Data Privacy Statement
Website: https://www.lufthansa-cargo.com
* * *
We are delighted that you have visited the world of Lufthansa Cargo, including our website and our App, where we offer you not only information about our company and services, but also personalized features. We are committed to transparency and integrity in processing your personal data. In processing personal data, we comply with requirements under data protection law, in particular the EU General Data Protection Regulation (“GDPR”) and the German Federal Data Protection Act (“BDSG”).
In this Data Privacy Statement, we explain what information (including personal data) we process during your visit and use of our aforementioned internet offering on our website https://www.lufthansa-cargo.com and its subpages as well as in our App (hereinafter collectively referred to as "Website") and which rights you have in relation to your personal data.
I. Who is responsible for processing the data?
The party responsible for the processing of personal data under
data protection law (the “Controller”) is Lufthansa Cargo AG,
Frankfurt Airport - Gate 21, Building 322, D-60546 Frankfurt am Main,
Germany (e-mail: lhcargo@dlh.de).
Where the words “we” or “us” are used in this Data Privacy Statement,
they refer to the above company.
We have appointed the Data Protection Officer of the Lufthansa Group as our company’s Data Protection Officer. If you have any questions regarding the processing of your personal data, you can contact the Data Protection Officer at any time by post (FRA CJ/D, Airportring - LAC, 60546 Frankfurt) or e-mail (datenschutz@dlh.de).
II. What principles do we observe?
In compliance with requirements under data protection law, we
process personal data only if we are permitted to do so under a
statutory provision or you have given us your consent.
On this Website we can also record items of information that, taken on their own, do not allow us to directly draw conclusions about your person. Nevertheless, this information may constitute “personal data” within the meaning of data protection law in certain cases, in particular if it is combined with other data. In addition, we may also record information on this Website that does not enable us to identify you directly or indirectly; this is the case, for example, with aggregated information on all users of this Website.
III. What data do we process?
You can access our Website without directly providing personal
data (such as your name, postal address or e-mail address). In this
case, too, we have to process certain information to enable you to
access our Website. Moreover, on this Website we use certain analytics
methods and have integrated links to other Websites whose operators
may process further (personal) data. Finally, on our Website we offer
you the use of various services for the performance of which we
require personal data from you. These are mostly your contact data,
which we collect either when you contact us or when you register as a
user of our various services. In detail, we process personal data on
our Website as follows:
1. Log files:
When you visit this Website, our web
server automatically stores the domain name or IP address of the
requesting computer system (usually your internet access provider),
including the date, time and length of your visit, the sub-sites/URLs
you visit, and information on the applications and devices you use to
view our Websites.
2. Cookies:
Like many well-known companies, we use
cookies to make our offering as user-friendly as possible. Most of the
cookies we use are what are termed session cookies. They are
automatically deleted when your visit is over. However, we also use
persistent cookies, - also from third-party providers - if you allow
us to do so, in order to make our Website more convenient for you to
use or to improve our services and our Website by analyzing your use
of our Website. For more information about the cookies we
(like to) use on our Website please see our Cookie Information. Via the Cookie
Settings, which you can access via the link in the footer of our
Website, you have the possibility to adjust your settings in this
regard at any time.
3. Embedded videos:
We have embedded our own videos on
our Website, which are also available on our channel on the YouTube
platform (an offering from YouTube LLC, 901 Cherry Avenue, San Bruno,
CA 94066, U.S. – “YouTube”). The contents of the
YouTube videos embedded on our Website are shown in a subsection of
our Website, but are only started and played if you click actively on
them. When you play an embedded YouTube video, a connection to the
YouTube servers is established so that the video is played in your
browser. YouTube videos are embedded on our Website in the
privacy-enhanced mode provided by YouTube; according to YouTube, use
of this mode means that no cookies are stored on your device. However,
when you play a YouTube video, your IP address is transferred and so
YouTube obtains information that you have visited our Website.
