Data Protection Policy

Swiss Youth Hostels Data Protection Policy

As of October 2023

Protection of your privacy is an absolute priority for Swiss Youth Hostels. We strive to guarantee the highest possible data protection and security.

A) Cross-channel notes

1) Content of this Privacy Policy

Please take note of the information below regarding the type of data we collect and the purpose it is used for. When it comes to data protection, we are guided primarily by the legal requirements of Swiss data protection law, in particular the Swiss Federal Data Protection Act (DSG), as well as the EU Data Protection Regulation, the provisions of which may be applicable in individual cases.

Please note that the following information will be reviewed and amended from time to time. We therefore recommend that you regularly review this privacy policy. Furthermore, for individual data processing listed below, other companies are responsible under data protection law or jointly responsible with us, so that in these cases the information of these providers is also authoritative.

2) Contact person for data protection

In case you have any questions regarding data protection or if you would like to use your rights, please contact our responsible person within the organization. You may reach the person on the following e-mail address: datenschutz@youthhostel.ch.

The address of our data protection representative in the EU is:

VGS Datenschutzpartner GmbH, Am Kaiserkai 69, 20457 Hamburg, Germany. It can be contacted at info@datenschutzpartner.eu.

3) Your rights

Provided that the legal requirements are met, you have the following rights as a person affected by data processing:

  • Right of access: You have the right to request at any time, free of charge, access to your personal data stored by us when we process it. This gives you the opportunity to check what personal data we are processing about you and that we are using it in accordance with applicable data protection regulations.
  • Right to rectification: You have the right to have inaccurate or incomplete personal data corrected and to be informed about the correction. In this case, we will inform the recipients of the data concerned about the adjustments made, unless this is impossible or involves disproportionate effort.
  • Right to deletion: You have the right to have your personal data deleted under certain circumstances. In individual cases, especially in the case of legal retention obligations, the right to deletion may be excluded. In this case, the deletion may be replaced by a blocking of the data if the conditions are met.
  • Right to restriction of processing: You have the right to request that the processing of your personal data be restricted.
  • Right to data transfer: You have the right to receive from us, free of charge, the personal data that you have provided to us in a readable format.
  • Right to object: You can object to data processing at any time, especially for data processing in connection with direct advertising (e.g. advertising e-mails).
  • Right of withdrawal: In principle, you have the right to withdraw your consent at any time. However, processing activities based on your consent in the past will not be rendered unlawful by your revocation.

To exercise these rights, please send us an e-mail to the following address: datenschutz@youthhostel.ch.

Right to lodge a complaint: You have the right to lodge a complaint with a competent supervisory authority, e.g. against the way your personal data is processed.

4) Data security

We use appropriate technical and organizational security measures to protect your personal data stored with us against loss and unlawful processing, namely unauthorised access by third parties. Our employees and the service companies commissioned by us are obligated by us to maintain confidentiality and data protection. Furthermore, these persons are only granted access to personal data to the extent necessary for the performance of their duties.

Our security measures are continuously adapted in line with technological developments. However, the transmission of information via the Internet and electronic means of communication always involves certain security risks, and even we cannot provide an absolute guarantee for the security of information transmitted in this way.

5) Contacting us

If you contact us via our contact addresses and channels (e.g. by e-mail, telephone or contact form), your personal data will be processed. The data you have provided us with, e.g. the name of your company, your name, your function, your e-mail address or telephone number and your request will be processed. In addition, the time of receipt of the request is documented. Mandatory data is marked with an asterisk (*) in contact forms.

We process this data exclusively in order to implement your request (e.g. providing information about our youth hostels, support in the processing of contracts such as questions about your booking, inclusion of your feedback in the improvement of our service, etc.). The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f EU-DSGVO in the implementation of your request or, if your request is directed towards the conclusion or execution of a contract, the necessity for the implementation of the necessary measures within the meaning of Art. 6 para. 1 lit. b EU-DSGVO.

6) Use of your data for marketing purposes

6.1) Central data storage and analysis in the CRM system

If it is possible to clearly identify you, we may store and link the data described in this privacy policy, i.e. in particular your personal details, your contact details and your contract details, in a central database. This serves the efficient administration of customer data and allows us to adequately respond to your request, and enables the efficient provision of the services requested by you and the processing of the associated contracts. The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 (1) f EU-DSGVO in the efficient management of user data.

We can evaluate this data in order to further develop our offers in a needs-oriented manner and to display and suggest the most relevant information and offers to you. The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 Para. 1 lit. f EU-DSGVO in the implementation of marketing measures.

