Privacy Policy

Personal information is any information or an opinion about an identified individual, or an individual who can be reasonably identified from the information or opinion. Information or an opinion may be personal information regardless of whether it is true. Our Processing of your personal information will depend on our relationship with you, the circumstances of collection and the types of products and services you request from us. We may collect additional personal information from you from time to time.

We may collect personal information in the following circumstances:

Directly from you – When you make or manage bookings for accommodation directly with us, check-in to our accommodation online or at our properties, stay at our accommodation, become a member of YHA, purchase travel products such as travel vouchers online, make a donation to our foundation, register and use our online services, manage your YHA profile online, sign up to our updates or newsletters, respond to offers from us and our partners, enter a competition or giveaway, make an enquiry, respond to our surveys or provide feedback or comments, attend our properties including via sign-in and security surveillance of our premises, use the wi-fi at our premises or otherwise interact with us or provide your personal information to us.

Personal information may include your name, address, email address, date of birth, gender, telephone number, photo, nationality, YHA or HI membership number, accommodation reviews you provide on our website, reservation details, information particular to your stay such as dates, duration and location, your personal preference in relation to travel and accommodation and any other specific requirements you nominate to tell us.

Indirectly from the primary guest – When a primary guest makes or manages bookings for accommodation, or checks-in online on your behalf, we may collect your name, address, email address, date of birth, gender, telephone number, nationality and YHA or HI membership number. Where you give us personal information on behalf of someone else, you confirm that you have provided them with the information set out in this Privacy Policy and they have not objected to our handling, use and disclosure of their personal information.

Indirectly from third parties – There may be occasions when we may collect personal information about you from publicly available sources and third parties including travel agents or partners you make booking accommodations through. Where we receive personal information about you from third parties, we require that the third party complies with applicable laws including privacy laws.

If you provide us with personal information about other individuals, such as when making a booking on someone's behalf irrespective of whether you are travelling together, you are responsible for telling those individual(s) and letting them know that they can find a copy of this Privacy Policy on our website.

Information about minors – We do not knowingly collect personal information directly from any person we know is under the age of 17. We do not allow any persons under the age of 17 to be the primary guest and book accommodation. As part of the booking and check-in process, we may collect personal information about persons under the age of 17 indirectly from parents or other adults they travel with who are the primary guest. Where we collect personal information about persons under the age of 17 in any other circumstances, we may seek or require consent from a parent or guardian where YHA considers this is appropriate.

Sensitive information – We generally do not ask for, or collect sensitive information about you, unless you provide it to us voluntarily. For example, when you make a booking or interact with one of our staff, you may voluntarily provide sensitive information such as racial or ethnic origin, sexual orientation, health information or religious or philosophical beliefs. If you do provide sensitive information to us voluntarily, you consent to us collecting this information. If we require sensitive information to provide you our services, we will ask for your consent.

You don’t have to give us all the personal information we request. You may engage with us anonymously or using a pseudonym if it is feasible to do so. For example, if you wish to give feedback without requiring a response from us, you won’t need to provide a full name or email address.

However, if you do not provide us with some or all of the personal information required, we may not be able to provide you with the products and services or information you request, to the requested standard or at all, and you may also miss out on receiving valuable information about us and our products and services.

For example, upon check-in:

• we collect your personal information by taking a photo of you. If you do not wish to have your photo taken, we will not be able to provide accommodation to you if you have booked a shared co-living room or a private room which includes the use of a shared bathroom. As you will stay in a shared environment with other guests it is important that we know who is in our property at all times to ensure maximum safety and security for all guests. We also keep a copy of the photo, so that we can use it to identify you the next time you check in to one of our accommodation properties. If we do not have a copy of your photo, it may be necessary to sight your photo identification each time you check in to verify your identity.
• we sight your photo identification (such as a current valid drivers’ licence or passport) and collect your name, date of birth, residential address and nationality in order to verify your identity. If you do not allow us to sight your photo identification and collect the foregoing information, we will not be able to provide accommodation to you.

