Privacy Policy
Last Updated: 31 August, 2026

Galaxy Entertainment Group Limited (and its subsidiaries and affiliates, referred to as the “Company”, “we”, “us”, or “our”) is committed to protecting your personal information.

This Privacy Policy sets out how we, as a group and as individual companies, collect and use your personal information and your rights in relation to personal information.

For residents of the People's Republic of China (excluding the Hong Kong Special Administrative Region, the Macao Special Administrative Region, and Taiwan) and other individuals located within Mainland China, please refer to Appendix I for information regarding how we process the personal information of Mainland China members in accordance with the requirements of the Personal Information Protection Law of the People's Republic of China (PIPL).

1. Scope of Application
This Privacy Policy applies to our processing of your personal information, including without limitation, our collection, storage, use, processing, transmission, provision, disclosure, deletion and/or dealing with your personal information, during or when you use, purchase or subscribe our goods and/or services, or in any way interacting with us through or during the course of using the various online and offline channels or platforms, such as:
• Our official websites, mobile applications, WeChat, and any other of our official online social media platforms (collectively, refer to as “Our Official Online Channels”).
• Our customer service centers, telephone services, and communications through our official customer service hotline and/or official email addresses.
• In our hotels, resorts, retail shopping mall, restaurants & bars, spas, customer service locations, event & performance venues, and/or any other properties operated or managed by us.
• Our promotion and marketing campaigns and/or membership loyalty program whether held by us alone and/or in collaboration with any of our marketing partners. 
• through any other channels, platforms or medium to which we think fit and necessary.  

2. What Personal Information We Collect
2.1
The categories of personal information we may collect from you, including and without limitation to the following:
[Basic Identity and Contact Information]
Such as name, gender, date of birth, nationality, telephone number, email address, mailing address, age, language, occupation, marital status, country/region of residence, and citizenship status;
[Transaction and Payment Information]
Such as payment method, bank account information, credit card number and cardholder name, expiration date, security code, delivery address, billing address, transaction type, transaction amount, payment details, transaction date and time, transaction location, outlet/store information, and receipt/invoice number;
[Legal Identification Documents]
Such as passports, identity cards, travel documents, visas, and any other identification documents you may provide when checking in or when necessary for the provision of services;
[Membership and Account Information]
Such as username, password, membership account number and personal identification number (PIN) provided when registering for our loyalty program, registration and login methods, linked accounts, membership tier, points information, and communication preferences;
[Travel Itinerary and GPS locational Information]
Such as traveler names, arrival and departure information, transportation reference numbers and details, origin and destination, and group information;
[Reservation/Booking Information]
Such as reservation number, reservation name, booking date and time, itinerary, outlet/location, and arrangement preferences;
[Information Provided by Family or Friends]
Such as information relating to you provided by your family members or friends when making reservations or participating in referral programs;
[Preference Information]
Such as dining preferences, dietary requirements, accommodation preferences, and special requests;
[Content]
Such as photographs, reviews, feedback dates, feedback details, and any other content you provide;
[Signature]
Such as signatures provided when checking in at our properties or signing applications and forms;
[Device Information]
Such as operating system (OS) version, WeChat Union ID, access source (e.g., websites and applications), geolocation data, and other location information derived from your IP address, country, and postal code;
[Browsing Activity]
Information about your online activities, devices, viewing behavior, click events, and usage patterns collected through Cookies, Web Beacons, and similar technologies (please refer to the “Cookie Notice” for more details);
[Information Obtained from Processors and Service Providers]
Personal information obtained from business partners, including ticketing agencies, travel agencies, event organizers, travel booking platforms, business partners, and marketing partners;
[Analytics and Inferences]
Inferences drawn from any of the above information to create a profile reflecting your preferences, characteristics, psychological trends, predispositions, behaviors, attitudes, intelligence, abilities, and aptitudes, for the purpose of conducting limited analysis necessary to support membership service functions (such as account status and service eligibility). Where automated decision-making may have a significant impact on you, we will provide appropriate safeguards and choices in accordance with the applicable laws, including the right to refuse decisions based solely on automated processing;
[Other Information Provided To Us]
Any other personal information that you voluntarily provide to us through our Official Online Channels, forms, applications, customer service interactions, or other communications with us.

