Travel ID data protection notice

The following Travel ID data protection notice (hereinafter “data protection notice”) informs you about the processing of your personal data in connection with your use of Travel ID.

We, the airlines of the Lufthansa Group and Miles & More GmbH as Travel ID Operators, would like to provide our services within the Lufthansa Group in the most convenient way possible for you and to offer you a travel experience that is tailored to you and your personal desires and expectations, from the first time you visit our websites and other touchpoints to the end of your trip. Travel ID gives you the option of creating a free customer profile that is valid for all Travel ID Operators, enabling you to use a range of services.

Creating a Travel ID profile and providing the data required for this is voluntary. However, some of our services are available exclusively to our Travel ID customers. This includes the option of getting personalized flight offers and additional services on the booking platforms of Lufthansa Group Airlines.

This privacy policy is designed to comply with applicable data protection regulations, which include, depending on the scope of application, the GDPR as well as any other applicable national data protection laws and regulations laid down by law.

The Travel ID Operators are Air Dolomiti S.p.A Linee Aeree Regionali Europee (Dossobuono di Villafranca (VR), Via Paolo Bembo 70, Italy), Austrian Airlines AG (Office Park 2, Postbox 100, 1300 Wien-Flughafen, Austria), Brussels Airlines SA/NV (1050 Brussels, Belgium, Jaargetijdenlaan 100-102/B30 Av. des Saisons), Deutsche Lufthansa AG (Venloer Strasse 151-153, 50672 Cologne, Germany), Edelweiss Air AG (The Circle 32, 8058 Flughafen Zürich, Switzerland), Eurowings GmbH (Waldstrasse 249, 51147 Cologne, Germany), EW Discover GmbH (Hugo-Eckener-Ring 1, FAC Building, 60549 Frankfurt am Main, Germany), Italia Trasporto Aereo S.p.A. (Via Venti Settembre 97, Rome, 00187, Italy), Lufthansa City Airlines GmbH (Flughafen München, FOC, Südallee 15, 85356 Munich, Germany) and Swiss International Air Lines AG (Obstgartenstrasse 25, 8302 Kloten, Switzerland), as “Lufthansa Group Airlines” or “LHG Airlines,” as well as Miles & More GmbH (Frankfurt Airport Tor 21, Airportring, Geb. 322, 60546 Frankfurt am Main, Germany).

Unless stated otherwise in this data protection notice, “we”, “us” or “Travel ID Operators” refers to the Lufthansa Group Airlines and Miles & More GmbH as the joint controllers, within the meaning of Art. 26 GDPR, responsible for the processing of your personal data.

In North America, Central America and Japan, ITA Airways operates independently, both commercially and operationally.

Contact information for the data protection officers:

Data Protection Officer for Air Dolomiti S.p.A., Deutsche Lufthansa AG, Lufthansa City Airlines GmbH, Miles & More GmbH, Eurowings GmbH, EW Discover GmbH, and Brussels Airlines SA/NV:

Deutsche Lufthansa AG
Data protection officers
FRA CJ/D
Lufthansa Aviation Center
Airportring
60546 Frankfurt/Main
Germany

Data Protection Officer for Austrian Airlines AG:

Austrian Airlines AG
Rechtsbüro – Datenschutz
Office Park 2
Postbox 100
1300 Wien-Flughafen
Austria

Data Protection Officer for Swiss International Air Lines AG:

Swiss International Air Lines AG
ZRH S/CJ
Postfach
8058 Zürich Flughafen
Switzerland

Data Protection Officer for Italia Trasporto Aereo S.p.A.:

ITALIA TRASPORTO AEREO S.p.A.
Via Venti Settembre 97
00187 Rome
Italy

Data Protection Officer for Edelweiss Air AG:

Edelweiss Air AG
Betrieblicher Datenschutzverantwortlicher
The Circle 32
Postfach
8058 Zürich Flughafen
Switzerland

When you register for Travel ID, we will ask for your email address, title, first and last name, date of birth and a password as mandatory information. Your country and preferred language will be set automatically, when technically possible, based on the country/language settings you selected on the relevant Travel ID Operator websites or other touchpoints. This is the minimum information required to create a Travel ID profile. If you register for the Miles & More program at the same time, your address and contact details will also be required.

