Data protection information Travel ID

The operators of Travel ID are Austrian Airlines AG, Brussels Airlines SA/NV, Deutsche Lufthansa AG, Eurowings GmbH, EW Discover GmbH and Swiss International Air Lines AG as Lufthansa Group Airlines and Miles & More GmbH.

Unless otherwise stated in this privacy notice, "we", "us" or "Travel ID Operator" refers to Lufthansa Group Airlines and Miles & More GmbH as joint controllers ("Joint Controllers") for the processing of your personal data within the meaning of Art. 26 of the European Union's General Data Protection Regulation ("GDPR"). We have concluded a so-called Joint Controller Agreement for this purpose. We will be happy to answer any further questions you may have.

Further details and contact addresses for Lufthansa Group Airlines and Miles & More GmbH can be found in the introduction to the Travel ID Terms of Use and in the respective imprints of the Travel ID operators.

To ensure the protection of your personal data, all Travel ID operators have appointed a data protection officer. You are also welcome to contact these data protection officers with data protection-related questions in connection with Travel ID. 

Data protection officers of Deutsche Lufthansa AG, Miles & More GmbH, Eurowings GmbH and EW Discover GmbH:

Data Protection Officer of Austrian Airlines AG:

Data Protection Officer of Swiss International Air Lines Ltd.:

Data Protection Officer of Brussels Airlines SA/NV:

When registering for Travel ID, we request your e-mail address, title, first and last name, date of birth and password as mandatory information. Your country and your preferred language setting are - as far as technically possible - automatically adopted in accordance with the country/language settings you have made on the respective websites or apps of the Travel ID operators. This information is required to create a Travel ID profile and to be able to use the Travel ID services described in detail below and in the Travel ID Terms of Use.

You have the option of adding further information to your Travel ID profile on a voluntary basis. This may include, for example, your address or mobile phone number or your flight preferences such as preferred departure airport. You may also voluntarily provide documents such as travel or health documents (see section 7 of this privacy policy) or payment details. We will also use this information to provide the Travel ID services described below and in the Travel ID Terms of Use.

When you visit our websites and applications, we want to help you find and use the information that is relevant to you more quickly. Therefore, you have the option of logging on to the websites and applications of the Travel ID operators with your Travel ID in order to make personalised use of the respective service without having to create a new customer profile each time. The personalisation consists, for example, in the fact that you are addressed personally on the respective website/application, receive information matching your current flight booking and/or find pre-filled forms.

We process your data stored in the Travel ID profile to the extent necessary in individual cases to enable you to log in with your Travel ID and to personalise the content of the website/application.

If you do not wish to use the login service, you are of course free to use the website/application without logging in. In this case, the respective content will be displayed to you in a non-personalised manner, unless you subsequently manually add certain information (such as your current flight booking) in order to receive (flight-)specific information. In this case, manually completed data will not be linked to your Travel ID profile. 

We use your data stored in your Travel ID profile to facilitate the booking process by pre-filling forms. This can be data that you have actively added there as part of the registration process or at a later point in time, or data that you have provided as part of a previous booking and which we automatically adopt when you make a new booking. We also use the data you provide as part of the booking process to provide you with pre-filled forms during online check-in or at check-in kiosks. If you fill in any other forms, for example to enter a competition, or to submit customer feedback using our electronic feedback form on the website, for example in the case of lost luggage or feedback on the travel experience, the required contact details will also be pre-filled from your Travel ID profile.

To enable you to track your past bookings with Travel ID operators in the future and to retrieve and print booking receipts and invoices, your past bookings will be displayed in your Travel ID profile. These bookings are automatically saved in your Travel ID profile if you have made them while logged in. You also have the option of adding bookings to your profile at a later date. Bookings made in the last ten years (maximum) are displayed in your Travel ID profile.

You can use the Health Document Check process to have health-related documents checked for their validity with regard to entry or transit. For this purpose, you can upload relevant health-related documents such as vaccination and health certificates to your Travel ID profile. By using this process, you consent to your health-related documents and thus in particular also special categories of personal data as defined by the DGSVO being stored and checked.

You have the right to revoke your consent to the use of health-related data at any time without affecting the lawfulness of the processing carried out on the basis of the consent until revocation. In the event of a revocation, the documents will be deleted from the Travel ID profile.

The legal basis for the listed data processing is the consent given by you pursuant to Art. 6 para. 1, lit. a DSGVO.

