Question 1

Introduction

Accepted Answer

YHA Ltd (trading as YHA Australia), together with its related bodies corporate and YHA and ModeByYHA branded properties in Australia, respects your privacy and complies with the Privacy Act 1988 (Cth), the Australian Privacy Principles, and where required the EU and UK General Data Protection Regulation. YHA offers member services including accommodation, YHA Travel & Tours, and member discounts, and is part of Hostelling International. This Privacy Policy describes how YHA collects, uses, holds, discloses and handles your personal information. By visiting our website, properties or otherwise interacting with us, you agree to this handling. We will update this policy when practices change or when required; continued use constitutes agreement to changes. Linked third-party websites have their own privacy policies.

Question 2

Information we collect

Accepted Answer

Personal information is information or an opinion about an identified or reasonably identifiable individual, whether or not it is true. We collect information depending on our relationship with you and the services you request. We may collect directly from you when you book or stay, become a member, purchase travel products, donate, use online services, subscribe to updates, enter competitions, make enquiries, respond to surveys, attend properties, use wi-fi or otherwise interact with us. This may include your name, address, email, date of birth, gender, phone, photo, nationality, membership number, reviews, reservation and stay details, and travel preferences. We may collect indirectly from a primary guest who books or checks in on your behalf, or from third parties such as travel agents, requiring them to comply with applicable privacy laws. If you provide information about others, you must tell them about this policy. We do not knowingly collect information directly from anyone under 17 and do not allow under-17s as primary guests; information about minors may be collected indirectly from accompanying adults. We generally do not ask for sensitive information unless you provide it voluntarily, in which case you consent to collection.

Question 3

What if you don’t want to give us your personal information?

Accepted Answer

You do not have to provide all personal information we request and may engage anonymously or using a pseudonym where feasible, such as when giving feedback without needing a response. However, if you withhold required information we may be unable to provide products, services or information to the requested standard, and you may miss valuable information about our offerings. At check-in, we take a photo of guests; without a photo we cannot provide shared co-living rooms or private rooms with shared bathrooms, though we may use stored photos to identify you on future check-ins. We sight photo identification and collect name, date of birth, address and nationality to verify identity; without this we cannot provide accommodation.

Question 4

How we use cookies and similar technologies

Accepted Answer

Cookies are text files and similar technologies including web beacons and server logs downloaded to your device when you visit our website or application. We collect general device information such as geo-location, IP address, device identifier, browser, operating system and pages accessed. We use necessary cookies essential to operate the site and process payments, functional cookies to remember preferences such as login and language (EU users consent via the cookies pop-up), and analytics cookies to understand usage and improve services, including Google Analytics. You can change browser or app settings to disable or notify you of cookies, though some functionality may be reduced. Browser cookie controls are under Settings and Privacy; mobile devices offer ad-tracking limits; interest-based advertising can be managed via AdChoices, aboutads.info, youronlinechoices.com.au or youronlinechoices.eu. Third-party providers may have their own cookie policies.

Question 5

Why do we process your information?

Accepted Answer

We process personal information to perform our functions such as providing accommodation booking and membership services and improving our services. We will not use or disclose sensitive information without consent. Purposes include administering products and services, ensuring guest safety and verifying identity, customer support and reviews, competitions and promotions, marketing and advertising, membership communications, data analysis and aggregated insights, developing and improving services, business operations, legal compliance, and other disclosed or consented purposes. Our legal bases include necessity to fulfil a contract, legitimate interests unless consent is required, consent where required, compliance with legal obligations, and other applicable grounds.

Question 6

Direct marketing

Accepted Answer

YHA may send direct marketing about our activities and services that we consider useful. You can opt out at any time via unsubscribe links in emails, by updating preferences on the YHA website email preferences page if you have a profile, by disabling push notifications on your device or app, or by contacting us through the channels listed in this policy. Even if you opt out of marketing, YHA may still contact you for legally required information, reservation details, membership information, service or policy changes, and information about use, rights, benefits or obligations of our services.

