Who processes the data
The controller is Victor / Dja Hostel. Address: 14 Sichovykh Striltsiv Street, Kyiv. Website: djahostel.com.
This is a hostel in Kyiv, not a Russian operator. The legal frame is Ukraine’s Law on Personal Data Protection. Russian Federal Law 152-FZ does not apply to us.
Legal basis
- The stay contract: booking, check-in, payment, and messages about arrival.
- Consent: by clicking “Create booking”, you agree to this policy.
- Law: guest records and accounting documents where Ukrainian law requires them.
Booking on this website
The booking form receives your name, phone number, dates, selected room, number of beds, and an optional comment.
This data is needed to check availability, create and confirm your stay booking, and contact you about arrival.
Booking data is stored in the booking system on Supabase. It is not stored long-term on the public website itself.
After a booking is created, a notification with the guest’s name, phone number, room, stay dates, number of beds and total price is sent through the Telegram Bot API to the hostel owner’s private chat. We do not sell this data or hand it to anyone for mailing lists.
Check-in
Independent stays start at age 18. At check-in you need a passport or national ID.
The document is to confirm who is staying. We record what is needed for the guest record. We do not publish copies and do not give them to third parties except where the law requires it.
Telegram and phone
If you write to @dja_hostel_bot or +380 50 066 10 12, we see your number, messenger name and the message. That is so we can reply and run the booking.
Free-text messages to the bot may be sent to DeepSeek to draft a reply. If that service key is not configured, the message is only forwarded to the owner.
Telegram also processes those messages. Their rules are their document, not this one.
Payment
Pay in cash in UAH or by bank transfer. There is no online payment on the website. No deposit is required. No prepayment is required.
If you pay by transfer, the bank shows us the payer on a normal receipt. We use that to match the payment to the booking. We do not store card numbers on this site.
CCTV
Cameras are in common areas only. There are no cameras in bedrooms or bathrooms.
The purpose is guest and property safety, not marketing. We do not publish the footage. We keep it only as long as that purpose needs, not forever.
Cookies and analytics
Google Analytics is no longer used. There are no analytics cookies on this site.
During the browser session we may remember a coarse visit source (for example Google, maps, a campaign, an OTA) — not the full URL and not your name. If you create a booking, that source is stored with the booking in the booking system on Supabase, so we can see how guests find us — not “only in the browser”.
There is no Yandex Metrica, no session replay, no ad pixels and no cookie banner: there is nothing to turn on.
Who else may see the data
Not “anyone” — the processors the booking actually needs:
- Supabase — the booking system (database host).
- Telegram — the owner notification after a booking, and chat if you write to the bot yourself.
- DeepSeek — a draft reply to free-text messages in the bot.
- The bank — if you pay by transfer.
- Booking.com, Hostelworld and other OTAs — only if you book there, not on this site. Their policy applies then, not this one.
Transfers outside Ukraine
Supabase, Telegram and DeepSeek may run infrastructure outside Ukraine. This is not “stored only in Ukraine”.
By clicking “Create booking” or writing to the bot, you accept that transfer. We do not send data to other countries “just in case” and we do not sell lists.
How long we keep it and how we delete it
Booking and guest data stay while needed for the stay, contact and records, or while the law requires accounting documents.
When the purpose is done and the law does not require keeping it, we delete or anonymise it. The controller does that — not a silent “after one year” job with no check.
Your rights
- Ask what data we hold and correct what is wrong.
- Withdraw consent and ask us to delete what the law allows us to delete.
- Restrict processing where the law provides for it.
- Complain to the Ukrainian Parliament Commissioner for Human Rights.
Minors
Independent check-in starts at 18. We do not knowingly collect a child’s data without a legal guardian. If that happens, we delete it as soon as we know.
Contacts
Questions about data: +380 50 066 10 12, Telegram @dja_hostel_bot, email djahostelkyiv@gmail.com.
Send access, correction or deletion requests through one of these channels. We reply within a reasonable time, usually a few working days — not by silence.
Changes to this page
If processing changes, we update the text and the date at the top. The new version applies from the moment it is published here.