Privacy Policy

1. Introduction

Casa Hostel Pirna ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or stay at our hostel.

We process personal data in compliance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (Bundesdatenschutzgesetz - BDSG).

2. Data We Collect

2.1 Information You Provide

We collect information you voluntarily provide when:

• Making a reservation (name, email, phone, address)
• Checking in (passport/ID information as required by German law)
• Contacting us via email or contact form
• Subscribing to our newsletter
• Making a payment (payment card details)

2.2 Automatically Collected Information

When you visit our website, we may automatically collect:

• IP address
• Browser type and version
• Operating system
• Referring website
• Pages viewed and time spent
• Date and time of visit

2.3 Legal Requirements (Meldeschein)

German law (Bundesmeldegesetz) requires accommodation providers to collect and store certain guest information:

• Full name
• Date of birth
• Nationality
• Passport/ID number
• Home address
• Arrival and departure dates

3. How We Use Your Data

We use your personal data for the following purposes:

• Reservation Processing: To process and manage your booking
• Guest Registration: To comply with German registration laws
• Payment Processing: To process payments securely
• Communication: To send booking confirmations and respond to inquiries
• Service Improvement: To improve our services and website
• Marketing: To send promotional materials (only with your consent)
• Legal Compliance: To comply with legal obligations

4. Legal Basis for Processing

Under GDPR, we process your data based on:

• Contract Performance (Art. 6(1)(b) GDPR): Processing necessary for booking and accommodation services
• Legal Obligation (Art. 6(1)(c) GDPR): Processing required by German law (guest registration)
• Legitimate Interest (Art. 6(1)(f) GDPR): Processing for business operations and security
• Consent (Art. 6(1)(a) GDPR): Processing for marketing communications

5. Data Sharing

We may share your data with:

• Payment Processors: To process your payments securely
• Booking Platforms: If you booked through a third-party platform
• Authorities: When required by law (e.g., police, tax authorities)
• Service Providers: IT services, accounting (under data processing agreements)

We do not sell your personal data to third parties.

6. Cookies

Our website uses cookies to enhance your experience. Cookies are small text files stored on your device.

6.1 Types of Cookies We Use

• Essential Cookies: Required for website functionality
• Analytics Cookies: Help us understand website usage (Google Analytics)
• Marketing Cookies: Used for advertising purposes (only with consent)

6.2 Managing Cookies

You can control cookies through your browser settings. Disabling cookies may affect website functionality.

6.3 Google Analytics

We use Google Analytics to analyze website traffic. Google Analytics uses cookies and collects anonymized data. You can opt out using the Google Analytics Opt-out Browser Add-on.

7. Data Retention

We retain your data for the following periods:

• Guest Registration (Meldeschein): 1 year (as required by German law)
• Booking Records: 10 years (German commercial law - HGB)
• Invoice/Payment Data: 10 years (German tax law - AO)
• Marketing Data: Until consent is withdrawn
• Website Analytics: 26 months

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of your data
• Right to Rectification (Art. 16): Correct inaccurate data
• Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
• Right to Restrict Processing (Art. 18): Limit how we use your data
• Right to Data Portability (Art. 20): Receive your data in a portable format
• Right to Object (Art. 21): Object to processing based on legitimate interest
• Right to Withdraw Consent (Art. 7): Withdraw consent at any time

To exercise your rights, contact us at: info@casahostelpirna.com

9. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• SSL/TLS encryption for data transmission
• Secure payment processing (PCI DSS compliant)
• Access controls and authentication
• Regular security updates
• Staff training on data protection

10. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). In such cases, we ensure adequate protection through:

• EU Standard Contractual Clauses
• Adequacy decisions by the European Commission
• Other appropriate safeguards as required by GDPR

11. Children's Privacy

Our services are not directed to children under 16. We do not knowingly collect personal data from children without parental consent. If you believe we have collected data from a child, please contact us immediately.

12. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority. The relevant authority for Saxony is:

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this policy periodically.

Last updated: January 2025