What are cookies and similar technologies – Cookies are text files which are downloaded to your device when you visit a website. Cookies are used to describe a range of technologies including web beacons and server logs used in desktop software or mobile devices. We will use the term “cookies” throughout this Policy to cover all these technologies.

We collect general information from your device when you use our website and application. This might include your geo-location, IP address, device identifier, the browser and operating system you are using, and details of website that IP address has come from, the pages accessed on our website and the next website visited.

Types of cookies and how we use them – There are different types of cookies that perform different functions, like letting you navigate between pages efficiently, remembering your preferences, and ensuring the ads that you see online are more relevant to you and your interests. We (and authorised service providers) use the following types of cookies:

How to withdraw consent to cookies or amend your cookie preferences – If you want to prevent cookies being used, you can change your browser or application settings to disable cookies or to notify you when you receive a new cookie. However, you may not be able to access all or parts of our website or application, or you may experience reduced functionality when accessing certain services (for example, automatic login may not function properly).

• Browser Cookies: If you no longer wish to receive cookies you can use your web browser settings to accept, refuse or delete cookies. To do this, go to “Settings” and then “Privacy”. Note that different browsers will have different procedures.
• Mobile Identifiers: On your mobile device, your operating system may provide you with additional options to opt out of interest based advertising or to otherwise reset your mobile identifiers. For example, you may use the “Limit Ad Tracking” setting (on iOS devices) or a setting to “Opt out of Interest-Based Ads” (on Android) which allows you to limit the use of information about your use of apps for purposes of serving ads targeted to your interests.
• Interest-Based Advertising: Certain targeted advertisements that we (or a service provider acting on our behalf) display to you based on information about your online activities across websites and other interactive properties operated by third parties may include the “Ad Choices” icon or another mechanism to opt out of receiving interest-based advertisements. You may click on the AdChoices icon or visit www.aboutads.info to receive more information about the collection and use of information about your online activities for interest based advertising or to learn how to opt out of having your data used for interest based advertising by Digital Advertising Alliance (DAA) participating companies. Australia users can also visit https://www.youronlinechoices.com.au/. European users can also visit https://www.youronlinechoices.eu/.   

Third-party service providers may have their own privacy policies in relation to their cookies and tools that YHA cannot control. Please check the third-party websites for more information about their cookies and how to manage them.

We Process your personal information so that we can perform our functions and activities such as to provide you accommodation booking and membership services and to evaluate and improve our services. We will not use or disclose sensitive information without your consent.

 We may Process your personal information for the following purposes:

1. Provide and administer our products and services including YHA memberships, travel products, YHA Travel to Learn, processing bookings, check-ins and cancellations, processing payments or managing your profile;
2. Ensure safety and security for all guests at our accommodation including through verifying your identity;
3. Provide customer support and seek and publish feedback as reviews including through conducting surveys and investigating and responding to your queries and comments;
4. Operate our competition and promotions including determining entry eligibility, awarding prizes and publishing or otherwise making available a list of prize winners;
5. Conduct marketing and advertising activities, including displaying content on our website and app and serving display advertising on third party websites and apps;
6. Provide information about our products and services, including through distributing newsletters and other communication on information about us and our related services, your YHA profile and your use of our services;
7. Provide information about your YHA membership, including through distributing newsletters and other communication on updates on your membership benefits, invitations to participate in governance aspects of YHA such as board elections, Annual General Meetings, and changes to the YHA Constitution;
8. Perform data analyses, research and generate aggregated customer and market trends, statistics and insights and commercialising such aggregated information, which may be a result of combining de-identified information collected from you and other customers;
9. Develop and improve our products and services, including our website and to provide a more personalised service before, during and after your stay;
10. Manage and carry out our business and operational functions, including HR management, business decisions and technical operations;
11. Maintain our records and complying with our legal obligations; and
12. For any other purpose disclosed at the time the information is collected or to which you consent.