3. Purposes for Processing and Use of Personal Information
We will collect and use your personal information to the scope reasonable and necessary, as well as to the extent permitted by the applicable laws, to administer our business operations, providing highest-quality services to our customers, complying with applicable legal and regulatory requirements, and other purposes set out in this Privacy Policy or disclosed to you at the time of collection.

We may use your information for one or more of the following purposes:
•To enter into any contracts or agreements for provisions of any goods or services, processing bookings or reservations and/or purchases of goods or services;
• To execute, handle and/or in any way deal with and complete the performance of the contracts entered or to be entered into with our customers;
• To confirm your booking, order and/or purchase of our goods and/or services, including without limitation, hotel accommodations, food and beverage and other entertainment arrangements such as cinemas, shows, events, package reservations, and related activities;
• To confirm your booking or order for any tour or travel arrangements, including without limitation, transportation and hotel room reservations;
• To register and administer our membership loyalty accounts, as well as for any other communications for orders, promotions, offers, loyalty rewards, and other membership-related information;
• To process, verify and/or complete billing and payments;
• To communicate with our customers and users about our goods and/or services;
• To verify and confirm customers’ identification and/or for authentication purposes;
• To handle customers’ enquiries, feedback and complaints;
• To conduct customer surveys to better understand our customers’ preferences and needs;
• To conduct and develop research and promotion for improvement and further enhancement and upgrade of our customers’ experiences;
• For our own reference, record, and operational administration purposes, including data analysis (including behaviour analysis and evaluation) to further elevate and refine our  quality of services;
• Any marketing communications and marketing automation analytics (subject to your separate and voluntary consent where required by applicable law). With your consent, we may operate online marketing campaigns and promotional programs, including to notify winners and provide discounts, offers, benefits, privileges, and related information relating to the campaigns and programs;
• To comply with any obligations, requirements, or arrangements relating to the disclosing and using of personal information that apply to us according to the applicable laws or regulations;
• Any other purposes we deem appropriate and necessary to the extent permitted by the applicable laws and regulations; and
• Any other ancillary and/or incidental purposes in relation to and/or in connection to the above purposes.
Where required by the applicable law in certain jurisdiction, we may obtain your separate consent before processing your personal information. If you choose not to provide your personal information or to withdraw your consent, please note that we may be unable to provide certain goods and services to you, and you may be unable to access certain features available in our properties and/or through our Official Online Channels.

4. How We Transfer Personal Information
• We endeavors to protect customer’s personal information with high standard.  We do not sell or trade your personal information.
• We may only share your personal information with our staff, employees, our group companies, agents, contractors, sub-contractors, subsidiaries, affiliates, and/or third-party service providers (such as information technology service providers, payment institutions, and marketing partners), collectively referred to as “Permitted Recipients”, who are under a duty of confidentiality obligations to us, for the purposes set out in the section “How We Use Information.”
• We will endeavor to seek such the Permitted Recipients to process your personal information in accordance with the stated and authorized purposes and not to transfer it unless permitted by us and/or the applicable law.
• Some Permitted Recipients may be located outside your jurisdiction. Please refer to the section “How we Transfer Data Across Borders” for further information on cross-border transfers and applicable protection measures.
• When legally required, we may also disclose customers’ personal information under the following circumstances:
• Where required by applicable laws, regulations, stock exchange listing rules or court orders;
• Where requested by any government authorities or law enforcement agents; or
• Where we reasonably believe that such disclosure is necessary to protect our legal rights, interests, properties, or those of others.

5. How We Transfer Data Across Borders
Due to our operational and business needs, your personal information may be transferred across borders to locations outside your country/region of residence, including to the Permitted Recipients located in other jurisdictions where necessary for the purposes set out in this Privacy Policy.

Where we transfer customers’ personal information across borders, we will comply with the applicable laws and regulations, and will endeavors to:
• Implement the appropriate data protection measures to which we deem fit and necessary;
• Provide the relevant information to customers about the transfer where required; and
• obtain your separate consent where required.