6.2) E-Mail Marketing and Newsletter

You are able to subscribe to our newsletter, but registration is required. The following information is needed as part of the registration process:

  • First name
  • Surname
  • Email address

To avoid misuse and to ensure that the owner of an email address has actually given their consent, we use the so-called double opt-in for registration. After sending the registration you will receive an e-mail from us, which contains a confirmation link. To definitely register for the newsletter, you must click on this link. If you do not click on the confirmation link within the specified period of time, your data will be deleted again and our newsletter will not be sent to this address.

The above data is necessary for data processing. In addition, you can voluntarily provide further data (gender, language, member number). We process this data exclusively in order to personalize the information and offers sent to you and to better align them with your interests.

By registering, you give us your consent to process the data you have provided for the regular sending of the newsletter to the address you have provided and for the statistical evaluation of user behavior and the optimization of the newsletter. This consent constitutes our legal basis for the processing of the data within the meaning of Art. 6 (1) lit. a EU-DSGVO. We are entitled to commission third parties with the technical processing of advertising measures and are entitled to pass on your data for this purpose.

We use the email marketing software CleverReach from CleverReach GmbH & Co. KG (Schafjückenweg 2, 26180 Rastede, Germany) for marketing e-mails. Therefore, your data is stored in a database of CleverReach, which allows CleverReach to access your data when necessary to provide the software and to support you in using the software. The legal basis for this processing is our legitimate interest within the meaning of Article 6(1)(f) EU-DSGVO in the use of third-party services.

At the end of each newsletter you will find a link that allows you to unsubscribe at any time. After unsubscribing, your personal data in connection with the newsletter will be deleted.

7) Disclosure to third parties and access by third parties

Without the support of other companies, we would not be able to provide our services in the desired form. In order for us to be able to use the services of these companies, a transfer of your personal data is also necessary to a certain extent. Such a transfer takes place namely, as far as this is necessary for the fulfillment of the contract, i.e. e.g. to restaurants or other third party providers, for which we have made a reservation. In the case of these disclosures, the legal basis is the necessity for the performance of the contract within the meaning of Art. 6 (1) lit. b EU-DSGVO.

Furthermore, a transfer is made to selected service providers and only to the extent necessary for the provision of the service. Various third-party service providers are furthermore already explicitly mentioned in this privacy policy, such as in the sections on marketing. These are, for example, IT service providers (such as providers of software solutions), advertising agencies and consulting companies.

In addition, your data may be passed on, in particular to authorities, legal advisors or collection agencies, if we are legally obliged to do so or if this is necessary to protect our rights, in particular to enforce claims arising from our relationship with you. Our legitimate interest within the meaning of Art. 6 Para. 1 lit. f EU-DSGVO in the protection of our rights and compliance with our obligations forms the basis for this data transfer.

8) Transfer of personal data abroad

We are entitled to transfer your personal data also to third parties abroad, provided that this is necessary to carry out the data processing mentioned in this privacy policy. In doing so, the legal requirements for the disclosure of personal data to third parties will of course be complied with. If the country in question does not have an adequate level of data protection, we ensure through contractual arrangements that your data is adequately protected at these companies.

9)    Data retention and linkage

We store personal data in the data processing systems provided for this. Your data is thus systematically recorded and if necessary linked to the processing of your booking and performance of the contractual services. Processing of this data takes place exclusively in the context of customer-friendly and efficient client data management.

10) Retention periods

We store personal data only for as long as is necessary to carry out the processing explained in this data protection declaration within the scope of our legitimate interest. In the case of contractual data, storage is required by statutory retention obligations. Requirements that oblige us to retain data arise from the provisions on accounting and from tax law regulations. According to these regulations, business communication, concluded contracts and accounting vouchers must be stored for up to 10 years.

B) Data processing related to our website

11) Access our site

When you visit our website, our server temporarily stores every access in a log file. The following technical data is collected, without any action on your part, on every connection with a web server and saved by us until it is deleted automatically after a month at the latest

  • browser types and versions
  • operating system used by the accessing system
  • internet site from which an accessing system reaches our site (referrer)
  • sub-websites visited by a system accessing our website
  • fonts and maps integrated in Google Fonts and Google Maps
  • date and time of access to the internet site
  • internet protocol (IP) address
  • internet service provider of the accessing system
  • other similar data and information that serve as hazard prevention in case of an attack on our IT systems

This data is collected and processed to enable use of our website (connection set-up), ensure permanent system security and stability, help us enhance our internet offer and for internal statistical purposes.

