Privacy Statement

Welcome to our website. We have put together some information for you here about the way we process your data in accordance with Art. 13 of the General Data Protection Regulation (GDPR).

1. Websites // 2. Bookings

Data controller

The function named in the "Legal Notice" section of this website is responsible for data processing as described below.

Usage data

When you visit our websites, our web server temporarily stores data referred to as usage data in the form of a protocol for statistical purposes and in order to improve the quality of our websites. This dataset comprises:

• name and address of the content accessed,
• date and time of enquiry,
• quantity of data transmitted,
• access status (transmitted content, content not found),
• description of web browser and operating system,
• referral link, which tells us the page from where you reached ours,
• IP address of the source computer of the enquiry in abbreviated form to prevent
• any personal identification.

The protocol data listed above are only evaluated anonymously.

Storage of IP address for security purposes

In addition to the above, we save the full IP address sent by your device, strictly for use only for its legitimate purpose for 14 days, the legitimate interest being to enable identification, limitation and elimination of attacks on our websites. When this period expires, we delete and/or anonymise the IP address. The legal basis for this is Art.  6 Paragraph 1 S. 1 lit. f GDPR.

Data security

We take technical and organisational measures in order to protect your data as comprehensively as possible against unwanted access. We use encryption on our websites. Any details sent via the internet from your computer to our server or vice-versa are transmitted by means of TLS encryption. You can usually recognise this if the padlock symbol in the status bar of your browser is displayed in locked position and the URL is displayed in your browser's address bar starting with https://.

Necessary cookies

Our website places cookies that are essential for its operation.

Cookies are small text files that can be stored and read out on your terminal device. There is a distinction between session cookies, which are deleted again as soon as you shut down your browser, and permanent cookies, which are saved beyond the individual session.

We do not use the necessary cookies we place for the purpose of analysis, tracking or advertising.

Some of these cookies contain only information for particular settings and are not related to personal data. They may be necessary to enable user navigation, security and practical realisation of the website.

We use this kind of cookies as permitted under Art. 6 Paragraph 1 S. 1 lit. f GDPR.

You can adjust the settings of your browser so that it informs you about the placing of cookies. In this way, the use of cookies is transparent to you. You can also delete cookies and prevent the placement of new cookies via the appropriate browser settings. Please note that, in this case, our websites may not be displayed or certain technical functions may not be available. You will find a list of the cookies we use under the "Privacy Settings" tab.

Google Consent Mode

We use Google Consent Mode V2 (Basic Mode). As a consequence, your IP address is always transmitted to Google, irrespective of your choice you have made in the cookie consent banner. The IP address is then deleted by Google immediately after its receipt and no record of it is kept. This processing is justified by our legitimate interest in the optimised use and management of the Google services we use on our website. Art. 6 Paragraph 1 S. 1 lit. f GDPR is the legal basis for this processing.

Google Analytis

In order to tailor our web pages to our users’ needs, we use the Google’s Analytics web tool. Google Analytics creates usage profiles based on pseudonyms. To this end, permanent cookies are placed on your terminal device and accessed by us. This puts us in a position to recognise returning users and count them as such. 
In the context of Google Analytics, Google Ireland Limited and Google LLC. (USA) support us as data processors pursuant to  Art. 28 GDPR. Accordingly, processing may also take place outside the EU or EEA (specifically, in the USA). The EU-U.S. Data Privacy Framework (Adequacy Decision) ensures that Google protects the data in an appopriate manner. In addition, Google has also agreed to conclude standardised contractual agreements with any sub-processors it may use. However, Google LLC may not provide an adequate level of protection at all times, since it processes data within the USA. There is a risk that authorities may access the data for safety and monitoring purposes without informing you of said intervention and without any means of redress. Please bear this in mind when you consent to our use of your data  for the purposes of Google Analytics.
You may withdraw your consent at any time. Should you wish to do so, please open the “Privacy Settings” section of this web page.

Google Tag Manager

We use Google Tag Manager. With the exception of IP addresses, Google Tag Manager does not collect any personal data. Google Tag Manager is a tool that helps us integrate and manage our tags; tags are small elements of code that are used, among other purposes, to measure traffic and user behaviour, to gauge the impact of online ads and social media channels, to set up our remarketing/retargeting activities, and to test and optimise websites. We use Tag Manager for the Google Ads and Google Analytics web services. Data is processed in accordance with Art. 6 Paragraph 1 S. 1 lit. f GDPR.