6. How We Keep and Protect Personal Information
• We will not keep or store personal information for longer than necessary to fulfill the purposes for which it was collected. We determine retention periods based on factors including the nature and purpose of processing, legal and regulatory requirements, and business operational needs. Unless otherwise required by law, personal information may be anonymized upon expiry of the applicable retention period, unless otherwise required by applicable law.
• We endeavor to maintain the appropriate administrative, technical, and physical safeguards designed that we deem fit and necessary, to protect customers’ personal information against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, leakage or use of the customers’ personal information. These safeguards may include access controls, encryption technologies, security audits, and other appropriate technical and organizational measures.  
• In the event of a privacy incident or data breach, we will take reasonable measures and, where required by the applicable laws and regulations, report the incident to the relevant regulatory authorities.  To the extent reasonably practicable and/or required by the applicable laws and regulations, we may also notify you of such incident through the contact information you have provided or by other reasonable and effective means of communication.

7. How We Respond to Your Requests
You may contact us to make a written request for the following matters:-
• access and obtain a copy of your personal information (where administration fee or photocopying charges may be imposed for such request)
• correct or supplement inaccurate personal information
• request deletion of your personal information (subject to applicable legal requirements)
• withdraw consent for direct marketing
We will process your requests as soon as reasonably practicable in the circumstances, and also in accordance with the applicable laws and regulations.

8. Core Membership Service Notifications and Direct Marketing Communications
(This section does not apply to residents and individuals located in the People’s Republic of China, excluding the Hong Kong Special Administrative Region, the Macao Special Administrative Region, and Taiwan. Please refer to Appendix I, Section 4.)

8.1. Core Membership Service Notifications
Core membership service functions and features rely on automated processing, which is essential to the provision of membership services. This includes membership benefits promised at the time of registration and service notifications relating to membership status.

8.2. Direct Marketing Communications
Your personal information may be used for direct marketing purposes, and we will may obtain your separate consent, in accordance with the applicable laws and regulations, before doing so.

Direct marketing materials may relate to our goods and services, marketing activities and promotional programs in hotels and hospitality, travel and tour, transportation, retail and shopping, entertainment shows and events, and food and beverage sectors, including without limitation, our hotels, restaurants, spas, retail shops, cinemas, shows, events, package reservations, and other entertainment-related offers from time to time.

If you no longer want your personal information to be used for direct marketing purposes, you may contact us using the contact details set out in the “How to Contact Us” section below.

9. Our Age Policy
We may collect personal information of minors and contractually incapacitated individuals where necessary, in which we will obtain consent from their legal guardians. You may also contact us in writing to request for deletion of personal information relating to minors and contractually incapacitated individuals.

10. Policy Updates
To the extent that any inconsistencies between the English and the Chinese versions of this Privacy Policy, the English version shall prevail.

We may change this Privacy Policy from time to time.  If required by the applicable laws and regulation, we will notify you of the changes by posting a notice on Our Official Online Channels or by other appropriate means we deem fit.

We encourage you to check this Privacy Policy from time to time to ensure that you are fully aware of the most updated version.

11. How to Contact Us
If you have any comments, opinions, concerns, or questions about the way we use your personal information, please email us at info@galaxyentertainment.com or contact our Customer Relations Hotline at +853 2888 0888.
 
 
Appendix I : Special Provisions for Mainland China Users
Galaxy Market Information Technology (Shenzhen) Co., Ltd. and Successful Richness Limited (being the subsidiaries of Galaxy Entertainment Group Limited who owns Galaxy Resort Macau, StarWorld Hotel and Broadway Macau situated in Macau SAR) (collectively referred to as the “Company”, “we”, “us”, or “our”) is committed to protecting your personal information.

For residents of China and individuals located in Mainland China, we have prepared this Appendix in accordance with the Personal Information Protection Law of the People’s Republic of China (“PIPL”).

To the extent that any material or substantive conflict between this Appendix and the Privacy Policy, the provisions of this Appendix shall prevail.

