Policies

The PuLi Privacy Policy

Last Updated: December 12, 2025

Introduction

The Puli Hotel Holdings Pte. Ltd. ("PuLi", "we", "us", "our") respects your privacy, and is committed to protecting the privacy, confidentiality and security of the personal data you provide to us or that we collect about you when you use our website thepuli.com ("Site"). We are aware of our responsibility to protect your personal data, to keep it secure and comply with applicable privacy and data protection laws. For the purposes of this Privacy Policy, “personal data” shall have the meaning as given to it by applicable privacy or data protection laws (including but not limited to the PRC Personal Information Protection Law).

This Privacy Policy explains our personal data processing and protection practices and the rights you have regarding your personal data as well as the way to exercise such rights. This Privacy Policy gives effect to our commitment to protecting your personal data and serves as guidelines to be observed by all the hotels, resorts and properties managed and/or operated by PuLi or its affiliates and subsidiaries. Please read this Privacy Policy carefully and ensure your full understanding of this Privacy Policy before providing any personal data for us.

You will be asked to consent to this Privacy Policy when subscribing to e-Newsletters, or otherwise corresponding with us via the Site or otherwise where required under applicable law. To the extent permitted by applicable law, your continued use of the Site will constitute your deemed consent or acknowledgement to the terms of this Privacy Policy.

Types of Personal Data We Collect

• Information you provide to us: we collect personal data you provide directly to us. This includes your title, name (given name & family name), email, country / region when you choose to subscribe to our e-Newsletter.
• Information We Collect Automatically When You Use the Site by Cookies: When you visit our Site from either a desktop or mobile device, we may collect your data such as preferred language, country / region, IP address, device MAC address, browser type, duration of online service access, history of visited web pages, referring URL, etc. from you primarily through cookies in order to serve you with personalized advertisements for PuLi and third-party products, via email, on our Site, or on other websites on the Internet, as well as to measure how you interact with our Site and to maintain your preferences. For more information about cookies, and how to disable them, please see section "Cookies and Similar Technologies".

Where you provide personal data of third parties to us, you confirm that you have their consent or rely on applicable legal basis to provide their personal data to us. We recommend you show them this Privacy Policy.

How We Collect, Use and Disclose Your Personal Data

To the extent permitted by applicable law, we may collect, use and disclose your personal data for the purposes set out below.

• For the purpose of sending you our e-Newsletters and providing you with our news updates and promotional offers;
• For the purpose of monitoring your use of our Site, and conduct analysis of the use of our Site in order to operate, evaluate, protect and improve our Site and our services, understand your preferences;
• For the purpose of providing you with the products, services, promotional offers and relevant information that you may be interested in; and
• For any other purposes for which we or our third-party service providers have obtained your consent, in accordance with the requirements of applicable law.

In addition to the above, except in limited instances where your consent is required, we may also collect, use, and disclose your personal data (i) where it is necessary for the conclusion or performance of a contract to which you are a party; (ii) where it is necessary for the performance of our statutory duties or statutory obligations; (iii) where it is necessary for the response to a public health emergency or for the protection of the life, health and property safety of you or another natural person in an emergency; (iv) where it is necessary to process the personal information disclosed by you or otherwise legally disclosed within a reasonable scope in accordance with the applicable laws; and (v) other circumstances prescribed by applicable laws and administrative regulations.

Cookies and similar technologies

Cookies are small text files containing small amounts of information which are downloaded and may be stored on any of your Internet-enabled devices e.g. your computer, smartphone or tablet - like a memory for a web page. The Site uses following first-party and third-party cookies:

• Necessary Cookies: Necessary cookies are essential and help you navigate the Site. This helps to support security and basic functionality of the Site. These cookies are necessary for the proper operation of our Site, so if you block these cookies, we cannot guarantee your use or the security of our Site during your visit.
• Functional cookies: Functional cookies are used to provide you with the best user experience. These cookies could also recognize if a Site user has already signed up for our e-Newsletter about a service or if the user is seeing our Site for the first time.
• Performance cookies: Performance cookies help us to understand the behaviours of our visitors and the usage of the Site. This allows us to continuously improve the Site to provide you the best user experience. These cookies are also used to help us understand what interests our users, and measure how effective our advertising is. The Site uses below performance cookies:
  • _ga stored by Google for 2 years - We use Google Analytics to help analyze which pages on our website visitors viewed. When you visit our Site, your web browser automatically sends certain information to Google. For further information on how Google uses your data, please refer to https://policies.google.com/technologies/cookies.
  • _pk_id.* and _pk_ses.* stored by PuLi for 13 months and 1 hour respectively – We use these cookies to conduct first-party guest traffic monitoring.
• Advertising cookies: Advertising cookies will remember your preferences in general when you visited the Site. We strive to provide you with advertisements for hotels, resorts, and other products and services relevant to you and your interests on other online platforms, where available. These cookies are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of advertisements. The Site uses below advertising cookies:
  • _fbp stored by Facebook for 3 months - Facebook (facebook.com) sets this cookie to provide Facebook and Instagram advertisement and website analysis service. For more information on how Facebook uses your data, please refer to https://www.facebook.com/policies/cookies/.

We shall store a cookie on your computer or device to remember this for next time. You can change your browser settings so that you receive a warning before certain cookies are stored. You can also adjust your settings so that your browser refuses most of our cookies or only certain cookies from third parties. If you wish to withdraw your agreement at any time, you will need to delete our cookies using your internet browser settings. You should do this through the browser settings for each browser you use. Please be aware that some of our services will not function if your browser does not accept cookies. However, you can allow cookies from specific websites by making them “trusted websites” in your Internet browser.

Disclosures of Your Personal Data

In order to improve the efficiency of information processing, we may engage our affiliates and third parties (such as IT service providers, marketing service providers) to process your personal data on our behalf. We will enter into strict confidentiality agreements with such third parties and require them to process personal data in accordance with our requirements, this Privacy Policy, and the confidentiality and security measures required by applicable laws.

Subject to the provisions of any applicable law, we may share your personal data with the following entities and parties, for the purposes listed above (where applicable):

• with any law enforcement, courts, government or regulatory bodies (in whatever jurisdiction), or otherwise in response to a request for information if we believe disclosure is in accordance with, or required by, any applicable law, regulation, court order or legal process;
• with any business partner, investor, assignee, or transferee (actual or prospective) in connection with, or during negotiations of, or to facilitate any business asset transactions (which may extend to any merger, sale of company assets, financing or acquisition of all or a portion of our business by another company, or any change of management of a hotel);
• with any other party at your consent or at your direction or whom you authorize us to disclose your personal data to; and
• otherwise as permitted or required by applicable laws and regulations.

We may also disclose, aggregate or anonymized data that is not personally identifiable with third parties, including our commercial and strategic partners.

Overseas Transfers of Your Personal Data

Your personal data will be transferred to, and stored at, locations in Hong Kong SAR. It will also be accessed and processed by our personnel and the personnel of our partners, affiliates and third-party service providers, who operate outside of Hong Kong SAR. Your personal data will only be transferred outside of the country or region you are located in where we are satisfied that adequate or comparable levels of protection are in place to protect personal data held in that jurisdiction or that appropriate safeguards are put in place.

Where you are located within the PRC, we will transfer your personal data to Avalade Group Limited (Entrusted Party) in Hong Kong SAR (whose contact information and channel for exercising data subjects’ rights are privacyofficer@avalade.com) in below scenarios. We provide in the table below the transfer purpose, types of personal data transferred, the processing purpose and processing method of the foreign recipient:

• Business scenario: Subscription of e-Newsletter
• Purpose of transfer: Provide the e-Newsletter service
• Types of personal data transferred: Title, Name (Given Name & Family Name), Email, Country / Region
• Processing purpose of the foreign recipient: Provide the e-Newsletter service
• Processing method of the foreign recipient: Collect, use, store, transfer and entrusted processing

Direct Marketing

From time to time, we would like to use your title, name (given name & family name), email, country / region to send you via emails information that we think may be of interest to you, including about our hotels, products and services, events, etc. but we can only do so with your consent.

You may, in accordance with applicable law, choose not to receive marketing communications or opt-out from receiving marketing communications at any time, free of charge, by following the unsubscribe instructions contained in the marketing communications or contacting PuLi in accordance with the section “Your Rights and Contact Us” below. If you opt out of these communications, we may still send you non-promotional communications, unless we are prohibited from doing so by applicable laws.

Retention Period of Personal Data

We may retain your personal data only for as long as it is necessary for the purposes it has been collected and as required by applicable law. To the extent required or permitted by applicable law, we take reasonable steps to delete, destroy, anonymize or redact your personal data in a secure manner when the retention period expires.