In the event of attacks on the network infrastructure or other unauthorised or improper website use, the IP address and other data are also evaluated for information and defence, and could be used in criminal proceedings for identification or for civil or criminal action against the user in question.

In the purposes described above, there is our legitimate interest in data processing within the meaning of Art. 6 (1) lit. f EU-DSGVO.

Finally, when visiting our website, we use cookies as well as applications and tools that are based on the use of cookies. In this context, the data described here may also be processed. You can find more details on this in the other following sections of this privacy policy, in particular item 13.

A service provider to whom the personal data collected via the website is transferred or who has or may have access to it is our web host RTP GmbH, Josefstrasse 92, 8005 Zurich. The website is hosted on servers in Switzerland. The data is passed on for the purpose of providing and maintaining functionalities of our website.

12) Use of our contact form

You can get in touch with us by using the contact form. For this, we require the following information:

  • First name
  • Surname
  • Email address
  • Message

We use this data and any telephone number that you give voluntarily in order to be able to answer your contact question in the best possible and personalised manner.

13) Cookies

Cookies are information files that your web browser stores on your computer's hard drive or memory when you visit our website. Cookies are assigned identification numbers that identify your browser and allow the information contained in the cookie to be read.

Among other things, cookies help to make your visit to our website easier, more pleasant and more meaningful. We use cookies for various purposes that are necessary, i.e. "technically required", for your desired use of the website. Furthermore, cookies also perform other technical functions required for the operation of the website, such as so-called load balancing, i.e. the distribution of the performance load of the page to different web servers in order to relieve the servers. Cookies are also used for security purposes, for example to prevent the unauthorised posting of content. Finally, we also use cookies as part of the design and programming of our website, e.g. to enable the uploading of scripts or codes.

The legal basis for this data processing is our legitimate interest within the meaning of Art. 6 para. 1 lit. f EU-DSGVO in providing a user-friendly and up-to-date website.

Most internet browsers accept cookies automatically. However, when you access our website, we ask you for your consent to the cookies we use that are not technically necessary, in particular when we use cookies from third-party providers for marketing purposes. You can use the corresponding buttons in the cookie banner to make your desired settings. Details of the services and data processing associated with the individual cookies can be found within the cookie banner and in the following sections of this privacy policy.

14) Tracking tools

14.1) General information

We use various tracking tools on our website. Your behaviour on our website is monitored using these tracking tools. This monitoring is for the purposes of needs-based design and ongoing optimisation of our website. In this context, pseudonymised user profiles are created and small text files that are saved on your computer (‘cookies’) are used. The information generated by the cookies about your use of this site is transferred to the service provider’s server, saved and prepared for us.

By processing the data, we obtain, among other things, the following information:

  • Navigation path followed by a visitor on the site (including content viewed and products selected or purchased or services booked),
  • the time spent on the website or sub-page,
  • the sub-page on which the website is left,
  • the country, region or city from which access is made,
  • End device (type, version, colour depth, resolution, width and height of the browser window) and
  • Returning or new visitors.

On our behalf, the provider will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage for the purposes of market research and tailoring this website to your needs. For these processing operations, we and the providers may, up to a certain extent, be regarded as jointly responsible parties under data protection law.

The legal basis for this data processing with the following tools is your consent within the meaning of Art. 6 para. 1 lit. a EU-DSGVO. You can revoke your consent or refuse processing at any time by rejecting the relevant cookies in your web browser settings.

For the further processing of the data by the respective provider as the (sole) data protection controller, in particular also a possible forwarding of this information to third parties such as authorities due to national legal regulations, please note the respective data protection information of the provider.

14.2) Google Analytics

We use the web analysis service Google Analytics from Google Ireland Limited (Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland) or Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) ("Google").

In the process, the data described about the use of the website may be transmitted to the servers of Google LLC. in the USA for the processing purposes explained (see section 14.1). The IP address is shortened by activating IP anonymisation ("anonymizeIP") on this website before transmission within the Member States of the European Union or in other contracting states to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there.

Users can prevent the collection of the data generated by the cookie and related to the website use by the user concerned (incl. the IP address) by Google as well as the processing of this data by Google by downloading and installing the browser plugin at the following link: tools.google.com/dlpage/gaoptout. Further information and the applicable data protection provisions of Google can be found at www.google.de/intl/de/policies/privacy/ and at www.google.com/analytics/terms/de.html. Google Analytics is explained in more detail under this link www.google.com/intl/de_de/analytics/.