Third-party tracking technologies for advertising purposes

We use cross-device tracking technologies that enable us to display targeted advertising to you on other web pages based on your visit to our website and to determine how effective our advertising has been.

Data is processed on the basis of your consent if you have consented accordingly through one of our banners. Your consent is voluntary and can be withdrawn at any time.

How does tracking work?

When you visit our web pages, the third-party providers mentioned below may retrieve data by which your browser can be identified (e.g., data called a 'browser fingerprint') or your IP address evaluated, or may store or retrieve data from your device by which the device can be identified (e.g., cookies), or access individual tracking pixels.

Such identifying data may be used by these third parties to recognise your device when you access other internet pages. We may commission such third parties to display advertising to you on websites based on the sites you visited before.

What does cross-device tracking mean?

When you log on to a third-party site with your user credentials, identifiers collected from different browsers and devices can be linked to each other. If the third-party provider has created its own identifier for the laptop, desktop, smart phone or tablet you are using to access their site, the different identifiers can be linked to each other as soon you use the third-party service while logged in with your own user credentials. This way, third-party providers can display our campaigns in a targeted manner even across various devices.

Which third-party providers do we use for this?

Below, we list the third-party providers we cooperate with for the purpose of delivering adverts. Insofar as data is processed outside the EU or EEA for this purpose, please note that there is a risk that authorities may access such data for safety and monitoring purposes without informing you of said intervention and without any means of redress. To the extent that we commission service providers in unsafe third countries and you have given us your consent, data is transmitted to the third country on the basis of Art. 49 Paragraph 1 lit. a GDPR.

Anonymous visitor measurement

In addition, we carry out anonymous visitor measurement on our websites. For this purpose, the log data of the web server and the truncated IP address are evaluated. It is not possible to draw any conclusions about your person.

Contact form

If you wish to contact us via our contact form, we will need you to provide the data marked as mandatory entries in our contact form.

We require this information to provide you with an answer and use it in compliance with Art. 6 Paragraph 1 S. 1 lit. f GDPR.

Otherwise, you can decide for yourself whether you wish to send any further details to us. Any such data is given voluntarily and is not absolutely necessary for establishing contact. We process your voluntarily given data with your consent under Art. 6 Paragraph 1 S. 1 lit. a GDPR. 

We process your data solely for the purpose of replying to your question. Any of the following regional DJH Associations (Landesverbände) may be in receipt of your data if it is in a better position to answer your enquiry:

• Landesverband Baden-Württemberg e. V., Fritz-Walter-Weg 19, 70372 Stuttgart - Bad Cannstatt
• Landesverband Bayern e.V., Mauerkircherstraße 5, 81679 München
• Landesverband Berlin-Brandenburg e.V., Babelsberger Str. 28, 14473 Potsdam
• Landesverband Hannover e. V., Ferdinand-Wilhelm-Fricke-Weg 1, 30169 Hannover
• Landesverband Hessen e.V., Berner Str. 119, 60437 Frankfurt am Main
• Landesverband Mecklenburg-Vorpommern e.V., Konrad-Zuse-Straße 2, 18057 Rostock
• Landesverband Nordmark e.V., Rennbahnstraße 100, 22111 Hamburg
• Landesverband Rheinland e. V., Düsseldorfer Straße 1a, 40545 Düsseldorf
• Die Jugendherbergen in Rheinland-Pfalz und im Saarland, In der Meielache 1, 55122 Mainz
• Landesverband Sachsen e. V., Zschopauer Straße 216, 09126 Chemnitz
• Landesverband Sachsen-Anhalt e. V., Leiterstraße 10, 39104 Magdeburg
• Landesverband Thüringen e.V., Zum Wilden Graben 12, 99425 Weimar
• Die JugendHerbergen gemeinnützige GmbH, Woltmershauser Allee 8, 28199 Bremen
• DJH Landesverband Westfalen-Lippe gemeinnützige GmbH, Eppenhauser Straßsse 65, 58093 Hagen

We delete your data as soon as they are no longer needed, provided there is no legal storage obligation.

You may withdraw permission to process the data based on Art. 6 Paragraph 1 S. 1 lit. f GDPR  via the contact form at any time. You can also revoke your consent to the processing of your voluntarily given data at any time. To do so, please refer to the email address given in the "Legal Notice" section of this website.