You have the option of voluntarily adding further information to your Travel ID profile so that you can take advantage of all the benefits of Travel ID. Such information might include your cell phone number or flight preferences (e.g., preferred departure airport).
You also have the option of adding one or more travel partners to your profile. Please note that this is only permitted with the consent of the person in question.

In your Travel ID profile, you can also give and withdraw your consent to the processing of data for various purposes. This includes the “cookie settings,” which we automatically apply according to your selection when you visit our websites and mobile apps. This saves you the trouble of repeatedly choosing these settings whenever you access these touchpoints.
In addition, you can view and edit your settings for receiving personalized offers and customized promotional communications from us.
If you belong to one or more of our defined customer groups, you will also have the option of consenting to the use of our proactively designed top customer relation services.

Based on your activity associated with your Travel ID profile, you may be shown anonymous statistics (e.g., your position in the ranking of kilometers flown) and/or badges (e.g., an award for achieving a certain milestone).

If you want to create a Travel ID profile for your child or your child wants to create one and the child is under 18 years of age, consent from a legal guardian is required. After the completed registration form has been submitted, the legal guardian will receive an email requesting them to provide consent to the creation of the Travel ID profile by clicking on the link in the email. If the legal guardian does not consent within the defined time after registration, all entered personal data will be deleted.

The legal basis for the processing of your data is the performance of the contract pursuant to Art. 6(1)(b) of the GDPR.

You will also have the option to consent to storing additional personal data, such as your preferred payment method or travel documents, in your Travel ID profile. Please refer to the relevant passages of this data protection notice for details.

If your employer participates in a Lufthansa Group business support program or incentive model, you may add specific company information about your employer to your Travel ID profile. If you subsequently book business travel on the websites or apps of Lufthansa Group Airlines while you are logged in, you will see corresponding fares based on this information. When you complete your booking, this information will also be added to it.

To connect your Travel ID profile with your employer’s company data, you need a link provided by your employer. When you use this link, you will be asked if you would like to add your employer’s company data to your Travel ID. To establish the connection for the first time and to confirm it later, you will be asked to enter your work email address. You will be asked to identify yourself using a code that we will send to that email address.
Once you have successfully linked your Travel ID profile to your employer’s company information, your first and last name, your business travel bookings and a “connection ID” will be displayed in order to inform your employer of this. None of your other Travel ID data will be shared with your employer.

You can disconnect your profile from the company information at any time in the “Company Information” section of your Travel ID. Likewise, your employer can have your profile disconnected at any time.

The legal basis for the processing of your data is the performance of the contract pursuant to Art. 6(1)(b) of the GDPR.

To the extent required for the performance of the contract, we may send you messages about your Travel ID profile. Such messages include, but are not limited to, the Travel ID activation email, emails regarding information about and changes to processing purposes that require consent (communication settings) and other messages, such as information about changes to the Travel ID terms and conditions of use and about status changes in your Travel ID profile. Status changes may relate, for example, to the expiration of travel documents uploaded via your Travel ID profile, of your payment methods or of your password.

The legal basis for the processing of your data is the performance of the contract pursuant to Art. 6(1)(b) of the GDPR.

We want to make it easier for you find and use the information relevant to you when you visit our websites and use our mobile apps and other touchpoints, whether on the ground or on board our aircraft. You therefore have the option of logging in to these with your Travel ID and being personally addressed and of receiving information relevant to your current flight booking or your Miles & More membership, for example.

You can also make use of the option to store your privacy settings (“cookie settings”) in your Travel ID profile. Once you use one of our websites or mobile apps and we can identify you, we will apply the cookie settings you have stored in your profile. Details about the processing purposes and activities can be found in the data protection notice and/or cookie policy on the website of the relevant LHG Airline or on the Miles & More website.

