Privacy Policy

Introduction

YHA Ltd (trading as YHA Australia) (ABN: 94 008 387 791), together with its related bodies corporate and YHA branded hostels in Australia (collectively, YHA, we, us, our) respect the importance of protecting your privacy. We comply with applicable privacy laws, including the Privacy Act 1988 (Cth) including the Australian Privacy Principles, as well as the EU and UK General Data Protection Regulation.

YHA offers a range of member services including an Australia-wide network of hostels and accommodation services, YHA Travel & Tours, and an extensive member discount program. YHA is part of the world's largest backpacker accommodation network, Hostelling International (HI).

We understand that you care about the collection, use, disclosure and handling (Processing) of your personal information and we value your trust in allowing us to do this in a careful and sensible manner.

This Privacy Policy describes how YHA Processes your personal information. By visiting our website, our hostels or otherwise interacting with us, you agree to us Processing your personal information in accordance with this Privacy Policy.

We will update this Privacy Policy when our information handling practices change, or when required. Any revised Privacy Policy will take effect when it is published on our website and your continued use of our website or services will constitute your agreement to those changes. Please note that any websites that may be linked to our website are subject to their own privacy policy.

Information we collect

“Personal information” or “personal data” is any information about you, from which you can be identified. Our Processing of your personal information will depend on our relationship with you, the circumstances of collection and the types of products and services you request from us. We may collect additional personal information from you from time to time.

We may collect personal information in the following circumstances:

Directly from you – When you make or manage bookings for accommodation directly with us, check-in to our accommodation online or at our hostels, stay at our accommodation, become a member of YHA, purchase travel products such as travel vouchers online, register and use our online services, manage your YHA profile online, sign up to our updates or newsletters, respond to offers from us and our partners, enter a competition or giveaway, make an enquiry, respond to our surveys or provide feedback or comments, attend our office or hostels including via sign-in and security surveillance of our premises, use the wi-fi at our premises or otherwise interact with us or provide your personal information to us.

Personal information may include your name, address, email address, date of birth, gender, telephone number, photo, nationality, YHA or HI membership number, accommodation reviews you provide on our website, reservation details, information particular to your stay such as dates, duration and location, and any other specific requirements you nominate to tell us.

Indirectly from the primary guest – When a primary guest makes or manages bookings for accommodation, or checks-in online on your behalf, we may collect your name, address, email address, date of birth, gender, telephone number, nationality and YHA or HI membership number. Where you give us personal information on behalf of someone else, you confirm that you have provided them with the information set out in this Privacy Policy and they have not objected to our handling, use and disclosure of their personal information.

Indirectly from third parties – There may be occasions when we may collect personal information about you from publicly available sources and third parties including travel agents or partners you make booking accommodations through. Where we receive personal information about you from third parties, we require that the third party complies with applicable laws including privacy laws.

If you provide us with information about other individuals, sucha as when making a booking on someone's behalf irrespective of whether you are travelling together, you are responsible for telling those individual(s) and letting them know that they can find a copy of this Privacy Policy on our website.

Information about minors – We do not knowingly collect personal information directly from any person we know is under the age of 17. We do not allow any persons under the age of 17 to be the primary guest and book accommodation. As part of the booking and check-in process, we may collect personal information about persons under the age of 17 indirectly from parents or other adults they travel with who are the primary guest. Where we collect personal information about persons under the age of 17 in any other circumstances, we may seek or require consent from a parent or guardian where YHA considers this is appropriate.

Sensitive information – We generally do not ask for, or collect sensitive information about you, unless you provide it to us voluntarily. For example, when you make a booking or interact with one of our staff, you may voluntarily provide sensitive information such as racial or ethnic origin, sexual orientation, health information or religious or philosophical beliefs. If you do provide sensitive information to us voluntarily, you consent to us collecting this information. If we require sensitive information to provide you our services, we will ask for your consent.

Government related identifiers - From time to time we may collect 'government related identifiers' as defined under the Privacy Act. Examples of government related identifiers include driver's licence number and a Passport number. We only collect government related identifiers to verify your identity to ensure the safety of our guests.

