Privacy notice

Brussels Airlines is committed to protecting your personal information.

This privacy notice applies to the personal data we process about you as a natural person. Below you will find information about what happens to the data collected, why we collect it, how long we keep it, what data protection rights you have and how you can exercise them.

Brussels Airlines NV/SA, with its registered office at 1050 Brussels (Belgium), Jaargetijdenlaan 100-102/B30 Av. des Saisons and registered in the Commercial Register (RPR/RPM) Brussels (under number 0445692234) is the “controller” responsible for the processing of your personal data.

If you have any questions about this privacy notice or about data protection at Brussels Airlines, you can contact our data protection officer at any time using this form or by mail:

BRUSSELS AIRLINES
DATA PROTECTION OFFICER
AIRPORT BLD 26, GENERAL AVIATION – RINGBAAN
1831 MACHELEN
BELGIUM

In the UK, the body responsible for applicable data protection laws is World Business Centre 1, Newall Road, London Heathrow Airport, Hounslow, Middlesex, TW6 2FA, England.

We regularly review our privacy notice and update it as necessary. The latest version can be accessed through our websites; the date of publication is clearly indicated.

You have the right to have us confirm the processing or non-processing of your personal data. If we process your personal data, you also have the right to request a free copy of the processed data. We will also provide you with the following information:

• Processing purposes
• The categories of personal data that are processed
• Individuals or categories of individuals to whom your personal information has been or will be disclosed
  
• Period for which your personal data will be retained
  
• Your privacy rights, as explained below
  
• All available information about the origin of the data, if we did not receive it from you
  
• Automated decision-making, if applicable
  

We are entitled to charge a reasonable administrative fee for each additional copy you request.

You have the right to rectify inaccurate and/or incomplete personal data.

You have the right to erasure of your personal data if one of the following reasons applies:

• Your personal data are no longer necessary for the purposes for which they were collected or processed
  
• You withdraw your prior consent to processing and there is no other legal basis for (further) processing
• You have objected to processing for direct marketing purposes
• You have objected to the processing of your data in our legitimate interest and there are no more valid, legitimate grounds for (further) processing.

We are not obliged to comply with your request for erasure when the processing is necessary for the establishment, exercise or defence of legal claims.

You have the right to request the restriction of processing if any of the following conditions apply:

• You dispute the accuracy of your personal data, whereupon we may restrict the processing of the relevant data for the period we need to verify the accuracy of your personal data
  
• We no longer need your personal data, but you need it to make, exercise or defend legal claims
• You have objected to the processing based on our legitimate interests, whereupon we may restrict the processing of the relevant data for the period necessary to verify your legitimate grounds.

You have the right to request the portability of your personal data processed by automated means in a format that you have communicated to us. This only applies if the processing is based on your consent or the fulfilment of a contractual obligation. In all other cases, this right cannot be exercised (for example, when we are legally required to process your data).

You have the right to object to processing on the basis of our legitimate interests. However, we will continue to process your personal data if we can demonstrate that our legitimate grounds outweigh your interests.

You have the right to object to processing for direct marketing purposes.

You have the right to withdraw your consent to the processing of your personal data, provided that the processing of your personal data was originally based on your consent.

You also have the right to lodge a complaint with the supervisory authority in the European member state of your habitual residence, place of work or place of alleged breach of applicable data protection regulations:

In Belgium, the supervisory authority is:

Autorité de protection des données
Gegevensbeschermingsautoriteit
Rue de la presse 35, 1000 Brussels
contact@apd-gba.be
www.dataprotectionauthority.be

The purposes for which we process your personal data depend on your contact with us:

A. When you visit our website
B. When you contact us
C. When you purchase our products or services
D. When you book with Brussels Airlines
E. When you pay for your booking
F. When you give us feedback
G. When you visit us
H. For legitimate interests 

A. When you visit our website

We process data about your device and your use of our website for the following purposes:

• Ensuring information security (e.g. to ward off cyber-attacks, to monitor performance)
  
• Managing and maintaining our website (for example, to allow you to access the website from your device and to remember your preferences)
• Developing a better understanding of your needs, continuously improving our website and application.
• Analysing the use of our websites and application and compiling statistics
• Displaying information and advertising content that is more relevant to you on our websites and applications.
• Interacting with social media channels.

