Data Protection information
The data protection information provided below applies from 25 May 2018 and reflects the enhanced transparency requirements as provided in the EU General Data Protection Regulation.
Who is the controller?
Deutsche Lufthansa AG (Venloer Straße 151-153, 50672 Cologne, Germany) (hereinafter also “Lufthansa”, “we”, “us”) wishes to inform you below of how your personal data are processed within the context of our offerings. These offerings can be directly accessed via lufthansa.com (“website”) and the Lufthansa app.
Any mention of Lufthansa Group airlines below refers to the Lufthansa, SWISS International Airlines AG, Austrian Airlines AG and Eurowings GmbH airlines. The Lufthansa Group includes Lufthansa Group Airlines as well as the other companies of the Lufthansa corporation.
Whom can I contact?
If you have any further queries regarding data protection in connection with our website or the services offered there, please contact our data protection officer:
Group Data Protection Officer for the Lufthansa Group
Deutsche Lufthansa AG
Please address any request for information to:
Deutsche Lufthansa AG
or by e-mail to:
If you contact us via email, the communication is unencrypted.
Why do we process your data (purpose of the processing) and what is the legal basis?
We process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Data Protection Act (BDSG).
We process personal data to fulfil contractual obligations pursuant to Art. 6(1), Subparagraph 1(b) GDPR. In particular this includes:
- issuing flight tickets
- sending booking confirmations
- providing flight-related services booked by you and flight-related information, such as à la carte menus, Pre-flight Shopping, eJournals, and luggage services
- administering the check-in process from the invitation through to waiting list processing and baggage handling
- collection and transmission of your contact data, which is absolutely necessary due to legal regulations of local authorities and therefore necessary for the fulfilment of your contract of carriage.
We also process your data for the purposes of our legitimate interests pursuant to Art. 6(1), Subparagraph 1(f) GDPR
- so that we can provide you with relevant information about your booked flight and travel destination
- for the purpose of preventing, investigating and prosecuting criminal offences, such as fraud, e.g. credit card or identity fraud, the use of fraudulent means to obtain special terms or fares
- to enforce legal claims, including debt collection and defence in the event of legal disputes
- for auditing purposes
- to safeguard the airline’s IT security and operations
- to guarantee flight safety
- for advertising, provided that you have not objected to the use of your data
- for the purpose of creating international aviation statistics
- for the purpose of creating statistics to improve our products and services. In individual cases, we may create customer profiles for this purpose by processing reservation data; however, these profiles will be anonymized immediately and will not be used to analyze or predict any aspects relating to your personal preferences.
- To communicate with you, to the extent that an ongoing business relationship with you or your employer already exists, or it is intended to be established (business contacts).
We process your data based on your consent pursuant to Art. 6(1), Subparagraph. 1(a) GDPR for specific purposes, especially:
- for sending out newsletters with regular offers from Lufthansa
- for receiving specific information and offers from Lufthansa and partner companies
- for market research and customer surveys
- for personalised use of the website and personalised offers, including profiling
- to support processes relating to usage of the website, with reminder features and live chats
- for analytical purposes so that we can optimise our offer for you.
Any consent given can be withdrawn at any time. This also applies to the withdrawal of declarations of consent given to us before the GDPR came into force, in other words, prior to 25/05/2018. Withdrawal of consent has effect for the future only and does not affect the lawfulness of data processed until the withdrawal.
Based on what other obligations do we process your data?
We process passenger data on the basis of the legal obligations pursuant to Art. 6(1), Subparagraph 1(c) GDPR:
If obliged to do so by law, we process personal data in order to meet duties of retention under commercial or tax law or to meet legal security requirements (such as Section 7 of Germany’s Aviation Security Act [LuftSiG]). For further information on retention periods, please refer to “Duration of the data processing”.
Data transmission to immigration authorities:
- Based on the airline passenger data agreement between the EU and the USA and the EU and Canada
- Based on the German Airline Passenger Data Act (FlugDaG)
- API* (Advance Passenger Information) - we transmit data to the extent that we are obliged to participate in international travel control activities
Data transmission to health authorities:
- to fight a pandemic
* Data stored in the machine-readable zone in passports or identity documents
Further information can be obtained from the relevant authorities.
Which personal data are you required to provide?
For legally stipulated or contractual requirements, we have marked the respective input fields on our website forms as mandatory, which are to be filled out on your part, so that we can provide you with the desired contract or service.
How long are your data stored?
Your personal data is erased as soon as it is no longer required for the purposes stated. However, if necessary, we must continue to store your data until the retention periods and deadlines expire, set by the legislator or supervisory authorities, which may arise from the German Commercial Code (Handelsgesetzbuch), Tax Code (Abgabenordnung) or Money Laundering Act (Geldwäschegesetz). These generally amount to six to ten years. We may also retain your data until the statutory limitation periods have expired (usually three years, but up to 30 years in some cases), provided that this is necessary for the establishment, exercise or defence of legal claims. After that, the relevant data are routinely erased.
Who receives your data?