What if you don’t want to give us your information

You don’t have to give us all the information we request. You may engage with us anonymously or using a pseudonym if it is feasible to do so. For example, if you wish to give feedback without requiring a response from us, you won’t need to provide a full name or email address.

However, if you do not provide us with some or all of the personal information required, we may not be able to provide you with the products and services or information you request, to the requested standard or at all, and you may also miss out on receiving valuable information about us and our products and services. For example, we collect some of your personal information on check-in by taking a photo of you or taking a photo of your ID to verify your identity. If you do not wish to have your photo taken or your photo ID to be scanned, we will still need to sight the details on your photo ID and manually record the information. As you will stay in a shared environment with other guests it is important that we know who is in our hostel at all times to ensure maximum safety and security for all guests. If you do not consent to having your photo taken or providing photo ID upon check-in you will not be able to stay with us.

We also keep a copy of the photo, so we can use it to identify you the next time you check in to one of our accommodations. If we do not have a copy of your photo, it may be necessary to sight your photo ID each time you check in to verify your identity.

How we use cookies and similar technologies

What are cookies and similar technologies – Cookies are text files which are downloaded to your device when you visit a website. Cookies are used to describe a range of technologies including web beacons and server logs used in desktop software or mobile devices. We will use the term “cookies” throughout this Policy to cover all these technologies.

We collect general information from your device when you use our website and application. This might include your geo-location, IP address, device identifier, the browser and operating system you are using, and details of website that IP address has come from, the pages accessed on our website and the next website visited.

Types of cookies and how we use them – There are different types of cookies that perform different functions, like letting you navigate between pages efficiently, remembering your preferences, and ensuring the ads that you see online are more relevant to you and your interests. We (and authorised service providers) use the following types of cookies:

How to withdraw consent to cookies or amend your cookie preferences – If you want to prevent cookies being used, you can change your browser or application settings to disable cookies or to notify you when you receive a new cookie. However, you may not be able to access all or parts of our website or application, or you may experience reduced functionality when accessing certain services (for example, automatic login may not function properly).

• Browser Cookies: If you no longer wish to receive cookies you can use your web browser settings to accept, refuse or delete cookies. To do this, go to “Settings” and then “Privacy”. Note that different browsers will have different procedures.
• Mobile Identifiers: On your mobile device, your operating system may provide you with additional options to opt out of interest based advertising or to otherwise reset your mobile identifiers. For example, you may use the “Limit Ad Tracking” setting (on iOS devices) or a setting to “Opt out of Interest-Based Ads” (on Android) which allows you to limit the use of information about your use of apps for purposes of serving ads targeted to your interests.
• Interest-Based Advertising: Certain targeted advertisements that we (or a service provider acting on our behalf) display to you based on information about your online activities across websites and other interactive properties operated by third parties may include the “Ad Choices” icon or another mechanism to opt out of receiving interest-based advertisements. You may click on the AdChoices icon or visit www.aboutads.info to receive more information about the collection and use of information about your online activities for interest based advertising or to learn how to opt out of having your data used for interest based advertising by Digital Advertising Alliance (DAA) participating companies. Australia users can also visit https://www.youronlinechoices.com.au/. European users can also visit https://www.youronlinechoices.eu/.   

Third-party service providers may have their own privacy policies in relation to their cookies and tools that YHA cannot control. Please check the third-party websites for more information about their cookies and how to manage them.

Why do we process your information?

We Process your personal information so that we can perform our functions and activities such as to provide you accommodation booking and membership services and to evaluate and improve our services. We will not use or disclose sensitive information without your consent.