According to YouTube, this information cannot be assigned to you if
you are not logged on to YouTube or another Google service at the time
a video is called. As soon as you start playing an embedded video by
clicking on it, YouTube – in privacy-enhanced mode – only stores
cookies on your device which do not contain any data that can identify
you personally, unless you are currently logged on to a Google
service. These cookies can be prevented by appropriate browser
settings and extensions. You can find more information on data
processing by and the privacy policy of YouTube and Google at https://policies.google.com/privacy?hl=en.
4. Social media content ("Flockler"):
We use Flockler, a social media aggregator of Flockler Oy,
Rautatienkatu 26 B 32, 33100 Tampere, Finland, to curate and display
social media content by and about Lufthansa Cargo on our Website,
without you having to log in to the respective social media provider
or access its platform. Currently Lufthansa Cargo is active on
platforms of the following social media providers: LinkedIn, Twitter,
Instagram, Facebook and YouTube. Generally Flockler doesn’t store any
information regarding your visit to our Website. However, social media
provider might store information regarding you if you decide to
interact with the content (e.g., play a video or visit our social
media profile page). If you do this, a connection to the servers of
Flockler will be established. In the process, your IP address is
transmitted and data is passed on to the respective social media
provider. This also applies if you are not logged in to the respective
social media provider or do not have an account with them. We would
like to point out that we, as the provider of the Website, have no
knowledge of the content of the transmitted data or its use by the
social media provider. For more information, please refer to the
privacy policy of the respective social media provider. You can find
the data privacy policy and further information on Flockler and its
data processing at: https://flockler.com/privacy-policy.
5. Links to other Websites:
Our Website contains links
to other offerings (including our presence on Facebook, YouTube,
LinkedIn and Instagram. These are not social plugins (i.e. buttons
which enable the operator of the offering in question to collect
information on our Website’s users when the Website is called).
However, please note that when you call the other offering,
information (possibly including personal data) on your visit may be
collected by the operator of the other offering. You can find more
information in the data privacy statements of the operators of the offering.
6. Means of contacts:
On our Website, we point out
various ways you can contact us. If you use one of these ways, we
process the information we ask for and/or you give us in order to
handle your inquiry. If necessary, this information may be stored for
a longer period of time after completion of the processing for reasons
of preservation of evidence.
7. Registration and user account:
On our Website we
offer you the possibility of registering as a user, in particular so
that you can use our e-services. However, registration as a user can
also be carried out by us at your request if you confirm this
registration to us. Only employees, contact persons and
representatives (jointly termed “Contact Person(s)”)
of existing customers and business partners (jointly termed
“Business Partner(s)”) can register. Please note
that we do not permit registration by Contact Persons who are minors
in our General Terms and Conditions or special terms and conditions
for use of our e-services. During registration, we collect not only
details of the Business Partner, but also personal data on the Contact
Person as defined specifically in the registration mask. Obligatory
information is indicated as such. We may ask you to enter the data
collected during registration again (in particular so that you can be
identified) and collect further personal data if you use certain
content or features on our Website.
For the administration of your
user account we use the Customer Relationship Management
("CRM") system Microsoft Dynamics 365. The provider of
Microsoft Dynamics 365 is Microsoft Ireland Operations Limited, One
Microsoft Place, South County Business Park, Leopardstown, Dublin 18,
Ireland. For more information about how Microsoft Dynamics 365 works,
see the Microsoft Privacy Statement, available at https://privacy.microsoft.com/en-us/privacystatement.
8. Our Services:
The use of the services offered by us
("Services") is possible with and without registration:
- Services for registered users: A large part of our Services can only be used by registered Contact Persons from our Business Partners. By registering, we give you the opportunity, in particular, to request offers from us, to place, change and delete orders, to initiate collection and after-sales processes, to make claims and provide feedback, and to call up information on current or already completed orders for the respective Business Partner within the framework of an existing business relationship. In addition, we can also proactively inform you about current orders and will do so in any case if there are certain irregularities in the course of the execution of an order. Depending on the type of Service, we may ask for further information, exceeding the personal data of the Contact Person that was collected during registration. This data is also as defined in the online screen(s) for the e-service in question; here too, obligatory data is indicated as such.