In the context of the data processing above and the respective legal bases given (contract performance, legitimate interests, consent or processing obligations under law), your data may be passed on to the following categories of recipients:
- Lufthansa Group airlines
- vicarious agents, e.g. service providers for ground handling services and other additional related services
- other airlines performing part of the carriage
- other service providers, e.g. for the provision of the website, newsletter dispatch, feedback handling, compiling of international aviation statistics
- state agencies and bodies, e.g. based on entry requirements or police activities and investigations.
In the process, personal data may be transmitted to third countries or international organisations. For your protection and the protection of your personal data, appropriate safeguards are provided for such data transmissions as per and in accordance with legal requirements.
If these transmissions do not have a legal basis or are carried out to a country, for which the EU Commission has not issued an adequacy decision, we use EU standard contractual clauses.
Information on EU standard contractual clauses is available here on the European Union website.
What are your data protection rights?
Lufthansa is committed to ensuring fair and transparent processing. That is why it is important to us that persons concerned can not only exercise their right to object but also to exercise the following rights where the respective legal requirements are satisfied:
- Right to information, Art. 15 of the GDPR
- Right to rectification, Art. 16 GDPR
- Right to deletion (right to be forgotten), Art. 17 GDPR
- Right to restrict processing, Art. 18 GDPR
- Right to data portability, Art. 20 GDPR
- Right to object, Art. 21 of the GDPR
To exercise your right, please email email@example.com
Please provide the following details so that we can identify you:
- Postal address
- E-mail address and optionally: customer number or booking code or ticket number
If you send us a copy of your ID, please black out all other information apart from your first and last name and address.
In order to be able to process your request, as well as for identification purposes, please note that we will use your personal data in accordance with Art. 6 para. 1 (c) of the GDPR.
You also have the right to lodge a complaint with a supervisory authority pursuant to Art. 77 GDPR in combination with Section 19 GDPR. The relevant supervisory authority for Lufthansa is:
The Officer for Data Protection and Freedom of Information of the State of Hesse
How can you withdraw your consent?
If you gave us your consent to processing your personal data, please note that you may withdraw this consent at any time.
If you gave this consent on this website, please visit the page where you originally gave consent or log in using your LH ID in order to withdraw consent in the settings.
If you have consented to receive our newsletter, you may withdraw this consent yourself using the Unsubscribe link in the newsletter.
In all other cases or if you have problems withdrawing your consent on this website, you can contact the data protection officer.
Please note that your consent can only be withdrawn with future effect and such a withdrawal does not have any influence on the lawfulness of past processing. In some cases, we may be entitled in spite of your withdrawal to continue to process your personal data on a different legal basis – to perform a contract, for example.
Information about your right to object pursuant to Art. 21 GDPR
You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data based on Article 6 (1) (e) or (f) of the GDPR, including profiling based on those provisions.
The controller shall no longer process the personal data that relates to you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms, or in case processing is necessary for the establishment, exercise or defence of legal claims.
If personal data that relates to you is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes, which includes profiling to the extent that it is related to such direct marketing.
If you object to processing for direct marketing purposes, the personal data that relates to you shall no longer be processed for such purposes.
You have the option of exercising your right of objection in connection with the use of the services of the information company using an automated procedure – notwithstanding Directive 2002/58/EC – in which technical specifications are used.
Disclaimer and limitations of these data protection notices
These data protection notices only apply to processing for the website. Other websites are not subject to these data protection guidelines and may provide their own specific data protection guidelines.
What data do we process when you visit our website?
You can prevent tracking via cookies (do not track, tracking protection list) and reject the storage of third-party cookies in your browser settings.
If you delete all cookies, this will also delete any opt-out cookies placed, so you will have to actively opt-out again.
We differentiate between cookies that are absolutely necessary for the website’s technical features and optional cookies.
To enable you to select the data protection settings for your visits to our website that best suit your requirements, we give you the option below of adjusting your preferences with respect to the categories of operational necessity, statistics, convenience and personalisation.
1. Operational necessity category
These cookies are necessary for the operation of the website and to manage our corporate commercial objectives. Furthermore, these cookies also allow us to recognise whether you wish to remain logged in to your profile so that we can provide our services to you more quickly on your next visit to our website.
Lufthansa AG uses the services of a third-party provider, Uplift (801 El Camino Real, Menlo Park, CA 94025), in order to offer a flexible, pay-over-time travel financing solution. Please be aware that payment offers and advertising may be displayed even if you have not granted your consent to personalisation. If you file a loan application or receive a loan via Uplift, Uplift will collect personal data such as your name, your address, your telephone number, your mobile phone number, your email address, your date of birth, your full or partial social security number, your identity card number (e. g. driving licence number), your bank account or payment card number. This information is required for a loan application, to open an account and to process your transaction. This information is used to verify your identity, to determine that you qualify and to complete your transaction. Processing is necessary for the performance of a contract (GDPR Art. 6 (1) b). Additional information may be collected if you contact customer service by SMS, email or telephone. Lufthansa AG does not store your full or partial social security number or your identity card number (e. g. driving licence number).