1. Sensitive Personal Information
We may process the following categories of sensitive personal information (under reasonable circumstances where applicable):
• Financial account and payment information
• Identification document information
• Travel itinerary and location information
• Biometric information
• GPS location information
Before processing your sensitive personal information:
• We may obtain your separate consent
• Clearly inform you of the necessity and potential impact of such processing
• Implement strict security protection measures

The Personal Information Protection Law of the People's Republic of China (“PIPL”) imposes enhanced requirements on the processing of sensitive personal information, which refers to personal information that, once disclosed or unlawfully used, may cause harm to an individual's personal dignity or personal and property security. We only process sensitive personal information where necessary to provide services, protect your health or financial security, or fulfil our legal obligations. We will implement adequate security measures to protect sensitive personal information and prevent unauthorized access or use.

According to the definition under the PIPL, the sensitive personal information that we may process for the purposes set out in this Privacy Policy includes:
• Financial Account Information: such as payment card information used for hotel reservations, expiration dates, and security codes;
• Travel Itinerary Information: such as travel arrival and departure information, flight numbers and details, points of origin and destination, and geolocation information in or outside China;
• Biometric Information: We may use facial recognition or other technologies in our Macau properties for security management purposes. Where required by applicable law of certain jurisdictions, we may obtain your separate consent before processing such information. If you choose not to provide the relevant biometric information, we will provide to you reasonable alternative methods of verification.

2. How We Collect Information
We may collect your data through the following methods:
• Information provided directly by you (for example, when you register an account or create a profile, enroll as a member, contact us, respond to surveys, make reservations, or submit enquiries).
• Information collected automatically (for example, we may use “cookies” or other technologies to collect certain technical information from your computer or device, which may include:)
o Browser details (such as Internet Protocol (IP) address and browser type);
o Device details (such as device model, MAC address, advertising identifier, and operating system);
o Location information from your device;
o A “cookie” is a text file placed in your internet browser. Some cookies are sent directly by us, and others are sent by third parties, such as advertising and analytics service providers.  Please refer to our Cookie Notice for more details.
• Information obtained from partners and service providers (for example, travel agencies, payment processors, event ticketing providers, and marketing/analytics service providers).
• We normally do not collect or process information relating to ethnic origin, politics, religion, health conditions, or sexual orientation

3. Purposes for Processing Personal Information
3.1 Purposes of Processing
• Core Services (Required)
           o Reservation processing
           o Payment and settlement
           o Membership account administration
           o Customer support
           o Service optimization and analytics
If you refuse to provide the relevant information, you will not be able to use the above functions.
• Value-Added Services (Optional)
           o Personalized recommendations
           o Service optimization and analytics
If you refuse to provide the relevant information, you may not be able to use the relevant value-added functions, but this will not affect your access to core services unless the information is necessary for those services.
• Marketing Purposes (Subject to Consent)
           o Sending promotional offers and information
           o Delivering customized marketing content
You may withdraw your consent at any time.
Where required by applicable laws and regulations, we will inform you whether the requested personal information is necessary for the relevant goods, services or functions, and the possible consequences if you choose not to provide such information.

3.2 Circumstances Where We May Process Your Personal Information
We may process your personal information in the following circumstances, as permitted by applicable laws and regulations:
• Where necessary for the formation or performance of a contract (such as reservations and membership services)
• Where necessary to comply with legal obligations or regulatory requirements (such as anti-money laundering requirements)
• Based on your consent (such as for marketing purposes)
• Where necessary to protect the life, health, or property of natural persons in emergency situations
• Information that has been lawfully made public
• Where necessary to ensure network and transaction security (such as security protection and fraud prevention)

4. Cross-Border Data Transfers
• Your personal information may be transferred, remotely accessed, consulted, viewed or processed by personnel located outside Mainland China . The recipient in Macau is: Successful Richness Limited and/or its affiliates in Galaxy Entertainment Group; Address: Galaxy Resort, Estrada da Baía de Nossa Senhora da Esperança, Macau Special Administrative Region; Contact Number: +853 2888 0888.
• We will implement protective measures in accordance with applicable laws and obtain your separate consent where required.
• The purposes and categories of personal information involved in cross-border data transfers are as follows:
 

For all cross-border transfers of personal information, we will implement protection measures that comply with applicable legal requirements. Where necessary, to the extent required by the applicable law and regulations, we will inform you of the overseas recipient's name, contact information, processing purposes, processing methods, categories of personal information involved, and the methods and procedures for exercising your rights against the overseas recipient, and may obtain your separate consent.
In addition, when your data is accessed or processed outside the People's Republic of China, we have implemented security measures, including encryption, to safeguard the security and confidentiality of your data.