14.3) Google Ads

This website uses the services of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google") for online advertising. Google uses cookies for this purpose, such as the so-called DoubleClick cookie, which enable your browser to be recognised when you visit other websites. The information generated by the cookies about your visit to these websites (including your IP address) will be transmitted to and stored by Google on servers in the United States. You can find more information about Google's data protection at policies.google.com/privacy.

The legal basis for this data processing is your consent within the meaning of Art. 6 para. 1 lit. a EU-DSGVO. You can revoke your consent at any time by rejecting or deactivating the relevant cookies in your web browser settings. Further options for blocking advertising can be found at support.google.com/My-Ad-Center-Help/answer/12155764.

15) Jetpack

On our website, we use Jetpack, a product of Automattic Inc ("Automattic") located at 60 29th Street, San Francisco, USA. Through Jetpack, we use a feature that allows visitors of our website to share content on our website via email, link or on social media. Shared content including name, email address and IP address is forwarded to Automattic for processing and in turn shared with the respective selected service (Facebook, Pinterest, etc.). Automattic's privacy policy can be found at automattic.com/privacy/.

16) Website bookings

If you make a booking using our website, we require the following information to process the order:

  • First name
  • Surname
  • Street
  • Postcode
  • Place
  • Country
  • Email address
  • Credit card details

We use this data and any other information that you give voluntarily (e.g. telephone number, age of children and other comments) only to process the order, unless otherwise stated in this data protection policy or where you have not specifically given your consent. We process this data in particular to record your booking requirements, to provide the services booked, to contact you with any queries or issues, and to ensure the correct payment.

If you make a booking via our website, the personal data collected is shared with the operator of our booking platform, ASSD GmbH, Unterhaching, Germany. The booking platform is hosted on rented servers at the data centres of Amazon AWS and Daticum Bulgaria. Both data centres meet the requirements of the EU GDPR. Data disclosure is for the purposes of recording and registering your booking.

The legal basis for data processing for this purpose is the fulfilment of a contract according to Art. 6 (1) b EU-DSGVO or your consent according to Art. 6 (1) a EU-DSGVO. You can revoke your consent at any time with effect for the future.

17) Orders on our webshop

You can place orders using the contact form in our webshop. For this, we require the following information:

  • Title
  • First name
  • Surname
  • Street and house number
  • Postcode and place
  • Date of birth
  • Email address

We use this data and any other information that you give voluntarily (additional address, country, telephone number and comments) only to process your order requirements. The processing of this data therefore takes place within the meaning of Art. 6 para. 1 lit. b EU-DSGVO for the implementation of pre-contractual measures as well as for the implementation of a contract.

18) Online payment processing

When you make chargeable bookings or purchase products on our website, depending on the product or service and the desired method of payment, you may be required to provide additional data, such as your credit card information or the login to your payment service provider. This information, as well as the fact that you have purchased a service from us for the amount and at the time in question, is forwarded to the respective payment service providers (e.g. payment solution providers, credit card issuers and credit card acquirers). In doing so, always also note the information of the respective company, in particular the data protection declaration and the general terms and conditions. The legal basis for this transfer is the fulfilment of a contract according to Art. 6 para. 1 lit. b EU-DSGVO.

19) Application for a vacancy

You have the option of applying to us spontaneously or via a corresponding e-mail address for a specific job advertisement. For this purpose, we collect the following data, whereby mandatory data are marked with an asterisk (*) in the corresponding form:

  • First name
  • Surname
  • E-mail address
  • Application documents (e.g. CV, letter of motivation, references, etc.)

We use these and other data you provide voluntarily to review your application. Application documents of unsuccessful applicants will be deleted at the end of the application process, unless you explicitly agree to a longer retention period or we are not legally obliged to retain them for a longer period.

The legal basis for processing your data for this purpose is thus the execution of a contract (pre-contractual phase) in accordance with Art. 6 para.1 lit. b EU-DSGVO.

D) Data processing related to Social Media

20) Social Media

We maintain an online presence within social networks and platforms (Facebook, Instagram, Twitter) to communicate with visitors, interested parties and users, and to be able to inform them about our services. On access to the respective networks and platforms, the business conditions and data protection policies of the operator in question apply.

On our website, we have included links to our profiles in the social networks of the following providers:

  • Meta Platforms Inc, 1601 S California Ave, Palo Alto, CA 94304, USA;
  • Instagram Inc. 1601 Willow Road, Menlo Park, CA 94025, USA;
  • Twitter Inc. located at 1355 Market Street, Suite 900, San Francisco, CA 94103, USA;
  • Linkedin Unlimited Company, Wilton Place, Dublin 2, Ireland.