Our website uses cookies and similar technologies (hereinafter commonly referred to as “cookies”). Cookies are small pieces of information that a web portal leaves on your device (computer, tablet or smartphone) when you visit. Personal data can be stored in cookies.

We use several cookies for the purposes set out above. Some of these cookies are needed for technical reasons (functional cookies), and some are needed to provide you with the content you have requested (necessary cookies). These cookies are therefore set by default. It is not possible to disable these cookies.

The processing of data collected by functional and necessary cookies, for example to record your consent or for your authentication, is in our legitimate interest.

The processing of cookies that are neither functional nor necessary, but fall under the category of analysis, personalisation or advertising, depends on your consent. You can adjust the use of these cookies on our website.

For more information, please see our cookie notice.

Please note that registered users of TikTok, depending on their interaction with the content on the platform, may be able to see our advertising. We are not responsible for how your personal data is collected or processed on this platform. We therefore advise you to familiarise yourself with TikTok’s privacy policies before using the platform.

B. When you contact us

You may receive information, offers and surveys about travel preferences or customer satisfaction, newsletters with “best price alerts” as well as travel-related newsletters from us, companies of the Lufthansa Group or partner companies via communication channels you select such as email, SMS, messenger services and telephone.

These messages and offers may be personalised using technologies that allow us to determine whether recipients have opened or otherwise interacted with the message. For more information, please see our cookie notice.

If we ask for your consent, for example if you subscribe to one of our newsletters, your consent provides the legal basis for this processing (Art. 6(1)(a) GDPR). You can withdraw your consent to processing for this purpose with future effect at any time by clicking on the relevant unsubscribe link in the communication concerned.

If we process your personal data for information and marketing purposes without having requested your consent, that is because we have concluded in the individual case that our legitimate interest forms a sufficient legal basis for the processing concerned (Art. 6 (1)(f) GDPR).

We also process your personal data to enable you to manage your booking through call centres and/or booking offices. This processing is based on the contract you enter into when purchasing a product or service with Brussels Airlines.

Via chat

You can get online help on our website via our chat.

A processor with automated processes and AI is used for simple conversations such as frequently asked questions or real-time flight information.

For more complex questions, a live chat feature is available with one of our customer service representatives, who has access to the chat content.

You should therefore not enter any sensitive information, such as credit card information, in the chat.

Everything you enter in the chat box is visible to customer service representatives. In addition, in the event of technical problems and to improve quality, the service provider can also access the chat in real time. If you are communicating in a language other than English, your input will be automatically translated by one of our processors.

Chats with our customers will be deleted or anonymised by us after 30 days. This processing is in our legitimate interest.

C. When you purchase our products or services

We process your personal data for customer management in order to provide you and/or your travel group with our products or services (such as tickets from Brussels Airlines or our partner airlines, special services, baggage handling and freight services). This allows you to carry out the transactions at different points of contact, such as online on Brussels Airlines websites or via booking or travel agents, commercial agents, tour operators, call centres and using our mobile app. You can also visit websites and platforms of Brussels Airlines partners, such as Tomorrowland. There you can purchase our products and services, and your data will be processed accordingly in cooperation with the respective partner.

Without your personal data, it is not possible to provide you with the products or services you wish to purchase. Consequently, this processing is based on the contract you enter into when purchasing a product or service with Brussels Airlines.

We process your personal data for passenger management purposes. Some examples:

• Passenger management on the ground, for example at the airport, when boarding an aircraft, when making a ticket reservation, for baggage handling (including self-service baggage drop-off), and when providing check-in options in various forms, based on our contractual obligation
  
• Issuing of flight documents and notification (including flight documents in the mobile app) based on our legal obligation
  
• Issuing passenger information lists to our cabin crew in order to fulfil our contract with you. Without your personal data, we cannot fulfil this contract.
  
• Administration of visas and other documents for entry into certain countries in order to fulfil our contract with you. Without your personal data, we cannot fulfil this contract.
  
