Travel ID Privacy Notice

The purpose of this Travel ID Privacy Notice (referred to below as “Privacy Notice”) is for us to inform you about the processing of your personal data in connection with your use of Travel ID.

We, the airlines of the Lufthansa Group and Miles & More GmbH, as the operators of Travel ID, would like to offer you our services within the Lufthansa Group in the most convenient way possible and provide you with an air travel experience that is tailored to you and your particular wishes and expectations, from your first visit to our website and other touchpoints through to the end of your trip and beyond. You have the option through Travel ID of creating a free customer profile that is valid for all Travel ID operators and allows you access to a wide range of services.

Creating a Travel ID profile and providing the data needed for this is voluntary. However, some of our services are available exclusively to our Travel ID customers. This applies, for example, to the option of receiving personalised flight offers and additional services on the Lufthansa Group airlines’ booking platforms.

This data protection statement is aligned with the applicable data protection regulations; depending on the scope of application, these include the GDPR as well as any other future statutory national data protection laws and regulations.

The Travel ID operators are Air Dolomiti S.p.A. Linee Aeree Regionali Europee (Dossobuono di Villafranca (VR), Via Paolo Bembo 70, Italy), Austrian Airlines AG (Office Park 2, Postbox 100, 1300 Vienna Airport, Austria), Brussels Airlines SA/NV (1050 Brussels, Belgium, Jaargetijdenlaan 100-102/B30 Av. des Saisons), Deutsche Lufthansa AG (Venloer Straße 151-153, 50672 Cologne, Germany), Edelweiss Air AG (The Circle 32, 8058 Zurich Airport, Switzerland), Eurowings GmbH (Waldstraße 249, 51147 Cologne, Germany), EW Discover GmbH (Hugo-Eckener-Ring 1, FAC Building, 60549 Frankfurt a.M., Germany), Italia Trasporto Aereo S.p.A. (Via Venti Settembre 97, Rome, 00187, Italy), Lufthansa City Airlines GmbH (Munich Airport, FOC, Südallee 15, 85356 Munich, Germany) and Swiss International Air Lines AG (Obstgartenstrasse 25, 8302 Kloten, Switzerland), as “Lufthansa Group airlines” or “LHG airlines”, and Miles & More GmbH (Frankfurt Airport Tor 21 Airportring, Geb. 322, 60546 Frankfurt a.M. Germany).

Unless otherwise stated in this Privacy Notice, “we” or “us” or “Travel ID operators” refers to the Lufthansa Group airlines and Miles & More GmbH as the data controllers with joint responsibility (“Joint Controllers”) for processing your personal data as defined in Art. 26 of the General Data Protection Regulation of the European Union (“GDPR”).

ITA Airways operates independently, both commercially and operationally, in North and Central America as well as in Japan.

You can contact the data protection officers at the following addresses:

data protection officer of Air Dolomiti S.p.A., Deutsche Lufthansa AG, Lufthansa City Airlines GmbH, Miles & More GmbH, Eurowings GmbH, EW Discover GmbH and Brussels Airlines SA/NV:

Deutsche Lufthansa AG
Data Protection Officers
FRA CJ/D
Lufthansa Aviation Center
Airportring
60546 Frankfurt am Main
Germany

Data protection officer of Austrian Airlines AG:

Austrian Airlines AG
Legal office – Data Protection
Office Park 2
P.O. Box 100
1300 Vienna Airport
Austria

Data protection officer of Swiss International Air Lines AG:

Swiss International Air Lines AG
ZRH S/CJ
P.O. Box
8058 Zurich Airport
Switzerland

Data protection officer of Italia Trasporto Aereo S.p.A.:

ITALIA TRASPORTO AEREO S.p.A.
Via Venti Settembre 97
00187 Rome
Italy

Data protection officer of Edelweiss Air AG:

Edelweiss Air AG
Company Data Protection Officer
The Circle 32
P.O. Box
8058 Zurich Airport
Switzerland

When you register for Travel ID, the only mandatory information we request is your email address, your title, your first and last names, your date of birth and a password. Your country and preferred language settings are transferred automatically, where technically feasible, using the country and language settings you entered on the relevant websites or other touchpoints of the Travel ID operators. This is the minimum information required to create a Travel ID profile. If you register for the Miles & More programme at the same time, providing your address and contact details will also be mandatory.

