Privacy Policy

1. Introduction

This Privacy Policy (hereinafter referred to as the “Policy”) contains information on how Company InterRus-M AO (Ararat Park Hyatt Moscow hotel), hereinafter referred to as the “Hotel”, “we”, “us” or “our”, processes your personal data. This Policy implements our obligation to protect your personal data, as defined in accordance with the requirements of the Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006.

We use your personal data to fulfill our commitment to providing the highest quality services during any of your interactions with the Hotel (hereinafter referred to as the “Purpose”). As part of this obligation, we undertake to ensure the confidentiality of the personal data we collect.

As a guest or an individual interacting with us, you understand and acknowledge that we may process your personal data in accordance with this Policy.

If you provide us with personal data of another person, you must ensure that this person consents to this Policy and, in particular, inform them of how we may use their data. You must remind this person to read this Policy in advance, and you may also provide them with a copy of this Policy.

2. Scope of this Policy

This Policy applies when you interact with the Hotel through our websites – including https://araratparkhotel.ru and our various booking sites – (hereinafter collectively referred to as the “Websites”), or when you communicate with us via phone, SMS, private messages, social media or using other similar features.

3. Data we may collect

We collect and process your personal data to provide you with the best possible service when you interact with us. The data we collect may vary depending on the way you interact with us. Categories of personal data that we may collect:

• Contact and identification details. We may collect information such as your given name, surname, patronymic, telephone number, email address, nationality, loyalty program card details, length of stay (check-in date, check-out date, purpose of visit, room number), and accommodation conditions.
• Account data and marketing preferences. We may collect information about your account and registration data for the Hotel’s guest loyalty program, as well as any frequent flyer programs and partner loyalty programs. We may also collect information about your marketing preferences.
• Device, Internet, and Network Activity Information. We may collect information about the Internet Protocol (“IP”) address, which is automatically assigned to your computer or device whenever you interact with us online. We may also collect information from your devices if they connect to or are detected by wireless networks at our hotels. We or our service providers may also collect information about how you use Wi-Fi networks and other services, such as the websites you visit through our Wi-Fi network. We also use cookies and related technologies to collect information about how you interact with our Websites and online content. We may collect information about the date and time of your visit, the pages you visit and the time you spend on each page, the type of internet browser you use, the model, manufacturer, and operating system of your device, your search queries on the Website, the URLs of any websites you visited before and after visiting our Websites (including advertisements that redirected you to our Website), as well as whether you use or interact with links to our digital content and advertisements on our Websites and other sites. We may also use technologies to record user sessions on our Websites. When you access the mobile version of the Website, we collect information about your device, its unique identifier, details about your mobile network and the browser type you are using. We may also embed technologies (including web beacons, tags and pixels) into emails and other messages that we or our service providers send to you to understand how you interact with these messages, for example, when you open the message or click on any of its content. Information about how the Hotel uses cookies and related technologies, as well as how to disable them, is detailed in Section 5 below.
• Payment and credit information. We may collect information about your credit card and other payment methods. In certain cases, we may also collect information about the status of clients’ credit accounts.
• Location information. In cases established by applicable law, we may automatically collect information about your precise geolocation when you visit the Website. We may also collect information about your general location using your IP address and postal code.
• Preferences and profiling. We may collect information about your preferences or draw our own conclusions about your preferences, characteristics and predispositions based on other personal data we have about you.

We undertake to strictly protect such information using the security standards described below.

By agreeing to this Policy, in the cases and to the extent permitted or provided for by applicable law, you give your explicit written consent to the processing of any personal data that you provide to Company InterRus-M AO and which is considered Confidential Personal Data or Financial Information.

Except as required by law, you are not obligated to provide the Hotel with your confidential personal data, and if you choose not to do so, this will not prevent you from purchasing any products or services from the Hotel (except in regions where credit card details may be considered Confidential Personal Data).

4. How we collect your personal data

We collect the above categories of personal data from the following categories of sources:

• Directly from you. Most of the personal data we process is data that you or a person acting on your behalf has directly provided to us.
• From your devices and our networks. We use cookies and related technologies to automatically collect personal data from your devices when you interact with the Website, our emails or other online content, or when your device connects to or is detected by wireless networks in our hotels.
• From social networks. If you post information on one of our social network pages, we may receive contact and identification details, information about your place of residence and purchases, your Internet and network activity, as well as any other personal data contained in your posts or social network profile.

