Privacy

Introduction

YHA Ltd (trading as YHA Australia) (ABN: 94 008 387 791), together with its related bodies corporate and YHA branded hostels in Australia (collectively, YHA, we, us, our) respect the importance of protecting your privacy. 

YHA offers a range of member services including an Australia-wide network of hostels and accommodation services, YHA Travel & Tours, and an extensive member discount program. YHA is part of the world’s largest backpacker accommodation network, Hostelling International (HI). 

We understand that you care about the collection, use, disclosure and handling (Processing) of your personal information and we value your trust in allowing us to do this in a careful and sensible manner. 

This Privacy Policy describes how YHA Processes your personal information. By visiting our website, our hostels or otherwise interacting with us, you agree to us Processing your personal information in accordance with this Privacy Policy. 

We will update this Privacy Policy when our information handling practices change, or when required. Any revised Privacy Policy will take effect when it is published on our website and your continued use of our website or services will constitute your agreement to those changes. Please note that any websites that may be linked to our website are subject to their own privacy policy. 

Information we collect

“Personal information” or “personal data” is any information about you, from which you can be identified. Our Processing of your personal information will depend on our relationship with you, the circumstances of collection and the types of products and services you request from us. We may collect additional personal information from you from time to time. 

We may collect personal information in the following circumstances: 

Directly from you – When you make or manage bookings for accommodation directly with us, check-in to our accommodation online or at our hostels, stay at our accommodation, become a member of YHA, purchase travel products such as travel vouchers online, register and use our online services, manage your YHA profile online, sign up to our updates or newsletters, respond to offers from us and our partners, enter a competition or giveaway, make an enquiry, respond to our surveys or provide feedback or comments, attend our office or hostels including via sign-in and security surveillance of our premises, use the wi-fi at our premises or otherwise interact with us or provide your personal information to us. 

Personal information may include your name, address, email address, date of birth, gender, telephone number, photo, nationality, YHA or HI membership number, accommodation reviews you provide on our website, reservation details, information particular to your stay such as dates, duration and location, and any other specific requirements you nominate to tell us. 

Indirectly from the primary guest – When a primary guest makes or manages bookings for accommodation, or checks-in online on your behalf, we may collect your name, address, email address, date of birth, gender, telephone number, nationality and YHA or HI membership number. Where you give us personal information on behalf of someone else, you confirm that you have provided them with the information set out in this Privacy Policy and they have not objected to our handling, use and disclosure of their personal information. 

Indirectly from third parties – There may be occasions when we may collect personal information about you from publicly available sources and third parties including travel agents or partners you make booking accommodations through. Where we receive personal information about you from third parties, we require that the third party has provided you with the information set out in this Privacy Policy, has collected and disclosed that information with your knowledge or consent and ensure you have not objected to our Processing of your personal information. 

Information about minors – We do not knowingly collect personal information directly from any person we know is under the age of 17. We do not allow any persons under the age of 17 to be the primary guest and book accommodation. As part of the booking and check-in process, we may collect personal information about persons under the age of 17 indirectly from parents or other adults they travel with who are the primary guest. Where we collect personal information about persons under the age of 17 in any other circumstances, we may seek or require consent from a parent or guardian where YHA considers this is appropriate. 

Sensitive information – We generally do not ask for, or collect sensitive information about you, unless you provide it to us voluntarily. For example, when you make a booking or interact with one of our staff, you may voluntarily provide sensitive information such as racial or ethnic origin, sexual orientation, health information or religious or philosophical beliefs. If you do provide sensitive information to us voluntarily, you consent to us collecting this information. 

What if you don’t want to give us your information

You don’t have to give us all the information we request. You may engage with us anonymously or using a pseudonym if it is feasible to do so. For example, if you wish to give feedback without requiring a response from us, you won’t need to provide a full name or email address. 

However, if you do not provide us with some or all of the personal information required, we may not be able to provide you with the products and services or information you request, to the requested standard or at all, and you may also miss out on receiving valuable information about us and our products and services. For example, we may collect some of your personal information on check-in by scanning your photo ID to verify your identity. If you do not wish your photo ID to be scanned, we still need to sight it and manually record the information. As you will stay in a shared environment with other guests it is important that we know who is in our hostel at all times to ensure maximum safety and security for all guests. If you do not provide photo ID upon check-in you will not be able to stay with us. 

We also keep a scanned copy of your photo, so we can use it to identify you the next time you check in to one of our accommodations. If we do not have a scanned copy of your photo, it may be necessary to sight your photo ID each time you check in to verify your identity. 