Question 7

How we share your information

Accepted Answer

We may disclose personal information to third parties in accordance with applicable law for the purposes listed in this policy, including travel deal operators for tours and attractions you booked, sponsors and partners for competitions, Hostelling International when you become a YHA member, when required by law, and where you have consented. We may also disclose to contractors, suppliers, agents and service providers who help deliver our functions, including hosting, marketing, advertising, data analysis, market research, IT services, data processing and storage, and payment processing.

Question 8

International disclosures

Accepted Answer

Some third parties we disclose personal information to may be based or have servers overseas in countries including Europe, the USA and the UK. Before disclosing to overseas recipients we take reasonable steps to ensure information is only processed for authorised purposes and adequately protected using appropriate technical, organisational, contractual or other lawful means. You consent to overseas disclosures on this basis.

Question 9

Non-Australian resident data

Accepted Answer

YHA is based in Australia and our servers are located in Europe and the United States. If you are outside Australia, information you provide will be transferred from your country of origin to these locations. Providing information or allowing us to collect it constitutes your consent to this transfer.

Question 10

How we store and hold your personal information and keep it secure

Accepted Answer

YHA stores most personal information in computer systems and databases operated by YHA or external providers in Europe and the United States; some information may be kept in paper files. We implement technical, administrative and physical measures to safeguard information from misuse, interference, loss and unauthorised access, modification or disclosure, including access restrictions and encryption. Third parties with access must have appropriate controls consistent with this policy and may only process information for authorised purposes.

Question 11

Credit card information

Accepted Answer

When you purchase on our website we do not store complete credit card numbers, expiry dates or CVV codes. We use third-party payment processors that handle collection and processing using PCI-DSS compliant tokenisation, replacing card details with secure tokens. We may retain transaction details such as the security token, amount, date and confirmation status for accounting, record-keeping, payment processing and customer service, but not sensitive card information.

Question 12

How long do we keep your personal information?

Accepted Answer

Personal information is retained for as long as reasonably necessary for the purposes in this policy or as required by law. When no longer needed it is destroyed or de-identified. De-identified information may be kept for statistical purposes without time limits where permitted by law.

Question 13

Your rights of access and correction of your information

Accepted Answer

We aim to keep information accurate, up-to-date and complete and will update records when advised. Notify us of changes or update your online profile; you may ask us to correct or delete inaccurate, incomplete, irrelevant or misleading information. Access, update, correction or deletion requests can be made in writing and we may verify your identity. We aim to respond within 30 days and will only refuse access in exceptional circumstances with reasons. Access and correction requests are free, though we may charge a fee for searching and providing access on a per-request basis.

Question 14

Rights of individuals located in the European Economic Area and the UK

Accepted Answer

Individuals in the European Economic Area and UK have additional rights under applicable data protection law. You may know what personal information we hold and request corrections; request restriction or objection to processing including automated processing and profiling; request deletion unless lawful retention is required; and in some circumstances request portable transfer of information you provided to another provider. Exercise rights by contacting us in writing and verifying identity; we aim to respond within 30 days. We may refuse requests only in exceptional circumstances under applicable law. In some countries a fee may apply for searching and providing information.

Question 15

Complaints

Accepted Answer

We take complaints seriously and will attempt to resolve privacy issues fairly within a reasonable time. Contact us using the details below if you believe YHA has interfered with your privacy. If unresolved, Australian residents may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au. European Economic Area and UK residents may contact the relevant supervisory authority, such as the UK Information Commissioner's Office or EU national data protection authorities listed on the European Commission website.

Question 16

Other websites

Accepted Answer

Our website may link to other companies' websites or materials. If you access third-party websites, this Privacy Policy does not apply and the third party's privacy policy and terms apply instead.

Question 17

Our contact details

Accepted Answer

For questions, comments, rights requests or complaints about this Privacy Policy, contact our Privacy Officer in writing. Email privacy@yha.com.au is the quickest channel; we generally respond within 72 hours. Post: Privacy Officer, YHA Australia, GPO Box 5276, Sydney NSW 2001, Australia. If you reside in the European Union or United Kingdom you may alternatively contact our representative DataRep via www.datarep.com/yhaaustralia or yhaaustralia@datarep.com.