 We may Process your personal information for the following purposes:

1. Provide and administer our products and services including YHA memberships, travel products, processing bookings, check-ins and cancellations, processing payments or managing your profile;
2. Ensure safety and security for all guests at our accommodation including through verifying your identity;
3. Provide customer support and seek and publish feedback as reviews including through conducting surveys and investigating and responding to your queries and comments;
4. Operate our competition and promotions including determining entry eligibility, awarding prizes and publishing or otherwise making available a list of prize winners;
5. Conduct marketing and advertising activities, including displaying content on our website and app and serving display advertising on third party websites and apps;
6. Provide information about our products and services, including through distributing newsletters and other communication on information about us and our related services, your YHA profile and your use of our services;
7. Provide information about your YHA membership, including through distributing newsletters and other communication on updates on your membership benefits, invitations to participate in governance aspects of YHA such as board elections, Annual General Meetings, and changes to the YHA Constitution;
8. Perform data analyses, research and generate aggregated customer and market trends, statistics and insights and commercialising such aggregated information, which may be a result of combining de-identified information collected from you and other customers;
9. Develop and improve our products and services, including our website and to provide a more personalised service before, during and after your stay;
10. Manage and carry out our business and operational functions, including HR management, business decisions and technical operations;
11. Maintain our records and complying with our legal obligations; and
12. For any other purpose disclosed at the time the information is collected or to which you consent.

We must be able to identify the legal basis on which we Process your information. These are if Processing is:

• Necessary to fulfil a contract, such as website terms or booking contract that we have in place with you, for the purposes set out in points 1, 2, 3, 4, 6, 7 and 12 above;
• Necessary for our legitimate interests, such as the Processing for the purposes set out in points 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 and 12 above, unless consent is required under applicable law;
• With your consent, such as the Processing for the purposes set out in points 6 and 12 above, where such consent is required under applicable law;
• Necessary for compliance with a legal obligation to which we are subject, such as the Processing for the purposes set out in point 11 above; and
• Any other applicable legal grounds for Processing.

Direct marketing

YHA may, from time to time, send direct marketing communications to you about our activities and services and other material that we consider you would find interesting or useful. If you do not wish to receive such direct marketing communications, you can always opt out. If you are receiving email communications from us, there will be a mechanism to opt out contained in each of those emails. If you subscribe to YHA email newsletters or have created a YHA profile, you can also log in to the YHA website and change your preferences on the email preferences page. You can disable push notifications on our app by changing the notification setting on your mobile device or through the app. To stop receiving other communications from us, you can contact us via any of the channels listed below.

If you choose to opt out of all direct marketing communications, please note that YHA may still contact you for other reasonable purposes, including information that YHA is legally required to send, information about your reservation, your YHA membership, notifications of changes to YHA services or policies and information regarding the use, rights, benefits or obligations of users of our services.

How we share your information

We may disclose your personal information to third parties in accordance with the applicable law and for the purposes listed above, including:

• To third party operators and providers of ‘travel deals’, including tours and attractions you have booked;
• To sponsors and partners when you enter a competition or promotion;
• To HI when you become a HI member;
• When we may be required by law from time to time; and
• To any other third party where you have provided your consent.

We may also disclose personal information to third parties such as our contractors, suppliers, agents and service providers who help us deliver, administer and support our functions and activities, including:

• Hosting our servers and website;
• Delivering marketing and digital marketing services;
• Serving advertising;
• Conducting data analysis and data matching services;
• Conducting market research, surveys and analysis;
• Providing IT services;
• Data processing, storage and back-up; and
• Processing payments.

International disclosures

Some of the third parties we disclose your personal information to may be based or have servers located overseas in various countries, including Europe, USA and the UK. Before we disclose your information to our overseas recipients, we will take all reasonable steps to ensure that your information is only Processed for authorised purposes and adequately protected using the appropriate technical, organisational, contractual or other lawful means. You consent to us disclosing your personal information to overseas recipients on this basis.

Non-Australian resident data

YHA is based in Australia and our servers are located in Australia. If you are located outside of Australia, please be aware that any information you provide to us, will be transferred from your country of origin to Australia. Your decision to provide such information to us or allow us to collect such information constitutes your consent to this information transfer.

How we hold your information and keep it secure

YHA takes the security of your personal information seriously and we implement a range of technical, administrative and physical measures to safeguard your information from misuse, interference, loss and unauthorised access, modification or disclosure, including electronic and physical access restrictions to files containing personal information and ensuring encryption of personal information sent and received.

