Discover Airlines data protection notice

We, EW Discover GmbH, consider the protection of your personal data a matter of great importance. The text below explains how we process your personal data in connection with your use of the services and products we offer via our website and in other ways, as well as your rights in this context.

We process personal data exclusively in accordance with the legal requirements, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the EU General Data Protection Regulation (“GDPR”). The text below informs you of how we process your personal data when you use the services and products that we offer via this website, as well as of your rights in this context.

The controller, within the meaning of the GDPR, who is responsible for the processing of your personal data within the framework of this data protection notice is:

EW Discover GmbH
Hugo-Eckener-Ring 1
FAC Building
60549 Frankfurt a.M.

Please contact ​legal4y@lufthansa-group.com or our Data Protection Officer at datenschutz@dlh.de if you have any further questions about data protection in connection with our website or the services and products offered there.

Personal data is any information that you provide to us, or that we obtain or collect, about a specific or identifiable natural person. This includes the following, in particular:

Booking data: when you book a flight or flight-related service with us, the content data you enter during the process and produced as a result (in particular, your name, contact details, date of birth and payment data), as well as the information we provide to you, will be processed. We will also collect information about the time, scope and, if applicable, the location of your booking. In individual cases, your nationality and voluntary information about frequent flyer programs will also be collected. When you book transport services, we may process data about certain forms of transport that could indirectly disclose sensitive data, such as information about a required wheelchair.If bookings are made for minors, the contact details of the parents or legal guardians will also be collected.

Check-in data: as part of the check-in and boarding process, we will process your booking data; information about your baggage; safety information (such as your boarding time, security-check status and time stamp of your check-in process); if applicable, information about your entry documents (passport, visa, etc.); and any other contact details, such as your emergency contact.

API data: API (advanced passenger information) data contains the information from your travel document (e.g., passport), such as your name, date of birth, nationality, passport number and gender, in particular.

PNR data: in the case of certain flights, we collect and process PNR (passenger name record) data. Such data includes, in particular, your name, contact details, baggage information, API data, payment data, information about the itinerary and the history of booking changes. A detailed list of possible data elements can be found in Annex 1 of PNR Directive (EU) 2016/681The link will be opened in a new browser tab.

SSR data: special service request information, such as health data related to mobility assistance or information about religion in connection with meals provided on board.

Medical data: information regarding the processing of personal data of passengers who require a medical clearance certificate.

Content data: when you use services on our website, such as when you use contact forms, customer service or newsletters or participate in sweepstakes or surveys, the data from content you enter during the process and produced as a result, as well as the information we provide to you, will be processed.

Cookie data: data collected by cookies used by us during your visit to the website.

Registration data: some services on our website (e.g., Travel ID, email newsletter) require you to register. Certain information is mandatory for this (e.g., email address); other information can be added voluntarily (e.g., gender or name). As part of the registration process, we will also collect your IP address and the time of registration.

Server log data: when you use our websites, related data (such as, in particular, the date and time of your visit, the pages accessed and files requested, the type and version of the web browser you are using, the type and operating system of the device you are using and your IP address) is temporarily stored on our servers in a log file.

In principle, we receive this personal data directly from you, such as when you make a booking, use our website, contact us or use our services. We may also automatically collect personal data from your device or through your use of our websites and other services. In addition, we may receive personal data from the following when necessary and permitted by applicable law:

• other companies of the Lufthansa Group and companies (e.g., travel service providers or payment service providers) involved in the provision of your booked services;
• persons acting on your behalf, such as family members, legal representatives or travel agencies; and
• authorities, courts and other parties in connection with official or judicial proceedings.

When you provide us with personal data about another person, such as a family member or travel companion, please ensure that you are authorized to do so and that the data subject has been informed of the information in this data protection notice.

When you book a flight and/or flight-related additional services with us (such as advance seat reservation, baggage or animal transport, lounge access, etc.), we process your booking data to issue a flight ticket or booking confirmation for the booked flight-related service. If you change or cancel your flight or flight-related additional service, we will process your booking data accordingly.

The legal basis for this processing is the conclusion and performance of a contract with you for the provision of a flight or flight-related services (Art. 6(1)(b) GDPR).