In order to take advantage of all the benefits of Travel ID, you have the option of adding more information to your Travel ID profile on a voluntary basis. This may include your mobile phone number or flight preferences (e.g. your preferred departure airport).
You also have the option of adding one or more travel partners to your profile. Please note that this is only permitted with the consent of the person in question.

You can also give and withdraw your consent to the processing of data for different purposes in your Travel ID profile. This includes the “cookie settings”, which we automatically apply as per your selection when you visit our websites and mobile apps. This saves you the trouble of repeatedly choosing these settings when you access these touchpoints.
In addition, you can view and edit your settings regarding the personalisation of our offers and sending of customised promotional communications.
If you belong to the customer groups defined by us, you also have the option of consenting to the use of our proactive Top Customer Relation Services.

Based on your activities that you linked in your Travel ID profile, you may be shown anonymous statistics (e.g. your position in the ranking of kilometres flown) and/or so-called badges (e.g. awards when you reach specific targets).

The consent of a parent or guardian is required if you wish to set up a Travel ID profile for your child or your child wishes to do so themselves, and the child is under 18 years of age. After submitting the completed registration form, the parent or guardian will receive an e-mail in which they are asked to give their consent to the creation of a Travel ID profile by confirming the link in the e-mail. All personal data entered is deleted if the parent or guardian does not give their consent within the specified deadline after registration.

The legal basis for processing your data is the performance of the contract in accordance with Art. 6(1)(b) GDPR.

You also have the option of saving additional personal data, such as your preferred payment method or travel documents, in your Travel ID profile on the basis of your consent. You can find details about this in the relevant sections of this Privacy Notice.

If your employer participates in a Lufthansa Group corporate promotion programme or incentive model, you can add specific company information about your employer to your Travel ID profile. When booking business travel while logged in to the websites or apps of the Lufthansa Group airlines, the relevant fares will be displayed based on this information. This information will also be added to your booking when you complete it.

To link your Travel ID profile to your employer’s company information, you will need a link provided by your employer. When using this link, you will be asked whether you would like to add your employer’s company information to your Travel ID. For the initial setup of the link and for confirmation later, you will be asked to enter your work email address. We’ll send you a code to the address, and you’ll be asked to use it to identify yourself.
Once you have successfully linked your Travel ID profile to your employer’s company information, your employer will be notified of this action and will be able to see your first and last name, your business travel bookings and a "connection identifier". No further data from your Travel ID will be shared with your employer.

You can unlink your profile from your employer’s company information at any time within the "Company Information" section of your Travel ID. Your employer can also request the removal of the link at any time.

The legal basis for processing your data is the performance of the contract in accordance with Art. 6(1)(b) GDPR.

If necessary for fulfilling the contract, we may send you messages about your Travel ID profile. Such messages include the email for activating the Travel ID, the emails for editing your information and changes to processing purposes requiring consent (communication settings) and other messages, such as information about adjustments to the Travel ID Terms and Conditions of Use and about status changes in your Travel ID profile. Status changes may relate, for example, to the expiry of the validity of your travel documents uploaded via your Travel ID profile, your payment methods or your password.

The legal basis for processing your data is the performance of the contract in accordance with Art. 6(1)(b) GDPR.

When you visit our websites and use our mobile apps and other touchpoints on the ground and on board our aircraft, our aim is to make it easier and quicker for you to find and use the information that is relevant to you. You therefore have the option of registering there with your Travel ID and being contacted personally, for example receiving information that matches your current flight booking or your Miles & More membership.

You can also make use of the option to save your privacy settings (“cookie settings”) in your Travel ID profile. As soon as you use one of our websites or mobile apps and we are able to identify you, we will apply the cookie settings you have saved in your profile. Detailed information about the purposes of processing and processing activities can be found in the privacy policy or cookie policy on the respective LHG airline websites and on the Miles & More website.

If you do not wish to use the login service, you are, of course, free to use the website/touchpoints without logging in. In this case, the respective content will be displayed without being personalised to you.

