Hostels.com - Data Protection Notice
What is the purpose of this notice?
Hostelworld has been processing online hostel reservations since 1999, and while much has changed in the world of hostel travelling over the years, one thing that hasn't is our commitment to protecting your privacy. This notice sets out details of the information that we collect about you, how we process it, to whom we disclose it, and your rights under data protection law in relation to our processing of your data.
This data protection notice covers personal data that is collected through all of our websites (such as Hostelworld, Hostelbookers and Hostels.com), through our mobile sites and applications, and through booking engines that are integrated into third party websites. Although you should bear in mind that where you access our booking engine on a third-party website, this data protection notice only applies to information we collect through your use of the booking engine, and does not apply to data collected or held by the operator of the third party website.
Who controls the use of your personal data?
When this data protection notice mentions "we", "us", "our" or "Hostelworld" we are referring to Hostelworld.com Limited. This is the Irish company that operates the booking platform that allows you to make reservations, and is in charge of the processing of your personal data. For more information about us, and contact details for our Data Protection Officer, please click here.
Hostelworld.com Limited's registered company number is 337103, and its registered address is 1 Central Park, Leopardstown, Dublin 18. You can contact us using the details at the end of this notice, or if you have any queries in relation to the processing of your personal data you can also contact our Data Protection Officer by emailing DataProtectionOfficer@hostelworld.com or by calling +353 1 498 0700.
What personal data is collected?
In order for us process your booking we will ask you for certain information, such as your name, your email address, your payment information and booking details. We also collect certain information from the device you use to access our website, such as your IP address, what browser you use and what type of device you are using. In addition to the information that we collect ourselves, we sometimes receive information that is collected on our behalf by third parties, such as when you see a Hostelworld advert displayed on a third party site. For more details about the information that we collect, please click here.
Information that you give to us:
Most of the personal data that we collect about you will be information that you have given to us yourself. This might include:
- Account - If you set up an account with us, we will store details of your username and password, your settings preferences (e.g. language, currency and distance units), your past trips and any wish lists that you create.
- Booking Details - When you make a booking we will ask you for information that we need in order to process the booking. This will include your name, email address, nationality, gender, mobile number (if you want to receive a free confirmation by SMS message) and your payment details.
- Queries and Complaints - If you contact our Customer Service team with a query or a complaint, we will record details of the query or complaint and how it is dealt with on our systems. We may also seek further details about the query or compliant from an accommodation provider, which we will also record in our systems.
- Reviews - If you leave a review in relation to your stay at a property, this will be linked to your Hostelworld account, which means we will treat it as containing your personal data.
- Email Marketing - When we collect your email address we will record your preferences regarding receipt of marketing emails from us in relation to our own products and services and those of third parties.
- Competitions - If you enter into a competition, we will collect details from you in order to enter you into the competition (e.g. your name, email address and your competition entry).
- Location Data - If you enable location services for our app and perform a search using your current location or view map directions to the hostel from your location, we will record your location . We also use your IP address to determine what country you are in when you make a booking.
- Surveys - If you participate in a survey, we will record your responses to the survey. In some cases we anonymise your responses, but where we don't do this we will let you know.
Personal information that we collect automatically:
When you use our websites, mobile apps or booking engines we use various technologies to automatically capture details about the device you are using and how you interact with our platforms. This information includes:
- Device Details - We automatically collect details about the device you are using, including its IP address, its device ID, the browser you are using, and the operating system that the device uses.
- How You Interact With Our Site - We record details about how you use our websites and mobile apps, like the date and time that you visit, what pages you visit, how long you stay on the pages, where you have clicked on a page, and details of any crashes or system bugs you might encounter.
- How You Got Here - Where we can, we record how you arrived on our website (e.g. from a search engine, or by clicking on one of our adverts).
Personal information we receive from other sources:
Although we mainly collect information directly from you, there are circumstances where we collect information from third party sources. These circumstances include:
- Affiliates - We operate an affiliate programme under which third parties advertise our website on our behalf. If you click on one of those advertisements you are directed to our website using a technology that allows us to understand which affiliate referred you. We then track if you make a booking, and if you do we attribute that booking to the affiliate for the purposes of paying them a commission. However, we don't provide the affiliate with any personal information in relation to you.
