Privacy policy

1. Controller

2. Hosting and server logs

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When the website is accessed, the server processes technically necessary access data such as IP address, date and time, requested file, transferred data volume, referrer, browser and operating-system information. This is necessary to deliver the website, ensure stability and security and detect attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure and reliable operation of the website. STRATO states that IP addresses in web-server logs are generally stored for no more than seven days for attack detection and defence. A data-processing agreement with STRATO is or must be in place before launch.

3. Contact and group enquiry forms

When you contact us through a form, we process the information entered in order to handle and answer the enquiry. Depending on the form, required information includes your name or contact person, email address, subject or travel dates, number of guests and purpose of travel, and your message. Phone number and booking reference are optional. Contact enquiries are sent to reception@backpackers-stpauli.de and group enquiries to gruppenanfrage@backpackers-stpauli.de. The technical sender is website@backpackers-stpauli.de; no automatic confirmation is sent to the guest.

Where the enquiry concerns a booking or another contractual service, processing is based on Article 6(1)(b) GDPR for steps taken at your request before entering into a contract. General communication, abuse prevention and secure operation are additionally based on Article 6(1)(f) GDPR. The forms do not store a separate permanent copy of the message in the website database. Technical delivery and abuse logs do not contain message texts and are deleted automatically after 14 days. Subsequent correspondence is retained only for as long as needed to handle the enquiry or contract and to comply with statutory evidence and retention obligations.

Additional technical information about the forms

4. Direct booking via Book.World / DormProject

The booking section integrates an external booking component supplied by Book.World. The provider is alixon gmbh, Aarepark 2a, 5000 Aarau, Switzerland. Loading the component establishes a connection to the provider’s systems. In particular, the IP address, browser and device information, time and requested page may be processed, and technically necessary cookies or comparable storage may be used. Once you start a booking, the provider also processes the information entered for availability search, reservation, payment and booking administration.

Processing to initiate and perform a booking is based on Article 6(1)(b) GDPR. Where access to your device is strictly necessary for the booking function expressly requested, this is governed by section 25(2) TDDDG. Non-essential cookies or comparable technologies may only be used after valid consent. Switzerland is covered by an adequacy decision of the European Commission. The allocation of data-protection roles, possible payment providers and the cookies actually used must be confirmed before launch against the current Book.World agreement and a technical test.

Open the Book.World privacy policy

5. Map and route links

The website currently does not embed an interactive map automatically. Links to OpenStreetMap and routes in Google Maps are opened only after you actively select them. From that point onwards, the privacy terms of the respective provider apply; in particular, IP address, location or route data may be processed.

6. Cookies, local storage and analytics

At the current development stage, the hostel website itself uses no analytics, advertising trackers, social-media plugins or externally loaded web fonts. The external booking component may use its own technically necessary or additional technologies. This will be checked again with browser developer tools before launch. If analytics, marketing or other non-essential technologies are added later, they will be activated only after appropriate information and, where required, consent.

7. Recipients and processors

Personal data is received only by parties that need it to provide the website, handle your enquiry or perform a booking. These include authorised hostel staff, STRATO as hosting and email provider, and Book.World or payment service providers involved in the booking process. Data is also disclosed where required by law or where you have consented.

8. Retention periods

We delete personal data once the relevant purpose no longer applies and no statutory retention or evidence obligations prevent deletion. Pure contact enquiries without a subsequent contract are deleted after communication is complete unless further retention is necessary. Depending on the type of document, booking, payment and business records may be subject to statutory retention periods commonly lasting six, eight or ten years.

9. Your rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing and data portability. You may object, on grounds relating to your particular situation, to processing based on legitimate interests. Consent can be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with a data-protection supervisory authority.

10. Security and updates

The website is provided using encrypted HTTPS connections. We take appropriate technical and organisational measures to protect data against loss, manipulation and unauthorised access. This privacy policy will be updated when functions, providers or legal requirements change.