5. Website Analytics and Tracking

We use Google Analytics and Yandex Metrica to analyze our website usage. They record the frequency of visits, the pages viewed, and the websites from which users arrive at our site. At the same time, the services only collect the IP addresses assigned on the day of the visit, without personal identification. Google Analytics and Yandex.Metrica place persistent cookies on your browser, allowing them to recognize you during subsequent visits. These files may not be used by third parties other than Google and Yandex. The data obtained in this way is shared and stored on the servers of the specified companies. Information collected via Google Analytics and Yandex.Metrica counters is used exclusively to improve the performance of the website. We do not combine it with users’ personal data. The sharing of collected data with third parties is regulated by the privacy policies of Google and Yandex. If you want to disable tracking, you can restrict or block cookies in your browser settings.

6. How we use your data

In accordance with applicable law, we may collect and use any of your personal data to:

• process hotel room bookings on your behalf, collect payments and manage your hotel stay;
• provide you with support and a higher or more personalized level of service at the Hotel, as well as through the Website, the guest recognition program, third-party applications, products or services, or through products and services that the Hotel will develop in the future;
• allow us to evaluate, analyze and improve the functionality of our Websites, our products and services;
• manage loyalty, travel and discount programs, as well as the Hotel’s guest recognition program;
• administer contests/competitions, sweepstakes/prize draws or other promotional activities;
• fulfill our contractual obligations to you, to everyone involved in the organization of your holiday (e.g., travel agencies, group tour organizers or your employer) and to service providers (e.g., credit card issuers, airlines and third-party loyalty, travel or discount programs);
• conduct market research, customer satisfaction surveys for service quality, and quality assurance purposes;
• conduct marketing and advertising campaigns, as well as display targeted advertising for products, services, events or promotions that may be of interest to you, including those offered by the Hotel and other parties. In cases permitted by law, we may collaborate with other companies to display advertising and marketing materials that we believe may be relevant and of interest to you. They may include advertisements displayed on our own Websites, contained in emails or other messages sent by us, or our advertisements displayed on other companies’ websites. The advertisements you see may be based on information collected by us or third parties and/or your activities on our Websites or third-party websites;
• prevent, detect and investigate fraud, cybersecurity incidents or other illegal or malicious activity;
• achieve other purposes disclosed to you in accordance with applicable law or with your consent; and

The Hotel uses and stores your personal data for as long as necessary to achieve the purposes for which it is being processed, and in accordance with our legal and regulatory obligations and risk management principles.

6.1 Basis for processing

When processing your personal data as one of our guests or another person with whom we do business, we do so on one of the following legal bases, depending on the circumstances: (i) our legitimate interests (as set out above), (ii) in connection with our legal obligations, (iii) because the information is necessary to fulfil contractual obligations towards you and/or providers (e.g., credit card issuers, airlines and third-party loyalty, travel or discount programs), or (iv) with your consent.

7. Disclosure of your personal data

From time to time, we may disclose your personal data. We always make these disclosures in accordance with applicable law. In certain jurisdictions, data privacy laws may require us to obtain your consent before disclosing your data to third parties. By agreeing to this Policy, in the cases and to the extent permitted or required by applicable law, you consent to the transfer of your personal data to such third parties for the purposes, in the cases and to the extent specified in this section and section 5 above (except that in certain jurisdictions we will ask you to provide such consent separately). Below are the cases in which we may disclose such data (in addition to those listed in section 6 above):

7.1 Our agents, service providers and suppliers of goods

As is standard in the hospitality industry, we may engage third parties to perform certain functions and/or process information. When we engage third parties to process your personal data or disclose your personal data to third-party service providers, we require them to protect your personal data by implementing appropriate security measures.

When using payment services, your personal data may be processed in accordance with the Privacy Policy provided in Appendix No. 1.

7.2 Transfer of business

As our business expands, we may sell our hotels and other assets. We may also use your personal data or control over it as a transferable asset. Furthermore, in the event our company or a substantial portion of our assets is acquired (which is highly unlikely), your personal data or control over it may become part of the transferred assets. Similarly, we may share your personal data with a third party we are acquiring to facilitate our mergers and acquisitions and to achieve the purposes described in section 6 above.