If you click on the icons of the social networks, you will automatically be redirected to our profile in the respective network. This establishes a direct connection between your browser and the server of the respective social network. This provides the network with the information that you have visited our website with your IP address and clicked on the link.

The legal basis for any data processing attributed to us is our legitimate interest in the use and promotion of our social media profiles within the meaning of Art. 6 para. 1 lit. f EU-DSGVO.

E) Data processing related to your membership

21) Your membership

The following information is required in relation to your membership (annual or day membership) of Swiss Youth Hostels:

  • Title
  • First name
  • Surname
  • Street and house number
  • Postcode and place
  • Date of birth
  • Email address

In connection with family memberships, we also collect this information for members of your family.

We use this data and any other information that you give voluntarily (additional address, country, telephone number, comments) to carry out our contractual relationships. A personalised membership is required in order to verify and document your entitlement to membership benefits. In addition, by creating a membership, you give us your consent to process the data provided for the regular mailing of membership information in connection with your membership. You can unsubscribe from this member information at any time.

We store the above data in a central electronic data processing system. The data is thereby systematically recorded and linked for the processing and handling of the above-mentioned services. For this purpose, we use the Microsoft Dynamics 365 software of Microsoft Corporation ("Microsoft") with its registered office at One Microsoft Way, Redmond, WA 98052-6399, US.

Further information and the applicable data protection provisions of Microsoft can be found at privacy.microsoft.com/de-de/privacystatement.

F) Data processing related to your booking in writing or by telephone or via a third-party platform

22) Bookings in writing or by telephone

If you make bookings by correspondence (email or post) or telephone, we require the following information to process the order:

  • Title
  • First name
  • Surname
  • Street and house number
  • Postcode and place
  • Country
  • Language
  • Email address or telephone number
  • Payment details

We will only use this data and other information voluntarily provided by you (e.g. expected arrival time, preferences, allergies in connection with meal orders, etc.) to process the contract, unless otherwise stated in this privacy policy or you have given your separate consent. We will process the data by name in order to record your booking as requested, to provide the booked services, to contact you in the event of any uncertainties or problems and to ensure correct payment.

The legal basis for data processing for this purpose is the fulfilment of a contract according to Art. 6 para. 1 lit. b EU-DSGVO or your consent according to Art. 6 para. 1 lit. a EU-DSGVO. You can revoke your consent at any time with effect for the future.

23) International bookings via Hostelling International

Swiss Youth Hostels is a member of the international network Hostelling International. You can reach the Hostelling International website via the international hostels link on our website. The website is operated by the International Youth Hostel Federation (IYHF), YHA England & Wales, under the name Hostelling International. The general terms and conditions and data protection guidelines apply to use of this website, and can be consulted at www.hihostels.com. Swiss Youth Hostels bears no liability for use of this website.

24) Third-party platforms

If you make bookings via a third-party platform, we receive various personal information from the respective platform operator in connection with the booking made. This is usually the data listed in section 22 of this privacy policy. In addition, we may receive enquiries about your booking. We will process this data by name in order to record your booking as requested and to provide the booked services. The legal basis for data processing for this purpose is the implementation of pre-contractual measures and the fulfilment of a contract in accordance with Art. 6 para. 1 lit. b EU-DSGVO.

Finally, we may be informed by the platform operators about disputes in connection with a booking. In the process, we may also receive data on the booking process, which may include a copy of the booking confirmation as proof of the actual booking completion. We process this data to protect and enforce our claims. This is our legitimate interest within the meaning of Art. 6 para. 1 lit. f EU-DSGVO.

Please also note the information on data protection of the respective booking platform.

G) Data processing related to your stay

25) Data processing to fulfil legal reporting requirements

On arrival at our youth hostels, we require the following information from you and any accompanying persons:

  • Title
  • Surname
  • First name
  • Street/no.
  • Postcode, place
  • Country
  • Nationality
  • Email address
  • Telephone
  • Date of birth
  • Passport number

We collect this information to meet legal reporting requirements, particularly those arising from hospitality or administrative legislation. If required by the provisions in force, we disclose this information to the relevant police authority.

The processing of this data is based on a legal obligation within the meaning of Art. 6 para. 1 lit. c EU-DSGVO.

To offer you the best service on arrival, you are able to record this information conveniently via a web platform a few days before your arrival (web check-in).

