Privacy Policy
Last Updated: 07th August 2026
Hotel Gateway Express (“the Hotel”, “we”, “our”, or “us”) values your privacy and is committed to protecting your Personal Data. This Privacy Statement explains how we collect, use, disclose, store, retain, and protect your Personal Data in accordance with the Personal Data Protection Order, 2025 (PDPO) of Brunei Darussalam and other applicable laws.
By using our products or services, making a reservation, visiting our premises, or otherwise providing us with your Personal Data, you acknowledge that your Personal Data will be collected, used, and disclosed in accordance with this Privacy Statement and applicable laws.
SCOPE OF THIS PRIVACY POLICY
This Privacy Policy applies to all Personal Data collected, used, disclosed, stored, retained, or otherwise processed by Hotel Gateway Express in the course of its business operations.
This Privacy Policy applies to Personal Data collected through, including but not limited to:
- Hotel reservations and accommodation services
- Guest check-in and check-out processes
- Restaurant, café and room service operations
- Banquet, meeting and event bookings
- Sales and marketing activities
- Customer enquiries and correspondence
- The Hotel’s website, online booking platforms and mobile communications
- Social media platforms operated by the Hotel
- Guest Wi-Fi services
- CCTV systems located within the Hotel premises
- Recruitment and employment processes
- Supplier, contractor and business partner engagements
- Any other products, services or facilities provided by the Hotel
This Privacy Policy applies to all individuals whose Personal Data is processed by the Hotel, including guests, visitors, customers, event participants, employees, job applicants, suppliers, contractors, consultants and business partners.
This Privacy Policy should be read together with any privacy notices, consent forms or other data protection notices that may be provided for specific products, services or activities.
THE DATA WE COLLECT
The Personal Data we collect depends on the products, services or facilities you use, and your interactions with Hotel Gateway Express. We collect only the Personal Data that is reasonably necessary to provide our services, comply with legal obligations, and support our legitimate business operations. This may include:
General Identifying Information
Including full name, identification card, passport or other government-issued identification details, residential address, e-mail address, telephone number, social media account ID, profile photo and other data made publicly available, or data made available by linking your social media, or other similar identifiers.
Demographic Information and Important Dates
Including gender, language preferences, nationality, birthdays.
Financial Information
Including credit, debit, or other payment data.
Travel Information
Including prior guest stays or interactions (including interactions via our chat functionalities), goods and services purchased, special service and amenity requests, travel itinerary, tour group information, activity data, or employer details (for business-related bookings).
Health Information
Including information collected in connection with providing our spa, wellness, and beauty service treatments.
Claims Information
Including insurance information, emergency contacts, complaints, or employment details (for worker’s compensation claims).
In more limited circumstances, we may also collect:
- Data about family members and companions (including names, and ages of children);
- Images, videos, and audio data via: (a) recordings of your voice; (b) security cameras located in public areas, such as corridors and lobbies, in our properties. CCTV is not installed in guest rooms, bathrooms or other areas where individuals have a reasonable expectation of privacy.
We may also collect information about your preferences that you provide to us or that we learn about you during your stay, in order to make your current and future stays and experiences with us more enjoyable. These include your food and beverage preferences, which may include your dietary preferences or personal needs so that we can provide for your wellbeing; and your room preferences, which include room options, amenities and any likes and dislikes so that we can improve the Services.
Online and Mobile Information
When you access our website, online booking platform, guest Wi-Fi or other digital services, we may automatically collect certain technical information, including your Internet Protocol (IP) address, device and browser information, operating system, pages visited, date and time of access, referring websites, and other usage data. This information helps us administer and secure our systems, analyse website usage, improve user experience, diagnose technical issues, and support the delivery of our online services. Where you provide your consent, we may also collect your device’s approximate or precise location information to enable location-based services, such as providing directions to the Hotel, displaying nearby facilities, or enhancing your user experience. You may enable or disable location services at any time through your device settings. We also use cookies and similar technologies to remember your preferences, facilitate website functionality, analyse website traffic, improve our services, and, where permitted by law, deliver relevant marketing communications and advertisements. You may manage or disable cookies through your browser settings; however, doing so may affect the functionality of certain features of our website.
Our website uses cookies and similar technologies to enhance your browsing experience, remember your preferences, improve website functionality, analyse website traffic, and support the operation of our online services. Cookies are small text files stored on your device when you visit our website.
Most web browsers automatically accept cookies; however, you may choose to disable or delete cookies through your browser settings. Please note that disabling certain cookies may affect the functionality and performance of our website and online booking services.