Contact via live chat

Our website offers you an opportunity to contact us with your specific questions via a live chat. When you do so, the messages exchanged between you and us are processed. The data transmitted to our servers is encrypted using the TLS protocol (https) so that it cannot be accessed by third parties. Art. 6 Paragraph 1 S. 1 lit. f GDPR is the legal basis for this processing. Should you wish to prevent any further processing of your data beyond this, please let our employee know. We use cookies in order to differentiate between individual chat sessions. This way, you can continue your chat even if you open additional pages of our web site or change from one page to another within the web site. We use a service provider strictly bound by our instructions for the technical aspects of the live chat (INEXSO GmbH, registered in Germany), with whom we have concluded a data processing agreement. The contents of chats is stored for a period of three months. Content may be stored longer if this is required for follow-up or you have given your consent. In this case, we may ask you for details to link the chat to you, e.g., your customer number or email address for further communication.

Embedded videos

The videos that we embed in our websites are not stored on our own servers. In order to avoid automatic loading of content from third-party providers when accessing web pages with embedded videos, we display only locally stored preview images of the videos in the first step. This way, the third-party provider does not receive any information. Only when you click on the preview image is content from the third party loaded with it. In this way, the third-party provider receives the information that you have accessed our website plus the technically necessary usage data. The third-party provider would now be enabled to install tracking technology.

We have no influence on further data processing by the third-party providers. A click on the preview image means that you are giving your consent to load third-party content. Embedding is legally permitted Art. 6 Paragraph 1 S. 1 lit a GDPR once you have given your consent by clicking on the preview image. We have provided information on the level of data protection for data processed outside the EU or EEA (specifically, in the USA) in the table below.

Subscription and mailing of newsletter

You are welcome to subscribe to our newsletter on our internet page. Please note that we require certain data (minimum: your email address) in order to take your subscription to the newsletter.

The newsletter will be mailed only if you have explicitly given us your consent according to Art. 6 Paragraph 1 S. 1 lit. a GDPR. To this end, we use AGNITAS AG, Werner-Eckert-Strasse 6, 81829 Munich, Germany, or Salesforce Germany GmbH, Erika-Mann-Str. 31, 80636 Munich, Germany, as our service provider (data processor). This company has undertaken to adhere strictly to our instructions and set out these obligations in a binding contract.

After successfully subscribing via our websites, you will receive email confirmation to the email address you have given us (this is known as double opt-in). Your consent can be revoked at any time. An uncomplicated way to unsubscribe is to follow the unsubscribe link that is present in every newsletter.

As part of the subscription to the newsletter, we store some additional necessary data in addition to those described above, as proof if needed that you have ordered the newsletter. This may include the complete IP address at the time of subscribing and/or confirmation of the newsletter, and a copy of the email confirmation sent by us. The corresponding data processing is governed by Art. 6 Paragraph 1 S. 1 lit. f GDPR and serves the legitimate interest of accountability for the Newsletter.

Map services

Map services not stored on our servers are embedded in our websites. In order to prevent automatic loading of third-party content when accessing our websites with embedded map services, we display only locally saved preview images of the maps in the first step. At this stage, the third-party provider receives no information.
Third-party content is loaded only when the preview image is clicked. The third-party provider now receives the information that you have accessed our page together with the technically necessary usage data. We have no influence on further processing by the third party. With your click on the preview image, you are giving your consent to download third-party content. 
Embedding is based on your consent according to Art. 6 Paragraph 1 S. 1 lit. a GDPR and/or Art. 15 Paragraph 3 S. 1 TMG, respectively, which you have given by means of a click on the preview image. 
Please note that using the embedded map services can lead to your data being processed outside the EU or EEA (specifically, in the USA). We have provided information on the level of data protection for data processed outside the EU or EEA (specifically, in the USA) in the table below.

Other data processors

We pass on your data in connection with commissioned data processing according to Art. 28 GDPR to service providers who support us in operating our websites and running associated processes, for example to web hosting service providers. Our service providers have undertaken to adhere strictly to our instructions and set out these obligations in a binding contract.

The data processors with whom we cooperate are listed below unless already named in the previous text of this Privacy Statement. Should any data be transferred outside the EU and/or EEA respectively, we have provided details on the data protection level below.

Your Rights as Data Subject

Right of access (Art. 15 GDPR) 
You have the right to demand confirmation whether personal data affecting you are being processed; if this is the case, you are entitled to receive information about the personal data in question and the details of information detailed in Art. 15 GDPR

Right of rectification (Art. 16 GDPR)
You are entitled to demand immediate rectification of incorrect personal details and, if appropriate, completion of incomplete data.

Right to erasure (Art. 17 GDPR)
You have the right to demand that personal data relating to you be deleted without delay on any of the grounds listed in Art. 17 GDPR.

