City Hostel Fürth
Last updated: August 2026
1. Data protection at a glance
The protection of your personal data is of great importance to us. This privacy policy explains what personal data we collect, for what purposes we process it, and what rights you have under the General Data Protection Regulation (DSGVO).
Personal data is any information relating to an identified or identifiable natural person.
2. Data Controller
The data controller within the meaning of Article 4 Nr. 7)of the DSGVO is:
CHN GmbH
represented by the Managing Director, Michael Seibel
City Hostel Fürth, Kurgartenstraße 54, 90762 Fürth
Telephone: +49 (0)911 92349409
Email: info@city-hostel-nuernberg.de
3. Legal basis for processing
The processing of personal data takes place exclusively on the basis of the applicable legal provisions, in particular:
· Article 6(1)(a) of the DSGVO – Consent
· Article 6(1)(b) of the DSGVO – Performance of a contract or implementation of pre-contractual measures
· Article 6(1)(c) of the DSGVO – Compliance with legal obligations
· Article 6(1)(f) of the DSGVO – Pursuit of legitimate interests
4. Visiting our website
When you visit our website, information is automatically collected by the web server. This includes, in particular:
· IP address
· Date and time of access
· Browser type and version
· Operating system
· Referrer URL
· Pages accessed
This data is used exclusively for the technical provision of the website, system security and error analysis.
The legal basis is Article 6(1)(f) of the DSGVO.
5. Hosting
Our website is hosted by:
frankencom
Tillystraße 11
90431 Nuremberg
We have a contract with the hosting provider for data processing on our behalf in accordance with Article 28 of the DSGVO.
6. Cookies
Our website uses only technically necessary cookies that are absolutely essential for the operation of the website (§ 25(2)(2) of the TTDSG). These cookies serve, for example, to ensure the technical provision of the website or to guarantee its security.
The legal basis is § 25(2)(2) of the TTDSG in conjunction with Article 6(1)(f) of the DSGVO.
A cookie consent banner is not currently required, as no analytics or marketing cookies requiring consent are used.
7. Contacting us
If you contact us via
· Telephone
· WhatsApp Business
we will process the personal data you provide solely for the purpose of handling your enquiry.
The legal basis is Article 6(1)(b) of the DSGVO or Article 6(1)(f) of the DSGVO.
8. Bookings
When a booking is made – whether directly or via a sales partner – we process the following data in particular:
· First name and surname
· Address
· Telephone number
· Email address
· Dates of stay
· Room category
· Additional services
· Invoicing details
· Payment details
This data is processed solely for the purpose of fulfilling the accommodation contract.
The legal basis is Article 6(1)(b) of the DSGVO.
9. Property Management System (Mews)
We use the Mews Property Management System to manage our hostel operations.
The following data in particular is processed via Mews:
· Booking details
· Guest details
· Online check-in details
· Stay details
· Invoice details
· Payment status
· Registration details
Processing is carried out solely for the purpose of fulfilling the accommodation contract and organising your stay. A data processing agreement has been entered into with the provider in accordance with Article 28 of the DSGVO.
The legal basis is Article 6(1)(b) of the DSGVO.
10. Online check-in
To simplify the arrival process, we offer a digital online check-in via Mews.
In particular, the following data may be processed:
· Identity data
· Contact details
· Data required by law for registration purposes
· Estimated time of arrival
· Information provided voluntarily by the guest
This data is processed solely for the purpose of preparing and facilitating your stay, as well as to fulfil statutory registration obligations.
The legal basis is Article 6(1)(b) of the DSGVO (performance of a contract) and Article 6(1)(c) of the DSGVO (statutory registration obligations).
11. Channel Manager (SiteMinder)
We use SiteMinder to manage our room availability and booking channels.
In doing so, booking data may be transferred between our Property Management System and connected booking platforms. We have a data processing agreement with the provider in accordance with Article 28 of the DSGVO.
Processing is carried out solely for the performance of the contract.
The legal basis is Article 6(1)(b) of the DSGVO.
12. Booking platforms
We work with the following booking platforms, amongst others:
· Booking.com
· Hostelworld
· Other online travel portals
When a booking is made via these platforms, we receive the personal data necessary to organise your stay.
The respective platform’s own privacy policy also applies to the processing of data by that platform; in this respect, the respective platform itself is the data controller within the meaning of the DSGVO.
13. Payment processing
We use Mews Payments and, where applicable, other payment service providers to process payments.
In particular, the following data may be processed:
· Payment amount
· Payment method
· Payment status
· Encrypted or tokenised payment information
Processing is carried out solely for the purpose of payment processing. Where necessary, a data processing agreement in accordance with Article 28 of the DSGVO is in place with the provider.
The legal basis is Article 6(1)(b) of the DSGVO.
14. Statutory Reporting Obligations
Under the Federal Registration Act, we are obliged to collect certain personal data from our guests and to retain it for the periods prescribed by law.