In the event that special personal data must be processed when booking flight-related additional services (e.g., health data when booking mobility aids or information about religion when booking meals on board), the processing is based on your explicit consent (Art. 6(1)(a) GDPR). The processing of the respective special categories of personal data is also permissible in accordance with the exception mentioned in Art. 9(2)(a) GDPR.

In individual cases, we are also legally and contractually obligated to process the required data of passengers with disabilities or limited mobility in order to ensure carriage (Regulation (EC) No. 1107/2006, Art. 6(1)(b) and (c) and Art. 9(2)(g) GDPR).

This data will be erased when it is no longer required for the performance of the contract (including customer service and the possible assertion of legal claims before expiration of the limitation period) unless we are legally obligated to store it, due to retention obligations under commercial or tax law, for example.

Details about data processing in connection with Travel ID registration can be found in the “Travel ID data protection notice.”

If you would like to earn miles with our Miles & More frequent flyer program when booking a flight, we will share your booking details and Miles & More card number with Miles & More GmbH accordingly (see also section 5.2 below). The legal basis for the data processing is the performance of a contract (Art. 6(1)(b) GDPR).

More detailed information about data processing in connection with the Miles & More frequent flyer program can be found in the Miles & More data protection notice.

In order to provide the flights and other flight-related services you have booked, we will process the booking data we have already received for you as well as your check-in data. You may also receive flight-related notifications, such as about gate changes or entry/baggage information. If your journey is affected by any irregularities, such as delays or cancellations, you will receive information about the situation and suggestions for remedial measures to compensate and assist you on the basis of the Passenger Rights Regulation (EC) No. 261/2004. In connection with the provision of your flight and in accordance with national and international legislation and agreements, we will, if necessary, transmit your API data or PNR data to the relevant authorities in Germany and abroad for the purpose of preventing, detecting, investigating and prosecuting terrorist offenses and serious crimes and in order to combat illegal immigration.

The legal basis for this processing is the conclusion and performance of a contract with you for the provision of a flight or flight-related services (Art. 6(1)(b) GDPR).

In individual cases, the legal basis with regard to the transmission of your API and PNR data is a legal obligation (Art. 6(1)(c) GDPR in conjunction with the applicable national or international legislation or agreements that result in legal obligations for us). For example, in certain cases, we are required to share your API data with the relevant authorities in Germany in accordance with Section 31a of the German Federal Police Act (Bundespolizeigesetz or “BPolG”). We are also required to share your PNR data with the relevant authorities in Germany in accordance with Section 2 of the Passenger Data Act (Fluggastdatengesetz or “FlugDaG”) [please adapt the aforementioned laws to the applicable local laws for airlines outside Germany] and with the relevant authorities in France in accordance with Article L. 232-7 of the French Code of Internal Security (Code de la Sécurité Interieure) in connection with Decree No. 2014-1095 of September 26, 2014 and Decree No. 2018-714 of August 3, 2018 and, if applicable, with authorities in third countries on the basis of existing PNR agreements (USA, Canada, United Kingdom) prior to providing a flight to the country in question. Third countries are countries outside the European Economic Area.

You also have the option of storing the contact details of a person who would be contacted in an emergency (emergency contact). The processing of these contact details is based on the consent of the data subject (Art. 6(1)(a) GDPR). In this regard, when you enter the contact details, you confirm that you have the data subject’s consent.

In the event that special personal data must be processed when providing flight-related services (e.g., SSR (special service request) data, such as health data in the context of mobility aids or information about religion when providing meals on board), the legal basis for processing this data is your consent in accordance with Art. 9(2)(a) GDPR.

This data will be stored for as long as legal claims in connection with a specific booking can be asserted in court. They will be erased once this period has expired or upon completion of ongoing court proceedings that extend beyond the regular storage period. If you revoke your consent, your data will be erased unless we are legally obligated or entitled to store it, due to retention obligations under commercial or tax law, for example.

We process personal data for security purposes.

For example, we use video surveillance at certain locations to detect and prosecute criminal offenses. In accordance with the applicable requirements for aviation safety, we also monitor the area directly in front of the cockpit door.