If you do not wish to use the login service on our websites/touchpoints, you are, of course, free to use the websites/touchpoints without logging in. In this case, the relevant content will be displayed in a non-personalized manner.

The legal basis for the processing of your data is the performance of the contract pursuant to Art. 6(1)(b) of the GDPR.

We use data stored in your Travel ID profile to simplify your experience on our websites by providing pre-filled forms. This may be data that you actively added to your profile during or after registration. It may also be data that you provided during a previous booking in connection with your Travel ID, for example, in which case we automatically take this data into account when you make another booking. In addition, we use the data you have provided during a booking, for example, in order to provide pre-filled forms when you check in online or at the kiosk. If you complete any other forms, such as when you participate in a sweepstakes or use our electronic feedback form on the website to submit customer feedback, required contact information will also be pre-filled based on your Travel ID profile.

The legal basis for the processing of your data is the performance of the contract pursuant to Art. 6(1)(b) of the GDPR.

Flight bookings are automatically saved and displayed in your Travel ID profile if you book them while logged in. If you want to add a flight booking to your Travel ID profile after the fact, we will review the booking for completeness and add information that you have stored in your profile if necessary. No data will be overwritten without your consent.
The overview of your flight bookings is limited to 10 years and includes, among other things, the creation and display of flight statistics.

In the event that you change your previous customer profile with one of the Lufthansa Group Airlines to a Travel ID profile, your past flight bookings from your previous customer profile will also be displayed in your Travel ID profile.

The legal basis for the processing of your data is the performance of the contract pursuant to Art. 6(1)(b) of the GDPR.

We use the data stored in your Travel ID profile to offer you personalized, targeted service at all our touchpoints on the ground and in the air as well as to improve our complaint management. In doing so, we combine the data that you saved to your Travel ID profile during or after your registration as well as all the data that we can link to you based on your Travel ID, such as the purchases you have made and services you have used, as well as delays, flight cancellations, and baggage irregularities. We also process data and information like your preferences and inquiries addressed to our Service Centers, as well as information from other interactions with us, such as with the crew on board our aircraft or the staff in our lounges.

The legal basis for the processing of your data is the performance of the contract pursuant to Art. 6(1)(b) of the GDPR.

If you have a Travel ID profile, we may use your information to contact you with respect to special personal occasions (e.g., your birthday or events related to your Miles & More membership) or your travel and service preferences, such as on board our aircraft. In addition, if you use or have used Travel ID operator products and services and we were repeatedly unable to offer you the promised service, we may use this data (e.g., irregularities and customer concerns, number and severity of incidents) and contact you about this.

The legal basis for processing your data is our legitimate interest pursuant to Art. 6(1)(f) of the GDPR.

If you belong to one or more customer groups (e.g., students), you can have your affiliation with such a customer group verified and save the confirmation in your Travel ID profile. If you book a trip while logged in after that, we can check whether you are eligible to receive customer-group-specific benefits based on the customer group status saved in your Travel ID profile.

The legal basis for processing your data is the consent you have given for this purpose, pursuant to Art. 6(1)(a) of the GDPR.

You have the right to withdraw your consent to the confirmation of your customer group at any time without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal. To do so, you can delete the confirmation(s) under “Customer Groups” in your Travel ID profile.

Your eligibility for special rates and discounts will be automatically deleted once it expires.

You have the option of storing your travel documents, such as a passport or visa, in your Travel ID profile. We will store this data for you in a separately secured database. When you are logged in and book a trip that requires specific travel documents, we will automatically add the data stored in your Travel ID profile to your flight booking. This process will not be carried out if your flight booking already contains data from travel documents.

The legal basis for processing your data is the consent you have given for this purpose, pursuant to Art. 6(1)(a) of the GDPR.

You have the right to withdraw your consent to the use of the data from the travel documents at any time without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal. To do so, you can delete your travel documents under “Personal Documents” in your Travel ID profile.

The travel documents will be automatically deleted once they expire.