2. Category "Analytics"
Cookies in this category are used to enable the following activities:
- Monitor website traffic and optimize your user experience
- Evaluate which marketing channels are performing better and
- Analyse aggregated data about usage of the website to understand our customers. Randomized identifiers shared with partners.
3. Category "Personalization"
Cookies in this category are used to enable the following activities:
- Store your preferences from previous visits
- Collect user feedback to improve our website
- Evaluate your interests to provide you unique customised content and offers
4. Category "Advertising"
Cookies in this category are used to enable the following activities:
- Make online and social advertising more relevant for you
- Invite specific customer groups to reconnect with our products later
- Share data with our advertising and social media partners via their third-party cookies to match your interests
You can adjust your personal settings here.
Usage-based online advertising with third-party providers
In order to provide relevant and current interest-based advertising to you, we try to draw conclusions about your current interests on the basis of your visits to Lufthansa Website, third-party websites and your surfing behavior.
We use third-party cookies and create usage profiles under a pseudonym for the purpose of retargeting/remarketing to website visitors and for conversion tracking. We may analyse these for advertising and monitoring purposes. It is not possible for us to trace these back directly to any individual.
For example, we use advertising cookies for the following purposes:
- To store your website visits in order to determine your interests
- To verify whether you clicked on an ad
- To monitor the number of visitors that click on an ad
- To use third-party services to display ads tailored to your needs, interests or preferences
- To determine which kind of advertising is efficient for us
- To display ads for products you have clicked on or searched for previously
- To monitor the number of ads shown so that the same ads do not appear all of the time
- To display other interesting ads based on your use of Lufthansa websites
- To analyse which ads you have clicked on before buying products
- To establish the number of orders resulting from ads and their monetary value
Description of third-party cookies used
Usage-based online advertising:
We use various remarketing and tracking technologies on our website. These allow us to recognise visitors on the websites of our advertising partners and approach them with personalised information.
The following companies are responsible for collecting the data needed to deliver usage-based online advertising: Google (Adwords (Remarketing), DoubleClick (Floodlight), Facebook.
The same contractors deliver usage-based online advertising.
The tracking and remarketing tools used fall under different categories:
- Google Adwords Remarketing – Category "Advertising"
- DoubleClick Floodlights (Conversion) – Category "Analytics"
- DoubleClick Floodlights (Remarketing) – Category "Advertising"
- DoubleClick Search – Category "Analytics"
Further information and explanations regarding the Google products used are available here.
You can discover more about Facebook’s interest-based advertising here.
To opt out of interest-based advertising from Facebook, please follow Facebook’s instructions here.
The following systems are also used on the website:
Under the Operational necessity category:
This website uses Google Analytics, a web analysis service of Google Ireland Limited, (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). It includes the use of “Universal Analytics” technology, which makes it possible to assign data, web sessions and interactions on several devices to an anonymised user ID, thus enabling an analysis of a user’s activities across multiple devices.
Google Analytics uses so-called “cookies”, text files which are saved on your computer and which enable an analysis of your usage of the website. Information generated by the cookie about your usage of this website is generally transferred to a Google server in the USA and stored there. In the event that IP anonymisation is activated on this website, your IP address will be shortened by Google within the member states of the European Union or in other states which are party to the Agreement on the European Economic Area before the transfer takes place. Only in exceptional circumstances will the complete IP address be transferred to a Google server in the USA and shortened there. The IP address of your browser conveyed in the context of Google Analytics will not be joined with other Google data. Google will use this information on behalf of the operator of this website to evaluate your usage of the website in order to compile reports about the website activities and to provide the website operator with additional services in connection with the usage of the website and the internet. These purposes also constitute our legitimate interest in the data processing. The legal basis for the use of Google Analytics is Section 15(3) German Telemedia Act (TMG) and Art. 6(1), Subparagraph 1(f), GDPR. Sessions and campaigns are terminated on expiry of a fixed period. The fixed period for the termination of sessions is generally 30 minutes without activity, and for campaigns the limit is six months. The maximum permissible time limit for campaigns is two years. More information about conditions of use and data protection can be found at http://www.google.com/analytics/terms/de.html or at https://policies.google.com/?hl=de.
You can prevent cookies from being installed by activating a corresponding setting in your browser software; however, we must inform you that, in this case, it is possible that you will not be able to use all the functions of this website entirely. Furthermore, you can prevent the capture of data by Google relating to your use of the website generated by the cookie (including your IP address), as well as the processing by Google of this data, by downloading and installing the browser add-on. Opt-out cookies prevent the future collection of your data when visiting this website. To prevent the capture of your data across multiple devices by Universal Analytics, you must complete the opt-out process on all systems you use. Click here to install an opt-out cookie: disable Google Analytics
Tealium IQ is a tag management system used to load tracking pixels from third-party providers onto the website. Tealium uses a cookie to collect some non-personal data in order to optimise loading of the tracking pixels. This cookie expires after 12 months.