7.3 Legal requirements

In accordance with applicable law, we reserve the right to disclose any of your personal data in our possession upon the request of a court, law, or government authority, as well as if we determine that it is necessary or appropriate to comply with the law or to protect and defend our rights and property under applicable law. We also reserve the right to store and use the collected personal data to comply with accounting and tax regulations, as well as laws regarding data storage periods.

7.4. Cross-border transfer of personal data

Prior to commencing activities on cross-border transfer of personal data (if such transfer is carried out), we (the Operator) are obliged to notify the authorized body for the protection of the rights of personal data subjects of its intention to carry out cross-border transfer of personal data (such notification is sent separately from the notification of intention to process personal data).

Before submitting the above notification, we (the Operator) are obliged to receive relevant information from the foreign authorities, foreign individuals, and foreign legal entities to whom the cross-border transfer of personal data is planned.

8. Online interaction

If you interact with us online, you may wish to know the following:

8.1 You may use websites anonymously

You may visit our Websites without registration or any other form of personal identification.

8.2 Cookies and other tracking technologies

Along with other parties, we use cookies, pixels, beacons and other technologies on our Websites, emails and advertising messages. These technologies are used to improve and advertise our products and services and allow us, advertising networks, social networks and other providers to place and display advertisements and personalized content.

Some of our Websites allow you to manage your cookie preferences by clicking on the “Cookie Center” link, which can be found in the footer of these Websites. Additionally, you may opt out of certain uses of cookies for advertising purposes, and refer to your Internet browser’s user instructions to explore additional options for managing cookie usage, including blocking specific cookies by changing your browser settings.

Your cookie settings are specific to the website, device, and browser you are using, and are deleted whenever you delete cookies or clear your browser’s cache. This means you need to adjust your cookie settings on every website, device and browser you use. If you block cookies, you will not be able to use all the features of our Websites, including user profile creation settings.

The list of cookies processed is shown in the table below.

We may also collect device advertising identifiers. You can adjust your mobile privacy or ad settings on your iOS or Android device to limit app tracking for advertising purposes. The choice depends on the specific device.

8.3 Social networks

Our Websites may also contain plugins and other features that integrate third-party social media platforms into our Websites. You will be able to activate them manually. If you do this, the third parties that operate these platforms will be able to identify you, determine how you use this Website, as well as store this information and link it to your social network profile.

Please familiarize yourself with the data protection rules of these social media platforms to understand what will be done with your personal data. You activate these plugins and other features at your own risk.

8.4 Links to other websites

If you visit our Website and decide, for example, to purchase a gift certificate, book a flight, rent a car, submit a reward form, or send a resume online, you can easily use the links to the websites of third parties with whom we partner to provide these services.

When clicking on links on our website or any other website, pay attention to your browser’s address bar to determine if you are being redirected to another website.

This Policy and our liability apply only to our information collection methods. We are not liable for and cannot guarantee the information collection methods or privacy policies of other websites operated by third parties or our service providers when you submit your personal data directly to those websites.

Furthermore, we cannot be held liable for the content of third-party websites or those of our service providers, even if these sites are accessed via links provided on our Websites. We strongly recommend that you read the privacy and security policies of external websites before providing any personal data when visiting them.

8.5 Security

Since the security of your personal data is important to us, we use Transport Layer Security (“TLS”) protocol software to encrypt the personal data you provide. When using the TLS protocol, the personal data you transmit to us online is encrypted. You can determine whether your personal data is being transmitted in encrypted form using the TLS protocol by looking for the “padlock” or “key” icon in your browser’s address bar.

You can also ensure your personal data will be encrypted using the TLS protocol by checking the web address prefix of the page, where “https” should be displayed instead of “http”. If you do not see a corresponding symbol and/or https prefix, you cannot assume that the personal data you are asked for will be encrypted before transmission.

The personal data collected from you online is stored by us and/or our service providers in databases protected by physical and electronic access controls, access restriction system technologies and other reasonable security measures. However, such security measures cannot guarantee absolute protection against the loss, misuse or change to personal data, and to the fullest extent permitted by law, we will not be liable for any damage or loss related to such incidents.