We offer you the option of saving your preferred payment methods in your Travel ID profile. You can add these yourself at any time within your Travel ID profile. When you make a booking, you can also choose to store the payment method you entered for the booking in your Travel ID for future purchases.

If you have saved a payment method in your Travel ID profile and you make a booking while logged in to your Travel ID profile, we will automatically fill in your preferred payment methods or offer them for selection. You have the option of editing or deleting your payment methods at any time.

The legal basis for processing your data is the consent you have given for this purpose, pursuant to Art. 6(1)(a) of the GDPR.

You have the right to withdraw your consent to the storage of your payment methods at any time without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal. To do so, you can delete your payment methods under “Payment Methods” in your Travel ID profile.

If you have registered for a Travel ID, you can give the Lufthansa Group Airlines and Miles & More GmbH your consent to receiving offers and information for products and services suited to your personal interests. To better tailor our services to your individual needs and preferences, we offer you the option of choosing the types of content about which you would like to be contacted, the Travel ID Operators from which you would prefer to receive information, and the electronic communication channels through which we may contact you.

Content may include suggestions about destinations, products and services, or flights you have booked. This could be offers of products, services, or benefits to make your travel experience even more enjoyable. This includes, for example, services provided by Lufthansa Group Airlines, such as premium meals, upgrades, or lounge access, as well as products and services provided by our partners, such as rental cars or insurance.

You can also receive offers and information from Miles & More about the Miles & More programThe link will be opened in a new browser tab or other products and services, including those provided by Miles & More partner companiesThe link will be opened in a new browser tab.
For this purpose, we determine your key interests based on the data stored in your Travel ID profile as well as by the LHG Airlines and Miles & More (e.g., demographic data and flight data, such as travel routes, travel classes, services used, preferences and purchases). If you have given us permission to save your interactions with our mobile apps and websites (see the cookie policy of the respective website), we also include this information in our analysis so that we can make you the best offer when you search for specific destinations, for example.
If you have given your consent on our mobile apps and websites for the purpose of showing you targeted product offers from LHG Airlines and/or Miles & More on third-party websites, we also use this information so that we can assign you to a relevant target group based on your interests.

The legal basis for processing your data is the consent you have given for this purpose, pursuant to Art. 6(1)(a) of the GDPR.

You can give this consent during the Travel ID registration process or later in your Travel ID profile. You can manage your preferences as well as manage and withdraw your consent regarding promotional communications there at any time without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal.

Depending on their flight activity, Miles & More members can achieve different types of frequent flyer status, giving them exclusive privileges. When a member reaches HON Circle Member status, these privileges include exclusive services, including proactive, personal communications. Details regarding the scope and type of data we process about you can be found in the data protection notices of the respective LHG Airlines. Travel ID Operators are also free to define customer groups and to offer this service to their members regardless of the status achieved in the Miles & More program.

The legal basis for processing your data is the consent you have given for this purpose, pursuant to Art. 6(1)(a) of the GDPR.

You can give this consent in your Travel ID profile. You can manage and withdraw your consent for this processing purpose there at any time without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal.

On selected flights, we offer internet access via Starlink. To use the internet connection, you will need to log in with your Travel ID. In connection with providing the internet connection, we process the data required for its technical operation. This includes the pseudonymized device identifier that is transmitted to Starlink to enable use of the connection.

If you have a Travel ID profile and your Travel ID profile is not linked to a Miles & More member account, Lufthansa Group Airlines will share your data with each other in order to offer you the services specified in the Travel ID terms and conditions of use. Miles & More GmbH will receive your data that is necessary for the creation and management of your Travel ID profile (e.g., contact details, date of birth and your voluntarily stored profile data) and will not process this data for its own purposes unless you have given your consent to receiving personalized offers and customized promotional communications from us (see above).

If you have linked your Travel ID profile to your Miles & More member account, the Travel ID Operators will share your data with each other in order to offer you the services specified in the Travel ID terms and conditions of use. Whether you link the two is up to you. If you do link them, the data in your Travel ID profile and your Miles & More account will be synchronized. Specifically, the data you have stored in both accounts will be applied as follows:

All master data (such as name, date of birth, postal address and phone number) and preferences (such as preferred departure airport) will be automatically taken from your Miles & More account. The email address will be taken from your Travel ID profile.