How we use cookies and similar technologies

We collect general information from your device when you use our website and application. This might include your geo-location, IP address, device identifier, the browser and operating system you are using, and details of website that IP address has come from, the pages accessed on our website and the next website visited. 

We (and authorised service providers) also use cookies and tools, such as web beacons and web server logs to monitor visitor traffic and actions on our website. Cookies are small data files placed on your computer that allows our website to “remember you” when you return to our website. These cookies and tools are not used to record personal information but are only used to identify generic preferences and behavioural patterns of how our website and online resources are being used. 

We may use and combine information collected using cookies and tools with information we already have about you to maintain, secure and improve our website, enhance your experience when using our website, display and deliver relevant information and advertising (including direct marketing and targeted ads on third party websites and social media sites) and understand the effectiveness of our marketing and advertising. 

If you want to prevent cookies being used, you can change your browser settings to disable cookies or to notify you when you receive a new cookie. However, you may not be able to access all or parts of our website, or you may experience reduced functionality when accessing certain services (for example, automatic log in may not function properly). For more information, visit www.youronlinechoices.com.au. Third party service providers may have their own privacy policies in relation to their cookies and tools. 

Why do we process your information?

We Process your personal information so that we can perform our functions and activities such as to provide you accommodation booking and membership services and to evaluate and improve our services. We will not use or disclose sensitive information without your consent. 

We may Process your personal information for the following purposes: 

1. Provide and administer our products and services including YHA memberships, travel products, processing bookings, check-ins and cancellations, processing payments or managing your profile;
2. Ensure safety and security for all guests at our accommodation including through verifying your identity;
3. Provide customer support and seek and publish feedback as reviews including through conducting surveys and investigating and responding to your queries and comments;
4. Operate our competition and promotions including determining entry eligibility, awarding prizes and publishing or otherwise making available a list of prize winners;
5. Conduct marketing and advertising activities, including displaying content on our website and app and serving display advertising on third party websites and apps;
6. Provide information about our products and services, including through distributing newsletters and other communication on information about us and our related services, your YHA profile and your use of our services;
7. Provide information about your YHA membership, including through distributing newsletters and other communication on updates on your membership benefits, invitations to participate in governance aspects of YHA such as board elections, Annual General Meetings, and changes to the YHA Constitution;
8. Perform data analyses, research and generate aggregated customer and market trends, statistics and insights and commercialising such aggregated information, which may be a result of combining de-identified information collected from you and other customers;
9. Develop and improve our products and services, including our website and to provide a more personalised service before, during and after your stay;
10. Manage and carry out our business and operational functions, including HR management, business decisions and technical operations;
11. Maintain our records and complying with our legal obligations; and
12. For any other purpose disclosed at the time the information is collected or to which you consent. 

We must be able to identify the legal basis on which we Process your information. These are if Processing is: 

• Necessary to fulfil a contract, such as website terms or booking contract that we have in place with you, for the purposes set out in points 1, 2, 3, 4, 6, 7 and 12 above;
• Necessary for our legitimate interests, such as the Processing for the purposes set out in points 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 and 12 above, unless consent is required under applicable law;
• With your consent, such as the Processing for the purposes set out in points 6 and 12 above, where such consent is required under applicable law;
• Necessary for compliance with a legal obligation to which we are subject, such as the Processing for the purposes set out in point 11 above; and
• Any other applicable legal grounds for Processing. 

Direct marketing

YHA may, from time to time, send direct marketing communications to you about our activities and services and other material that we consider you would find interesting or useful. If you do not wish to receive such direct marketing communications, you can always opt out. If you are receiving email communications from us, there will be a mechanism to opt out contained in each of those emails. If you subscribe to YHA email newsletters or have created a YHA profile, you can also log in to the YHA website and change your preferences on the email preferences page. You can disable push notifications on our app by changing the notification setting on your mobile device or through the app. To stop receiving other communications from us, you can contact us via any of the channels listed below. 

If you choose to opt out of all direct marketing communications, please note that YHA may still contact you for other reasonable purposes, including information that YHA is legally required to send, information about your reservation, your YHA membership, notifications of changes to YHA services or policies and information regarding the use, rights, benefits or obligations of users of our services. 

How we share your information

We may disclose your personal information to third parties in accordance with the applicable law and for the purposes listed above, including: 

• To third party operators of ‘travel deals’ you have booked;
• To sponsors and partners when you enter a competition or promotion;
• To HI when you become a HI member;
• When we may be required by law from time to time; and
• To any other third party where you have provided your consent. 