The Tealium cookie stores the following information:
- Timestamp of the website visit
- ID for the page access
- ID for the visitor
- ID for the session
Exactag GmbH collects and stores data on this website and its sub-pages for marketing and optimisation purposes. Pseudonymised usage profiles are created from these data. Cookies and a technology called Fingerprint are used for this. The Fingerprint technology stores the browser’s environment variables in a database without storing distinct user-related data such as IP addresses. Cookies and/or Fingerprint allow browser recognition.
Under the Analytics category:
Your mouse clicks and sessions are recorded to improve the website, for error analysis, and to generate heatmaps and behaviour reports. The data are transmitted to the processor Decibel (Decibel Insight Limited, 89 Worship Street, London EC2A 2BF, United Kingdom) for this purpose. Processing is carried out in accordance with Article 6 (1) a) GDPR which can be revoked afterwards. The standard procedure is to delete sessions after 30 days. Aggregated data are deleted after 12 months.
Google Flight Search
We use conversion scripts to track the successful completion of an action (purchases, newsletter subscriptions, effectiveness of ad campaigns). This specific script shares anonymised booking details with Google Flights when customers have been referred to our platforms by Google Flights.
Processing is carried out in accordance with Article 6 (1) a) GDPR which can be revoked afterwards.
Under the Personalization category:
Proactive live chat
Lufthansa AG uses a chat service to offer you additional support options where necessary so that you can successfully complete your booking online.
To establish a chat, anonymous data are analysed first and a chat invitation is shown on the user session in certain instances. The data regarding the booking are only passed to the chat system if the customer accepts this.
The chat agent is given information about your visit to our website and the web standard data so that they can help you as quickly as possible. The agent also sees the booking process page the customer is now on, including where the cursor is positioned. Please note that in order to provide the required quality of our consulting service, it may be necessary that we pass on the content of the chat with the agent to another agent or supervisor. Please also note that the agent with whom you are communicating can see your chat inputs live. This allows us to respond more quickly to your specific questions. Sensitive inputs such as payment data are not transmitted and cannot be seen by the agent.
Customer chats are stored for twelve months so that we can advise you in the future and further optimise our website and services.
Not under any category:
Lufthansa AG creates usage profiles using pseudonyms for the purposes of advertising, market research and user-oriented website design, provided you do not object to this.
We do not use any personal data, only anonymised or pseudonymised data, to create the usage profiles. We do not merge the usage profiles created under a pseudonym with data about the person behind the pseudonym.
In particular, Maxymiser GmbH uses the data transmitted on our behalf to analyse user behaviour on our website and optimise the website. You can prevent the collection of your data through the Maxymiser technology and our processing of these data by disabling the feature here (an opt-out cookie is automatically downloaded and installed when you click on the link).
Social media features
We offer social network functionality in various parts of our website and on the Lufthansa app. These include:
- sharing and recommendation features for Lufthansa content (e.g. share and like buttons)
- linking Lufthansa offerings with social networks, e. g. when logging into your personalised area on the website (“social login”)
We give you the opportunity in our online offerings to share and recommend your content in social networks . If you visit our website and use the recommendation features, we pass on the URL to the social network you select.
We recommend that you read the privacy information of the respective social networks carefully.
“Social login” is an addition to the conventional login option on our online offerings. Instead of using your Miles & More service number or user name and PIN, select your favourite network from a list of different social networks with which you would like to identify yourself to Lufthansa.
When you click on one of the buttons, a window of the selected network opens to ask if you consent to Lufthansa accessing your personal profile. Depending on the network, you are also told which information in your profile we will have access to as soon as you provide your consent.
On our website, we use this two-click solution for the following social media plugins:
- Google Plus
What is the situation when you receive our newsletter?
If you gave your consent in the Newsletter section of our website to receive the newsletter (until you withdraw your consent or Lufthansa stops sending out a newsletter), we wish to make you aware of the following:
Consent is the legal basis for the processing.
Your consent relates to the processing of the following personal data provided voluntarily by you:
- Email address
- Surname, first name, title, gender/salutation
- Country of origin
- Preferred newsletter language
- Airport preference
Your consent is used for the purpose of using your email address to send the newsletter to the address given.
The newsletter provides you with information on topics from the Lufthansa world and our partner companies.
We analyse your usage patterns in every newsletter by using cookies and similar technologies to personalise communication. This analysis includes, for example, pages opened, clicks, reading time and potential bookings.
Personalisation of the newsletter is based on the analysis of
- your interaction with the newsletter
- your master data voluntarily provided to us (departure airport, gender, …)
- your IP address
- your existing and future bookings
The following systems and technologies are used in our newsletter:
The following data are processed by the Responsys delivery tool for marketing, optimisation and legal purposes:
- Email delivery
- Email opening
- Time of opening and time of clicks
- End device used for opening, clicking and booking
- Click behaviour in the email
- Booking completed from within the email
The following data are processed by the Litmus email marketing tool for marketing and optimisation purposes:
- Reading time and reading behaviour
- Location where opened
- Email programme and end device used
These data are stored on a subscriber/customer basis (email address).