The legal basis for the transfer of your data is the performance of the contract pursuant to Art. 6(1)(b) of the GDPR.

If you have given Miles & More GmbH your consent for customized promotional communications (see the “Customized promotional communications” section), Miles & More GmbH will also process your flight data (such as travel route, travel class, departure airport and destination airport) for this purpose.

Your customer group status will be reviewed by our processor, SheerID, Inc., based in the United States. The data transfer is based on the EU-U.S. Data Privacy Framework, under which SheerID, Inc. is certified by the U.S. Department of Commerce.

Beyond this, your personal data will generally be processed within the EU.

When you log in to a Travel ID Operator website or other touchpoint for the first time, you will be prompted to enter your credentials. To help us recognize you during your session, we use a “log-in” cookie. This cookie allows you to stay logged in without having to re-enter your Travel ID credentials when you visit the websites of other Travel ID Operators.

You also have the option of actively selecting a “stay logged-in” feature on Travel ID Operator websites on which you have logged in so that you will not have to log in again when your session ends and you visit the website again later.

To this end, we also use a cookie that automatically recognizes you when you return to the website/touchpoint.

Once the “stay logged-in” feature expires, you will be prompted to log in again. You will also be prompted to log in again whenever you want to take actions that require a higher level of security.

The legal basis for processing your data is the consent you have given for this purpose, pursuant to Art. 6(1)(a) of the GDPR.

We process your data to the extent and for as long as necessary for the processing purposes described in this data protection notice.

If the purpose for which your data was processed no longer applies, this data will be deleted unless its retention is necessary for the following purposes:

• Compliance with statutory retention periods, which may result from obligations under commercial or tax law, for example; these periods may be as long as ten years
• Asserting, exercising, or defending legal claims

In these cases, the processing of your data will be restricted (“blocked”) so that it can no longer be processed for other purposes.

In the event that you withdraw from the contract within the statutory cancellation period, your personal data will generally be deleted as soon as it is no longer needed for the performance of the contract. In addition, if you no longer wish to use the Travel ID services, you can delete your Travel ID profile at any time. The personal data collected about you in the context of your use of Travel ID will then be deleted immediately, unless otherwise required by conflicting statutory retention obligations.

Your Travel ID profile and individual data you have provided can be deleted by you personally in your Travel ID profile by logging into your Travel ID profile and deleting it there.

We will also delete your temporary Travel ID profile if you do not confirm your registration within the period specified in the confirmation email or if you request a confirmation email with the activation link more than three times without using it.

Your rights

As a data subject, you can exercise the following rights if the respective legal requirements are met:

• right of access, Art. 15 GDPR
• right to rectification, Art. 16 GDPR
• right to erasure (“right to be forgotten”), Art. 17 GDPR (see also the “Deletion of your Travel ID profile” section of this Travel ID data protection notice)
• right to restriction of processing, Art. 18 GDPR
• right to data portability, Art. 20 GDPR
• right to object, Art. 21 GDPR (see also the “Right to object according to Art. 21 GDPR” section of this Travel ID data protection notice)

To the extent that we process your data on the basis of consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing carried out on the basis of your consent before its withdrawal.

To exercise your rights, you can contact the relevant Travel ID Operators as listed in the “Controllers under data protection law” section of this data protection notice. In order to handle your request and identify you, we will process your personal data in accordance with Art. 6(1)(c) of the GDPR.

You can also update your master data yourself at any time in your Travel ID profile. Please update your personal information (e.g., your mailing address, email address, or phone number) as soon as possible after it has changed. To delete your Travel ID profile, you can also proceed as described in the “Deletion of your Travel ID profile” section.

In addition, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Competent supervisory authorities

Below is a list of all the data protection authorities responsible for the Travel ID Operators.