We must be able to identify the legal basis on which we Process your information. These are if Processing is:

• Necessary to fulfil a contract, such as website terms or booking contract that we have in place with you, for the purposes set out in points 1, 2, 3, 4, 6, 7 and 12 above;
• Necessary for our legitimate interests, such as the Processing for the purposes set out in points 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 and 12 above, unless consent is required under applicable law;
• With your consent, such as the Processing for the purposes set out in points 6 and 12 above, where such consent is required under applicable law;
• Necessary for compliance with a legal obligation to which we are subject, such as the Processing for the purposes set out in point 11 above; and
• Any other applicable legal grounds for Processing.

YHA may, from time to time, send direct marketing communications to you about our activities and services and other material that we consider you would find interesting or useful. If you do not wish to receive such direct marketing communications, you can always opt out. If you are receiving email communications from us, there will be a mechanism to opt out contained in each of those emails. If you subscribe to YHA email newsletters or have created a YHA profile, you can also log in to the YHA website and change your preferences on the email preferences page. You can disable push notifications on our app by changing the notification setting on your mobile device or through the app. To stop receiving other communications from us, you can contact us via any of the channels listed below.

If you choose to opt out of all direct marketing communications, please note that YHA may still contact you for other reasonable purposes, including information that YHA is legally required to send, information about your reservation, your YHA membership, notifications of changes to YHA services or policies and information regarding the use, rights, benefits or obligations of users of our services.

We may disclose your personal information to third parties in accordance with the applicable law and for the purposes listed above, including:

• To third party operators and providers of ‘travel deals’, including tours and attractions you have booked;
• To sponsors and partners when you enter a competition or promotion;
• To HI when you become a YHA member;
• When we may be required by law from time to time; and
• To any other third party where you have provided your consent.

We may also disclose personal information to third parties such as our contractors, suppliers, agents and service providers who help us deliver, administer and support our functions and activities, including:

• Hosting our servers and website;
• Delivering marketing and digital marketing services;
• Serving advertising;
• Conducting data analysis and data matching services;
• Conducting market research, surveys and analysis;
• Providing IT services;
• Data processing, storage and back-up; and
• Processing payments.

Some of the third parties we disclose your personal information to may be based or have servers located overseas in various countries, including Europe, USA and the UK. Before we disclose your personal information to our overseas recipients, we will take all reasonable steps to ensure that your personal information is only Processed for authorised purposes and adequately protected using the appropriate technical, organisational, contractual or other lawful means. You consent to us disclosing your personal information to overseas recipients on this basis.

YHA is based in Australia and our servers are located in Europe and the United States. If you are located outside of Australia, please be aware that any information you provide to us, will be transferred from your country of origin to any of these locations. Your decision to provide such information to us or allow us to collect such information constitutes your consent to this information transfer.

YHA stores most personal information in computer systems and databases operated by either YHA or its external third-party data storage providers based in Europe and the United States. Some personal information may also be recorded in paper files. YHA takes the security of your personal information seriously and we implement a range of technical, administrative and physical measures to safeguard such information from misuse, interference, loss and unauthorised access, modification or disclosure, including electronic and physical access restrictions to files containing personal information and ensuring encryption of personal information sent and received.

We require that all third parties, to whom we disclose personal information or who may have access to personal information, to have appropriate controls to protect your personal information in a manner that is consistent with our Privacy Policy, including in relation to security and confidentiality. They must only Process your personal information for authorised purposes.

When you purchase a product or service on our website, we do not store or retain complete credit card information, such as credit card numbers, expiration dates or CVV codes. Instead, we rely on the secure payment processing services of third-party payment processors (Payment Processor).