Exactag GmbH collects and stores data on this website and its sub-pages for marketing and optimisation purposes. Pseudonymised usage profiles are created from these data. Cookies and a technology called Fingerprint are used for this. The Fingerprint technology stores the browser’s environment variables in a database without storing distinct user-related data such as IP addresses. Cookies and/or Fingerprint allow the browser recognition.
If you do not consent to the technologies and analyses used in the newsletter and wish to withdraw this consent, please unsubscribe from the newsletter by using the link provided in every edition of the newsletter.
Information on participation in the Miles & More programme
You can register for the Miles & More programme on our website.
More details on how your personal data are processed within the context of the Miles & More programme, please check here.
Information on participation in Lufthansa iD
Our goal is to deliver our services to you in the most convenient way possible and thus enable you to enjoy a travel experience that is tailored to you and your particular wishes and expectations, from your first visit to our website lufthansa.com, as well as to certain other websites and apps offered by us or other companies in the Lufthansa Group, all the way through to the end of your journey and beyond. That is why we offer you the option through Lufthansa iD to create a free customer profile with which you can access a wide range of personalised services.
The creation of a Lufthansa iD profile and provision of the data needed for this is not required by law or contract. However, some services are only available to our Lufthansa iD customers. These include, for example, the option to receive personalised flight offers and additional services on our lufthansa.com booking platform, avail yourself of personalised FlyNet offers and in-flight entertainment tailored to you in the future, and receive an enhanced selection of entertainment options. To the extent contractual purposes are given below as the legal basis for data processing, we cannot meet the respective purposes of Lufthansa iD without carrying out the data processing.
We wish to explain to you below how we process your personal data when you create a Lufthansa iD profile.
When you register for Lufthansa iD, the only mandatory information we request are your email address and a password. Your country and preferred language settings will be automatically transferred, using the country and language settings you entered at lufthansa.com. This information is required in order to create a Lufthansa iD profile and use the Lufthansa iD services described in detail below.
You are free to add further information to your Lufthansa iD profile , such as your name, gender, address, date of birth, further contact details and your mobile number or flight preferences such as seat preference or preferred departure airport. We also use this information to provide the Lufthansa iD services described below.
Personalised use of websites and apps
When you visit our websites and apps, our aim is to make it easier and quicker for you to find and use the information that is relevant to you. That is why we give you the option of using your Lufthansa iD when you log in to certain websites and apps offered by us or by other companies in the Lufthansa Group, so that the respective service you wish to use is already personalised and it is no longer necessary for you to create a new user account every time. Examples of this personalisation might be that you are greeted by name when you access the respective website/app, or we might provide information relevant to your current flight booking and/or pre-populated forms.
As may be required in individual cases, we process the data stored in your Lufthansa iD profile to enable you to log in with your Lufthansa iD and to personalise the content displayed in the website/app you access. When you access the website/app, you will be informed in detail about the nature and scope of the personalisation, the data processing required for this purpose, and the potential recipients of your data.
Specific data which you provide while logged in to a website or an app and which are not already stored in your Lufthansa iD profile may also be linked to your profile so that in future, the added data will also be available for the purposes of the Lufthansa iD (in accordance with any relevant and applicable requirements). Depending on the individual case, this may include the following categories of data: (i) Master data which you enter in forms, (ii) Preferences, such as preferred destinations, which you expressly designate as preferences to be stored in your profile, and/or (iii) Flights which you manually enter in the website/app. Where applicable, you will also be notified on the website/app in advance of any data recovery activity.
"Stay logged-in" feature
While you are logged in to websites or apps, you have the option of actively enabling a “stay logged-in” feature, which means that after finishing your session and then re-visiting the website/app at a later time, you will not be required to log in again.
When the “stay logged-in” feature expires, you will be asked to log in again. Furthermore, you will always be prompted to log in again if you are in the process of carrying out activities which require an enhanced level of security, such as changing your profile data. If you do not wish to use the login service, you are of course free to use the website/app without logging in. If you choose to do so, the content you access will no longer be personalised, unless you subsequently enter certain types of information manually (such as your current flight booking), in order to obtain specific information relating to your flight. In such cases, any data you input manually will not be linked to your Lufthansa iD profile.
Personalised booking process
By personalising the booking process, we aim to make it as convenient and efficient as possible for you to use our services. That is why we process information from your previous bookings and any preferences in your profile to display the relevant options and/or use the appropriate defaults immediately for you within the booking process. This makes it quicker for you to book and rebook flights and purchase additional services, i.e. without first having to find the offers of interest to you among all of the many available options.
Specifically, we process your personal data for this purpose:
- Top three flights
If you use our booking portal to search for flights and enter the data for your desired flight (departure and destination airports, dates of travel) in the search screen, we process these data plus the information stored in your profile regarding previous flight bookings to show you what are likely to be the three most interesting flights for you as a recommendation at the top of the search result list. For example, if you previously booked flights to the destination airport entered in the search screen, we display to you the same or similar connections as a recommendation at the top of the search result list so that you can again select a similar connection without having to search through all of the many suggestions. Of course, you can also select a different connection from the alternatives displayed below the recommendations.