The legal basis for processing your data is the performance of the contract in accordance with Art. 6(1)(b) GDPR.

We use the data saved in your Travel ID profile to make visiting our websites easier for you through pre-populated forms. This can be data that you actively entered there during registration or added at some later point or data that you provided, for example, as part of a previous booking in connection with your Travel ID and which we automatically take into account during a subsequent booking. We also use the data you provide during a booking to give you access to pre-populated forms, e.g. during online check-in or at a check-in machine. If you fill out other forms, such as during your participation in a contest or when you send customer feedback using one of our electronic feedback forms on the website, the contact details required are also pre-filled using information from your Travel ID profile.

The legal basis for processing your data is the performance of the contract in accordance with Art. 6(1)(b) GDPR.

Flight bookings are automatically saved and displayed in your Travel ID profile if you make the booking while logged in. If you add a flight booking to your Travel ID profile after this, we check whether the booking is complete and add information you have saved in your Travel ID profile as required. No data will be overwritten without your consent.
The summary of your flight bookings is limited to 10 years and also includes the creation and display of flight statistics, among other things.

If you change your previous customer profile from one of the Lufthansa Group airlines to a Travel ID profile, your past flight bookings from your previous customer profile will also be displayed in your Travel ID profile.

The legal basis for processing your data is the performance of the contract in accordance with Art. 6(1)(b) GDPR.

We use the data stored in your Travel ID profile to provide you with personalised, targeted service at all our touchpoints on the ground and in the air as well as to improve our complaint management. In doing so, we combine the data entered by you in your Travel ID profile during or after registration as well as all the data that we can link to you based on your Travel ID, e.g. completed purchases and use of services as well as delays, flight cancellations and baggage irregularities. We also process data and information like your preferences, enquiries addressed to our Service Centre and data from other interactions with us, such as with the crew on board our aircraft or the staff in our lounges.

The legal basis for processing your data is the performance of the contract in accordance with Art. 6(1)(b) GDPR.

If you have a Travel ID profile, we may use your data to contact you with regard to special personal occasions (e.g. your birthday, events related to your Miles & More membership) or your travel and service preferences, such as onboard our aircraft. In addition, if you make use of or have made use of products and services offered by Travel ID operators and we were repeatedly unable to provide you with the promised service, we may use this data (e.g. irregularities and customer concerns, number and severity of the incidents) and contact you regarding this.

The legal basis for processing your data is our legitimate interest in accordance with Art. 6(1)(1)(f) GDPR.

If you belong to one or more customer groups (e.g. students), you can have your belonging to such a customer group checked and save the confirmation in your Travel ID profile. If you subsequently book a trip while logged in, for example, we can use the customer group status stored in your Travel ID profile to check whether you are authorised to benefit from customer group-specific benefits.

The legal basis for processing your data is provided by your consent granted in accordance with Art. 6(1)(a) GDPR.

You have the right to withdraw your consent to the confirmation of your customer group at any time without affecting the lawfulness of any storage on the basis of this consent before such consent is withdrawn. To do this, you can cancel the confirmation(s) in your Travel ID profile under “Customer groups”.

The entitlement to special terms and discounts is automatically cancelled once they expire.

You may store your travel documents, e.g. passport or visa, in your Travel ID profile. We store this information for you in a separately secured database. If you are logged in and book a trip that requires you have certain travel documents, we will automatically populate your flight booking with the information stored in your Travel ID profile. This process is not carried out if your flight booking already contains your travel documents details.

The legal basis for processing your data is provided by your consent granted in accordance with Art. 6(1)(a) GDPR.

You have the right to withdraw your consent to use of the data from the travel documents at any time, without affecting the lawfulness of any processing performed on the basis of this consent before such consent was withdrawn. To do this, you can delete your travel documents in your Travel ID profile under “Personal documents”.

Your travel documents will be deleted automatically once they are no longer valid.

We offer you the option of storing your preferred payment methods in your Travel ID profile. You can do this yourself at any time within your Travel ID profile. You also have the option during the booking process of deciding to store in your Travel ID the payment methods you entered for the booking for future purchases.