Payment Processors handle the collection and processing of payment information on our behalf. The payment processing systems used by the Payment Processors use credit card tokenisation, a security method compliant with the Payment Card Industry Data Security Standard (PCI-DSS). This technology replaces sensitive credit card information with a secure, randomly generated token. The token can only be used by the payment processing system and has no value if compromised, ensuring that your card details are safeguarded according to the highest industry security standards. Please note that while we do not store credit card information, we may retain certain transaction details provided by Payment Processors, such as the credit card security token, transaction amount, date, and confirmation status, for accounting, record-keeping, payment processing and customer service purposes. These stored transaction details do not include sensitive credit card information.

Your personal information will be retained for as long is reasonably necessary for the purposes listed above or as required by applicable law. If we no longer need your personal information, we will ensure that it is either destroyed or de-identified. We may keep the de-identified form of your personal information for statistical purposes without time limits, to the extent permitted by law.

It is important to us that the information we hold about you is up-to-date, accurate and complete, and we will try to confirm your details through our communications with you and promptly add updated or new personal information to existing records when we are advised. If any of your details change, please notify us as soon as you can or log into your online profile to update it. If you believe we are holding information about you that is inaccurate, incomplete, irrelevant or misleading, you can ask us to correct it, or delete it altogether.

If you would like to access your personal information, or ask us to update, correct or delete it, you can do so by making a request to us in writing. We may need to verify your identity when you make such a request. We will do our best to respond to your request within 30 days.

We will only refuse access in exceptional circumstances, and if this is the case, we will advise you of our reasons for doing so.

You will not be charged for making a request to access or correct your personal information. However, we may charge a fee for searching for, and providing access to, your information on a per request basis.

Under applicable data protection laws, individuals who are in the European Economic Area and the UK have additional rights.

In accordance with applicable data protection law:

• You are entitled to know what personal information we hold about you and you may ask us to make any necessary changes to ensure that it is accurate, up to date and complete;
• You may request for us to restrict or object to the processing of personal information, including automated processing and profiling;
• You may request that we delete personal information we hold about you, unless there is a lawful reason for us not to do so such as if retention is necessary for us to comply with our legal obligations; and
• In some circumstances, you may request that we provide the personal information (that you have provided to us) to you in a structured, commonly used and machine-readable format and have it transferred to another provider of the same or similar services.

If you wish to exercise any of your rights, you can do so by contacting us in writing and verifying your identity. We will do our best to respond to your request within 30 days.

We will only refuse your request in exceptional circumstances and in accordance with the applicable law, and if this is the case, we will advise you of our reasons for doing so.

In some countries, we may charge a fee for searching for, and providing you with details of the information we hold about you.

We take your complaints seriously and we will attempt to resolve any issues fairly and within a reasonable period of time. If you think that an act or practice of YHA has interfered with your privacy in relation to your personal information, you can contact us using the details below.

If we cannot resolve your complaint to a satisfactory standard, you are entitled to lodge your complaint:

• With the Office of the Australian Information Commissioner at: http://www.oaic.gov.au; or
• For residents of the European Economic Area and the UK, with the relevant supervisory authority. If you are based in the UK, this is the UK's Information Commissioner's Office. If you are based in the European Economic Area, a list of EU national data protection authorities can be found on the European Commission website at: https://ec.europa.eu/info/strategy/justice-and-fundamental-rights/data-protection_en.

From time to time, our website may contain links to other companies' websites or materials. If you choose to access such third-party websites, our Privacy Policy will not apply, and the privacy policy and terms of the third-party website will apply instead.

If you require any further information or have any questions or comments about this Privacy Policy or if you wish to exercise your rights or make a complaint about our handling of that information, please contact our Privacy Officer in writing as follows:

Email: privacy@yha.com.au - this email is the quickest way to exercise your rights or get in touch with YHA to resolve any questions, complaints or deletion requests. We generally attempt to respond to your questions and comments within 72 hours.

Post (Australia):
Privacy Officer
YHA Australia
GPO Box 5276
Sydney NSW 2001
Australia

If you reside in the European Union or United Kingdom, you may alternatively contact our representative (as applicable) - DataRep

Portal: www.datarep.com/yhaaustralia

Email: yhaaustralia@datarep.com