Unruly passengers are passengers whose inappropriate, aggressive or violent behavior; failure to follow instructions; threats or other misconduct endangers or adversely affects the safety of the flight, crew, other passengers or third parties.

We record relevant incidents in a passenger disturbance report (“PDR”). Depending on the nature and severity of the disruption or misconduct, the PDR may include details about the incident and, if necessary, information from the passenger’s travel documents to identify the passenger. We may use this information to document, evaluate and prevent incidents; to ensure the safety of our flights, crew and passengers; and to protect our rights.

We may share relevant information with the police and other authorities, and, in serious cases, we may refuse carriage, prohibit the passenger from traveling on our flights (flight ban) or inform the crew of previous incidents.

To the extent necessary and permitted by applicable law, we may also exchange relevant information within the Lufthansa Group and with other airlines in order to document, analyze and prevent fraud and incidents with unruly passengers, and we may share information about damage, injuries or criminal offenses with authorities and insurance companies.

This processing is based on our legitimate interest in guaranteeing security and protection (Art. 6(1)(f) GDPR).

If you send inquiries to us via a contact form, email, chat or service call, we will process your content data to answer your inquiry, and, if applicable, we will process the IP address, date and time of the inquiry to avoid misuse of the contact form. With your explicit consent, we may record the telephone conversation with you for quality assurance and training purposes. In the event that you inform us of possible errors on the website, we will use your entered data and, if applicable, data about the device used by you to analyze and correct the error you have reported.

The legal basis for this processing is Art. 6(1)(f) GDPR. Our and your (legitimate) interest in this data processing is based on the goal of answering your inquiries, solving any problems that may exist and thus maintaining and promoting your satisfaction as a customer or user of our website. If your request is aimed at initiating or concluding a contract, the legal basis for the processing is also Art. 6(1)(b) GDPR. The legal basis for the processing of inquiries related to data protection is Art. 6(1)(c) GDPR since such processing is necessary for compliance with legal obligations. With regard to the recording of telephone conversations, the legal basis is your consent (Art. 6(1)(a) GDPR).

Provided that the processing is based on the legal basis of an overriding legitimate interest, you can object to the processing of your data based on Art. 6(1)(f) GDPR. We may continue to process your personal data if we can prove compelling legitimate grounds that outweigh your interests, rights and freedoms or if the processing is necessary for the assertion, exercise or defense of legal claims.

This data will be erased when our communication with you has ended, meaning when the matter in question has been definitively resolved and there is no further legitimate interest in storing the data or there are no further legal obligations to store it. When you communicate with our employees, we store the data for 90 days or until the matter in question is completely resolved.

When you book a Discover flight, you have the option of consenting to receiving offers from Discover Airlines in relation to your booking. Based on your consent, we will email you with offers related to your flight. It will contain flight-related services, such as upgrades, advance seat reservation, additional baggage or meals, as well as content from our partners. After your flight, you will also receive an invitation to complete a feedback survey.

The legal basis for processing your contact details is your consent (Article 6(1)(a) GDPR). Your consent is valid only for the respective booking and will end automatically three days after this booking’s last flight. You can withdraw your consent to receiving our promotional notifications at any time.

You have various options for lodging your objection:

• In the case of email notifications, you can use the unsubscribe link provided for you in each of these emails.
• Alternatively, you can send a message to this effect (reference: data protection) via the contact form on our website or in writing or by email to the email address in section 2 above.

Your data will be erased after you lodge your objection or withdraw any consent you may have granted; at the latest, your data will be erased, or stored only in aggregated and anonymized form, once it is no longer being used by us. If necessary, we will keep a record of the fact that you have lodged an objection and your respective contact details so that you will not be contacted again. In the event of an objection or withdrawal of consent to marketing, we will update your marketing preferences. Please note that opting out of marketing will not automatically lead to the deletion of your entire profile or your travel ID.

We process your data in order to further develop and optimize our services and offers.

For example, we process your booking data and the content data that we collect when communicating with you (see section 4.5) in order to further develop and optimize our services and offers, including the AI tools we use, as well as for internal statistics. This processing serves, in particular, to optimize our customer service, to efficiently process your inquiries and to improve the customer experience with us and our range of services.