Right to restriction of processing (Art. 18 GDPR)
You are entitled to demand restriction of processing if any of the conditions listed in Art. 18 GDPR is given, e.g., if you have lodged a complaint against processing, for the duration of examination by the responsible person.

Right to data portability (Art. 20 GDPR)
In specific cases, as listed in Art. 20 GDPR, you have the right to receive the personal data in question in a structured, common and machine-readable format and/or demand that these data be sent to a third party.

Right of revocation (Art. 7 GDPR)
Inasmuch as the processing of data takes place on the basis of your consent, you are entitled under Art. 7 Paragraph 3 GDPR to withdraw your consent to the use of your personal data at any time. Please note that revocation of consent is only effective for the future. Processing that has taken place before you revoke your consent is not affected retrospectively.

Right to object (Art. 21 GDPR)
If data are captured on the basis of Art. 6 Paragraph 1 S. 1 lit. f GDPR (data processing in a legitimate interest) or on the basis of Art. 6 Paragraph 1 S. 1 lit. e GDPR (data processing in the public interest or the exercise of public powers), you are entitled at any time to object to such processing on grounds arising from your particular situation. We will then no longer process the personal data unless urgent and compelling reasons for such processing can be evidentially proved and override your interests, rights and liberties, or the processing serves the assertion, exercise or defence of legal claims.

Right of complaint to supervisory authority (Art. 77 GDPR)
You have the right under Art. 77 GDPR to lodge a complaint to a supervisory body if you are of the opinion that the processing of your personal data breaches data protection law. In particular, you can lodge your complaint with a supervisory body in the member state of your main residence, of your usual place of work or the place where the alleged breach occurred.

Asserting your rights
If not covered by the above, you may turn to the office named in the Legal Notice section of this website to claim redress as the victim of unlawful use of personal data.

Contact the Data Protection Officer

Our independent Data Protection Officer will be happy to give you information in connection with data protection matters. Here is the contact address:

datenschutz nord GmbH
Konsul-Smidt-Strasse 88
28217 Bremen
Web: www.datenschutz-nord-gruppe.de
Email: office@datenschutz-nord.de

If you wish to address our Data Protection Officer, please state the responsible function named in the Legal Notice section of our website.
 

The regional DJH Association (Landesverband) for the area in which you live is responsible for data processing (data controller):

• Landesverband Baden-Württemberg e. V., Fritz-Walter-Weg 19, 70372 Stuttgart - Bad Cannstatt
• Landesverband Bayern e.V., Mauerkircherstr. 5, 81679 Munich
• Landesverband Berlin-Brandenburg e.V., Babelsberger Str. 28, 14473 Potsdam
• Landesverband Hannover e. V., Ferdinand-Wilhelm-Fricke-Weg 1, 30169 Hanover
• Landesverband Hessen e.V., Berner Str. 119, 60437 Frankfurt am Main
• Landesverband Mecklenburg-Vorpommern e.V., Konrad-Zuse-Str. 2, 18057 Rostock
• Landesverband Nordmark e.V., Rennbahnstr. 100, 22111 Hamburg
• Landesverband Rheinland e. V., Düsseldorfer Str. 1a, 40545 Düsseldorf
• Die Jugendherbergen in Rheinland-Pfalz und im Saarland, In der Meielache 1, 55122 Mainz
• Landesverband Sachsen e. V., Zschopauer Str. 216, 09126 Chemnitz
• Landesverband Sachsen-Anhalt e. V., Leiterstr. 10, 39104 Magdeburg
• Landesverband Thüringen e.V., Zum Wilden Graben 12, 99425 Weimar
• Die JugendHerbergen gemeinnützige GmbH, Woltmershauser Allee 8, 28199 Bremen
• DJH Landesverband Westfalen-Lippe gemeinnützige GmbH, Eppenhauser Str. 65, 58093 Hagen

Data processing is carried out by the youth hostel where you booked your services, as well as by the office of the data controller.

The nature, purposes and legal basis of data processing

We process the following personal data about you:

• data of the person making the booking (name, address, e-mail address, landline/mobile phone number, DJH membership number);
• data of the persons accompanying the person making the booking (name, address, e-mail address if applicable, landline or mobile phone number, DJH membership number);.
• booking details (number and ages of the guests, booking period, meal arrangements, accommodation chosen);
• bank details, if applicable;
• where applicable, details of any of our chargeable services (additional services such as bed linen or Wi-Fi; leisure activities) that you use during your stay.
• After booking a stay at the youth hostel, you can provide feedback on the quality of your stay. An e-mail will be sent to you after your stay. For this purpose, the personal data (name, e-mail address, duration of stay) required for analysis and enquiries will be stored for a maximum of 3 months.