If you have stored a payment method in your Travel ID profile and make a booking with your Travel ID profile while logged in, we will pre-fill your preferred payment methods or offer you a selection. You can edit or delete your payment methods at any time.

The legal basis for processing your data is provided by your consent granted in accordance with Art. 6(1)(a) GDPR.

You have the right to withdraw your consent to the storage of your payment methods at any time without affecting the lawfulness of any storage on the basis of this consent before such consent is withdrawn. To do so, you can delete your payment methods in your Travel ID profile under “Payment methods”.

If you have registered for a Travel ID, you can give your consent to ​Lufthansa Group airlines and Miles & More GmbH in order to receive offers and information about products and services tailored to your personal interests. To respond to your needs and preferences in a more personalized manner, we offer you the option of choosing the content about which you would like to be contacted, the Travel ID operators via which you would prefer to be informed and the electronic communication media via which we may reach out to you.

Content may relate to suggestions for destinations, products and services, or flights you have already booked. Offers might therefore include products, services or benefits to make your travel experience even more enjoyable. This includes, for example, services provided by Lufthansa Group airlines, such as premium meals, upgrades or the use of lounges as well as products and services provided by our ​partners, such as rental cars or insurance.

You may also receive offers and information from Miles & More about the ​Miles & More programmeThe link will be opened in a new browser tab or other products and services, including Miles & More partner companiesThe link will be opened in a new browser tab.
For this purpose, we determine your main areas of interest based on the data stored in your Travel ID profile as well as data stored with LHG airlines and Miles & More (e.g. demographic data, flight data like travel routes, travel classes, services used, preferences, purchases). If you have given us permission to save your interactions with our mobile apps and websites (see the cookie policy of the respective website), we will also include this information in our investigations, e.g. so that we can make you the best offer when searching for specific destinations.
If you have given your consent on our mobile apps and websites for the purpose of specifically reaching out to you with product offers from LHG airlines and/or Miles & More on third-party websites, we also use this information so that we can assign you to a relevant target group based on your main areas of interest.

The legal basis for processing your data is provided by your consent granted in accordance with Art. 6(1)(a) GDPR.

You can give this consent during the Travel ID registration process or later in your Travel ID profile. You can manage your consent and your preferences regarding promotional communication there at any time and withdraw your consent without affecting the lawfulness of any processing performed on the basis of this consent before it was withdrawn.

Depending on their flight activities, members of the Miles & More programme can achieve various types of frequent flyer status and thus enjoy exclusive benefits. If a member achieves HON Circle Member status, these benefits include exclusive services, among them proactive personal contact. Detailed information about the scope and type of data processed about you can be found in the respective LHG airline’s privacy policy. In addition, Travel ID operators are free to define customer groups and offer this service to their members, regardless of the status achieved in the Miles & More programme.

The legal basis for processing your data is provided by your consent granted in accordance with Art. 6(1)(a) GDPR.

You can provide this consent in your Travel ID profile. You can manage your consent to this processing purpose at any time there and withdraw such consent without affecting the lawfulness of any processing performed on the basis of this consent before it was withdrawn.

On selected flights, we offer you Internet access via Starlink. To use the Internet connection, you are required to log in with your Travel ID. In the context of providing the Internet connection, we process the data required for its technical operation. This includes the pseudonymised device identifier, which is transmitted to Starlink to enable use of the connection.

If you have a Travel ID profile and your Travel ID profile is not linked to a Miles & More member account, Lufthansa Group airlines will exchange your data with each other in order to offer you the services specified in the Travel ID Terms and Conditions Of Use. Miles & More GmbH will receive data from you that is required to create and manage your Travel ID profile (e.g. contact details, date of birth and your voluntarily stored profile data) and will not process this data for its own purposes, unless you have consented to the personalisation of our offers and sending of customised promotional communication (see above).

If you have linked your Travel ID profile to your Miles & More member account, the Travel ID operators will exchange your data with each other in order to offer you the services specified in the Travel ID Terms and Conditions of Use. You can decide whether to create this link yourself. Data matching is performed between your Travel ID profile and your Miles & More account when you create the link. Specifically, the data you have stored in both accounts will be transferred as follows:

All master data (such as name, date of birth, postal address, telephone) and preferences (such as preferred departure airport) is automatically transferred from your Miles & More account. The email address will be taken from your Travel ID profile.