- Property - If there are any issues with your stay at a property, the property might contact us with information about the issue.
- Advertisements - When we work with third parties to display advertisements we may use technologies like cookies or pixel tags to record details of your interaction with those advertisements. This data is sometimes sent to us through cookies and pixel tags that are set on our behalf by those third parties.
Why do you use my personal data?
As you probably expect, the main reason we use your personal data is in order to process your bookings and to deal with any queries or issues that arise in relation to those bookings. We also use your personal data for a number of other reasons, such as tailoring adverts and our marketing emails so they are relevant to you, monitoring your use of our websites and apps to help us make improvements, and to provide the additional services that we make available on our website and apps. For more details about why we use your personal data, click here.
- Bookings - We use your personal data in order to process bookings with properties, and to let you manage your bookings through our platforms. Where we process personal data for this purpose we will do so either on the basis that we have a contractual duty to do so, or on the basis of our legitimate interests in providing the booking service.
- Queries and Complaints - When you send us a query in relation to a booking, or if you have a complaint in relation to a property, we will process your personal data in order to answer your query or in order to resolve your complaint. Where we process personal data in the context of a query or complaint we will do so on the basis of our legitimate interest in resolving customer queries and complaints. If you volunteer data in relation to your health, we will process that personal data on the basis that you consent to us using it in order to resolve your query or complaint.
- Reviews - When you provide a review for a property we will publish this on the property's page on our website, and on our some of our partners' sites. We will display the text of your review, alongside details of your gender, age range, home country and number of previous reviews. If you have not opted to be anonymous, we will also display your username alongside your review. Our processing of your personal data in order to make reviews available is on the basis of our legitimate interest in making the review system available to our users.
- Providing and Improving our Services - Where we collect data in relation to your use of our services, such as your device details and how you interact with our services, we use this data in order to deliver our services and personalise your experience (e.g. if you turn on location services on your mobile device, we will use this as part of the search function). We also use the data to test new features that we are thinking about introducing, to analyse how our website is used, and to evaluate and improve our services. If we find a problem on our websites or apps, we will use your data in order to fix any bugs that we find. We may also process your personal data as part of our development work, where we take a copy of our database and test our code on that before rolling it out to the live version of the database. Where possible we use this data on an anonymous basis, but sometimes this might not be possible. All of this processing of your personal data is on the basis of our legitimate interests in operating, improving and securing our services. Please also see our separate notice in relation to the testing that we undertake.
- Analysis/Reporting - We use data in relation to bookings in order to create internal reports regarding how our business is operating, such as determining how what we have spend on advertising affects the number of bookings that are made. We also use this data for other commercial analysis purposes, and to try to predict future trends that may affect our business. This processing is undertaken on an aggregated basis, so you are not identifiable from the reports or analysis that is produced.
- Advertising - We always want to ensure that when you see a Hostelworld advert it will be relevant to you and your interests, whether the advert appears on a website we operate, in our marketing emails or on a third-party site. We may also use the same information to show you adverts for carefully selected third-party products and services. We do this in a number of ways, either ourselves or through the use of third-party advertisers:
- Making Adverts Relevant To You - When you are using our websites and apps we use the searches you have made and the properties that you have looked at in order to tailor our adverts to your interests. For example, if you have been searching for hostels in Paris, we might use this information to display adverts to you on our websites and on third party websites for hostels in Paris that you might be interested in. We may also use this information in order to tailor the adverts that appear in our email newsletter. We may also use data about your past transactions on the website to tailor our advertising. For example, if we notice you haven't made any bookings for a while, we might send you a credit to your account as an incentive to make a new booking.We process your personal data in connection with tailoring our adverts on the basis of our legitimate interests in ensuring that our advertising is effective.
- Segmentation - When we develop some of our advertising campaigns we have certain groups of people in mind who we want to see the advert. This might be people in a particular age range, people who have made a booking recently, or people from a particular geographic location or who speak a particular language. We use the data that we hold in order to create groups of people that we then display an advert to, or ask our third-party advertising partners to display an advert to. We process your personal data in connection with creating these groups of people on the basis of our legitimate interests in ensuring that our advertising, or the advertising of third parties, is effective.
