Data protection notice and declaration of consent

Under the General Data Protection Regulation (GDPR), the body responsible for the processing of personal data in the utilisation of the chatbot via Facebook Messenger is

Deutsche Lufthansa Aktiengesellschaft,
Venloer Straße 151-153
50672 Cologne
Germany

Tel.: Phone: +49 (0) 69 86 799 799
Website: https://www.lufthansa.com/de/en/help-and-contact

Microsoft Ireland Operations Limited
Atrium Building Block B
Carmenhall Road
Sandyford Industrial Estate
Dublin 18
Ireland

Bertelsmann Arvato
Arvato Direct Services GmbH
An der Autobahn 2
33333 Gütersloh
Germany

Lufthansa Global Tele Sales GmbH
Ullsteinstr.118
Haus 1A
12109 Berlin
Germany

Mindpearl Ltd.
Caribbean Plaza, 2nd Floor, North Building
878 West Bay Road
Grand Cayman
KY1-1003
Cayman Island

Customers and interested parties with their own Facebook account have the opportunity to enter into a dialogue with the Lufthansa Chatbot via the website  https://www.facebook.com/ElisaLufthansaChatbot/ and the Facebook messenger function which is integrated or linked there, in order to receive information about flights and further products, services and aspects of Deutsche Lufthansa (“chat-function”). A chatbot is a computer system that interprets written chat texts and responds automatically to the written enquiries. As well as the chat function, users can subscribe to updates regarding their flight status and other operational notifications. The sending of operational notifications also takes place via Facebook Messenger.

As well as the chat feature, customers have other options for receiving information and services from Deutsche Lufthansa, such as from the service centre or the company’s own website. Further information about these options can be found here.

Personal data is any information which identifies or makes identifiable a natural person.

Deutsche Lufthansa uses the personal data you have provided in the context of the chatbot only insofar as this is necessary for the use of the chatbot via Facebook Messenger as described in point 4a). We may also contact you in the event of flight disruptions, if you have consented to this. We use your personal data exclusively in order to be able to respond to your individual query. You are free to decide whether you provide us with your data for the above-mentioned purposes. Deutsche Lufthansa will seek your consent to use the personal data you disclose while using the chatbot for other purposes (in particular for advertising purposes).
Moreover, we recommend that you take care when disclosing particularly sensitive information (e.g. information about religion or health).

We make use of the following personal date from you:

• first name
• surname
• username (chatbot)
• gender
• language
• Facebook username
• Facebook user ID
• chatbot user ID
• IP address
• booking code
• email address
• telephone number
• content of your communications
• personal data from your Lufthansa iD (customer profile)

a) Chat feature

Only natural persons who have completed their 16th year are permitted to use the chatbot.

When you use the chat feature, we will use your data as follows:

in the case of an enquiry to Deutsche Lufthansa via Facebook Messenger, Facebook will assign you a session-based pseudonymised user ID. In order to be able to process your enquiry, Facebook communicates this pseudonymised user ID and a user ID that is exclusive to the chatbot, as well as your Facebook username, to Deutsche Lufthansa. This enables us to recognise you if you submit subsequent enquiries via this channel and to contextualise your enquiry in relation to previous chat dialogues. The communication of your Facebook username also allows us to ensure that, in the event of a rebooking, only authorised persons can make this rebooking. The communication of language and gender allows us to address you using a personalised form.

The communication to Deutsche Lufthansa of other data stored by you on Facebook and information about you will not take place. Deutsche Lufthansa stores the user ID provided by Facebook solely for possible anonymised evaluation purposes, such as the collection of user numbers, surveys on language, frequently used areas of the application or similar, in order to be able to make product adjustments and improvements based on these evaluations.

In order to be able to offer a personalised service, there is an option to link the user ID with your Deutsche Lufthansa customer profile. The purpose of this link is to be able to provide information that is as closely tailored to you as possible, such as on baggage regulations, check-in times, etc. If the user has permitted a link with, for example, their Deutsche Lufthansa customer profile, this information will be stored in the customer database in order to be able to access this information in the event of future enquiries and to be able to provide personalised answers.

Any and all data you have entered into the chat history of Facebook Messenger in dialogue with the chatbot will be stored by the data processing company Microsoft and as far as it is necessary for the handling of your request, your data will also be processed for that purpose by Microsoft. If the chatbot software cannot process your enquiry via a dialogue provided within the software, the data you have entered will be processed by means of a special software. With the aid of this software, your data will be speech analysed and returned again to Deutsche Lufthansa in an analysed form. In each case, the special software only receives the text you entered during the chat history. This also includes personal data that may have been disclosed in the text.

If your enquiry cannot be answered satisfactorily, your input texts will be forwarded to the data processing company Bertelsmann Arvato. These input texts will be speech analysed there with the aid of a special software and compared with a knowledge database. Entries matching your input text will be sent back to you. Bertelsmann Arvato only receives the text you have written within the chatbot chat (including all personal data which you have disclosed in the same context).