- Services for users who have not registered: In addition to the services for registered users, you can also use parts of our services without registration. For example, we also provide certain features, such as a consignment tracking application, outside the section of our Website where registration is required. As part of these features, we may not only ask for information related purely to the company or an order, but also personal data (for example the name of the user or contact information such as an e-mail address).
You can also book many of our services by telephone, e-mail or in person with us or our service providers. If you book one of our Services, we process the information you provide and confirm to us for this purpose in order to be able to provide the corresponding Services to you. The information provided is usually contact information, such as names, address or email addresses. After completion of the processing, your data will be stored by us for a longer period of time to facilitate a further booking for you and for reasons of preservation of evidence.
In connection with your order, we may also offer you the possibility to provide information about the recipient of the consignment that we transport or a possible accompanying person; this information can as well refer to natural persons (for example, the recipient himself or a specific Contact Person in a legal entity).
Please ensure that the persons you have named are informed of the processing of their personal data in connection with an order, as required by law.
9. Lufthansa Cargo Developer Portal:
On the Lufthansa
Cargo Developer Portal we offer you the possibility to apply for a
key, which allows you to access Lufthansa Cargo APIs. If you register
for a Key, we process the information we request and/or the
information you provide in order to process your request.
10. E-mail newsletter:
On our Website we may also offer
you the possibility of registering for our e-mail newsletter. The
necessary information is as defined in the registration form and
usually comprises – as mandatory data – your title, your given name
and surname, your company and your e-mail address. Mandatory
information is indicated as such.
For the distribution of our e-mail newsletter, we use the Customer-Relationship-Management ("CRM") system Microsoft Dynamics 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.
Our email-newsletters contain cookie and tracking-pixel allowing us to track if emails are opened. In addition, the cookie or tracking pixel enables us to analyze the click behavior. The data thus collected is sent to Microsoft's servers and stored there. We use this data for statistical purposes and for the individual optimization of our newsletter. Further information about how Microsoft Dynamics 365 works can be found in Microsoft's privacy policy, available at: at https://privacy.microsoft.com/en-us/privacystatement.
11. Customer surveys:
If you have given us your
consent, we may contact you as part of our annual or transactional
customer surveys. As part of the annual customer surveys, which we
conduct to improve our services, we receive your information in
anonymized form and evaluate it accordingly. In the context of
transactional customer surveys, however, we do not anonymize your
data. In this case, we ask you about a specific transaction in order
to be able to respond to your feedback in this case. In the context of
customer surveys, the following personal data in particular will be
processed: First name, last name, gender, e-mail address and, if
applicable, your postal address.
12. Manage subscriptions / promotional consents:
In our
Subscription Center, we offer you the possibility to take out
subscriptions (e.g. for receiving our newsletters) and to give us your
consent to receive promotional information, as well as to view your
existing subscriptions and the given consents and to adjust them at
any time. If you give us your consent to send you advertising
information, we will, for example, inform you about our company, our
products and our events or, if necessary, carry out customer surveys
with you. In the context of subscriptions and promotional consents,
the following personal data in particular will be processed: First
name, surname, gender, e-mail address and, if applicable, your postal address.
13. Chatbot:
As part of our eServices, we offer you as
a registered user an online consultation in the form of a chatbot on
our Website. A chatbot is a computer program that interprets written
text and automatically responds to written requests. To the extent
necessary to process your request, your personal data will be
processed in this process. We use your personal data exclusively to be
able to respond to your personal request.
We may also offer a live chat function. If you use the live chat function of our chatbot, your personal data and the chat history will be transferred to an employee or to an external service provider to answer your request. To identify a chat session, we use a pseudonymized session and user ID. For more information about these IDs, see our Cookie Information. Your entries in the input mask of the chat will be transmitted to us and stored in order to answer your request. In this respect, the same applies as under III.6 Means of Contact. Furthermore, we use the chat data to improve and optimize the chatbot by analyzing it, e.g. with regard to categories of requests, abandonment rate, requests that cannot be matched, etc.