In accordance with the law, we will notify you of any loss, misuse or change to your personal data that may impact you so that you can take appropriate measures to adequately protect your rights.

8.6 Minor children

Our Websites do not sell products or services to children, and we do not knowingly request or collect personal data from children. You may use the Site’s services only if you are 18 (eighteen) years of age and have the right to enter into legally binding contracts in accordance with the applicable legislation. The Site is not intended for minors and may not be used by them. If you are under 18 (eighteen) years of age or cannot enter into legally binding contracts with the applicable legislation, you may contact the hotel directly for assistance.

9. Choice

You can always choose what personal data you want to provide to us. However, if you decide not to provide certain data, it may affect our ability to interact effectively (for example, we cannot process a booking without a name). If you provide us with your contact details (such as a postal or email address, telephone or fax number), where permitted by law, we may contact you to notify you about products, services, promotional offers and events that we believe may be of interest to you.

We may also share your personal data with carefully selected third parties, who may contact you directly in cases permitted by law. In some jurisdictions, data privacy laws may require us to obtain separate consent before we do so. You can always indicate whether you wish to receive any of these emails by contacting us using the methods specified in section 13 below, or by following the unsubscribe instructions provided in the emails you receive.

If you have a guest recognition program profile, we kindly ask you to indicate your contact preferences when applying for program registration or creating your user profile. We may also ask you to indicate how you would like to receive special offers, marketing and promotional information (for example, by email or post), as well as your willingness to participate in surveys. By indicating your preferences, you can always change them.

In addition to your agreement to this Policy, data privacy laws require us to obtain your consent before sending you information that you have not specifically requested. In some cases, your consent may be implied (for example, when information is needed to fulfill your requests and/or when you voluntarily provide information for our use). In other cases, we will require your explicit consent in accordance with local laws (for example, when the personal data collected is considered confidential under local laws).

We will fulfill any of your requests not to send you direct marketing information. After receiving such a request, your contact details will be “blocked” but not deleted. This will serve as a guarantee to record and preserve your request until you provide consent that cancels it.

10. Your rights

You have the right to:

• obtain information regarding the processing of your personal data, except in cases provided for by federal laws. The information is provided to you by the Hotel in an accessible form and to the extent available to the Hotel, and may not contain personal data relating to other personal data subjects, except when there are legal grounds for disclosure of such personal data. The list of information and the procedure for obtaining it are established by the Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006;
• request from the Hotel, where applicable, to clarify your personal data, block or destroy them if the personal data is incomplete, outdated, inaccurate, illegally obtained or is not necessary for the stated purpose of processing, as well as to take measures provided for by law to protect your rights;
• set the condition of prior consent to the Hotel, where applicable, for the processing of personal data for the purpose of promoting goods, works and services on the market;
• withdraw your consent to the processing of personal data from the Hotel, where applicable, as well as to submit a request to cease the processing of personal data;
• appeal to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) or in court against unlawful acts or omissions of the Hotel in the processing of your personal data;
• exercise other rights provided for by the applicable legislation.

You are obliged to:

• provide us with reliable data about themselves;
• notify us of any updates, corrections, changes to your personal data.

Persons who provide us with false information about themselves or information about another personal data subject without the consent of the latter bear liability under the applicable legislation.

11. Our rights

We have the right to:

• receive from you reliable information and/or documents containing personal data;
• in the event that you withdraw your consent to the processing of personal data, as well as submit a request to cease the processing of personal data, we are entitled to continue processing your personal data without your consent if there are grounds specified in the Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006 and other applicable legislation;
• independently determine the composition and list of measures necessary and sufficient to ensure the fulfillment of the obligations provided for by the Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006 and by the regulatory legal acts adopted in accordance with it, unless otherwise provided by the Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006 and other applicable legislation.