Our Commitment to Data Security

We have in place reasonable technical and organizational measures to prevent unauthorized or accidental access, processing, erasure, loss or use of your personal data. These measures are subject to ongoing review and monitoring. However, please be aware and understand that we cannot ensure an absolute secure network. If you find that your personal data are breached, please contact us using the contact details provided in “Your Rights and Contact Us” immediately so that we can take corresponding measures.

In the event of any accident, force majeure event or other circumstances leading to the breach of your personal data, we will make every effort to control the situation and promptly inform you of the cause, the security measures we have taken and you can take and other relevant information. In the event of a security incident related to personal data, we will report to the competent authorities in accordance with the requirements of relevant laws and regulations, promptly investigate the problem, and take emergency measures.

Protection of the Personal Data of Minors

Except where required by local laws, we do not knowingly collect personal data from minors. If you are a minor under the applicable law (i.e., under the age of 18 if you are located in PRC), please don’t use our Site and provide your personal data to us.

If you are the parent or guardian of a minor and have questions on how we process minors’ personal data, please contact us using the contact details provided in “Your Rights and Contact Us".

Third Party Sites

The Site may contain links to other websites, apps, content, services or resources on the Internet which are operated by third parties. If you access other websites, apps, content, services or resources using the links provided, please be aware they may have their own privacy policy, and we do not accept any responsibility or liability for these policies or for any personal data which may be collected through these sites. Please check these policies before you submit any personal information to these sites.

Your Rights and Contact Us

Subject to applicable law, you may be entitled to access, make/ raise objection to processing, rectify, erase, limit the use or transfer the personal data we hold of you, exercise the right to data portability, or lodge a complaint to a competent authority. You may also withdraw your consent to receiving direct marketing communications, or more generally to our processing of your personal data if based on your consent, at any time. You may in certain circumstances ask us to delete your personal data, in which case, to the extent permissible by applicable law, we will take reasonable steps to delete or anonymize your personal data. Please note that we may not be able to continue providing services to you if you entirely withdraw your consent or ask us to delete your personal data entirely, and this may also result in the termination of any agreements with PuLi.

If you want to exercise any of above rights, please contact us using the following information:

• The Puli Hotel Holdings Pte. Ltd.
• Address: 16 RAFFLES QUAY, #19-01, HONG LEONG BUILDING, SINGAPORE 048581
• Contact Information: information@thepuli.com

We will respond to all requests we receive to exercise the data subject's rights in accordance with the requirements of applicable data protection laws within the required time limit. To the extent as permitted by laws and regulations, we may not be able to respond to your request to exercise your rights in the following circumstances:

• If your request is contrary to our obligations under laws and regulations;
• If the requested data is directly related to national security, national defense security;
• If the requested data is directly related to public safety, public health, or significant public interest;
• If the requested data is directly related to criminal investigations, prosecutions, trials and enforcement of judgments, etc.;
• If we have sufficient evidence of your subjective malice or abuse of rights;
• If it is in the interest of safeguarding your or other individuals' significant legitimate rights and interests, such as life and property, but it is difficult to obtain your authorization or consent;
• If responding to your request to exercise your rights would result in serious harm to your or other individuals' or organizations' legitimate interests;
• If the requested data involves trade secrets.

Changes to the Privacy Policy

We may modify this Privacy Policy from time to time. Any changes to this Privacy Policy will be posted to the Site so that you are always informed of the way we collect and use your personal data, and we encourage you to review this Privacy Policy whenever you access the Site or otherwise interact with us to stay informed about our information practices and the ways you can help protect your privacy. Updated versions of this Privacy Policy will include the date of the revision at the beginning of this Privacy Policy so that you are able to check when the Privacy Policy was last amended.

Any changes to this Privacy Policy will become effective upon posting of the revised Privacy Policy on the Site. Use of the Site following such changes constitutes your acceptance of the revised Privacy Policy then in effect but, to the extent such changes have a material effect on your rights or obligations as regards our handling of your personal data, such changes will only apply to personal data after the changes are applied (and, where required under applicable law, we will obtain your consent to material changes to the Privacy Policy).

Miscellaneous

This Privacy Policy is written in the English language and may be translated into other languages. In the event of any inconsistency between the English version and the translated version of this Privacy Policy, the English version shall prevail.