The legal basis for transferring your data is the performance of the contract in accordance with Art. 6(1)(b) GDPR.

If you have given Miles & More GmbH your consent to receive personalised advertising communication (see the section “Personalised advertising communication”), Miles & More GmbH will also process your flight data (such as your route, travel class, departure airport and destination airport) for this purpose.

Your customer group status is verified by our data processor SheerID, Inc. with its registered office in the USA. Data transfers are carried out based on the EU-U.S. Data Privacy Framework under which SheerID, Inc. is certified with the U.S. Department of Commerce.

Apart from that, your personal data is, in principle, always processed within the EU.

When you log into a website or other touchpoint of a Travel ID operator for the first time, you will be asked to enter your access details. In order to recognise you during your session, we set a “log-in” cookie. This cookie allows you to visit websites of other Travel ID operators without having to long into your Travel ID credentials again.

You can also choose to actively enable a “stay logged-in” feature when logged into Travel ID operators’ websites, which means that you will not be required to log in again after ending your session and later re-visiting the website.

We also use cookies for this purpose so that when you return to the website/touchpoint, you will be recognised automatically.

When the “stay logged-in” feature expires, you will be asked to log in again. In addition, you will always be prompted to log in again if you are in the process of carrying out activities which require an enhanced level of security.

The legal basis for processing your data is provided by your consent granted in accordance with Art. 6(1)(a) GDPR.

We process your data to the extent and as long as necessary for the processing purposes described in this Privacy Notice.

If the purpose for which your data was processed no longer applies, this data will be deleted, unless the retention thereof is required for the following purposes:

• Fulfilment of statutory retention periods, which may result from obligations under commercial or tax law; these periods may be for up to ten years
• Assertion, exercise or defence of legal claims

In these cases, the processing of your data is restricted (“blocked”) so that it can no longer be processed for other purposes.

If you withdraw from the contract within the statutory withdrawal period, your personal data will generally be deleted as soon as it is no longer required for the performance of the contract. If you no longer wish to use the Travel ID services, you may also delete your Travel ID profile at any time. The personal data collected in connection with your use of Travel ID will then be deleted immediately, subject to conflicting statutory retention requirements.

You can delete your Travel ID profile yourself as well as any specific items of data you have provided in your Travel ID profile by logging into your Travel ID profile and performing the deletion there.

We also delete your provisional Travel ID profile if you do not confirm your registration within the period stated in the confirmation e-mail, or if you have had a confirmation e-mail with an activation link sent to you more than three times.

Your rights

As a data subject, you can exercise the following rights where the respective statutory requirement is met:

• Right of access, Art. 15 GDPR
• Right to rectification, Art. 16 GDPR
• Right to erasure (“right to be forgotten”), Art. 17 GDPR (see also the “Deletion of your Travel ID profile” section of this Travel ID Privacy Notice)
• Right to restriction of processing, Art. 18 GDPR
• Right to data portability, Art. 20 GDPR
• Right to object, Art. 21 GDPR (see also the section “Right to object under Art. 21 GDPR” of this Travel ID Privacy Notice)

Insofar as we process your data on the basis of consent, you have the right to withdraw this consent at any time without affecting the lawfulness of any processing performed on the basis of this consent before such consent was withdrawn.

To exercise your rights, you can contact the relevant Travel ID operators from the “Data controllers under data protection law” section of this Privacy Notice. In order to process your application and identify you, we will process your personal data in accordance with Art. 6 (1)(c) GDPR.

In your Travel ID profile, you can also check the current status of most of your master data yourself at any time. Please update your personal data immediately after any changes occur (for example your postal address, email address or telephone number). To delete your Travel ID profile, you can also proceed as described in the paragraph “Deletion of your Travel ID profile”.

You also have the right to lodge a complaint with a regulatory authority: Art. 77 GDPR.

Competent regulatory agencies

You will find a list of all data protection authorities responsible for the Travel ID operators below.