• Collection and processing of personal data for lounge management purposes
  
• Collection and processing of personal data for the purpose of lost property management and delivery of lost baggage to passengers
  

Any payment transaction made in connection with Brussels Airlines products and/or services on our websites will be managed by a responsible payment service provider, who will always be fully responsible for this data. For requests related to information about the relevant payment details, you must contact the responsible payment service provider directly.

D. When you book with Brussels Airlines

You have the option of creating your own profile on the website. This makes it easier for you to book flights yourself. When creating your profile, you will be asked for personal information such as your email address, title, first and surname, date of birth and country of residence, and you must enter a password. For your bookings, you can also save additional information such as passport details or your phone number in your profile. You can delete your profile at any time without giving reasons. Your profile will then no longer be used and cannot be reactivated.

The processing of your personal data is a prerequisite for entering into a contract with Brussels Airlines as stated in our General Conditions of Carriage.

If you provide us with any personal health information when booking your flight so that we can provide you with the relevant assistance in accordance with your medical needs, this data will be processed and/or shared with third parties (e.g. airports and security checks etc.) based on our legal obligation and only to provide these services.

After you have booked with us or purchased a product or service from us, you can use our online booking management platform to manage your booking. We process your personal data to provide this platform so that you can access and process information about your trip and any related purchases.

If you are eligible to make claims under EU Regulation 261/2004, we will process your personal data and provide you with digital vouchers to give you efficient and consumer-friendly access to food, accommodation and transportation. This is done through a digital solution supported by external service providers.

If you have any questions about the carriage of dangerous goods, we will process your personal data and answer such questions as required by law.

We process your personal data based on our legal obligation to monitor flight incidents.

As part of post-sale contract performance, we process your personal data and send you various transaction notifications. You cannot unsubscribe from these notifications, as they are obligatory for your travel. The notifications may be handled and processed on our behalf by third parties who assure us of the secure transfer and processing of your data.

We process your personal data that you have provided to us at the time of booking so that we can inform you about products, services and special offers specific to the flight you have booked. This may include discounted lounge access, or the option to bid for a travel class upgrade, to purchase a last minute upgrade or to get other special services. This processing is based on a legitimate interest, and you can unsubscribe at any time from the email or SMS distribution list. If you choose to unsubscribe, you will not receive any upgrade bid emails for any future Brussels Airlines bookings you make.

After providing services to you, we like to ask you about your satisfaction, for example, through satisfaction surveys, which we will send you via email after your flight or via SMS after you call the call centre. For these purposes, we process your personal data based on a legitimate interest, as we strive for continuous improvement and want to provide you with optimal services and products that are best suited to your needs. You can opt out of these surveys in a variety of ways (for example, through the opt-out options included in each survey email and SMS).

Based on our legal obligation to comply with your right to seek compensation for a justified reason, we process your personal data to process claims (from flight bookings as well as freight bookings). It is in our interest to protect ourselves against material and immaterial damages. The provision of your personal data for this purpose is a requirement to process your claim; therefore, it is your choice to provide such data or to refuse to do so as explained in Section 2 under “Your rights”.

It is in our legitimate interest to process your personal data so we can remind you about overdue payments.

When you sign up for one of our loyalty programs, such as Miles & More, we need to process your personal data in order to manage your accounts and update them with your travel details. However, you manage your account, and you can edit and/or delete it at any time. We will obtain your consent for any direct or indirect marketing activities related to these programmes, and you can opt out at any time.

Based on your consent, which we obtain on different occasions, we process your personal data for direct marketing of our products and services. We believe it is important to keep you, as our customer, informed about our products and services. When you opt in, you may receive promotional communications, promotional offers and/or news from us through various channels, such as emails or SMS campaigns.

Sending customer service emails such as e-ticket confirmations after airline ticket purchase and rebooking, emails 6 days prior to departure as booking reminders, online check-in reminders +/- 23 hours prior to departure, no-show notifications, refund confirmations, etc., is based on performance of our contractual obligation.

These emails incorporate technical means (pixels) to confirm the date and time when the e-mail notification was retrieved. All emails are linked to a certain booking and as such can be used as evidence in credit card fraud claims related to a booking. The collection of this data in the form of pixels is in our legitimate interest, and the retention period for these logs is 10 years.

We also collect statistics about the opening of emails and clicks using industry-standard technologies, including pixels, to monitor and improve our marketing activities.