The legal basis for data processing in each case is Article 6(1)(b) of the GDPR (for the performance of a contract or in order to take steps prior to entering into a contract).

Where the contract has been or is to be concluded with a legal entity or institution (e.g. an association, school, nursery, public authority or company), the data of the contact persons at that legal entity or institution will be processed on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in the performance of the contract with the legal entity or institution to which you belong.

On the basis of consent pursuant to Article 6(1)(a) of the GDPR[SL1] . This includes, among other things, the manner in which specific offers are used (e.g. whether you were interested in certain content from the newsletter or on the DJH website).

In addition, we process specific categories of personal data (e.g. information relating to a disability to provide a suitable room; or information relating to allergies to take them into account when preparing meals). The legal basis for the processing of this data is Article 9(2)(a) of the GDPR (consent). Consent may be withdrawn at any time with effect for the future. Any data processing carried out up to the point at which consent is withdrawn remains lawful.

We process your name and address in accordance with Article 6(1)(f) of the GDPR in order to inform you by post about our offers (based on the legitimate interest in promoting our services). You may object at any time to the use of your data for marketing purposes. You can contact our data protection officers via the office of the data controlle in charge.

If we have obtained your e-mail address as part of a contractual relationship, we will use it to inform you about the same or similar products and offers. The purpose of this application is to further the legitimate interest of increasing the occupancy rate of our youth hostels. You may object at any time to the use of your e-mail address for marketing purposes (contact details below under “Your data protection rights”), without incurring any costs other than the standard transmission charges.

Disclosure of data

We will only disclose your data to third parties where there is a legal basis for such disclosure under data protection law (e.g. consent, performance of a contract, legitimate interest). If necessary, personal data will be disclosed to companies involved in the processing or fulfilment of this contract, e.g. banks for payment processing, and partners involved in organising events booked.
We may use the services of external service providers to process data. Such providers are strictly bound by instructions. Data processing agreements have been concluded with these parties and we regularly audit these agreements.

Data deletion

We will delete your data once they are no longer required for the purposes set out above and provided that there are no statutory retention periods (in particular under the German VAT Act (UStG), the German Commercial Code (HGB) and the German Fiscal Code (AO)) that prevent their deletion. This is usually the case with accounting data after 10 years.

Your data protection rights

When processing your personal data, the GDPR grants you, the data subject, certain rights:

Right of access (Article 15 of the GDPR)
You have the right to request confirmation as to whether personal data relating to you is being processed; where this is the case, you have the right to access this personal data and to receive the information specified in detail in Article 15 of the GDPR.

Right to rectification (Article 16 of the GDPR)
You have the right to request, without delay, the rectification of any inaccurate personal data concerning you and, where necessary, the completion of any incomplete data.

Right to erasure (Article 17 of the GDPR)
You have the right to request that personal data relating to you be erased without delay, provided that one of the grounds set out in detail in Article 17 of the GDPR applies.

Right to restriction of processing (Article 18 of the GDPR)
You have the right to request that processing be restricted if any of the conditions set out in Article 18 of the GDPR apply, e.g. if you have objected to the processing for the period of the data controller’s review.

Right to data portability (Article 20 of the GDPR)
In certain cases, as set out in detail in Article 20 of the GDPR, you have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, or to request that this data be transferred to a third party.

Right to withdraw consent (Article 7 of the GDPR)
Where the processing of data is based on your consent, you are entitled, under Article 7(3) of the GDPR, to withdraw your consent to the use of your personal data at any time. Please note that the cancellation will only take effect for the future. Processing that took place before the withdrawal of consent is not affected by this.

Right to object (Art. 21 GDPR)
Where data is collected on the basis of Article 6(1), first sentence, point (f) of the GDPR (data processing to safeguard legitimate interests) or on the basis of Article 6(1), first sentence, point (e) of the GDPR (data processing to safeguard the performance of a task carried out in the public interest or in the exercise of official authority), you have the right, on grounds relating to your particular situation, to object to the processing at any time. We will then no longer process your personal data unless there are demonstrable and compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR)
Under Article 77 of the GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the data protection regulations. You may exercise your right to lodge a complaint, in particular with a supervisory authority in the Member State of your habitual residence, place of work, or place of the alleged infringement.

Asserting your rights
You can contact our data protection officers via the office of the data controller in charge.