Aggregated and Segmented Information
We may aggregate data that we collect, and this aggregated data will not personally identify you or any other user. We may also use both Personal Data and Other Data to divide customers into segments, or groups, to provide more relevant advertising, including third-party advertising.
If you submit any Personal Data about other people to us (e.g., if you make a reservation for another individual), you represent that you have the authority to do so and you permit us to use the data in accordance with this Privacy Policy.
HOW WE COLLECT YOUR DATA
Hotel Gateway Express collects Personal Data through various lawful means in the course of providing our products, services and facilities. Personal Data may be collected directly from you, from authorised third parties, or through your interactions with the Hotel.
Information Provided by You
We may collect Personal Data that you voluntarily provide when you:
- Make a hotel reservation
- Check in or check out of the Hotel
- Visit our restaurant, café or other facilities
- Book a meeting, conference, wedding or event
- Submit an enquiry or feedback
- Contact us by telephone, email or other communication channels
- Complete registration, consent or application forms
- Apply for employment
- Participate in promotions or surveys
Information Collected Automatically
We may automatically collect certain information when you interact with our website, online services or Hotel facilities, including:
- Website usage information
- Device and browser information
- IP address
- Cookies and similar technologies
- Guest Wi-Fi connection logs
- CCTV images and recordings captured in monitored public areas
Information from Third Parties
We may receive Personal Data from third parties where authorised or permitted by law, including:
- Online travel agencies and booking platforms
- Travel agents and tour operators
- Corporate clients arranging accommodation
- Event organisers
- Payment service providers
- Government authorities and regulatory bodies
- Recruitment agencies
- Service providers acting on your behalf
Information Generated During Your Stay or Use of Our Services
During your stay or interaction with the Hotel, we may generate or record information necessary to provide our services, including:
- Reservation and stay history
- Room assignment and service requests
- Transaction and billing records
- Customer service interactions
- Maintenance or incident reports
- Lost property records
- Security-related records
Accuracy of Personal Data
You are responsible for ensuring that the Personal Data you provide to the Hotel is accurate, complete and up to date. Where your Personal Data changes, we encourage you to notify us so that our records can be updated accordingly.
Where you provide Personal Data relating to another individual, you confirm that you have the necessary authority or consent to do so and that the individual has been informed of the purposes for which their Personal Data will be used in accordance with this Privacy Policy.
WHY WE COLLECT YOUR DATA
Hotel Gateway Express collects, uses and processes Personal Data only where it is necessary for legitimate business purposes, to provide our products and services, to comply with legal obligations, or where you have provided your consent, where required by applicable law.
Depending on your interactions with the Hotel, we may collect, use and process your Personal Data for one or more of the following purposes:
Hotel Reservations and Guest Services
We use your Personal Data to process and manage hotel reservations, facilitate check-in and check-out, verify your identity, provide accommodation and related hospitality services, respond to your enquiries and requests, personalise your stay where appropriate, and communicate with you regarding your reservation, stay or other Hotel services.
Restaurant, Café and Event Services
Where you use our restaurant, café, banquet or event facilities, we use your Personal Data to manage reservations and bookings, coordinate event arrangements, accommodate dietary preferences or accessibility requirements voluntarily provided by you, and deliver the requested hospitality and catering services.
Customer Service and Relationship Management
We use your Personal Data to respond to enquiries, provide customer support, handle complaints, resolve service-related issues, conduct customer satisfaction surveys, improve the quality of our products and services, and maintain accurate customer relationship records.
Financial Administration
Your Personal Data may be used to process payments, deposits and refunds, issue invoices and receipts, administer billing arrangements, maintain financial records, conduct internal and external audits, and detect or prevent fraudulent or unauthorised transactions.
Safety and Security
To safeguard our guests, visitors, employees and property, we process Personal Data for security and operational purposes, including operating CCTV systems in designated public areas, managing emergencies, investigating incidents, preventing fraud, theft and other unlawful activities, and supporting health, safety and security measures within the Hotel.
Legal and Regulatory Compliance
We may process your Personal Data where necessary to comply with applicable laws and regulations, fulfil statutory reporting obligations, respond to lawful requests from government authorities, regulatory agencies or law enforcement bodies, and establish, exercise or defend legal rights and claims.
Recruitment and Human Resource Management
Where you apply for employment or are employed by the Hotel, we process your Personal Data for recruitment, employee administration, payroll and benefits management, performance evaluation, training and development, workplace management, and compliance with employment-related legal and regulatory obligations.