We may also disclose personal information to third parties such as our contractors, suppliers, agents and service providers who help us deliver, administer and support our functions and activities, including: 

• Hosting our servers and website;
• Delivering marketing and digital marketing services;
• Serving advertising;
• Conducting data analysis and data matching services;
• Conducting market research, surveys and analysis;
• Providing IT services;
• Data processing, storage and back-up; and
• Processing payments. 

International disclosures

Some of the third parties we disclose your personal information to may be based or have servers located overseas in various countries, including USA and the UK. Before we disclose your information to our overseas recipients, we will take all reasonable steps to ensure that your information is only Processed for authorised purposes and adequately protected using the appropriate technical, organisational, contractual or other lawful means. You consent to us disclosing your personal information to overseas recipients on this basis. 

Non-Australian resident data

YHA is based in Australia and our servers are located in Australia. If you are located outside of Australia, please be aware that any information you provide to us, will be transferred from your country of origin to Australia. Your decision to provide such information to us or allow us to collect such information constitutes your consent to this information transfer. 

How we hold your information and keep it secure

YHA takes the security of your personal information seriously and we implement a range of technical, administrative and physical measures to safeguard your information from misuse, interference, loss and unauthorised access, modification or disclosure, including electronic and physical access restrictions to files containing personal information and ensuring encryption of personal information sent and received. 

We do not store your credit card information. 

We require that all third parties, to whom we disclose personal information or who may have access to personal information, to have appropriate controls to protect your personal information in a manner that is consistent with our Privacy Policy, including in relation to security and confidentiality. They must only Process your personal information for authorised purposes. 

How long do we keep your personal information?

Your personal information will be retained for as long is reasonably necessary for the purposes listed above or as required by applicable law If we no longer need your personal information, we will ensure that it is either destroyed or de-identified. We may keep the de-identified form of your personal information for statistical purposes without time limits, to the extent permitted by law. 

Your rights of access and correction of your information

It is important to us that the information we hold about you is up-to-date, accurate and complete, and we will try to confirm your details through our communications with you and promptly add updated or new personal information to existing records when we are advised. If any of your details change, please notify us as soon as you can or log into your online profile to update it. If you believe we are holding information about you that is inaccurate, incomplete, irrelevant or misleading, you can ask us to correct it, or delete it altogether. 

If you would like to access your personal information, or ask us to update, correct or delete it, you can do so by contacting us in writing and verifying your identity. We will do our best to respond to your request within 30 days. 

We will only refuse access in exceptional circumstances, and if this is the case, we will advise you of our reasons for doing so. 

We may charge a fee for searching for, and providing access to, your information on a per request basis. 

Rights of residents of the European Economic Area and the UK

Under the applicable data protection law, residents of the European Economic Area and the UK have additional rights. 

In accordance with applicable data protection law: 

• You are entitled to know what personal information we hold about you and you may ask us to make any necessary changes to ensure that it is accurate, up to date and complete;
• You may request for us to restrict or object to the processing of personal information, including automated processing and profiling;
• You may request that we delete personal information we hold about you, unless there is a lawful reason for us not to do so such as if retention is necessary for us to comply with our legal obligations; and
• In some circumstances, you may request that we provide the personal information (that you have provided to us) to you in a structured, commonly used and machine-readable format and have it transferred to another provider of the same or similar services. 

If you wish to exercise any of your rights, you can do so by contacting us in writing and verifying your identity. We will do our best to respond to your request within 30 days. 

We will only refuse your request in exceptional circumstances and in accordance with the applicable law, and if this is the case, we will advise you of our reasons for doing so. 

In some countries, we may charge a fee for searching for, and providing you with details of the information we hold about you. 

Complaints

We take your complaints seriously and we will attempt to resolve any issues quickly and fairly. If you think that an act or practice of YHA has interfered with your privacy in relation to your personal information, you can contact us using the details below. 

If we cannot resolve your complaint to a satisfactory standard, you are entitled to lodge your complaint: 

• With the Office of the Australian Information Commissioner at:  http://www.oaic.gov.au; or
• For residents of the European Economic Area and the UK, with the relevant supervisory authority. A list of EU national data protection authorities can be found on the European Commission website at: https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection_en. 

Our contact details

If you require any further information or have any questions or comments about this Privacy Policy or if you wish to exercise your rights or make a complaint about our handling of that information, please contact our Privacy Officer in writing as follows: 

Email: privacy@yha.com.au  

Post (Australia):

Privacy Officer

YHA Australia

GPO Box 5276

Sydney NSW 2001 Australia

Last Updated 16 April 2018