The health-related documents are automatically deleted after twelve months.

In the booking portals of the Travel ID operators, after you have booked a flight, you may be shown a list of possible additional services for your flight. These additional services may concern flight-related services of the Travel ID operators, such as premium meals or upgrades, or additional services of third parties, such as rental cars or insurance.

For this purpose, we process data stored about you with the Travel ID operators, such as flight data and the data stored in your profile, if you have consented to the use of your data.

If you have given us your consent in this respect, we also evaluate information collected by means of cookies about your reaction to the services offered, i.e. whether you have clicked on or purchased them, in order to continuously improve the personalisation of our offers.

During the registration process or later in your Travel ID profile, you have the option of giving us permission to send you information and individualised offers on the services of Lufthansa Group Airlines and its respective partner companies and to contact you for this purpose by electronic means of communication (e.g. by e-mail, SMS/MMS) and/or by telephone.

In addition, you can give Miles & More GmbH permission to send you offers relating to possible participation in the Miles & More programme if you are not yet a participant in the Miles & More programme.

If you have given us such consent, we will process your contact details (i.e. name and telephone number and/or e-mail address) in order to send you information and individual offers in accordance with the declaration of consent.

As we only want to provide you with information and offers that are really of interest to you, we also process, with your consent, the information stored in your Travel ID profile about previous bookings, e.g. itinerary, travel period, booking class, and information about the current booking, e.g. destination, chosen fare and preferences stored in your Travel ID profile, in order to personalise the information and offers. For example, by evaluating the information about your upcoming trip, we would send you special offers or vouchers for additional services to that trip or for services available at your destination.

You have the right to withdraw your consent at any time. You can also decide for yourself the extent to which you want to be informed by us and receive individual offers by adjusting your communication settings. In your Travel ID profile, for example, you can also revoke your consent to promotional communication for individual areas (such as only for the e-mail newsletter). For further information on your right of revocation, please refer to section 15 of this data protection notice.

You have the option of actively selecting a "stay logged-in" function on websites and in applications of the Travel ID operators via which you have logged in, so that you do not have to log in again after ending the session and later revisiting the website/application.

For this purpose, we use cookies with your consent, via which you are automatically recognised when you visit the website/app again.

After the "stay-logged-in" function has expired, you will be prompted to log in again. You will also be prompted to log in again whenever you wish to take actions that require increased security, such as changing profile data. 11. 

If you no longer wish to use Travel ID services, you may delete your Travel ID profile at any time. Your personal data collected in connection with the use of Travel ID will then be deleted immediately - subject to any conflicting reasons and obligations to retain data.

You can delete your Travel ID profile and individual data provided by you yourself within your Travel ID profile by logging into your Travel ID profile and using the delete button located under your personal data.

In addition, we will delete your provisional Travel ID profile if you do not confirm your registration within the period stated in the confirmation email or if you have a confirmation email with the activation link sent to you more than three times without using it.

We also reserve the right to delete your Travel ID profile if you have not used it for ten years.

Should you register for the Miles & More programme in future via the websites or apps of Lufthansa Group Airlines, registration for Travel ID and a connection of both profiles is required.

In case you are already a participant the Miles & More programme when you register for Travel ID, we ask you to connect your Travel ID profile with your Miles & More account. This will make it even easier for us to ensure that you receive only the communication you want and that the different profile details do not contradict each other.

You decide yourself whether you want to establish the connection by giving your consent. If you give your consent, a data comparison will be made between your Travel ID profile and your Miles & More account. In detail, the data you have stored in both accounts will be synchronised or transferred as follows in the event of a connection:

Master data (e.g. surname, first name, address, telephone number) that you added voluntarily during registration or later will be synchronised. If these do not match, the title, first and last name, address, mobile phone number and date of birth are automatically taken from your Miles & More account. The email address is taken from the Travel ID profile.

Other data, such as details of preferences, are matched if they are stored in both accounts and the preferences are taken from the Miles & More account.

Since both profiles give you the option of consenting to promotional communication from us and we want to ensure that we only contact you if you actually want us to do so, these communication settings are also synchronised if both accounts are linked. This ensures that we only contact you if you have consented to this in both your Travel ID profile and your Miles & More account. Please note that from the time of the connection, both the granting of consent and its revocation will always be reflected in both accounts for this reason.