- Audience Matching - Some of our advertising partners, like Facebook and Twitter, provide a feature that helps us to identify if we have customers or users in common. Rather than sharing personal data with our advertising partners in order to find out if we have customers or users in common, we actually share what is known as a "hash" of the data that we hold (such as an email address). A hash is created by a computer programme that converts data into a string of numbers and letters, but only operates in one direction. This means that you can't use a hash to find out the underlying information, but if you run the hash on the same data you always get the same results. Our advertising partners compare their hashes with the hashes we send them, and if there is a match you are added to our custom audience. The hashes are then deleted by the advertising partner. We use audience matching to enable us to show you more relevant adverts, or to ensure that we don't show you an advert that isn't relevant to you. We process your personal data in connection with audience matching on the basis of our legitimate interests in ensuring that our advertising, or the advertising of third parties, is effective.
- Emails and App Notifications - Where we have collected your email address in the context of providing you with a service and you have not opted out of receiving email marketing, we may send you emails that we think will be useful to you. This may include our regular e-newsletter, special offers, travel tips, customer surveys and information about products and services offered by us. If you have given your consent, we will send you offers from selected third parties. These emails may include advertising that has been tailored using other information that we hold about you, as set out above in the 'Advertising' section. Where your settings on your device permit us to send app notifications we may also send you app notifications containing similar information. You may opt out of receiving email messages at any time by clicking on the link provided in the email messages, and app notifications can be disabled by changing the notification settings in your app. Although when we send you an email or app notification this may in certain circumstances be on the basis of your consent, for all other purposes our processing of your personal data in connection with those emails or app notifications is on the basis of our legitimate interests in ensuring that our advertising is effective.
- Affiliate Programme - We operate an affiliate programme under which third parties advertise our website on our behalf. If you click on one of those advertisements you are directed to our website using a technology that allows us to understand which affiliate referred you. We then track if you make a booking, and if you do we attribute that booking to the affiliate for the purposes of paying them a commission. However, we don't provide the affiliate with any personal information in relation to you. We process your personal data in connection with our affiliate programme on the basis of our legitimate interest in operating an effective commission based affiliate advertising programme.
- Competitions - We often run competitions on our website and on our social media channels. When we operate a competition we may take the opportunity to also ask you some market research questions, so that we can better understand our business and your needs. We will therefore process your personal data in order to operate the competition, and for market research purposes. We process your personal data in connection with operating competitions on the basis of our legitimate interest in operating the competition and conducting market research. Please note that competitions may be subject to their own data protection notices and separate terms and conditions.
- Surveys - We sometimes undertake market research surveys to better understand our customers and prospective customers. These can be general surveys to understand the market, or they might be more specific to you. For example, we may want to understand if you are generally positive about Hostelworld or if you have concerns. We may then send you tailored communications on the basis of the survey responses. Where this is the case we will let you know at the time that you complete the survey. We process your personal data in connection with our surveys on the basis of our legitimate interest in conducting market research and promoting our brands.
Information you are required to provide
You are not obliged to provide us with any of your personal data. However, if you want to make a booking you will need to provide us with the information that is indicated as required on our checkout page. If you don't provide us with this information, we won't be able to process your booking. Similarly, you may be required to provide certain information if you want to enter into a competition, participate in a survey, or if you contact our Customer Services team with a query or complaint. We will inform you where such information is required.
Who do we share your personal data with?
In order to process your booking we have to send your details to the property that you have booked. This includes making your credit or debit card details (not including the CVV code, which we do not store) available to the property in order for them to take payments where this is required (e.g. the charges that are applicable if you fail to show up at a property and have not cancelled your booking in accordance with the property's cancellation policy). If you purchase an ancillary service we may need to share personal data with the third-party service provider so that they can provide you with that service.
As part of our online advertising programmes we may share your personal data with third parties, who will combine it with data that they hold about you in order to tailor adverts that appear on third-party websites (which may be our own adverts, or adverts we serve on behalf of third parties). Where this data is shared you are not directly identifiable from the information itself, as we use technologies that use non-personally identifiable codes and tags.