The competent supervisory authority for Deutsche Lufthansa AG, EW Discover GmbH and Miles & More GmbH is:

The Officer for Data Protection and Freedom of Information of the State of Hesse
P.O. Box 3163
65021 Wiesbaden
Germany

Tel.: +49 611 14 08 0
Fax: +49 611 14 08 - 900 or 901

Email: poststelle@datenschutz.hessen.deThe link will be opened in a new browser tab
The competent supervisory authority for Eurowings GmbH is:

Regional Officer for Data Protection and Freedom of Information
State of North Rhine-Westphalia
P.O. Box 20 04 44
40102 Dusseldorf
Germany

Tel.: +49 211 38 424 0
Fax: +49 211 38 424 999

Email: poststelle@ldi.nrw.deThe link will be opened in a new browser tab

The competent supervisory authority for Lufthansa City Airlines GmbH is:

The Bavarian State Commissioner for Data Protection (BayLfD)
P.O. Box 22 12 19
80502 Munich
Germany

Email: poststelle@datenschutz-bayern.deThe link will be opened in a new browser tab

The competent supervisory authority for Austrian Airlines AG is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria

Tel.: +43 52 152 0

Email: ​dsb@dsb.gv.atThe link will be opened in a new browser tab

The competent supervisory authority for Swiss International Air Lines AG and Edelweiss Air AG is:

Swiss Federal Data Protection and Information Commissioner
Feldeggweg 1
3003 Bern
Switzerland

Tel.: +41 58 46 24 395
Fax: +41 58 46 59 996

For data processing that is subject to the GDPR:

The Officer for Data Protection and Freedom of Information of the State of Hesse
P.O. Box 3163
65021 Wiesbaden
Germany

Tel.: +49 611 14 08 0
Fax: +49 611 14 08 - 900 or 901

Email: poststelle@datenschutz.hessen.deThe link will be opened in a new browser tab

The competent supervisory authority for Brussels Airlines SA/NV is:

Autorité de protection des données
Gegevensbeschermingsautoriteit
Data Protection Authority
Rue de la presse 35, 1000 Brussels
Belgium

Tel.: +32 2 27 44 800

Email: contact@apd-gba.beThe link will be opened in a new browser tab

The relevant supervisory authority for Air Dolomiti S.p.A. and Italia Trasporto Aereo S.p.A. is:

Garante per la Protezione dei Dati Personali
Piazza Venezia n. 11
00187 Rome
Italy

Tel.: +39 06 69 6771

Email: protocollo@gpdp.itThe link will be opened in a new browser tab

For reasons arising from your specific situation, you have the right to object at any time to processing of your personal data based on Art. 6(1)(f) GDPR (Lawfulness of Processing).

In the event of an objection, we will no longer process the personal data that concerns you, unless we can prove that there are compelling reasons for the processing that are worthy of protection and that outweigh your interests, rights and freedoms, or if the processing is used to enforce, exercise or defend legal claims.

If the personal data concerning you is processed by us for the purpose of direct marketing, and you object to this processing, the personal data concerning you will no longer be processed for these purposes.

You can object to the processing of your personal data at any time, for example via the contacts specified in the section “Who can you contact?”.

We use technical and organisational security measures to protect your data against accidental or deliberate manipulation, loss, deletion or access by unauthorised persons. Our security measures are being improved continuously as new technology develops.

In connection with the processing operations described in this Travel ID Privacy Notice, we may disclose your data to the following categories of recipients:

• service providers with whom we cooperate on the basis of a commissioned data processing agreement in accordance with Art. 28(3) GDPR;
• governmental agencies and authorities, e.g. due to police and investigative activities.

In such cases, personal data may be transferred worldwide to third countries or international organisations. For your protection and the protection of your personal data, appropriate security measures will be taken for such data transfers in accordance with and pursuant to the law.

If these transfers are made to a third country for which the EU Commission or competent authority has not issued an adequacy decision, we use standard EU contractual clauses. Information about EU standard contractual clauses is available on the ​European Union websiteThe link will be opened in a new browser tab.

In exceptional cases, transfer to countries without adequate protection may also be permissible in other cases, e.g. based on consent, in connection with legal proceedings or if the transfer is necessary for the execution of a contract.