3TA

Privacy Policy

Version
1.0
Effective
Last updated

1. Who we are

This website, 3ta.info, is operated by 3TA Tourism Management Limited (“3TA”, “we”, “us”), a company registered in Hong Kong (Business Registration No. 75488124), of Room 1003, 10/F, Tower Two, Lippo Centre, 89 Queensway, Admiralty, Hong Kong.

For the purposes of the Personal Data (Privacy) Ordinance (Cap. 486) (the “Ordinance”), 3TA is the data user responsible for the personal data described in this policy.

Privacy Officer: Mr Mars Li — cservice@3ta.info. Please address any question or request about personal data to the Privacy Officer.

2. What this policy covers

This policy explains how we handle personal data when you, or an AI assistant acting for you, use 3ta.info in any language, and when you contact us. When we open our booking service, accounts, application programming interface (API) and Model Context Protocol (MCP) server, this policy will apply to them too, and we will update it before they open.

3TA’s separate service for customers in mainland China (a mini program) is not covered by this policy. It has its own privacy terms.

This policy is a statement of our practices under Data Protection Principle 5 of the Ordinance. When we collect personal data from you directly, for example in a booking form, we will also give you a short Personal Information Collection Statement at that point.

3. The website today

3ta.info is currently a static information site. Live availability, rates, booking and accounts are not open yet. Today:

  • No account, no booking data. The sign-in page does not send what you type anywhere. Nothing you enter on it leaves your browser.
  • No analytics or advertising cookies. We do not use analytics, advertising, social-media or tracking scripts, and the website itself does not set cookies.
  • Browser storage. The website stores two items in your browser’s local storage. They stay on your device and are not sent to us:
ItemWhat it holdsWhen it is written
3ta.langThe language you chose (English, 简体中文, 日本語 or 한국어)When you choose a language in the language menu
3ta.wishlist.v1Hotels you save (hotel ID, name, city, country and a thumbnail address)When you save a hotel. Saving needs an account, which is not open yet, so this item is not written today

You can delete these items at any time by clearing this site’s data in your browser settings.

  • Hosting and security logs. The website and its images (served from media.3ta.info) are delivered by Cloudflare, Inc. To deliver pages and protect the site, Cloudflare processes technical data about each request, such as your IP address, browser type, the page requested, the time and your approximate location derived from your IP address. Cloudflare may also receive network error reports from your browser and, if its security features are triggered, may set a strictly necessary security cookie. We use this information only to run and secure the site.
  • Fonts and images. Fonts are served from our own domain. Hotel photographs are served from media.3ta.info. The website does not load content from other third-party servers.
  • Email. If you email us, we receive your email address, your message and anything you choose to include.

4. Personal data we will collect when booking opens

When booking and accounts open, we will collect the following, mostly from you, and some from an AI assistant you have authorised or from the hotel:

  • Identity and contact details: names of the guests, email address, telephone number and country of residence.
  • Booking details: hotel, dates, room, rate, number of guests, arrival time, special requests, hotel confirmation numbers and booking history.
  • Credit-card guarantee details: cardholder name, card number, expiry date and card type, which the hotel needs to guarantee your booking. You enter these yourself on 3TA; they are not requested from or passed through AI assistants.
  • Hotel loyalty membership numbers, if you give them to us so that the hotel can credit your stay.
  • Account and rewards data: sign-in details, saved hotels, your 3 COIN balance, tier and ledger.
  • AI assistant connection data: which AI assistants or applications you have connected, the permissions you gave them, and records of the requests they made for you.
  • Communications with us and with hotels about your booking.
  • Technical data described in section 3.

Special requests. Information you include in a special request, such as an accessibility or dietary need, may reveal health information or religious beliefs. Please include only what the hotel needs. We pass it to the hotel solely to arrange your stay.

Providing booking details is necessary to make a booking. If you do not provide them, we cannot make the booking.

5. How we use personal data

We use personal data only for the purposes for which it was collected, or directly related purposes (Data Protection Principle 3):

  1. To search for and show you live rates and terms, prepare your booking, and send it to the hotel through the Sabre global distribution system.
  2. To send you confirmations, changes and cancellations, and to help you with your stay.
  3. To run your account, wishlist, trips and the 3 COIN rewards programme, including confirming completed stays with hotels.
  4. To act on requests from AI assistants that you have authorised, within the permissions you gave them, and to show you what they prepared for your approval.
  5. To keep the site, our systems and your account secure, and to prevent and investigate fraud and misuse.
  6. To comply with law, regulation, court orders and requests from authorities, and to establish or defend legal claims.
  7. To improve our service using aggregated information that does not identify you.

We will ask for your consent before using your personal data for any new purpose that is not directly related to these purposes.

6. Direct marketing

We do not currently send direct marketing. If we decide to, we will first tell you which kinds of personal data we intend to use, which classes of goods or services we intend to market, and obtain your consent as required by Part 6A of the Ordinance. You can withdraw consent at any time, free of charge, and we will stop. We will not provide your personal data to any other person for use in their direct marketing.

