Privacy

In short

• Your data is used only to answer your request for a bed, to prepare your stay and to run the site.
• No advertising or audience-measurement cookie is set, and no third-party service is loaded during your visit.
• Requests are kept for 3 years, anonymous audience measurement for 13 months and technical logs for 12 months.
• You can erase your request yourself with the form at the bottom of this page and exercise all your other rights with the operator.

The details follow below.

Who is responsible for your data?

The operator of the hostel, whose identity, address and contact details are given in the legal notice. You can write to them with any question about your data.

The hostel has not appointed a data protection officer (DPO): an organisation of this size is not required to. Your questions are handled directly by the operator.

What data, for what purpose, on what basis?

Your request for a bed

• What you enter: name, email, phone (optional), language, arrival date, number of nights and guests, type of room, meals, extras (travel cot, animal), pilgrim status, way of travelling and message.
• Required fields: name, email, arrival date, number of nights and guests, and type of room. Without them the request cannot be handled; your email is used to reply to you. All other fields are optional.
• Technical data: a non-reversible fingerprint of your IP address (salted hash; the address itself is never stored), the time taken to fill in the form, the page it was sent from, the referring website (domain name only) and, where relevant, the campaign (UTM parameters).
• Why: to answer your request, prepare your stay and send you an acknowledgement; the technical data is used to filter out automated submissions and to learn how the hostel was found.
• Legal basis: steps taken at your request prior to a contract (Article 6(1)(b) GDPR); legitimate interest in preventing abuse (Article 6(1)(f)). The tick box on the form confirms that you have read how your data is used; the legal basis remains the one above.
• Sensitive data: the form does not ask for any. If you choose to mention health information in your message (a food allergy, for example), it is used only to prepare your stay and is kept for as long as your request.
• Emails exchanged: your request is also forwarded by email to the operator; any follow-up by email or phone stays between you and the hostel and is kept for the same periods.

Sorting of requests

An automatic indicator from 0 to 100 helps the operator spot incomplete or suspicious requests (disposable email address, multiple links, typical advertising wording). A very suspicious request is filed with unwanted messages but remains visible to the operator for 90 days. No decision producing legal effects concerning you or similarly significantly affecting you is taken solely by automated means (Article 22 GDPR): the operator reads, answers and confirms every stay.

Audience measurement

• What is measured: page viewed, reading time, device type (mobile, tablet or computer), language, referring website (domain name) and campaign, plus a few actions that matter to the hostel (call, email, form submission, opening a photo, switching language). Visitors are counted per day using a non-reversible daily fingerprint that is recalculated every day: neither your IP address nor your browser is stored, and no cookie is used.
• Why: to understand overall visits to the site and improve it.
• Legal basis: legitimate interest (Article 6(1)(f)). The measurement is in-house and anonymous, respects “Do Not Track” and “Global Privacy Control” signals, ignores robots and meets the CNIL's conditions for exemption from consent. To object, turn on either signal in your browser: nothing is recorded any more.

Running and securing the site

• What is kept: the accounts of the people who manage the site (email, name, irreversibly encrypted password), the log of actions and sign-ins (with a truncated fingerprint of the IP address) and technical logs.
• Why: to protect the site, detect intrusion attempts and keep track of changes.
• Legal basis: legitimate interest (Article 6(1)(f)).

Your erasure request

When you use the erasure form, your email address is used to send you the confirmation link. Once the erasure is done, only a fingerprint of the address (not the address itself) stays in the action log for 12 months, to prove that your request was handled. Legal basis: the operator's obligations regarding your rights (Article 6(1)(c)).

How long?

• Requests for a bed: 3 years after the last exchange, then deleted automatically.
• Messages identified as spam: 90 days.
• Audience measurement: 13 months (plus the current month), then deleted automatically.
• Action log and technical logs: 12 months.
• Anti-spam block list (email address and IP fingerprint of an abusive sender): for as long as the abuse justifies it; the operator removes it on request.
• Administration accounts: until they are deleted.
• Backups: the hosting provider's automatic backups are replaced over time; backups downloaded by the operator are kept in a safe place and deleted when no longer needed. Erased data therefore gradually disappears from backups too.

Who can see your data?

• The operator of the hostel and the people they allow to manage the site, who are bound by confidentiality.
• Their hosting provider, a processor under the GDPR: Hostinger International Ltd, 61 Lordou Vironos Street, 6023 Larnaca, Cyprus (European Union).
• Their email service, a processor, to send you the acknowledgement and forward your request to them.
• The technical provider in charge of maintenance, occasionally and on the operator's instructions.

Processors act only on the operator's instructions, under a contract that complies with Article 28 GDPR. Your data may also be disclosed to an authority that requests it within a legal framework (a court order, for example).

Your data is never sold, rented or used for advertising. The site loads no third-party resource (no advertising, social network, font, map or video hosted elsewhere), so your visit is not disclosed to anyone else.

Where is your data stored?

On the hosting provider's servers, in a data centre located in the European Union. The site does not transfer any data outside the European Union.

Cookies and browser storage

No advertising, audience-measurement or social-network cookie is set, which is why no banner asks for your consent. Only the following exist:

• gc_pub: a technical session cookie, set only when you use a form (request for a bed or data erasure). It protects against fraudulent submissions and disappears when you close your browser. It is strictly necessary.
• theme: browser local storage (localStorage), created only if you choose the light or dark theme. It stays on your device.
• Offline copy: your browser may keep pages and images of the site to show them without a connection on the trail. It contains no personal data and is cleared with the browser cache.
• Administration cookie: reserved for people signed in to the site's administration.

You can clear these items at any time in your browser settings; the site keeps working and the form simply asks for a new security token.

Links to other websites

Links to other websites (partners, routes, photo credits) take you away from this site. Those websites apply their own privacy policies, which we invite you to read.

Your rights

For data about you, you have the following rights:

• Access: to know whether data about you is held and to obtain a copy.
• Rectification: to have inaccurate or incomplete data corrected, for example your dates.
• Erasure: to have your data deleted; the form at the bottom of this page does it directly.
• Restriction: to have the use of data you dispute temporarily frozen.
• Objection: to object, on grounds relating to your situation, to processing based on legitimate interest, such as audience measurement.
• Portability: to receive the data of your request in a structured, machine-readable format.
• Instructions after death: to say what should happen to your data after your death (Article 85 of the French Data Protection Act).

To exercise them:

• Immediate erasure: enter your address in the form below; a confirmation link valid for 48 hours is sent to you and your data is erased as soon as you open it.
• Other requests: write to the operator (address in the legal notice), giving the email address used for your request. You will receive an answer within one month, which may be extended by two months for a complex request (you will then be told); proof of identity may be requested in case of reasonable doubt.
• Complaint: you can contact the CNIL online (www.cnil.fr/plaintes (new tab)) or by post: CNIL, Service des plaintes, 3 place de Fontenoy, 75007 Paris, France.

Children

The site is not aimed specifically at children. A request for a bed for a minor is made by a parent or by the accompanying adult; information about the minor is limited to the number of guests and, where relevant, the message.

Security

The site is served over HTTPS only. IP addresses are never stored in clear, passwords are irreversibly encrypted (bcrypt), the administration is protected against repeated attempts, data files cannot be reached from the web and the site is monitored automatically. If a data breach creates a risk, the operator notifies the CNIL within 72 hours and informs you if the risk is high (Articles 33 and 34 GDPR).

Changes

This policy may change, especially if the site changes. The date of the last update is shown at the bottom of this page; in the event of a significant change (a new service or a new use of your data), a notice is displayed here.