- Default travel class
Economy Class flights are searched for by default in the flight search; customers must amend this setting as necessary in the search screen in order to find flights in a different travel class (such as Premium Economy or Business Class). We automatically adjust the default to your preferred travel class in order to save you this step and immediately take into consideration your preferred travel class in the flight search. For this, we process the information regarding previous flight bookings stored in your Lufthansa iD profile or any preferences there possible in relation to the travel class. Of course, you can still select a different travel class from the default travel class set by us by adjusting the search settings.
- Pre-selection of the recommended fare
Various fare options (such as Economy Saver, Economy Classic and Economy Flex) are available within each travel class. We pre-select a recommended fare based on your preferences in order to make this selection easier and speed up the booking process for you. The benefit of this is that you can continue with your booking more quickly by simply clicking on “Next”. If the fare we have pre-selected for you is not actually what you require in a specific situation, you can naturally select a different fare by first clicking on this and then continuing the booking process by clicking on “Next”. We discern your preferences from the information regarding previous flight bookings stored in your profile and/or fare preferences in your profile.
We use your data stored in your Lufthansa iD profile (this could be data you actively provided there during registration or added at some later point or data you gave as part of a previous booking and which we automatically use for another booking) in order to make the booking process easier for you by pre-populating forms. We also use your data given during bookings to provide you with pre-populated forms for online check-in and at self-service check-in kiosks. If you fill out other forms, such as during your participation in a promotion or when you send customer feedback using one of our electronic feedback forms on the website, for example to report lost baggage or provide feedback on your travel experience, the contact details required are also pre-populated from your profile.
Storing previous bookings
Any previous bookings you made while logged in or subsequently added to your profile are stored in your Lufthansa iD profile. This means you can still keep track of your previous bookings in the future and access and print booking documents and invoices.
In-flight entertainment and FlyNet
Our Lufthansa iD customers can choose from an extensive range of films, music, magazines and much more as part of our in-flight entertainment programme. Through the FlyNet programme, we also offer our Lufthansa iD customers internet access on our flights (extra charge). Using the free FlyNet portal, Lufthansa iD customers can access tips and the latest weather forecast for their travel destination, purchase goods in the Lufthansa WorldShop and find out about services relating to connecting flights.
You will have to log into your Lufthansa iD profile to set up our in-flight entertainment programme and FlyNet services according to your particular preferences in the future. We will process your login details (email address and password) during this in order to identify you as a Lufthansa iD customer.
We will also offer you in the future personalised in-flight entertainment programmes and FlyNet services to make it easier for you to select from the extensive range of entertainment options and find the information of relevance to you. In other words, you will first be shown information and offers which we believe are most relevant to you. Your profile and the preferences chosen there will be analysed to achieve this personalisation.
If you have consented to this, we will also process information regarding your past use of these offers collected via cookies for the purpose of personalising our in-flight entertainment and FlyNet offerings.
Personalisation of offers for additional services
You are shown a list of possible additional services for your flight in the booking portal after you select or book a flight. These may be additional flight-related Lufthansa services, such as premium meals or upgrades, or additional third-party services, such as rental cars or insurance policies. We wish to display additional services of relevance to you, which is why we sort the ads so that those likely to be of most interest to you appear at the top. This means we show you additional services which would be a useful addition to the flight searched for or already booked by you and/or in which you have already demonstrated interest in the past at the top; offers we presume will be less interesting to you are then shown below these.
For this, we process the data regarding the flight selected by you or your upcoming flight and the data regarding previous bookings of additional services stored in your profile. If you have already booked a flight and log in again, we also process the booking information stored in your Lufthansa iD profile to check which additional services are available for your upcoming flight and might be of interest to you because they have not yet been included in your booking or purchased by you.
We do not build an extensive profile for this; in particular , we do not merge your aforementioned data with other data pools in order to carry out deeper analysis of your preferences without your consent. Insofar as we process data regarding your previous purchases of additional services, we also limit this to data from the last six months.
If you give us your consent in relation to this, we also use information collected using cookies to analyse your response to the additional services offered, i.e. whether you click or purchase them, in order to continuously improve the personalisation of our additional offers.
Personalised advertising communication
During the registration process and subsequently in your Lufthansa iD profile, you have the option of giving us consent to transfer information and individual offers regarding the services of Lufthansa Group airlines and their partner companies and to communicate with you for this purpose via electronic means of communication (e.g. email, SMS/MMS) and/or telephone.
If you give us the relevant consent, we process your contact details (i.e. name, telephone number, email address) in order to send you the information and individual offers.
As we only wish to send you information and offers that you are really interested in, we also process with your consent the information stored in your Lufthansa iD profile regarding previous bookings, such as itinerary, travel period and booking class, and your current booking, such as your travel destination, selected fare and preferences in your Lufthansa iD profile, in order to personalize the information and offers. For example, we may send you special offers or vouchers for additional services for your trip or for services available at your travel destination by analysing information regarding your forthcoming trip.