The supervisory authority responsible for Deutsche Lufthansa AG, EW Discover GmbH, and Miles & More GmbH is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany

Phone: +49 - 611 - 14 08 - 0
Fax: +49 - 611 - 14 08 - 900 or - 901

Email: poststelle@datenschutz.hessen.deThe link will be opened in a new browser tab
The supervisory authority responsible for Eurowings GmbH is:

Landesbeauftragte für Datenschutz und Informationsfreiheit
Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf
Germany

Phone: +49 - 211 - 38 424 - 0
Fax: +49 - 211 - 38 424 - 999

Email: poststelle@ldi.nrw.deThe link will be opened in a new browser tab

The supervisory authority responsible for Lufthansa City Airlines GmbH is:

Der Bayerische Landesbeauftragte für den Datenschutz (BayLfD)
Postfach 22 12 19
80502 Munich
Germany

Email: poststelle@datenschutz-bayern.deThe link will be opened in a new browser tab

The supervisory authority responsible for Austrian Airlines AG is:

Österreichische Datenschutzbehörde
Barichgasse 40–42
1030 Vienna
Austria

Phone: +43 - 52 - 152 - 0

Email: dsb@dsb.gv.atThe link will be opened in a new browser tab

The supervisory authority responsible for Swiss International Air Lines AG and Edelweiss Air AG is:

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter
Feldeggweg 1
3003 Bern
Switzerland

Phone: +41 - 58 - 46 24 395
Fax: +41 - 58 - 46 59 996

For data processing subject to the GDPR:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany

Phone: +49 - 611 - 14 08 - 0
Fax: +49 - 611 - 14 08 - 900 or - 901

Email: poststelle@datenschutz.hessen.deThe link will be opened in a new browser tab

The supervisory authority responsible for Brussels Airlines SA/NV is:

Autorité de protection des données
Gegevensbeschermingsautoriteit
Datenschutzbehörde
Rue de la presse 35, 1000 Brussels
Belgium

Phone: +32 - 2 - 27 44 800

Email: contact@apd-gba.beThe link will be opened in a new browser tab

The supervisory authority responsible for Air Dolomiti S.p.A. and Italia Trasporto Aereo S.p.A. is:

Garante per la Protezione dei Dati Personali
Piazza Venezia n. 11
00187 Rome
Italy

Phone: + 39 06 69 6771

Email: protocollo@gpdp.itThe link will be opened in a new browser tab

You have the right to object at any time, for reasons arising from your particular situation, to the processing of your personal data on the basis of Art. 6(1)(f) GDPR.

In the event of an objection, we will no longer process your personal data unless we can prove compelling legitimate grounds for the processing that outweigh your interests, rights and freedoms or the processing is necessary to assert, exercise or defend legal claims.

If your personal data is processed by us for the purpose of direct marketing and you object to this processing, the personal data concerning you will no longer be processed for these purposes.

You can object to the processing of your personal data at any time, such as via the contacts mentioned in the “Whom can you contact?” section.

We implement technical and organizational measures to protect your data against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our security measures are constantly being improved in line with new technological developments.

In connection with the processing operations described in this Travel ID data protection notice, we may share your information with the following categories of recipients:

• Service providers with whom we are working on the basis of a data processing agreement pursuant to Art. 28(3) GDPR;
• Government agencies and authorities, due to police and investigative activities, for example.

Personal data may be transferred to third countries or international organizations worldwide in such cases. To protect you and your personal data, appropriate safeguards will be implemented for such data transfers as required by and in accordance with legal regulations.

When data is transferred to a third country for which the EU Commission or the competent authority has not issued an adequacy decision, we use EU standard contractual clauses. Information about EU standard contractual clauses can be found on the website of the European UnionThe link will be opened in a new browser tab.

Transferring data to countries without adequate protection may also be permitted in other exceptional cases, such as when the transfer is based on consent, in connection with legal proceedings, or when the transfer is necessary for the performance of a contract.

We regularly review this Travel ID data protection notice and will update it as necessary. We will inform you (e.g., on our websites) of any significant changes to this Travel ID data protection notice.