We use this data exclusively in order to meet our legal reporting requirements or to process the order in question, unless otherwise stated in this data protection policy or where you have not specifically given your consent. We also process this data in particular to provide the services you have booked. In this context, we are entitled to disclose the data to third parties (e.g. for the purchase of visitor passes or mountain railway tickets).

The data collected during web-check-in and through feedback is saved on servers of the company Hetzner Online GmbH, DE-Gunzenhausen. The servers are located in a member state of the EU or in another state which has an agreement with the European economic area. The distribution of the data is only for savin purposes. Any other data processing is completed on behalf of the Swiss Youth Hostels only.

26) Recording services purchased

If you receive additional services during your stay (e.g. meals or mountain railway tickets), the service and, if applicable, the time at which the service is drawn will be recorded for invoicing purposes. The processing of this data is necessary within the meaning of Art. 6 para. 1 lit. b EU-DSGVO for the processing of the contract with us.

27) Swiss Youth Hostels App

You have the possibility to manage your membership, make a booking and collect points via our loyalty system with our app. Registration is required for this and the following data must be provided as part of the registration process:

  • First name
  • Surname
  • Street/no.
  • Postcode, place
  • Email address
  • Preferred language

The above-mentioned data is necessary for data processing. In addition, you can voluntarily provide further data. We store this data in a central electronic data processing system. For this purpose, we use the Microsoft Dynamics 365 software from Microsoft Corporation ("Microsoft"), located at One Microsoft Way, Redmond, WA 98052-6399, USA. Further information and the applicable data protection provisions of Microsoft can be found at privacy.microsoft.com/de-de/privacystatement.

The login to the app is provided by the discover.swiss cooperative ("discover.swiss") with its registered office at Schaffhauserstrasse 14, CH-8042 Zurich. The data protection provisions of discover.swiss can be found at https://discover.swiss/datenschutz.

28) Guest feedback

If you have given us your email address for your booking, you will receive an electronic form after your departure. We collect the following data via this form:

  • With whom you were travelling
  • Gender
  • Year of birth
  • Rating
  • Comments

This information is voluntary and helps us to continually improve our range of services and adjust them to meet your needs. We use the information provided only for statistical purposes, unless otherwise stated in this data protection policy or where you have not specifically given your consent. We process this data in particular so that we can contact you with any queries or issues.

For the aforementioned purposes, the legal basis of the processing is our legitimate interest within the meaning of Art. 6 (1) lit. f EU-DSGVO.

29) Video surveillance

In order to prevent misuse and to take action against illegal behaviour (especially theft and damage to property), the entrance area and the publicly accessible areas of our youth hostels are partially monitored by cameras. The image data is only viewed if there is a suspicion of illegal behaviour. Otherwise, the images are automatically deleted after 72 hours.

For the provision of the video surveillance system, we rely on a service provider who may have access to the data insofar as this is necessary for the provision of the system. Should the suspicion of unlawful conduct be substantiated, the data may then be passed on to consulting companies (in particular our law firm) and authorities to the extent necessary to enforce claims or file charges.

The legal basis for this is our legitimate interest within the meaning of Art. 6 (1) f EU-DSGVO in protecting our property and safeguarding and enforcing our rights.

30) Payment processing

When you purchase products or services or pay for your stay in one of our youth hostels using electronic means of payment, the processing of personal data is necessary. By using the payment terminals, you transmit the information stored in your means of payment, such as the name of the cardholder and the card number, to the payment service providers involved (e.g. providers of payment solutions, credit card issuers and credit card acquirers). They also receive the information that the payment method was used by one of our youth hostels, the amount and the time of the transaction. Conversely, we only receive the credit for the amount of the payment made at the relevant time, which we can assign to the relevant voucher number, or information that the transaction was not possible or was cancelled. Always also note the information of the respective company, in particular the data protection declaration and the general terms and conditions. The legal basis for this transmission is the fulfilment of the contract with you according to Art. 6 para. 1 lit. b EU-DSGVO.

31) Visitor passes

Many destinations issue guest passes for visitors. The passes are often linked to collection of data for visitor’s tax. We share your personal data only if this is specifically required for issuance of visitor passes or settlement of the visitor tax, unless otherwise stated in this data protection policy or where you have not specifically given your consent.

32) WLAN use

The WLAN available in our youth hostels is operated by Monzoon Networks AG, Spinnerei-Lettenstrasse, Riverside, 8192 Zweidlen. The data protection policy can be consulted at monzoon.net/gdpr/index_en.php .