Supplier and Business Management
We process Personal Data relating to suppliers, contractors and business partners to manage procurement activities, administer contracts and commercial relationships, communicate regarding goods and services, process payments, and support the effective operation of the Hotel.
Marketing and Promotional Activities
Subject to applicable legal requirements and your communication preferences, we may use your Personal Data to provide information about Hotel promotions, accommodation packages, dining offers, events, newsletters, surveys and other marketing communications.
Where we intend to send marketing messages to you via SMS, WhatsApp or telephone call, we will first obtain your clear and explicit consent. You may withdraw this consent at any time by contacting us using the details in this Privacy Policy, and we will stop sending such marketing messages within a reasonable time.
For marketing communications sent through other channels, such as email, you may opt out at any time by contacting the Hotel. Opting out of marketing communications does not affect service-related messages, such as booking confirmations, connected to your use of our services.
Website and Digital Services
Personal Data collected through our website and other digital platforms is used to operate and maintain our online services, process reservations and enquiries, improve website functionality and user experience, analyse website performance and usage, maintain system security, and support the delivery of our online services.
DISCLOSURE OF PERSONAL DATA
Hotel Gateway Express respects the confidentiality of your Personal Data and does not sell, rent or otherwise disclose your Personal Data to third parties except as described in this Privacy Policy or where required or permitted by applicable law.
We may disclose your Personal Data to the following categories of recipients where necessary for the purposes described in this Privacy Policy:
Service Providers
We may disclose Personal Data to carefully selected service providers who perform services on our behalf, including providers of hotel management systems, online reservation platforms, payment processing, information technology support, cloud hosting, website maintenance, marketing, communications, and other professional services. These service providers are required to protect your Personal Data and may only process it for the purposes authorised by the Hotel.
Business Partners
Where necessary to provide our products or services, we may disclose Personal Data to our business partners, including travel agents, tour operators, online travel agencies, corporate clients, event organisers and other hospitality partners involved in your reservation or service arrangements.
Professional Advisers
We may disclose Personal Data to our auditors, legal advisers, insurers, financial institutions, consultants and other professional advisers where necessary for the provision of professional services or to protect the legitimate interests of the Hotel.
Government Authorities and Law Enforcement
We may disclose Personal Data where required or authorised by applicable law, regulation, court order or lawful request from government authorities, regulatory bodies, law enforcement agencies or other public authorities.
Corporate Transactions
In the event of a merger, acquisition, restructuring, sale of assets or other corporate transaction involving the Hotel, Personal Data may be disclosed or transferred to the relevant parties, subject to appropriate confidentiality obligations and applicable legal requirements.
With Your Consent
Where required by applicable law, we may disclose your Personal Data to other third parties with your consent or at your direction.
Where Personal Data is disclosed to third parties, Hotel Gateway Express takes reasonable steps to ensure that such parties implement appropriate measures to protect your Personal Data and process it only for authorised purposes in accordance with applicable legal and contractual requirements.
PROTECTION OF PERSONAL DATA
Hotel Gateway Express is committed to safeguarding the confidentiality, integrity and security of the Personal Data entrusted to us. We implement reasonable administrative, technical and physical security measures designed to protect Personal Data against unauthorised access, collection, use, disclosure, copying, modification, disposal or other similar risks.
These measures may include access controls, authentication mechanisms, encryption where appropriate, network and system security, regular system maintenance, secure storage of physical records, employee confidentiality obligations, staff training, and the monitoring of information systems to help prevent unauthorised access or misuse.
Access to Personal Data is limited to employees, authorised representatives and service providers who require such access to perform their duties or provide services on behalf of the Hotel. All such persons are required to maintain the confidentiality of Personal Data and comply with the Hotel’s applicable policies and procedures.
While Hotel Gateway Express takes reasonable steps to protect Personal Data, no method of electronic transmission or storage is completely secure. Accordingly, we cannot guarantee the absolute security of Personal Data. We continually review and enhance our security measures to address evolving operational requirements, technological developments and emerging security risks.
TRANSFER OF PERSONAL DATA OUTSIDE BRUNEI DARUSSALAM
In the course of providing our products and services, your Personal Data may be transferred to, stored, or processed in countries outside Brunei Darussalam. This may occur where we engage service providers, business partners, or systems located overseas, including but not limited to:
- cloud hosting and data storage providers;
- our hotel property management and reservation systems;
- online travel agencies and booking platforms;
- payment processing and financial service providers;
- email and communication service providers;
- information technology support and software providers; and
- other service providers who support our business operations.