A profile is created as part of this data processing. This profile will not affect you; at most, the data processing will improve customer service and the provision of personalised offers and more targeted ads and advertising campaigns, which is to your advantage. You have no obligation to provide your personal data for this purpose, and you can easily opt out from any commercial communication we send you and/or object to this processing (see Section 2, “Your Rights”). If you request deletion of all of your data from our database, we will delete all of your personal data except for your email address and any opt-outs you have requested. Without this data we would not be able to consider your preferences and in some cases you might continue to receive undesired communications.

We may send you push notifications on mobile devices if you have given us your consent for this. These messages may appear differently on different types of devices. These communications will provide you with useful information about your trip, for example in connection with your flight and/or the situation at the airport.

We may process your personal data if you have requested a promotion code, for example from a Brussels Airlines representative. Such data is collected only for the purpose of providing you with the promotion code. If you use a photo booth at one of our promotional events, we may also collect and process your contact information.

E. When you pay for your booking

We process your personal data based on our legitimate interests to verify your creditworthiness and for fraud prevention. For example, we will make sure that we can collect the amount payable for the service provided using the payment method you have selected. It is in our interest to protect ourselves against material and immaterial damages and to prevent unlawful acts and misuse of our products, services and resources. Data processing may involve an automated decision-making and profiling process, which may result in you being unable to complete the purchase. You may object to this processing (see Section 2 “Your Rights”).

Your personal data will also be processed for the purpose of issuing invoices (and comparing payment and sale) and for the reimbursement of airline tickets and other services based on issued documents. This processing is based on the contract you have with Brussels Airlines.

F. When you give us feedback

We may collect and anonymise your personal data and then process the collected data based on our legitimate interests for research and development purposes (for example, in connection with sales statistics and reports, market analysis and market research, and the development of products or services). Research and development can improve customer service and continuously improve our products and/or services. It can also lead to the introduction of innovations, all of which benefits our customers. A profile may be created as part of this data processing. This profile has no impact on you; however, the data processing may improve customer service and result in optimizations and innovations in our products or services, which is beneficial to you. You do not have to provide your personal data for this purpose, and you may object to this processing (see Section 2 “Your Rights”).

G. When you visit us

When you visit one of our offices, you will be asked to register at reception.

Our buildings have security cameras in place to detect potential security issues. The recordings of these images are only stored to ensure the safety of goods and people and to prevent misuse, fraud and other offences that could put our visitors and employees at risk. The presence of cameras is indicated by pictograms, which also include our contact details.

We process this information based on our legitimate interests.

H. For legitimate interests

We also process your data for the purposes of our legitimate interests in accordance with Art. 6(1)(f) GDPR.

• To maintain IT security, the operation of IT systems and carrier operations, including data use for testing purposes
• To anonymise the data, which will then be used for artificial intelligence training systems, e.g. chatbots

On our websites, you can find social media elements such as:

• The “Share” button allows you to share and recommend content from our websites. When you click on the “Share” button, a new post will be created with a link to the page you are on. For example, if you click on “Share” on the bottom of the fare finder page, you share the URL of this page).
  
• Facebook Messenger on our online check-in platform website allows you to retrieve your boarding pass. If you choose to use this feature, we will notify you that you are leaving our website and ask for your consent to forward relevant personal information to the social network.
  

If you wish to use the features described above, we will ask you to read our cookie notice and adjust your cookie settings if applicable. For more information on privacy-related topics, please refer to the privacy policy of the respective social network.

In the footers of our websites, we promote our social media profiles and accounts on the following social networks:

• Facebook
  
• Twitter
• LinkedIn
• YouTube
• Instagram
• Pinterest

We do not pass on your personal data to third parties unless there is a valid legal basis. For example, we may forward your personal information to:

• Lufthansa Group partner companies (partners) for the same purposes and legal reasons as our own and as described in this privacy notice
• Commercial partners such as hotel booking and insurance services, car rental companies, ground handling companies, etc., who are responsible for their own business (their data processing is based on legal grounds established by them)
• Companies that process personal data in our name and on our behalf for the same purposes as we do (known as processors), such as:
• transportation, marketing service providers (including market research, commercial communications, loyalty management, e-commerce development and partnership, campaign management), customer feedback, IT maintenance, support and management, payment services and credit reference agencies, cloud and server hosting providers;
• Platforms for sending advertising content and transaction notifications;
• Operators of live help chats and call centres;
• Government agencies and authorities, for example in connection with APIS (Advance Passenger Information System) data transmitted to the responsible authorities of the respective flight countries, or TSA (Transportation Security Administration) information to exchange the data provided by you with respective law enforcement authorities, intelligence services and other organisations in accordance with our legal obligations.