We do not store your credit card information.

We require that all third parties, to whom we disclose personal information or who may have access to personal information, to have appropriate controls to protect your personal information in a manner that is consistent with our Privacy Policy, including in relation to security and confidentiality. They must only Process your personal information for authorised purposes.

How long do we keep your personal information?

Your personal information will be retained for as long is reasonably necessary for the purposes listed above or as required by applicable law If we no longer need your personal information, we will ensure that it is either destroyed or de-identified. We may keep the de-identified form of your personal information for statistical purposes without time limits, to the extent permitted by law.

Your rights of access and correction of your information

It is important to us that the information we hold about you is up-to-date, accurate and complete, and we will try to confirm your details through our communications with you and promptly add updated or new personal information to existing records when we are advised. If any of your details change, please notify us as soon as you can or log into your online profile to update it. If you believe we are holding information about you that is inaccurate, incomplete, irrelevant or misleading, you can ask us to correct it, or delete it altogether.

If you would like to access your personal information, or ask us to update, correct or delete it, you can do so by contacting us in writing and verifying your identity. We will do our best to respond to your request within 30 days.

We will only refuse access in exceptional circumstances, and if this is the case, we will advise you of our reasons for doing so.

We may charge a fee for searching for, and providing access to, your information on a per request basis.

Rights of individuals located in the European Economic Area and the UK

Under applicable data protection laws, individuals who are in the European Economic Area and the UK have additional rights.

In accordance with applicable data protection law:

• You are entitled to know what personal information we hold about you and you may ask us to make any necessary changes to ensure that it is accurate, up to date and complete;
• You may request for us to restrict or object to the processing of personal information, including automated processing and profiling;
• You may request that we delete personal information we hold about you, unless there is a lawful reason for us not to do so such as if retention is necessary for us to comply with our legal obligations; and
• In some circumstances, you may request that we provide the personal information (that you have provided to us) to you in a structured, commonly used and machine-readable format and have it transferred to another provider of the same or similar services.

If you wish to exercise any of your rights, you can do so by contacting us in writing and verifying your identity. We will do our best to respond to your request within 30 days.

We will only refuse your request in exceptional circumstances and in accordance with the applicable law, and if this is the case, we will advise you of our reasons for doing so.

In some countries, we may charge a fee for searching for, and providing you with details of the information we hold about you.

Complaints

We take your complaints seriously and we will attempt to resolve any issues quickly and fairly. If you think that an act or practice of YHA has interfered with your privacy in relation to your personal information, you can contact us using the details below.

If we cannot resolve your complaint to a satisfactory standard, you are entitled to lodge your complaint:

• With the Office of the Australian Information Commissioner at: http://www.oaic.gov.au; or
• For residents of the European Economic Area and the UK, with the relevant supervisory authority. If you are based in the UK, this is the UK's Information Commissioner's Office. If you are based in the European Economic Area, a list of EU national data protection authorities can be found on the European Commission website at: https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection_en.

Other websites

From time to time, our website may contain links to other companies' websites or materials. If you choose to access such third-party websites, our Privacy Policy will not apply, and the privacy policy and terms of the third-party website will apply instead.

Our contact details

If you require any further information or have any questions or comments about this Privacy Policy or if you wish to exercise your rights or make a complaint about our handling of that information, please contact our Privacy Officer in writing as follows:

Email: privacy@yha.com.au - this email is the quickest way to exercise your rights or get in touch with YHA to resolve any questions, complaints or deletion requests. We generally attempt to respond to your questions and comments within 72 hours.

Post (Australia):
Privacy Officer
YHA Australia
GPO Box 5276
Sydney NSW 2001
Australia

If you reside in the European Union or United Kingdom, you may alternatively contact our representative (as applicable) - DataRep

Portal: www.datarep.com/yhaaustralia

Email: yhaaustralia@datarep.com

Last Updated: 19 October 2022