We are obliged to:

• provide you, at your request, with information regarding the processing of your personal data;
• organize the processing of personal data in accordance with the procedure established by the applicable legislation;
• respond to your requests and inquiries in accordance with the applicable legislation;
• report the necessary information to the authorized body for the protection of the rights of personal data subjects (Roskomnadzor) upon its request within 10 days of receiving such a request, as well as to other regulatory authorities in accordance with the applicable legislation;
• publish or otherwise provide unlimited access to this Policy;
• take legal, organizational and technical measures to protect personal data against illegal or accidental access to them, destruction, modification, blocking, copying, provision, distribution of personal data, as well as against other illegal actions in relation to personal data;
• cease the transfer (distribution, provision, access) of personal data, cease processing and destroy personal data in the manner and in the cases provided for by the Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006 and other applicable legislation;
• fulfill other obligations provided for by the Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006 and other applicable legislation.

12. Amendments to this Policy

As our business evolves, this Policy may change from time to time. For your convenience, the effective date of this Policy is indicated at the end of this document.

13. Request for access to personal data/questions or complaints

If you have any questions regarding this Policy or the processing of your data described in it, other concerns and complaints related to the implementation of this Policy, or you would like to submit a request (using the methods specified above) to exercise your rights regarding your personal data stored by us, please contact us via one of the methods listed below:

• by calling the booking phone number listed on the customer service page of the araratparkhotel.ru website;
• by sending a letter to the address: 4 Neglinnaya Street, Moscow, 109012, Russia; or
• by contacting the reception desk at the Hotel.

All requests for access to your personal data must be sent in writing by post or email. We may respond to your request by post, email, telephone or any other method that suits you best. Effective date: 01.01.2026. In the event of any discrepancies between the Russian version of this Policy and any other language version, the Russian version shall prevail.

Appendix No. 1

Privacy Policy

1. General Provisions

1.1. This Privacy Policy (hereinafter referred to as the “Policy”) has been developed in accordance with the Federal Law No. 152-FZ “On Personal Data” dated 27.07.2006 and determines the procedure for processing the personal data of users (hereinafter referred to as the “Users”) when using payment services provided by I Company InterRus-M AO (hereinafter referred to as the “Company”) using the technologies of Runet Business Systems LLC (RBS) as the personal data processing operator.

1.2. RBS acts as a personal data processor on behalf of the Company and ensures data security in accordance with the legislation of the Russian Federation.

1.3. By using payment services, the User consents to the processing of their personal data in accordance with this Policy.

2. Scope of processed data

The Company and RBS process the following categories of Users’ personal data:

• Full name;
• Contact details (phone, email);
• Payment details (data of bank card, bank accounts and electronic wallets);
• Technical data (IP address, cookies, device and browser data);
• Other information required to fulfill the contract (e.g. payment amount, order number).

3. Purposes of personal data processing

The data is processed for the following purposes:

• Processing payments and fulfilling obligations to the User;
• Identifying the User to prevent fraud;
• Complying with the requirements of legislation (including tax and anti-money laundering legislation);
• Improving the quality of service (analyzing statistics, processing requests).

4. Legal basis for processing

4.1. The data is processed on the basis of:

• User Consent (Article 6 of the Federal Law No. 152-FZ);
• Necessity to fulfill the contract (providing payment services);
• the Law (for example, the Federal Law “On Combating Money Laundering”).

4.2. RBS processes data only within the framework of the contract with the Company and does not use it for any other purposes.

5. Transfer of data to third parties

5.1. The data may be transferred to:

• Banks and payment systems – for processing transactions;
• Government agencies – in cases provided by law;
• RBS counterparties (e.g. antifraud services) – exclusively for the purposes of processing payments.

5.2. The data may only be transferred outside the Russian Federation if adequate protection is ensured.

6. Data storage periods

6.1. The data is stored until the processing purposes are achieved, but no less than the periods established by:

• the Contract with the User;
• the Russian legislation (for example, 5 years for financial operations).

6.2. Upon expiration of the storage periods, the data is destroyed or anonymized.

7. User rights

The user has the right to:

• Withdraw their consent for data processing (by contacting the Company);
• Request access to, correction or deletion of their data;
• File a complaint with Roskomnadzor in case of violation of their rights.

8. Data security

8.1. The company and RBS implement security measures (SSL encryption, PCI DSS, regular audits).

8.2. The user is obliged not share payment information with third parties.

9. Contacts

For any questions regarding data processing, please contact:

• Company: Company InterRus-M AO, moscow.park@araratph.ru.
• RBS: Runet Business Systems LLC, support@rbs.ru.