In order to improve the chat function, we analyze all dialogues in an automated matter to highlight areas for future improvements. Solely the content of your dialogues and the respective responses from the chatbot will be analyzed and no additional information (such as user names etc.) will be taken into consideration.

b) Push Notifications feature

If you have registered for the chatbot, you will also receive messages with information about your flight (e.g. information about the departure gate, gate changes, cancellations, rebookings, etc.). If you do not wish to receive these messages, you can unsubscribe at any time and without giving reasons.

c) Check-in feature

If you utilise the check-in feature provided via the chatbot, the following personal data from you will be used:

If you would like to receive a check-in reminder via the chatbot, you must supply us with your booking code and surname. It is possible that you will be asked whether you would like to receive a message as soon as your flight is ready for check-in. As soon as your flight is ready for check-in, you will receive an unencrypted text. For the further check-in procedure, we will send you an encrypted link which contains personal data (booking code and surname).

d) Live-chat feature

If you use the live-chat feature provided by our chatbot, we will process the following personal data from you:

In cases, where the chatbot cannot process your queries or your requests, there is an option to contact our Service Center. You can also make contact with our Service Center by using the live-chat feature. If you use the live-chat feature, all your personal data will be passed to our Service Center and data processing company Lufthansa Global Telesales or Mindpearl, which will respond to you in Facebook Messenger.

e) Feedback feature

If you use the feedback feature provided by our chatbot, we will process the following personal data from you:

You have the option of letting us know your feedback about our chatbot. If you decide to let us know your opinion about it, your feedback will be sent to us via an unencrypted email. The email contains no personal data except for your pseudonymised user ID.

Declaration of consent

I agree to the processing of the personal data stated above for the use of the chatbot via Facebook Messenger. This consent can be revoked at any time without giving reasons, whereat the further use of chat is then no longer possible. To revoke your consent, you can select "More" from the Facebook Messenger menu, followed by "Legal & Data Protection" and click on "Revoke permissions". Use is then only possible after renewed consent.

In order to document the submission of your declaration of consent, we store your Facebook username (first name and surname), gender, your Facebook user ID, your pseudonymised user ID, IP address and the date of submission of your consent.

As a basic principle, the data provided by you in the context of the chatbot will be stored by us for 60 days. The duration of the storage is longer when your personal data is required for the defence, exercise and establishment of legal claims or a statutory obligation to preserve records otherwise exists. The storage period is longer if the date of a flight booking you have entered exceeds this period. In this case, your data will be deleted when the latest flight in your booking is reached, or after a maximum of 6 months. The 60 days retention period of the chatbot functions does not affect the retention period of all personal data processed to fulfill the contract of carriage. With regard to the processed personal data to fulfill the contract of carriage kindly note our terms and conditions of transport as well as the privacy policy in this context.

In processing your query in the context of the chatbot, it may be necessary for Deutsche Lufthansa to pass on your personal data to other affiliated companies within the Lufthansa Group or to external data processing companies (those named in these data protection notices or others), who act exclusively on our behalf and in accordance with legal requirements. Such data processing companies may be tasked, for example, with the provision of servers or the sending of news notifications.

Moreover, we do not pass on the personal data received in the context of the chatbot to third parties without your consent, nor do we sell or rent your personal data. However, we reserve the right to disclose information about you if we are required to do so by law or if we are required to do so by lawfully acting authorities or courts.

We have no influence over the type and extent of the data that may be collected by Facebook or beyond the extent described here. Information about the purpose and extent of the data collection and the further processing and use of the data by Facebook, as well as your related rights and settings options to protect your privacy, can be found in Facebook’s data policy at https://www.facebook.com/policy.php.

It is very important to us at Deutsche Lufthansa that our data processing methods are clear and transparent. Therefore, it is important that our customers not only are able to revoke their consent, but also to exercise their following rights:

• right of access to information
• right to rectify their personal data
• right of deletion
• right to limit processing
• right to data portability

The application for information is to be submitted in writing with evidence of identity (scan or copy of an official photographic identification). You can address your application for information by email to datenauskunft@dlh.de or by post to:

Deutsche Lufthansa AG
Data Information
FRA CJ/D
60546 Frankfurt,
Germany.

For every matter regarding data protection laws, please contact our company’s data protection officer at the above-mentioned address by post or via email to datenauskunft@dlh.de.
Moreover, you have the right to contact the data protection authority as the relevant regulatory body if you have a complaint. The relevant data protection authority for Deutsche Lufthansa AG is the following:

Hessian Officer for Data Protection and Information Freedom
PO Box 3163
65021 Wiesbaden
Germany

Phone: +49 (0) 211/38424-0
Email: poststelle@datenschutz.hessen.de

Deutsche Lufthansa uses technical and organisational data security measures to protect your personal data against accidental and deliberate manipulation, loss and deletion or unauthorised access. Data security is a continual process for Deutsche Lufthansa so that the technical security measures match up to the state of technology. Likewise the employees of Deutsche Lufthansa are trained in the fields of data security and data protection and are subject to organisational measures for secure data processing.

Parts of the data protection policy may be changed or updated by us without notifying you in advance. Please check the data protection policy in each case before using our service to stay up-to-date with any changes or updates.

Status of data protection policy as at: May 2019