Under the Belgian law concerning the use of passenger data, we are obliged to forward certain passenger data to the Belgian government. More information can be found here: https://crisiscenter.be/de/privacy-statement

• Carriers outside the Lufthansa Group where we or a third party have a legitimate interest. We will only share your personal data with other carriers if your interests or fundamental rights and freedoms do not outweigh them. In this case, you will always be thoroughly informed (except in exceptional legal cases).

For example, the personal data of unruly passengers will be shared. “Unruly passengers” are passengers who show improper, aggressive or violent conduct towards other passengers or cabin crew or have damaged the aircraft.

To the extent that this is in the legitimate interest of Brussels Airlines or a third party, Brussels Airlines is entitled and obliged to exchange personal data of its own passengers within the Lufthansa Group and with other carriers for the purpose of documenting, analysing and preventing fraud cases and cases of “unruly passengers”, and to process the data in this regard.

If you have caused property or personal injury to other passengers, Brussels Airlines may also disclose your personal data and information relating to the damage or injury to third parties (such as authorities, injured persons and insurance companies).

Personal data in the form of passenger lists will also be shared with air carrier crews who have been outsourced, contracted or leased.

We have a legal obligation to transfer certain personal data to certain foreign authorities for various purposes.

If you have booked a flight to a country where we are legally required to transfer your Passenger Data Records (PNR) or your Advanced Passenger Information (API) on your passport or ID card to the relevant flight authorities (e.g. Canada, USA, United Kingdom), we will do this.

We are also obliged to make your personal data available to Belgian and foreign law enforcement, judicial or administrative authorities if they need the data to prevent or prosecute crimes, misdemeanours or administrative offences or to perform their administrative duties.

Health authorities may require passenger data to combat pandemics.

Data transfers to authorities are based on intergovernmental agreements or national laws. Usually, such data is required by authorities in the country of departure and/or arrival.

In addition to the above transfers, we also disclose personal data to countries outside the EEA, as some of our partners, commercial partners or processors who support us in providing our products and services are located outside the EEA.

Some of these countries are recognised by the European Commission as providing an adequate level of data protection. There are legal safeguards for disclosure to other countries, such as standard contractual clauses of the European Commission. We endeavour to assess the transfers to these third countries on a case-by-case basis and to decide whether your personal data is adequately protected. When in doubt, we will take appropriate organisational, contractual and technical measures to ensure that your personal data is protected in accordance with applicable data protection laws and regulations.

You may contact us (see Section 1.2, “Contact Us”) for further information on appropriate safeguards and security measures we have put in place for such transfers.

We will store your personal data until you ask us to delete it or object to its storage or for as long as we need it for justifiable specified purposes in connection with the processing, or as long as we are legally required to store it. The corresponding periods are specified by applicable law and by authorities (for example, the Belgian Commercial Code, tax and duty laws and the anti-money laundering law).

The retention period depends on the processing purpose. This period can be very short as in the case of data collected for passenger lists (PIL) for our cabin crew and only stored for the respective flight; the data processed for the self-service baggage drop-off is stored for a maximum of 11 days after the flight; surveillance recordings are stored for up to 30 days.

The retention period may also be longer. In certain cases, there is a legal retention period (e.g. for accounting and tax obligations this is seven years) or for certain data (in particular for your contract, invoice and correspondence data in connection with complaints) as evidence in the case of a legal dispute for up to 10 years after the end of the contract. If your data is relevant to the establishment, exercise or defence of legal claims, we may retain it until the expiry of the statutory limitation periods (usually for three years, but in some cases up to thirty years). At the end of the retention period (statutory or as determined by the business purpose of our processing), the data in question will be securely deleted or anonymised.