IV. For what purposes and on what legal basis do we process your data?
- Personal data that may be contained in the log files is
processed to enable you to use our Website; that is done on the
basis of Article 6 paragraph 1 point (f) GDPR so as to safeguard our
legitimate interests in operating our Website.
- The data collected using necessary cookies and the
pseudonymous user profiles are processed for the purposes of
tailoring our Website to users’ needs on the basis of Article
6 paragraph 1 point (f) GDPR so as to safeguard our legitimate
interests in the use of our Website. The data collected
using optional cookies (cookies of the categories
"comfort", "statistics" and
"performance") and the pseudonymous user profiles are
processed for the purposes of analyzing the Website, advertising,
and market research on the basis of your consent and Article 6
paragraph 1 point (a) GDPR.
- The processing of the data collected through the playing of videos embedded on our Website and the use of the Flockler-Plugins is carried out for the purpose of using and designing our Website in accordance with the requirements of Article 6 paragraph 1 f) DSGVO to safeguard our legitimate interest in the operation of our Website.
- Personal data provided to us as part of an inquiry directed to
us using the channels specified on the Website is processed to
deal with the inquiry so as to safeguard our legitimate interests in
conducting an existing business relationship or performing our other
business activities on the basis of Article 6 paragraph 1 point (f)
GDPR.
- Personal data of our Business Partners’ Contact Persons or other
natural persons (recipient of the consignment or recipient’s Contact
Person) that is collected as part of registration or use of a
user account is processed so as to safeguard our legitimate
interests in conducting existing business relationships on the basis
of Article 6 paragraph 1 point (f) GDPR.
- The processing of personal data collected from you in the course
of using our Services is carried out on the basis of Article
6 paragraph 1 b) DSGVO in order to provide the corresponding
contractual services. The storage of this data beyond the provision
of the respective service is carried out to protect our legitimate
interest in the execution of existing business relationships or in
the assertion of legal claims and the defense in legal disputes, in
each case on the basis of Article 6 paragraph 1 f) DSGVO.
- The processing of the personal data collected from you within the
scope of the application for a key on our Lufthansa Cargo
Developer Portal is carried out to protect our legitimate
interest in the execution of existing business relations on the
basis of Article 6 Paragraph 1 f) DSGVO.
- Personal data provided as part of registration for a
newsletter, or in your participation in a customer
survey, or personal data provided as part of your
registration to receive promotional information, is
processed on the basis of your consent and Article 6 paragraph 1
point (a) GDPR. Please note that you can withdraw the consent you
have given us at any time with future effect, for example by
clicking on the relevant link in each newsletter or emailing we
send, via the Subscription Centre, or by sending a letter, fax or
e-mail using one of the contact channels specified in Section I. of
this Data Privacy Statement (kindly also refer to Article X b)
below).
- Personal data provided to us in the course of the use of our
chatbot is processed in order to answer the question(s) posed
there and to improve and optimize our chatbot so as to safeguard our
legitimate interests in conducting an existing business relationship
or performing our other business activities on the basis of Article
6 paragraph 1 point (f) GDPR.
- We can also process the personal data collected in connection with
the use of our Website to comply with legal obligations to which we
are subject; this is done on the basis of Article 6 paragraph 1
point (c) GDPR.
- Where necessary, we also process personal data above and beyond
the above-mentioned purposes to safeguard further legitimate
interests or the interests of third parties; this is done on the
basis of Article 6 paragraph 1 point (f) GDPR. Our legitimate
interests include
a. establishing legal claims and defending ourselves in legal disputes;
b. preventing and investigating criminal acts; and
c. controlling and further development of our business activities, including risk management and operation of our IT systems.
V. Do I have an obligation to provide data?
The particulars required for registration, the user account and
the e-services, for registering for the newsletter and for ordering
our customer magazine are indicated as mandatory details in the
relevant section of our Website (e.g. an online form); if you do not
provide these mandatory details, we cannot enable you to use the
feature in question.