We also use a number of service providers to assist us in providing our services, some of whom will have access to your data (e.g. we use various software service providers who host our data as part of their services). Where we engage a third party to process your data on our behalf, we make sure that they respect your privacy rights and that they process data in accordance with data protection law.
Although we hope it never happens, on very rare occasions our customers can get into difficulties whilst travelling. Where we think that there is a risk to your health or wellbeing, we may share your personal data with third parties in order to get you help (e.g. we might be asked to assist with locating a missing person). We may also receive requests from law enforcement agencies for personal data that we hold. In such circumstances we will only share your personal data with such law enforcement agencies in compliance with data protection law.
For further details of third parties who we share your personal data with, please click here.
- Properties - We share the following details of your booking with properties: your name, gender, nationality, email address, booking details and debit/credit card details (excluding the CVV code, which we do not store). We also share details of any reviews that you provide in relation to the property, so that they can address any complaints or make sure that they keep up the good work. If you contact us with a query or complaint in relation to a property we may also share details of the query or complaint with the property so that we can resolve it.
- Group Companies - There are a number of companies in our group that help us to provide our services. This includes a subsidiary in the UK that provides help with our marketing initiatives, a subsidiary in Portugal that provides development services, and a subsidiary in South Korea that helps to service our customers in Asia. We also have offices in China and Australia that help us service those markets. These subsidiaries and offices may have access to your personal data in providing us with intra-group services, but they only process it in accordance with our instructions and subject to appropriate safeguards.
- Service Providers - As you can imagine, operating the world's largest online hostel booking platform requires a lot of work behind the scenes. We use a large number of specialist service providers to assist us in operating our business and to provide us with specialist services. Not all of these service providers will have access to your personal data, but where they do we make sure that they are carefully selected by us to ensure that they respect your privacy rights. The categories of service providers that we currently engage include the following:
- Hosting Providers - We use various cloud service providers to help us host and manage our data. This means that the data is hosted remotely by the third party, and access by us in Hostelworld, rather than sitting on our systems.
- Payment Processors - We use third-party payment processors in order to assist us with taking payments on our website.
- Customer Relationship Management - We use a third-party provider to host our customer relationship management system, which our Customer Services team uses to record all contacts that you have with us and how we have resolved your queries and complaints.
- Technology Providers - This includes service providers who provide services that help us to secure our network, systems and emails. It also includes providers of services that enable us to undertake particular tasks, such as surveys or market research, or to implement our advertising programme.
- Consultants - We sometimes engage consultants to help us implement new technology or services, or to provide us with insights into how we run our business and how we might improve it. This sometimes requires us to provide access to our systems to those third parties, which means that they may have access to where your personal data is stored. We always make sure that any such access is limited to what is strictly necessary, and subject to appropriate security procedures.
- Auditors - We have an internal and external audit function that is provided by third parties. The auditors help us to ensure that we are complying with our legal obligations, including in relation to our processing of personal data. In certain circumstances this may mean that they have access to our systems that process personal data, or that they might need to review how we have processed certain personal data.
- Third-Party Advertisers - When we purchase advertising on third-party websites we may share information with them about your use of our services, which they then combine with the information that they hold about you in order to implement the particular advertising campaign. The data that is shared with third-party advertisers relates to how you use our websites and apps, such as the pages you have visited, the searches you have made, and whether you have made a booking. We use specialist service providers to help us purchase advertising, and to transfer the information about your use of our services to third party advertisers that is required for those third party advertisers to be able to show you the correct advert.
- Ancillary Services - We sometimes work with partners to make services available to you that we think will be useful, such as travel insurance. If you avail of one of these services we may need to provide your details to that third party in order to allow them to provide the service. We may also share non-personally identifiable information with the third party to enable them to track that we referred you to them.
Transfers outside of the EU
There are certain circumstances where we will transfer your personal data outside of the European Union to a country which is not recognised by the European Commission as providing an equivalent level of protection for personal data as is provided for in the European Union. The most common of these is where we transfer personal data to an accommodation provider so that they can fulfil your booking. We may also transfer your personal data outside of the European Union in connection with the operation of our business, such as when we use a service provider that is based in another jurisdiction. If we transfer your personal data outside of the European Union please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. Please click here for more details.
