Privacy Policy

YHA (England & Wales) is committed to protecting your personal information. This Privacy Policy explains how we collect information about you, how we use the information we collect, and how you can instruct us if you prefer to change the use of that information.

YHA (England & Wales) will update this Privacy Policy on a regular basis so that it reflects the measures we are taking in relation to your personal data. This Privacy Policy was last updated on the 26th April 2022.

1. Who we are

YHA (England & Wales) is one of the UK’s leading charities for young people, providing a wide range of hostel accommodation and programmes. Our aim is to improve health, wellbeing and life skills through travel and real adventure.

YHA (England & Wales) is a data controller and a data processor in terms of the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018, and is registered with the Information Commissioner’s Office (ICO).

  • ICO registration Number: Z6434257
  • Company Registration Number: 282555
  • Registered Charity Number: 306122

2. How we collect your information

Information about you will be collected by YHA (England & Wales) in a number of ways:

  • When you book accommodation
  • When you check in at one of our properties
  • When you join as a member
  • When you donate, buy raffle tickets, take part in fundraising events or subscribe to our lottery
  • When you volunteer
  • When you contact us
  • When you take part in surveys, events and competitions
  • When you review our Hostels or provide feedback on our services
  • When you use our websites
  • When you interact with us through social media or email
  • When you book our accommodation through third party websites
  • When you are involved in an accident or incident at one of our properties

3. What personal information we collect

YHA (England & Wales) may collect the following types of personal data about you:

  • Name and contact information (address, email and telephone number)
  • Gender
  • Date of birth
  • Payment details
  • Identification details, such as your passport
  • Medical information
  • Names and personal information for other people associated with a booking – we assume that you have their permission to share this information
  • Information relating to your online interaction with YHA (England & Wales), for example the pages you visit on our websites, your IP address, device and browser type, as well as social media interactions

4. How we use the information we collect

We use your personal information in the following ways:

  • To confirm and remind you of your reservations
  • To provide the services you have requested
  • To manage your volunteering and membership
  • To record and thank you for your donations
  • To manage your raffle entries or lottery subscriptions
  • To manage your participation in fundraising events
  • To record your interactions with us
  • To provide details of Hostel customers and visitors to NHS contact tracing services on request (see section 11 for more information)
  • Where we have your consent to contact you by email, post, text message or phone with relevant communications about our products and services, such as newsletters, surveys, promotions and charity appeals
  • To personalise the services we offer you through relevant communications, where you have given your consent for this
  • To help inform and improve the relevance of our online advertising
  • To analyse data so that we can better understand customer and supporter behaviours, trends and the impact of our activities
  • To analyse data so that we can better understand customer and supporter behaviours, trends and the impact of our activities
  • To record any accidents or incidents that you may have been involved in or witnessed at one of our properties
  • Where we process your personal information it may be held by YHA (England & Wales) or by trusted third party companies which processes it on our behalf

Please also read our Cookie Policy and our website terms and conditions.

5. How we store your personal information

The data that we collect from you will be securely stored and processed in the United Kingdom and may be transferred to, processed or stored at a trusted third-party destination within Europe or USA.

Where your data is stored and processed by a third party we have contracts in place to ensure that the data is afforded the same protections as it would be if it were hosted in the United Kingdom and in line with the requirements of the UK Data Protection Act 2018 and EU GDPR legislation.

6. How long we keep your information

We retain your personal information for as long as it is needed for the purposes it was collected. In some cases we must retain personal data in order to meet our legal obligations for reporting (for example, retaining financial records for up to seven years).

When your information is no longer required we will delete it securely.

We may retain information about customers whose conduct has been anti-social or breached our policies, for the purpose of restricting those customers’ future use of our services.

7. How we keep your information safe

We follow good security practices (including appropriate technical and organisational measures) in the processing, storage and disclosure of information which you have given us. 

We use a range of information security safeguards to keep your personal information secure, including but not restricted to the following:

  • Connections between internal systems and the internet are protected by firewalls;
  • data in transit is encrypted to industry standard
  • access to systems and data is protected by user-id and password controls, and employees can only access the data they need in order to perform their job;
  • your payment card data is always encrypted;
  • offices and secure areas are protected with physical access controls;
  • we continually monitor our systems for vulnerabilities and signs of attack, and carry out penetration tests regularly to assess the strength of our defences;
  • we enforce physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personal information; and
  • before divulging your personal information in response to a telephone call or email enquiry, we ask you for proof of identity in order to ensure that we do not provide your personal information to someone else.

8. Information about young people

We welcome children and young people to our hostels and to our online services, and we take extra care when handling information about young people, for example Summer Camps. However, our online bookings, membership, donation and purchasing services are intended for users aged 16 years and over, so please do not use these if you are under 16 years old.

The age a child can give consent varies - it is 13 years of age in the United Kingdom and up to 16 years in some EU Countries. If you provide information to us about children, then you confirm that you are the parent or legal guardian, or have the consent of the parent or legal guardian if they are below the age where they can give consent independently.

9. CCTV

We use Closed Circuit Television (CCTV) at some of our properties, and you may be recorded when you visit them. We use CCTV in order to help protect YHA guests, employees and visitors, and to protect YHA’s premises from criminal activities. CCTV footage will only be viewed when necessary – for example to detect a crime.

We comply with the ICO’s Code of Practice on the use of CCTV.

10. Disclosing your information to other organisations

Some of our hostels are operated by organisations other than YHA (England & Wales). Where you make a booking or enquiry about those hostels, we will pass your information on for the purpose of providing the services or information you have requested.

We may use trusted third parties to process your information on our behalf and when we do, appropriate data privacy contracts and clearly defined processing, storage and retention instructions will be in place. We will only transfer your personal information on the understanding that the third party has undertaken to us that they have in place adequate technical and organisational measures to protect that information.

We may release your information to the police or other authorities where we are under a legal obligation to do so, or where doing so is in your vital interests.

We may engage with trusted third parties to analyse data about our customers, supporters and website users in order to provide us with greater insight into customer and supporter behaviour for the purpose of informing future developments.

We may also provide anonymous statistics to reputable third parties for the purpose of analysis. These statistics will not include any personal information.

11. Your rights

You may, at any time:

  • Ask us what information we hold about you and what we are doing with it
  • Request copies of the information we hold about you
  • Ask us to correct your information if it is inaccurate
  • Request that we delete your information
  • Ask us to change the way we process your information
  • Object to our processing of your information
  • Change how we communicate with you

Requests in writing (email or post) can be sent to the address below. You will be required to prove your identity before a personal data request is actioned.

If you want to unsubscribe from YHA emails, you will find an unsubscribe link on the footer of our emails. A link is also provided to our email preference centre, which allows you to determine what kind of content you want to receive from YHA (England & Wales) in the future.

12. How to get in touch

If you have any questions about this Privacy Notice or wish to exercise your data privacy rights, please contact us as follows:

Email us: [email protected]

Write to us: Data Protection Team, YHA (England & Wales), Trevelyan House, Dimple Road, Matlock, DE4 3YH

Company Registration Number: 282555

Registered Charity Number: 306122

Registration Number with ICO: Z6434257