7. Who we share personal data with

We do not sell personal data. We share it only as follows:

  • Hotels. The hotel you book receives the guest names, contact details, stay details, special requests, loyalty numbers and credit-card guarantee details it needs to hold and fulfil your booking. Once the hotel receives them, the hotel’s own privacy policy also applies.
  • Sabre. We send bookings to hotels through the Sabre global distribution system, operated by Sabre GLBL Inc. and its affiliates, which processes booking data, including card guarantee details, to deliver it to the hotel.
  • Our service providers, who process data on our instructions under contract: Cloudflare, Inc. (hosting, content delivery, security and image storage); Google LLC (Google Cloud, which will host our booking system); and an email delivery service that sends booking confirmations. We require them by contract to protect personal data and to use it only to provide their service to us (Data Protection Principles 2(3) and 4(2)).
  • AI assistants you authorise. When you connect an AI assistant to 3TA, we return to it the information it needs to act for you, such as rates, booking status and trip details, within the permissions you gave. Card details are never returned to an AI assistant. How an AI assistant handles information is governed by its provider’s terms and privacy policy.
  • Professional advisers, such as lawyers, accountants and auditors, under duties of confidentiality.
  • Authorities, where required or permitted by law, including the exemptions in Part 8 of the Ordinance.
  • A successor business, if 3TA’s business is sold or reorganised, under a commitment to keep using personal data in line with this policy.

8. Transfers outside Hong Kong

Our service is international, so personal data is transferred outside Hong Kong:

  • Cloudflare processes requests in data centres around the world, usually the one nearest to you.
  • Our booking system will run on Google Cloud in the western United States.
  • Sabre processes booking data in the United States and other countries.
  • Hotels are located in many countries and regions, and receive your booking details there. The laws of those places may not protect personal data to the same standard as Hong Kong law.

Section 33 of the Ordinance is not yet in force, but we follow the guidance of the Privacy Commissioner for Personal Data (PCPD) on cross-border transfers. We use contractual safeguards with our service providers and, where practicable, adopt the PCPD’s Recommended Model Contractual Clauses for the cross-border transfer of personal data. Transfers to hotels are necessary to make the booking you asked for.

9. How long we keep personal data

We keep personal data only as long as needed for the purpose for which it was collected (Data Protection Principle 2(2) and section 26 of the Ordinance):

  • Booking and transaction records: 7 years after the booking ends, to meet record-keeping requirements, including those of the Inland Revenue Ordinance (Cap. 112).
  • Credit-card guarantee details: 3TA does not store full card numbers or security codes. Card details are held only in memory, for the few seconds needed to send them to the hotel through Sabre. With the booking we keep only the card brand, the last four digits and the expiry date.
  • Account and 3 COIN records: while your account is open, and 7 years after it is closed.
  • Records of AI assistant requests and approvals: for requests that led to a booking, as long as the booking record (7 years), because they show that you confirmed the booking; for other requests, 12 months.
  • Emails and enquiries: 2 years after the matter is closed.
  • Hosting and security logs: as set by Cloudflare’s standard retention.

10. Security

We take practicable steps to protect personal data against unauthorised or accidental access, processing, erasure, loss or use (Data Protection Principle 4). Today the site is served only over HTTPS, and no personal data is collected through it. Before booking opens, we will describe the security measures that protect booking and card data. No system is completely secure, and we cannot guarantee absolute security.

If a data breach occurs, we will act in line with the PCPD’s Guidance on Data Breach Handling and Data Breach Notifications. That includes containing the breach, assessing the risk of harm, and notifying the PCPD and affected people where appropriate.

11. Your rights

Under the Ordinance you may:

  • Ask for a copy of the personal data we hold about you (a data access request). You may use the PCPD’s Data Access Request Form (OPS003). We will respond within 40 days. We may charge a fee that is not excessive, and will tell you the amount before we proceed.
  • Ask us to correct personal data that is inaccurate. We will respond within 40 days.
  • Withdraw consent to direct marketing at any time.
  • Complain to the Office of the Privacy Commissioner for Personal Data, Hong Kong (www.pcpd.org.hk).

Send requests to the Privacy Officer at cservice@3ta.info. We may need to verify your identity before we act on a request. A request made through an AI assistant must be confirmed by you.

12. Children

3TA is intended for adults. Bookings must be made by a person aged 18 or over. We do not knowingly collect personal data from children except as guest details provided by the adult making a booking.

Our pages link to other sites, such as hotel websites and the MICHELIN Guide. Their own privacy policies apply when you visit them.

14. Changes to this policy

We will update this policy when our practices change, in particular before booking and accounts open. We show the version number and effective date at the top. If a change materially affects how we use personal data already collected, we will tell you before it takes effect and, where required, ask for your consent.

15. Language

This policy is written in English. Translations into Chinese, Japanese and Korean are provided for convenience. If they differ, the English version prevails.

16. Contact

Privacy Officer, 3TA Tourism Management Limited
Room 1003, 10/F, Tower Two, Lippo Centre, 89 Queensway, Admiralty, Hong Kong
cservice@3ta.info