You have the right to revoke your consent at any time. For further information on your right of revocation, please refer to section 15 of this data protection notice.

As part of the registration process, certain cookies are used on the registration page. You can find these here: Link.

We use the functionality of so-called local storage on the registration page. After logging in, your data is stored locally in the cache of your browser. After closing the browser window, your data will be deleted, except for your last selected login method. If you do not delete the cache of your browser, this information is retained and can be read the next time you visit the website. By using Local Storage, we enable you to view your data correctly when using our website without unnecessarily slowing down this process and overloading interfaces.

If you do not wish to use local storage, you can set this accordingly at any time in the settings of your respective browser. Please note that in this case the functionalities of our website will only be available to you to a limited extent or no longer. In particular, you will not be able to access your personal profile in this case.

You can find further information here: Link.

With regard to cookies and the functionality of local storage on the individual websites of the Travel ID operators, the respective data protection information and notes on cookies and similar technologies of the Travel ID operators apply.

We will process your data to the extent and for as long as necessary for the processing purposes described in this Privacy Notice.

When the purpose for which your data was processed ceases to apply, it will be deleted unless its retention is necessary for the following purposes:

• Fulfilment of legal retention periods, which may result from obligations under commercial or tax law; these periods are up to ten years.
• Assertion, exercise or defence of legal claims within the framework of the statute of limitations.

In these cases, the processing of your data is restricted ("blocked") so that it can no longer be processed for other purposes.

15.1 Your rights

As a data subject, you may exercise the following rights if the relevant legal requirements are met:

• Right to information, Art. 15 DSGVO
• Right to rectification, Art. 16 DSGVO
• Right to erasure ("right to be forgotten"), Art. 17 DSGVO (see also section 11 of this Travel ID Privacy Notice)
• Right to restriction of processing, Art. 18 DSGVO
• Right to data portability, Art. 20 DSGVO
• Right of objection, Art. 21 DSGVO (see also section 16 of this Travel ID Privacy Notice).

Where we process your data on the basis of consent, you have the right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent up to the point of withdrawal.

To exercise your rights, you can use the respective contact forms of the Travel ID operators (see section 1 of this privacy notice). In order to process your request and identify you, we will process your personal data in accordance with Art. 6 (1) lit. c DSGVO.

In your Travel ID profile on our websites and apps, you can also keep most of your master data up to date yourself at any time. Please update your personal data immediately after a change (e.g. your postal address, email address or telephone number). To delete your Travel ID profile, you can also proceed as described in section 11 of this Travel ID Privacy Notice.

In addition, you have the right to lodge a complaint with a supervisory authority, Art. 77 DSGVO.

15.2 Competent supervisory authorities

Below you will find a list of all data protection authorities responsible for Travel ID operators.

The supervisory authority responsible for Deutsche Lufthansa AG, Eurowings Discover GmbH and Miles & More GmbH is:

The supervisory authority responsible for Eurowings GmbH is:

The competent supervisory authority for Austrian Airlines AG is:

The supervisory authority responsible for Swiss International Air Lines AG is:

The competent supervisory authority for Brussels Airlines SA/NV is:

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6(1)(f) DSGVO.

In the event of an objection, we will no longer process the personal data relating to you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.

If the personal data concerning you is processed by us for the purpose of direct marketing and you object to this processing, the personal data concerning you will no longer be processed for these purposes.

You may object to the processing of your personal data at any time, including by contacting us as set out in section 2 of this privacy notice.

We use technical and organisational security measures to protect your data against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons. Our security measures are continuously improved in line with technological developments.

In connection with the processing operations described in this Travel ID Privacy Notice, we may disclose your data to the following categories of recipients:

• Service providers with whom we cooperate on the basis of a commissioned processing agreement pursuant to Art. 28 (3) DSGVO;
• Government agencies and authorities, e.g. on the basis of police and investigative activities.

In the process, personal data may be transferred to third countries or international organisations. For your protection and the protection of your personal data, appropriate security measures will be taken for such data transfers in accordance with and pursuant to the legal provisions.

If these transfers have no legal basis or are made to a country for which the EU Commission has not adopted an adequacy decision, we use EU standard contractual clauses.

Information about EU standard contractual clauses can be found on the ​European Union website.

We regularly review this Travel ID Privacy Notice and will update it as necessary. We will notify you (e.g. on our websites) of any material changes to this Travel ID Privacy Notice.