5. Third-Party SDK
SDK Name: “Zhuge Intelligence”
Purpose of Data Collection: To better understand user preferences and optimize services.
Use Scenario: Analysis of collected event information.
Data Types: WeChat Union ID, membership account number, device account number, and user click events.
Zhuge Intelligence Privacy Policy: Zhuge Intelligence Privacy Policy

6. Marketing
If you withdraw your consent to receive direct marketing notifications, we will cease the corresponding direct marketing notification activities; however, this will not affect your right to continue using our core membership services. Withdrawal of consent for direct marketing activities will not affect core membership services, and you will continue to enjoy the membership benefits designated at the time of registration.

6.1 Core Membership Service Notifications and Marketing Activities
Core membership service notification and marketing functions rely on automated processing, which is essential for providing membership services. These functions include activities and benefits promised to you when you registered as a member, such as offers, cashback, membership promotional benefits, and notifications related to your membership status.

We will not refuse to provide core membership services because you do not consent to receive marketing communications.

6.2 Direct Marketing Communications
Your personal information may be used for direct marketing purposes, and we may obtain your separate consent before doing so, in accordance to applicable law and regulation.

Direct marketing materials may relate to goods and services in the hospitality, travel, transportation, retail, entertainment, and food and beverage sectors. They may also include restaurants, cinemas, shows, events, package reservations, and other entertainment arrangements, as well as marketing activities and promotional programs relating to any other goods and services that we may provide to you from time to time.

If you no longer wish your personal information to be used for direct marketing purposes, please write to us or send an email to info@galaxyentertainment.com to inform us that you no longer want your personal information to be used for the above purposes.

We will not refuse to provide core membership services because you decline direct marketing communications.

We will process such requests in three (3) business days and will confirm completion by email.

You may also contact our customer service team by telephone, email, or other available channels at any time to exercise your rights and unsubscribe from direct marketing communications.

7. Information Sharing
To provide you with goods and/or services, you consent to provide your personal information to us or to our Permitted Recipients (for the purposes of entering into and performing contracts or orders with you, or for other purposes set out in this Privacy Policy).
At the same time, we will inform you of the recipient’s name, contact details, purpose of processing, method of processing, and categories of personal information involved.

In addition, you consent to our processing of such information for the purposes set out in this Privacy Policy and disclose your personal information to the Permitted Recipients located in other jurisdictions.

We will contractually seek such third parties to:
• Process your personal information only in accordance with our instructions;
• Not use your personal information beyond the authorized scope; 
• Adopt appropriate confidentiality and security protection measures; and
• Not transfer your personal information to any other party.
Where required, we will may obtain your separate consent in accordance with applicable laws of the jurisdiction before disclosing your personal information to recipients in other jurisdictions.

8. Deletion of Information
We will proactively delete or anonymise the personal information you have provided to us under any of the following circumstances:
▪ The purpose of processing has been achieved, cannot be achieved, or is no longer necessary to achieve such purpose;
▪ We cease providing the relevant goods or services, or the retention period has expired;
▪ You withdraw your consent;
▪ Other circumstances as required by applicable laws and regulations.
Where the retention period prescribed by applicable laws, regulations, or company policies has not expired, or where deletion of personal information is technically impracticable, we will cease all processing activities other than storage and the implementation of necessary security protection measures.

9. Exercising Data Subject Rights
If you are a Mainland China member and have any comments, opinions, concerns, or questions about the way we use your personal information, please contact us by: 
email: info@galaxyentertainment.com
Customer Relations Hotline: +853 2888 0888.