If we collect personal data from you above and beyond that, we notify you at the time whether the information has to be provided under the law or a contract or is necessary so that a contract can be concluded. We usually indicate information that is provided voluntarily and does not have to be furnished pursuant to one of the above obligations or is not required to conclude a contract.
VI. Who receives personal data?
In general, personal data is processed inside our company. Only
specific departments/organizational units can access personal data,
depending on its nature. They include in particular the specialist
departments tasked with providing our digital offerings (e.g.
Websites) or the described business processes, and our IT department.
A role and authorization concept restricts access at our company to
the functions and the scope required for the purpose for which the
data is processed.
We may also transfer personal data to third parties outside our company to the legally permissible extent. In particular, these external recipients may include
- affiliated companies in the Lufthansa Group to which we transfer personal data for internal administrative purposes and for the performance of central services (e.g. billing services);
- those third parties we use to provide our services (e.g. to carry out flights or load and unload cargo), insofar as the transfer is necessary to fulfil the contracts concluded with us, such as ground handling service providers at the airports we operate;
- service providers whom we have engaged (e.g. our transport-, IT-, CRM- or payment service providers etc. or partly also our ground handling service providers) and who, on the basis of a separate contractual agreement, provide us with services that may also involve processing personal data, as well as the subcontractors our service providers engage with our consent;
- non-public and public bodies (e.g. airports, customs or police authorities, etc.), where we are obliged to transfer your personal data pursuant to statutory obligations,
- recipients of a consignment we deliver for one of our Business Partners; the consignments may also contain personal data from you in individual cases if you have been named as the Contact Person in the provided consignment data;
- other Contact Persons at your organization if they are likewise registered to use our e-services; in this case, all Contact Persons within the organization of a Business Partner may be able to access details of all business transactions of that Business Partner (including information on your involvement in such a business transaction) using the e-services;
- Furthermore, we may transfer further data to third parties within the scope of the use of cookies and tracking functions on our Website, according to the details set down in our Cookie-Information.
VII. Is automated decision-making used?
In principle, we do not use any automated decision-making
(including profiling) within the meaning of Article 22 GDPR in
connection with operation of our Website. If we use such methods in
individual cases, we will notify you separately to the legally
prescribed extent.
VIII. Is Personal data transferred to countries outside the EU/EEA?
In most cases, personal data is processed within the EU or the
European Economic Area.
Since the Lufthansa Group operates globally and we also perform our services worldwide, we also possibly transfer information to recipients in what are termed “third countries”. “Third countries” are countries outside the European Union or not party to the Agreement on the European Economic Area where it cannot be readily assumed that they have a level of data protection comparable to that in the European Union. Recipients in third countries may be, for example, service providers we engage (such as our call center) or the foreign offices of our own we run as part of our international presence, but also non-public and public bodies (e.g. airports, customs or police authorities, etc.), in case we are obliged to transfer specific information in the course of the provision of our services pursuant to statutory obligations.
If the transferred information also includes personal data and we do not have a legal obligation to disclose such data, we ensure before transferring it that the necessary adequate level of data protection is ensured in the third country in question or at the recipient in the third country. That may be based in particular on an “adequacy decision” by the European Commission, in which an adequate level of data protection is ascertained for a specific third country as a whole. Alternatively, we can transfer data on the basis of EU standard contractual clauses agreed with a recipient. For information about the EU Standard Contract Terms, click here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en, and for information about the adequacy decisions click here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en#dataprotectionincountriesoutsidetheeu.
IX. For how long is personal data stored?
In general, we store personal data according to article 17 GDPR
only for as long as they are necessary for the purposes mentioned, or
if we have legitimate interests in storing it and they are not
overridden by your interests in your data no longer being stored.
Subsequently, such data will be deleted in order to comply with the
principle of data minimization.