The legal basis for the processing is our legitimate interest in further developing and optimizing our services and offers and in compiling internal statistics (Art. 6(1)(f) GDPR). You can object to processing for the purposes of further development and optimization at any time (see section 7 below).

We only process your data for these purposes in anonymized form and erase it after two years. When it is necessary, due to irregularities in the provision of services, for example, to store your data in order to fulfil statutory retention obligations (e.g., pursuant to Section 147 of the German Fiscal Code (Abgabenordnung or AO) or Section 257 of the German Commercial Code (Handelsgesetzbuch or HGB)), we store the data concerned for up to 10 years.

We may invite you to participate in customer satisfaction polls or surveys in order to obtain feedback about and improve our services and products and the customer experience with us. Participation is voluntary. We will process the personal data that you provide in this context, including your responses and any related contact or participation information. The basis of this processing is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with future effect.

Details about the processing of cookie data using cookies and similar technologies can be found in the “Cookies data protection notice.”

In order to secure and optimize the booking process and to prevent fraud and limit the risk of non-payment, we process, in particular, your payment data, name and address, during the booking process, as well as in connection with any compensation or refund transactions, to verify whether there are any risks or irregularities. In addition, when an order is abandoned, the data collected up to the point the order was abandoned is stored for the purpose of (technical) optimization of the order process, to detect patterns of fraud, and to respond to customer inquiries regarding the ordering process.

The legal basis for the data processing outlined in this section is Art. 6(1)(b) and (f) GDPR. Our legitimate interest in this regard is based on protecting your identity, minimizing the risk of non-payment and preventing attempts at fraud.

This data will only be stored for as long as is necessary for the stated purposes. When suspicious booking processes are detected and data is processed in the fraud management system, the retention period is three years from the time the data in question was collected. The data will only be stored for a longer period of time if and as long as statutory retention obligations exist or further storage is necessary for the assertion, exercise or defense of legal claims.

For the purpose of enforcing our own legal claims and defending our legal position, we process the personal data required for such enforcement or defense on a case-by-case basis. Among other things, this may include booking data.

The legal basis for the processing is our legitimate interest in enforcing legal claims and defending our own legal position (Art. 6(1)(f) GDPR).

The data required for this purpose will be erased following the conclusion of the legal dispute and once the statutory retention period has expired.

Server log data is processed for the technical operation of the website and then to ensure system security and to protect the technical infrastructure in order to detect malicious access to our website.

The legal basis for this processing is our legitimate interest in making the website with our services available and protecting our technical infrastructure (Art. 6(1)(f) GDPR). This processing is absolutely necessary for the use of our website.

This data will be erased no later than 180 days after the end of your session.

In the context of the data processing mentioned above and the applicable legal basis in each case, your data may be shared with the following categories of recipients:

In some cases, we engage service providers in compliance with legal requirements through data processing, that is, on the basis of a contract on our behalf, in accordance with our instructions, and under our control.

In particular, processors include

• third-party contractors, such as ground handling service providers, companies that process claims and other related service providers;
• service providers for customer service (call centers, chat providers, etc.);
• other service providers, such as for making the website available, distributing newsletters, processing feedback and compiling international aviation statistics;
• cloud service and hosting service providers (for data storage and infrastructure);
• service providers for operating and maintaining our IT systems;
• technical service providers we use to make our website available and provide the functionalities offered there, such as technically necessary cookies; and
• service providers for the practical implementation of advertising and marketing, such as service providers for email distribution and analytics cookies.

In these cases, we remain responsible for the data processing; the sharing and processing of personal data with or by our processors is based on the legal basis that allows us to process the data in each instance. A separate legal basis is not required.

Certain data about you will also be shared with other Lufthansa Group companies. In this case, we and the companies concerned may be joint controllers, as defined in Art. 26 GDPR, for the processing of this specific data.