Where your Personal Data is transferred outside Brunei Darussalam, Hotel Gateway Express takes reasonable steps to ensure that the recipient provides a standard of protection to your Personal Data that is comparable to the protection required under the Personal Data Protection Order, 2025 (PDPO) of Brunei Darussalam. These steps may include contractual data protection obligations, confidentiality agreements, due diligence on the recipient’s security practices, and other appropriate safeguards.
By providing your Personal Data to us, you acknowledge that it may be transferred, stored, and processed outside Brunei Darussalam in accordance with this Privacy Policy and applicable law.
If you have any questions about the countries in which your Personal Data may be processed or the safeguards we apply, you may contact us using the details provided in this Privacy Policy.
RETENTION OF PERSONAL DATA
Hotel Gateway Express retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including providing our products and services, complying with legal, regulatory, accounting and operational requirements, resolving disputes, enforcing our agreements, and protecting the legitimate interests of the Hotel.
The retention period for Personal Data varies depending on the nature of the information, the purpose for which it was collected, applicable legal or regulatory requirements, and the Hotel’s operational needs. Once Personal Data is no longer required, or where retention is no longer necessary or permitted by law, the Hotel will take reasonable steps to securely delete, destroy, anonymise or otherwise dispose of the Personal Data in a manner that prevents unauthorised access, use or disclosure.
Where Personal Data is subject to an ongoing investigation, legal proceeding, regulatory requirement or other legitimate business purpose, the Hotel may retain such Personal Data for a longer period where permitted or required by applicable law.
YOUR RIGHTS
Subject to the Personal Data Protection Order, 2025 (PDPO) of Brunei Darussalam and other applicable laws, you may have certain rights in relation to your Personal Data held by Hotel Gateway Express.
Where permitted by law, you may request to:
- Access the Personal Data that we hold about you;
- Request the correction of any Personal Data that is inaccurate, incomplete or out of date;
- Withdraw your consent to the collection, use or disclosure of your Personal Data where our processing is based on your consent; and
- Enquire about how your Personal Data has been collected, used or disclosed.
Please note that your rights may be subject to certain legal or regulatory limitations or exceptions. Where permitted by law, the Hotel may decline or be unable to comply with a request in whole or in part if an exception under the PDPO or other applicable legislation applies.
Where the withdrawal of consent affects our ability to provide a product or service, fulfil a contractual obligation, or comply with a legal requirement, Hotel Gateway Express may be unable to continue providing certain products or services to you.
To exercise your rights or make an enquiry regarding your Personal Data, you may contact the Hotel using the contact details provided in this Privacy Policy. We may require you to verify your identity before processing your request and may request additional information where reasonably necessary to process your request.
CHANGES TO THIS PRIVACY POLICY
Hotel Gateway Express may amend or update this Privacy Policy from time to time to reflect changes in our business operations, products and services, legal or regulatory requirements, technology, or other operational needs.
Any revised version of this Privacy Policy will become effective upon publication on our website or such other date as may be specified. Where required by applicable law, we will take reasonable steps to notify you of any material changes to this Privacy Policy.
We encourage you to review this Privacy Policy periodically to ensure that you are aware of how we collect, use, disclose, store and protect your Personal Data.
CONTACT US
If you have any questions, concerns or requests regarding this Privacy Policy or the processing of your Personal Data, please contact us using the details below:
Data Protection Officer
Hotel Gateway Express
EDR 99, Lot 106, Jalan Sungai, Kuala Belait KA2331, Brunei Darussalam
Telephone: +673 3286165 / 3286167
Email: hr@vplazabn.com
If you wish to request access to or correction of your Personal Data, withdraw your consent where applicable, or make an enquiry regarding our handling of your Personal Data, please contact us using the details above. We may require sufficient information to verify your identity before processing your request.
If you believe that your Personal Data has been handled in a manner that is inconsistent with this Privacy Policy or applicable data protection laws, you may submit a complaint to the Hotel’s Data Protection Officer using the contact details provided in this Privacy Policy.
When submitting a complaint, please provide sufficient information to enable us to investigate the matter, including:
- Your name and contact details;
- A description of the complaint;
- The relevant dates, if known; and
- Any supporting information or documentation.
Upon receiving your complaint, the Hotel will acknowledge receipt, review the information provided, conduct an appropriate investigation where necessary, and endeavour to respond within a reasonable period.
Where a complaint is found to be valid, the Hotel will take appropriate corrective actions to address the issue and, where applicable, implement measures to prevent similar incidents from occurring in the future.
Hotel Gateway Express will endeavour to respond to your enquiry or request within a reasonable period and in accordance with applicable legal and regulatory requirements.