When we transfer your personal data outside of the European Union, if required under data protection law we will either enter into contracts in the form approved by the European Commission with the entity that we transfer data to, or we will ensure that the company to which we transfer your personal data has agreed to abide by an approved transfer mechanism, such as the EU-US Privacy Shield framework. If you would like further details about the measures we have taken in relation to the transfer of your personal data, or copies of the agreements that we have put in place in relation to the transfers, please contact us using the details at the bottom of this notice.
Retention of personal data
We retain your personal data in accordance with our record retention policy. The record retention policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it, and in accordance with any requirements that are imposed on us by law. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please click here.
- Transaction Data - If you are an active user of our website (i.e. you have made a booking in the last 18 months) we want to ensure that you have access to data in relation to your previous bookings, and that we have access to this data for our own business purposes. We therefore won't delete your transaction data whilst you remain an active customer, unless you ask us to do so. If you cease to be an active customer, we will retain your personal data for a period of 4 years, in case you return to our website and want to continue using your account, and also so that we can continue to use transaction data to improve our services and undertake business analysis. After this 4 year period we anonymise the data, so that it is no longer possible for us to link it to you. However, our anonymisation process does let us re-identify you if you return to our site and use the same email address to make a booking. Please also note that if you are subscribed to our marketing database we will retain certain details even after the 4 year period expires, as set out below.
- Email Marketing - We will keep a copy of personal data that is required in order to send you marketing messages for as long as you are subscribed to receive those marketing messages. We will also retain certain information in relation to your transactions in order to allow us to customise our marketing messages. If you are subscribed to receive marketing messages and your transaction data is anonymised in our main database, we will continue to retain certain details in relation to your transactions, such as where you have booked properties before, what types of property you have booked, whether you have used our apps or our websites, your average length of stay, and what countries you have made bookings for and in.
For personal data that is not transaction data or related to email marketing, we will apply the following criteria:
- Managing legal claims – When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be made. If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made (which varies from 2 to 12 years).
- Business requirements – As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business purposes.
Important Information about Consent
When we process your personal data on the basis of your consent, you are free to withdraw that consent at any time. You can withdraw your consent by contacting us using the contact details at the bottom of this notice. If your consent relates to receiving email marketing you can use the unsubscribe link in the email, or if it relates to app notifications you can turn off app notifications using your device settings. Please note that if you withdraw your consent we may not be able to continue to provide the related service to you.
Your rights under data protection law
You have various rights under data protection law in connection with our processing of your personal data. For example, you have the right to request a copy of your personal data that we hold and to request that we correct any errors in the personal data that we hold. These rights are subject to certain exceptions and exemptions. For more details about your rights, click here.
You have the following rights under data protection law:
- Right to access your personal data - You have the right to request a copy of the personal data that we hold about you, together with other information about our processing of that personal data.
- Right to rectification – You have the right to request that any inaccurate data that is held about you is corrected, or if we have incomplete information you may request that we update the information so that it is complete.
- Right to erasure – You have the right to request us to delete personal data that we hold about you. This is sometimes referred to as the right to be forgotten.
- Right to restriction of processing or to object to processing – You have the right to request that we no longer process your personal data for particular purposes, or to object to our processing of your personal data for particular purposes.
- Right to data portability – You have the right to request us to provide you, or a third party, with a copy of your personal data in a structured, commonly used machine readable format.
Other Relevant Privacy Policies
Some of our third party advertising partners ask us to make you aware of their privacy policies. These policies are available by following the links below:
Questions and Complaints
If you have any queries or complaints in connection with our processing of your personal data, you can get in touch with us using the following contact details:
Phone: +353 1 498 0700
Post: Hostelworld.com Limited, One Central Park, 2nd Floor, Leopardstown, Dublin 18, Ireland
You also have the right to lodge a complaint with the Irish Data Protection Commission, or your local supervisory authority, if you are unhappy with our processing of your personal data. Details of how to lodge a complaint can be found on the www.dataprotection.ie website, or you can call the Data Protection Commission on +353 1 890 252 231.