The legal basis is Article 6(1)(c) of the DSGVO.
15. Communication via WhatsApp Business
Upon request, we communicate with guests via WhatsApp Business, a service provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.
In this context, personal data (e.g. mobile phone number, content of messages) may be processed by the provider. A transfer of data to Meta Platforms, Inc., which is based in the USA and is therefore a third country, cannot be ruled out. Where applicable, this transfer takes place on the basis of standard contractual clauses in accordance with Article 46(2)(c) of the DSGVO.
Please refer to the WhatsApp Business Privacy Policy.
Use of this service is voluntary and requires your consent.
The legal basis is Article 6(1)(a) of the DSGVO.
For particularly sensitive information, we recommend contacting us by telephone or email.
16. YouTube
Videos from YouTube may be embedded on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When you access a page containing an embedded YouTube video, a connection to Google’s servers may already be established and personal data (including your IP address) may be transmitted, provided that no two-click or consent mechanism is in place beforehand. The transmission of data to Google in the USA cannot be ruled out.
The legal basis is Article 6(1)(a) of the DSGVO in conjunction with Section 25(1) of the TTDSG.
Further information can be found in Google’s privacy policy.
17. Google Maps
Our website contains only links to Google Maps.
Personal data is only transferred to Google once you actively click on the relevant link.
18. Analysis
We use PHP Web Stat for the statistical analysis of our website. Where necessary, we have a data processing agreement with the provider in accordance with Article 28 of the DSGVO.
The data processed includes, amongst other things:
· Page views
· Visitors’ origin
· Browser information
· Technical access data
The analysis is carried out in a pseudonymised manner, in particular by truncating the IP address, for example.
The legal basis is Article 6(1)(f) of the DSGVO.
19. Social Media
We maintain company profiles on the following platforms:
· Threads
These are used to provide information about our hostel and to communicate with guests and prospective guests.
When you visit our profiles, personal data is processed by the respective platform operator (Meta Platforms Ireland Ltd.), in particular for the purpose of compiling page statistics (Page Insights). In this respect, we are joint controllers with the platform operator within the meaning of Article 26 of the DSGVO.
We have no influence over the nature and scope of any further data processing carried out by the platform operator. Further information can be found in the privacy policies of the respective platforms.
The legal basis for operating the profiles is Article 6(1)(f) of the DSGVO.
20. Recipients of personal data
Personal data will only be disclosed where this is necessary for the performance of a contract or required by law.
Recipients may include, in particular:
· Mews
· SiteMinder
· Mews Payments
· Booking.com
· Hostelworld
· Hosting provider (frankencom)
· PHP Web Stat
· IT service providers
· Tax advisers
· Public authorities in accordance with legal obligations
21. Transfer of data to third countries
Personal data is transferred to third countries in the following cases in particular:
· When using WhatsApp Business (transfer to Meta Platforms, Inc., USA)
· When embedding YouTube videos following the granting of consent (transfer to Google LLC, USA)
· In connection with social media profiles on Facebook, Instagram and Threads (Meta Platforms, Inc., USA)
These transfers take place exclusively in accordance with the legal requirements set out in Articles 44 et seq. of the DSGVO, in particular on the basis of standard contractual clauses pursuant to Article 46(2)(c) of the DSGVO.
22. Retention period
We store personal data only for as long as is necessary for the respective purposes or as required by statutory retention obligations.
In particular, the following applies:
· Documents relating to tax and commercial law: in accordance with the statutory retention periods (generally 6 or 10 years in accordance with Sections 147 of the German Fiscal Code (AO) and 257 of the German Commercial Code (HGB))
· Registration data: in accordance with the provisions of the Federal Registration Act
· Communication data: until the matter has been fully processed or within the statutory limitation periods
Once the relevant periods have expired, the data will be deleted, provided there are no legal grounds for further storage.
23. Rights of data subjects
You have the right at any time to
· Access your data (Art. 15 DSGVO)
· Rectification (Art. 16 DSGVO)
· Erasure (Art. 17 DSGVO)
· Restriction of processing (Art. 18 DSGVO)
· Data portability (Art. 20 DSGVO)
· Objection to processing (Art. 21 DSGVO)
· Withdrawal of consent with effect for the future (Art. 7(3) DSGVO)
24. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.
The authority normally responsible for our company is:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Telephone: +49 (0)981 180093-0
Email: poststelle@lda.bayern.de
25. Data security
We implement appropriate technical and organisational security measures to protect your personal data.
Our website uses SSL/TLS encryption to ensure the secure transmission of confidential data.
26. Automated Decision-Making
No automated decision-making or profiling in accordance with Article 22 of the DSGVO takes place.
27. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy should this become necessary due to technical developments, changes in the law or new services.
The current version published on our website shall apply at all times.