You have the right to withdraw your consent at any time. You may withdraw your consent to advertising communication for individual areas as well (such as just for the email newsletter) in your profile. For further information on your right to object, please refer to the “Information about your right to object pursuant to Art. 21 GDPR”. Your withdrawal of consent does not affect the lawfulness of any processing performed on the basis of this consent before such consent was withdrawn.
Profile setting and storage period options
You can use your profile settings to define which of your data we may process. For example, you can decide whether you wish to add further data, such as certain preferences, to your profile in addition to the data required for registration so that they can be processed for the aforementioned purposes.
You can also decide for yourself the extent to which you wish to receive information and individual offers from us by adjusting your communication settings.
If you no longer wish to avail yourself of the Lufthansa iD services, you may delete your Lufthansa iD profile at any time.
You can delete your Lufthansa iD profile as well as individual pieces of data provided by you within your Lufthansa iD profile.
We also delete your provisional Lufthansa iD profile if you do not confirm your registration by the deadline given in the confirmation email or have a confirmation email with activation link sent to yourself more than three times without confirming activation.
Participation in the Miles & More programme and linking with Lufthansa iD
If you are also registered for the Miles & More programme (“Miles & More”), we ask that you link (“connect”) your Lufthansa iD profile with your Miles & More account. This is the only way we can ensure that you only receive the communication you want and that the different profile details do not contradict each other.
You decide whether to connect these by giving your consent. If you give your consent, the data are compared. This is explained further below.
Specifically, the data stored by you in both accounts are synchronised/used as follows when connected:
- Master data (e.g. surname, first name, address, telephone number) which you have given voluntarily during registration or later are compared. If these do not match, the name and date of birth from your Miles & More account are automatically used. In all other cases, you are asked to select your choice.
- Other data such as your seat and other preferences are compared if there is information regarding these in both accounts. If the information does not match, you are asked to select one. If these data are only stored in your Miles & More account, the data in your Miles & More account are automatically added to your Lufthansa iD profile. If these are only stored in your Lufthansa iD profile, the data in your Lufthansa iD profile are automatically added to your Miles & More account.
- Payment details from your Miles & More account are added to your Lufthansa iD profile. For technical reasons, the payment details from your Lufthansa iD profile are discarded during a connect. You may subsequently amend your payment details at any time via the respective profile/account administration.
- Your booking summary from your Miles & More account is added to your Lufthansa iD profile. If there are current bookings in both your Lufthansa iD profile and Miles & More account at the time of the connect, only the current bookings of the Miles & More account are shown for technical reasons. Bookings no longer visible in the booking summary of your Lufthansa iD profile as a result of this can be added again manually at any time. Please note that there is no change to the binding nature of any bookings no longer visible as a result of the connect.
If you have given us your consent to carry out a connect, we use the linked data for the aforementioned purposes.
As you have the option to consent to advertising communication from us in both accounts and we want to be sure that we only contact you if you actually want us to, these communication settings are also synchronised during a connect. This ensures that we only then contact you when you have given your consent to this in both your Lufthansa iD profile and Miles & More account. Please note that if you provide or withdraw your consent after the accounts are connected, this is then effective for both of your accounts.
You have the right to withdraw your consent at any time. Your withdrawal of consent does not affect the lawfulness of any processing performed on the basis of this consent before such consent was withdrawn. For further information on your right to object, please refer to the “Information about your right to object pursuant to Art. 21 GDPR” section.
Star Alliance Biometrics
Star Alliance Biometrics is a product of Star Alliance and offers biometric passenger identification (facial recognition) at the airport on a voluntary basis. Currently, Lufthansa offers biometric identification services at following touchpoints: Boarding.
Controller for the here described data processing is Deutsche Lufthansa AG.
For Star Alliance Biometrics Lufthansa processes the following personal data:
- For enrolment with Star Alliance Biometrics we encrypt and transfer your Miles & More number and your name from the Lufthansa App to the Star Alliance Navigator App. For this we require your consent pursuant to Art. 6. Para. 1 S.1 lit. a) GDPR.
- Star Alliance is the controller for the further required steps of enrolment. For these you find more information at the Star Alliance Data Protection Information.
- For the creation of the Gallery of the Day (a day-specific identification list) your Miles & More number as well as your boardingpass information will be transferred to Star Alliance. For registered users of Star Alliance Biometrics these data are processed under your consent pursuant to Art. 6. Para. 1 S.1 lit. a) GDPR, for potential users with Miles & More number these data are processed in the interest of efficient operations pursuant to Para. 6. Abs. 1 S.1 lit. f) GDPR.
- At the Lufthansa owned touchpoints at the airport that are equipped to offer biometric identification by Star Alliance Biometrics a short video clip of you is taken. From that a photo is extracted and transmitted to with the Gallery of the Day for comparison.
These data are processed for registered users under your consent pursuant to Art. 6. Para. 1 S.1 lit. a) GDPR, for non-registered travellers these data are processed in the interest of efficient operations pursuant to Art. 6. Para. 1 S.1 lit. f) GDPR.