Even if we have no legitimate interests, we can continue to store your data if we are required to do so by law (such as to comply with retention obligations). We erase your personal data, also without any action on your part, as soon as we no longer need to know it in order to fulfill the purpose of processing or storage of it is otherwise legally impermissible.
As a rule
- log data is erased within seven days, unless it needs to be stored further for purposes envisaged under the law, such as detection of misuse and the identification and rectification of technical faults;
- data processed in connection with a business relationship is erased no later than by the end of the statutory retention periods or the applicable limitation periods;
- data stored in connection with a registration as a user is erased when the customer account is deleted, unless further retention of it is required to comply with statutory retention periods in connection with the business relationship in question. If applicable, information (including personal data) is also erased before the customer account is deleted if a shorter period of time is envisaged in the respective e-service, if such shorter period can be defined by you or the Business Partner in question or if the purpose for further processing such personal data ceases to apply otherwise;
- your entries in the chatbot are automatically deleted after their analysis for the optimization of our chatbot as described above under III.14, at the latest after 6 months.
Personal data we have to store in order to comply with retention obligations is stored until the obligation to retain it ends. If we store personal data solely to comply with retention obligations, it is usually blocked, meaning it can only be accessed when that is required for the purpose for which the data had to be retained.
X. What are your rights as a data subject?
a. Right of objection under Art. 21 DSGVO
As a data subject you have the right to object, on grounds
relating to your particular situation, at any time to processing of
personal data concerning yourself which is based on point (e) or (f)
of Article 6 (1), including profiling based on those provisions. In
the event of such an objection, we will no longer process your
personal data, unless (i) we can demonstrate compelling legitimate
grounds to further process the personal data, outweighing your
interests, rights and freedoms, or (ii) the processing is used for
effective exercise or defense of legal rights.
In case we process
your personal data for direct marketing purposes, you shall have the
right to object at any time to processing of personal data concerning
yourself for such marketing, which includes profiling to the extent
that it is related to such direct marketing. If you object processing
for direct marketing purposes, the relevant personal data will no
longer be processed for these purposes.
b. Withdrawal of consent
If you have given us your consent to process your personal data,
we hereby inform you that you can withdraw this consent at any time,
e.g. by clicking on the corresponding link in each of our newsletters
or in our e-mailings or with regard to cookies, by selecting the
appropriate boxes in the Cookie Settings, which you can access at any
time via the link in the footer of our Website, by sending us a
corresponding message by post, fax or e-mail via one of the contact
channels mentioned in Section I. of this Data Privacy Statement. You
can also withdraw or modify your consent to the use of cookies at any
time by clicking on this link. In all other cases or if you have
problems to withdraw your consent, you can also contact our Data
Protection Officer, also mentioned in Section I. of this Data Privacy Statement.
Please note that the consent you have withdrawn will only have effect for the future and has no influence on the lawfulness of processing based on consent before its withdrawal. In some cases, despite your withdrawal, we are entitled to process your personal data on a different legal basis - for example, to fulfil a contract.
c. Additional rights
As a data subject, you also have the right to
- access the personal data stored on you (Article 15 GDPR);
- have incorrect data rectified and to have incomplete data completed (Article 16 GDPR);
- demand erasure of personal data (Article 17 GDPR);
- demand restriction of processing (Article 18 GDPR); and
- demand data portability (Article 20 GDPR),
In order to exercise these rights, you can contact us at any time, e.g. by using the channels specified in Section I. of this Data Privacy Statement.
If you have questions relating to processing of data, you can also contact our Data Protection Officer, whose contact information you can also find in Section I. of this Data Privacy Statement.
As a data subject you also have the right to lodge a complaint with a supervisory authority responsible for data protection (Article 77 GDPR).
XI. Changes to the Data Privacy Statement
Due to the further development of our Website and our offers or
due to changed legal or official requirements, it may become necessary
to change this Data Privacy Statement.
If this results in fundamental changes for you or if legal provisions make this necessary, we will inform you of such changes (with a corresponding note when you go to our Website).
You can access and print out the current Data Privacy Statement on our Website at any time.
Status: May 2023
* * *