In individual cases, the recipients are Air Dolomiti S.p.A Linee Aeree Regionali Europee (Dossobuono di Villafranca (VR), Via Paolo Bembo 70, Italy), Austrian Airlines AG (Office Park 2, Postbox 100, 1300 Vienna Airport, Austria), Brussels Airlines SA/NV (1050 Brussels, Belgium, Jaargetijdenlaan 100-102/B30 Av. des Saisons), Deutsche Lufthansa AG (Venloer Strasse 151-153, 50672 Cologne, Germany), Edelweiss Air AG (The Circle 32, 8058 Zurich Airport, Switzerland), Eurowings GmbH (Waldstrasse 249, 51147 Cologne, Germany), Italia Trasporto Aereo S.p.A. (Via Venti Settembre 97, Rome, 00187, Italy), Lufthansa CityLine GmbH (Munich Airport, FOC, Südallee 15, 85356 Munich, Germany), Lufthansa City Airlines GmbH (Munich Airport, FOC, Südallee 15, 85356 Munich, Germany) and Swiss International Air Lines AG (Obstgartenstrasse 25, 8302 Kloten, Switzerland), collectively referred to as the “Lufthansa Group airlines.”

We may also transfer your data to other group companies, in particular Miles & More GmbH (see also section 4.3 above), insofar as they are involved in the performance of the services.

Your data will be shared with Lufthansa Group airlines if this is necessary for providing your booked flight. For example, if you book a flight with us, but the flight is operated by another Lufthansa Group airline, we will transfer your data to this airline in order to fulfil the contract with you (Art. 6(1)(b) GDPR). In addition, due to our legitimate interest, we share information about individuals who are subject to a flight ban (Art. 6(1)(f) GDPR).

Furthermore, we may share your data with Lufthansa Group airlines for the purpose of further developing and optimizing our services and offers (see also section 4.7 above). The legal basis for sharing this data is the legitimate interest (Art. 6(1)(f) GDPR) that the companies involved have in improving their own services for you and other customers in the future and in adapting their own offers to your needs.

Pursuant to Art. 26 GDPR, the joint controllers have entered into an agreement that defines their respective responsibilities for the fulfilment of their obligations under the GDPR. The main provisions of this agreement are as follows: Deutsche Lufthansa AG functions as the primary point of contact for exercising data subject rights relating to jointly processed data; inquiries received by another Lufthansa Group airline will immediately be forwarded to the appropriate office. The complete text of the agreement is available upon request from the Data Protection Officer named in section 2. However, you can assert your rights under section 7 of this data protection notice with respect to any group company involved.

In addition, we also transfer your data to third parties, meaning partners with whom we work outside the context of data processing. Such partners provide their services as independent controllers.

In particular, these partners are:

• other airlines, railway partners and ground transportation providers that carry out part of the transportation (legal basis for the transfer of data is Art. 6(1)(b) GDPR);
• payment service providers with whom we work and through which you can book flights with us (the legal basis for the transfer of data is Art. 6(1)(b) GDPR);
• providers of lounges to which you have access according to your booking (legal basis for the transfer of data is Art. 6(1)(b) GDPR);
• the communication provider that operates the Inflight Entertainment portal on board and provides you with access to the internet and entertainment content, such as FlyNet (the legal basis for the transfer of data is Art. 6(1)(b) GDPR);
• banks and payment service providers with whom we work in order to process relevant booking, payment, contact and technical data, insofar as this is necessary in order to secure and optimize the booking process, prevent fraud and limit the risk of non-payment (the legal basis for the transfer of data is Art. 6(1)(f) GDPR);
• government authorities and institutions, on the basis of entry regulations or police activities and investigations, for example (the legal basis for the transfer of data is Art. 6(1)(b) or (c) GDPR); and
• service providers who are involved in the event of service disruptions, such as hotels (the legal basis for the transfer of data is Art. 6(1)(f) GDPR).

In some cases, we transfer personal data to recipients who do not fall within the direct scope of the GDPR (“third countries”; see section 4.4 above). Unless the European Commission has determined that these countries provide an adequate level of legal protection for your personal data, we must either ensure that we implement adequate safeguards for your personal data or that one of the statutory exceptions applies.

