constitute acceptance of such changes. Last updated: September 9, 2004 CONTACTING BEST WESTERN INTERNATIONAL, INC. IF YOU HAVE QUESTIONS OR COMMENTS If you have any questions or comments about the manner in which we use or share your Personal Information, please contact our customer relations department through the contact information included below. Our customer relations department will coordinate with our designated Privacy Officer or others to best address any comments, questions or requests that you may have: Best Western International, Inc. Customer Relations Department Telephone: 1-800-528-1238 Fax: 623-780-6199 Email: customerservice@bestwestern.com Regular Mail: PO Box 10203 Phoenix, AZ 85064 Attn: Customer Service |