Recipients of data
- IT service provider under data processing agreements according to GDPR
- Star Alliance
Duration of data storage
- At the airport touchpoints your data will be deleted as soon as the identification process is done respectively as soon as your data is transmitted.
- The Gallery of the Day is created and processed under the control of Star Alliance and will be deleted on a flight-specific basis 2 hours after departure.
You can revoke your consent to use Star Alliance Biometrics at any time by accessing the profile settings in the Star Alliance Navigator App and deleting your profile. By revoking the consent, the lawfulness of data processing because of the consent up to the time of revocation is not affected.
In order to be able to process your request, as well as for identification purposes, we would like to point out that we process your personal data in accordance with Art. 6 Para. 1 lit. c GDPR and delete it after 3 years.
The provision of personal data is neither required by law nor by contractual obligation but necessary for the use of Star Alliance Biometrics.
An automated decision finding including profiling does not take place.
Examples of how your data are used in our Services
When you purchase a flight ticket via our website, we always process the following personal data from you:
- Title, first name, surname (collectively “master data”)
- Landline and/or mobile number, email address (for the booking confirmation) (collectively “contact data”)
- Your preferred payment method and related data, as well as the master data, address and contact data of the payer (collectively “payment data”).
Optionally, you can provide us with the following information:
- Date of birth
- Nationality and passport information (“identification data”)
- Frequent flyer information, such as the programme in which you participate and your membership number (“frequent flyer data”)
- your meal preference
- “Redress code” (US Immigration)
- PartnerPlusBenefit programme (for companies)
Flight-related travel information
An email sent to you a few days before your departure date provides information on your upcoming trip, offers of additional individual services and possible free travel services available. You can object at any time to the pre-flight email being sent using the link in the flight-related travel information.
We inform you when online check-in for your flight opens so that you can select a seat early on.
If you access your booking on lufthansa.com or are logged into lufthansa.com or the Lufthansa app and an upcoming trip is linked with your customer profile, you are then shown a link for online check-in.
If you have stored an email address in your customer profile and your current booking is linked with your customer profile or you have given an email address during the booking, we then send an unencrypted email to inform you that online check-in is open for your upcoming trip and provide you with direct access to online check-in for your flight. This access is enabled using an encrypted direct link.
Optionally, you may provide us with the following information during online check-in:
- Frequent flyer information (frequent flyer programme, card number)
- Mobile phone number and/or email address for sending mobile boarding passes and for notifications in the case of flight irregularities (any emails sent for this are explicitly unencrypted)
If you consent to the automated check-in option in your customer profile (Miles & More or LH iD, default setting for all Miles & More customers), then automated check-in ensures your mobile boarding pass is automatically sent to you for flight bookings completely within the Schengen Area and if flights have been booked no later than 24 hours before departure.
Flight status and flight irregularity notifications
If you provide us with a mobile number and/or email address when making a booking, when updating your booking or in your customer profile (Lufthansa iD or Miles & More) linked with the booking or for sending the boarding pass and/or use the Lufthansa app for your flight, we then inform you about changes to the flight status and, particularly, flight irregularities (either via SMS or unencrypted email and/or in the app).
Additional services in the Lufthansa app for your trip
You have the option in the Lufthansa app of storing personal data locally on your mobile end device so that the necessary elements are pre-populated during the check-in process, making check-in more convenient and faster for you.
Travel documents (passport, ID, residence permit and visa) can also be entered using the scan function.
The personal data stored on your device are only processed locally in the app and include:
- Identification data for check-in (type of frequent flyer card, card number, surname, first name)
- Contact data (mobile number or email address)
- Immigration document data (passport, ID, residence permit, visa, other types of documents)
Please note that misuse by a third party, such as if your mobile phone is stolen, cannot be ruled out. Therefore, we recommend that you protect your mobile phone accordingly, such as with a code lock. Lufthansa expressly emphasises that data are stored at your own risk and Lufthansa cannot be held liable for any misuse.
Location services and airport maps
If you permit the Lufthansa app to process your location (using the app’s location service settings in the respective operating system), then we can show you your location in our digital airport maps. This setting is needed for us to offer you further location-based services.
We process tracking data to pinpoint your position (dynamic IP address, location data via the device’s Bluetooth, WiFi, GPS functionality).
Our local information uses your location provided you have agreed to this in your smartphone settings under the app’s location service settings in the respective operating system.
We can use the local information to send you offers that are relevant for your location. Our processing of your smartphone’s motion data in an anonymised form also helps us to predict waiting times at security checkpoints, for example.
Your location is only used for the aforementioned purposes.
If you do not wish to use our local services, you may disable these at any time in the Lufthansa app settings.
We offer you various channels for providing feedback. You can therefore freely decide how you wish to communicate with us. Included in this, you have the option of using our feedback form on our website to send us data. A letter is another way to communicate with us. You may also choose to use other channels to provide feedback, such as your email address, fax or the Lufthansa app. Please be aware that your individual feedback may be used for training and quality purposes.
- If your communication with us includes a request for financial compensation, we ask you to provide official identity documents for your own protection and for ease of identification