As safeguards under Art. 46(2)(c) GDPR, we regularly use the EU Standard Contractual Clauses adopted by the European Commission when transferring data to recipients in third countries not recognized as safe. Nevertheless, in some third countries, there is a risk that national authorities may demand that recipients disclose your data for monitoring and surveillance purposes, without clear regulations governing the conditions under which this may occur or without corresponding legal remedies being available. Insofar as there are such risks, which are considered unreasonable under the case law of the European courts (such as in certain cases involving the USA), we will implement additional protective measures and agreements as far as possible. Further information about these transfers to third countries and, in particular, a copy of the standard contractual clauses can be obtained via the contact options specified in section 2.

In some cases, we also transfer your data on the basis of Art. 49(1) GDPR. This might be, for example, your explicit consent, pursuant to Art. 49(1)(1)(a) GDPR, to the transfer of data to recipients in unsafe third countries, such as when our partners use cookies or similar technologies on our website. Before you give your consent, we will expressly inform you that the transfer may entail potential risks for you due to the lack of an adequacy decision and the absence of appropriate safeguards. If you consent, you accept that the risks described above, in particular access to your data by foreign authorities, may occur without further safeguards or additional protective measures. In other cases, we may transfer your personal data to authorities in third countries on the basis of Art. 49(1)(1)(b) GDPR in order to fulfil the flight booking you have made with us.

Automated decision-making (including profiling) is a process in which no assessment of content and no decision based thereon has been made by a natural person.

We do not use fully automated decision-making that has a legal effect on you or similarly significantly affects you, pursuant to Art. 22(1) GDPR. Should we decide to use such automated decision-making in the future, we will inform you of this in accordance with our legal obligations.

With regard to the processing of your personal data by us, you have the following rights:

Right of access (Art. 15 GDPR): you have the right to obtain confirmation from us as to whether or not we are processing your personal data. If personal data is being processed by us, you have the right to obtain information about this data and about the processing purposes, data categories, data recipients, storage duration and data origin, as well as information about your rights and about the existence of automated decision-making, including profiling.

Right to rectification (Art. 16 GDPR): if your personal data is incorrect or incomplete, you have a right to the rectification of such data by us.

Right to erasure (Art. 17 GDPR): you have the right to insist on the erasure of your personal data. This is also known as the right to be forgotten. It is not a blanket right to the erasure of all your personal data. We may be legally obligated to continue processing individual personal data, or the processing may be necessary for defending our interests in the event of legal claims.

Right to restriction of processing (Art. 18 GDPR): you have the right to insist that the processing of your personal data be restricted. If processing is restricted, the data will be blocked.

Right to data portability (Art. 20 GDPR): if the processing is based on your consent or if the personal data must be processed by automated means for the fulfilment of a contract, you have the right to receive the personal data that you have provided to us in a structured, commonly used and machine-readable format or to transmit this data to another data controller.

Right to withdraw consent (Art. 7(3) GDPR): if you consented to processing by means of a corresponding declaration, you can withdraw this consent at any time for the future. This withdrawal of consent will not affect the lawfulness of any data processing based on your consent before such consent was withdrawn.

Right to object (Art. 21 GDPR): insofar as we process your data to protect legitimate interests, you can object to this processing at any time at legal4y@lufthansa-group.com if there are grounds relating to your particular situation that conflict with our data processing. You have the right to object to the processing of your personal data for the purpose of direct marketing at any time without giving a reason. The data processing will then cease unless EW Discover GmbH can prove compelling legitimate grounds for the processing that outweigh the interests, rights and freedoms of the data subject or the processing is necessary for the assertion, exercise or defense of legal claims.

To exercise your rights, please contact us or the corporate Data Protection Officer using the contact details specified in sections 1 and 2.

If you have any questions, concerns or complaints about the processing of your personal data, we recommend first contacting our team at legal4y@lufthansa-group.com or our Data Protection Officer at datenschutz@dlh.de.

This does not affect your right to lodge a complaint with a competent data protection supervisory authority. The competent supervisory authority for EW Discover GmbH is:

Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden

Email: poststelle@datenschutz.hessen.deThe link will be opened in a new browser tab 

This data protection notice may be amended to reflect changes in our data processing or legal requirements. You can find the latest version on our website at all times.