Source: https://www.miles-and-more.com/online/portal/mam/rowr/general_information?nodeid=2546270&l=en&cid=10001&solo=prt
Timestamp: 2018-07-17 05:53:03
Document Index: 274788970

Matched Legal Cases: ['Art. 6', 'Art. 6', 'Art. 6', 'Art. 28', 'Art. 6', 'Art. 6', 'Art. 6', 'Art. 28', 'Art. 6', 'Art. 6', '§ 195', 'Art. 17', 'Art. 18', 'Art. 20', 'Art. 6', 'Art, 77', '§ 19', 'Art. 21']

Miles & More - Privacy Statement of the Miles & More Programme
Privacy Statement of the Miles & More Programme
We know just how important the protection of your personal data is for you. It is of great importance to us that you are confident that we will handle your personal data carefully and responsibly, and we wish to give you the greatest possible transparency on this subject.
It is therefore the aim of this Privacy Statement to outline to you what information is processed in connection with your membership of the Miles & More loyalty programme (“Miles & More”) and to provide you with further information on the definition of terms and your declaration of consent (Section 6 of this Privacy Statement).
The operators and publishers of Miles & More are Miles & More GmbH (“MMG”) and Deutsche Lufthansa AG (“Lufthansa”). Unless stated otherwise in this Privacy Statement, “we” refers to Lufthansa and MMG as the bodies responsible for the processing of your personal data within the meaning of the General Data Protection Regulation of the European Union (“GDPR”) and the Federal Data Protection Act (Bundesdatenschutzgesetz - “BDSG”). Complete information relating to these companies can be found in their respective imprints at www.miles-and-more.com and www.lufthansa.com. Information about contacting the Lufthansa Group data protection officer and the relevant authorities and enforcing your rights can be found at the end of this Privacy Statement.
In this Privacy Statement we also make a distinction between the Lufthansa Group, our Joint Operators and Miles & More partner companies, so that we can make it more transparent for you which processes are carried out with the assistance of which company, and who has access to your data, to what extent and for what purpose. All the definitions for the groups referred to above and the purposes of data sharing can be found in Section 5 of this Privacy Statement.
1. Master Data and Status Data
When you apply to participate in the Miles & More programme, we collect some of your personal data in the application form. These data consist in particular of your last name, first name, gender, address and domicile. In addition, in certain processes you must provide additional compulsory information so that we can carry out your registration and the subsequent processes, such as sending out your cards or a confirmation e-mail, for example. This includes data such as your date of birth, e-mail address or a telephone number. Furthermore, along with your application or in the course of your membership of Miles & More, you can communicate other data to us of your own volition, for example a mobile telephone number, your academic title or other interests and preferences. To save you additional trouble in entering these data, we extract some information directly from the application form or when processing it. This includes the date of your registration and your preferred language for correspondence. All these data collected about you are called your “Master Data”.
In order to manage the status assigned by the operators or joint operators (such as Frequent Traveller, Senator or HON Circle Members), we also store data which are required to manage this status, such as the type of status or the number of Status or HON Circle miles you have earned (“Status Data”).
2. Miles & More Card Number
When you open your mileage account we provide you with a Miles & More card number. Your Miles & More card number is part of your Master Data. It is used to identify you clearly as a member.
3. Programme Data
When you earn miles, the program data include all the information required for mileage credit and the administration, ongoing development and marketing of Miles & More. This includes information about our Miles & More partner company where you earn miles, as well as information about the services and number of miles earned on which your mileage credit is based.
When you earn miles with another Miles & More partner company, the Programme Data include information about the services requested that relate to miles, i.e. in particular the products bought or services used, such as the price, quantity, goods category, time of purchase, time of execution or place of rental/stay.
When you earn miles with a Miles & More credit card, the program data include details of the amount spent with the Miles & More credit card. If you have given additional consent to your bank, further data may also be collected. You can find details of this in Section 8 of this Privacy Statement.
When you redeem miles, the Programme Data consist of details of the awards requested as well as the number of miles used (with a flight, the specific type of flight award, the flight route, the flight date and other information relating to the booking and with another award e.g. the type of award and product information such as the price, quantity, goods category, time of purchase, time of execution or place of rental/stay).
By storing these data, we can ensure that the mileage credit is correct, track account movements, in particular for fraud prevention, as well as ensure that detailed information is provided when requested, and that any possible complaints you may make are processed swiftly. If you give your consent, the data described above may also be used for advertising purposes (you can find more detailed information about possible uses in Section 6 of this Privacy Statement).
4. Treatment of your Personal Data
We process your personal data, i.e. Master Data, Programme Data and Status Data and web-tracking data, as described in Section 1 of the Privacy Statement for Miles & More website, app & communication media, as part of Miles & More; particularly to
process your application for membership of Miles & More, to be able to send you your Miles & More card and other contract information about Miles & More,
enable you to earn and redeem miles, in particular to be able to credit the miles earned by you with operators and Miles & More partner companies to your mileage account and be able to debit the miles used when you request an award,
allow us to be able to check that when you earn miles, the correct number of miles is credited, and that when you debit the account for an award, the correct number of miles is calculated,
be able to send you other contract information relating to your status when you fulfil the appropriate criteria of your Miles & More status card,
be able to manage, develop and market Miles & More, and
be able to inform you about current extensions or modifications to Miles & More.
The data are initially processed by us to fulfil your membership agreement with us (Art. 6 (1) b) GDPR) and to safeguard our justified interests (Art. 6 (1) f) GDPR). In addition to the purposes stated, justified interests are in particular the protection of our company against material and non-material damage, such as in particular for the prevention of fraud, appeals or filing legal claims.
We also process your data so that we can send you individually compiled offers relating to Miles & More, providing you have given us your separate consent to do so; this way we can send you information that is relevant to you. The legal basis for this processing is Art. 6 (1) a) GDPR. You can find further details under Section 6 of this Privacy Statement.
5. Data Transmission in the context of Miles & More
5.1 Joint Operators
The operators of Miles & More can appoint selected partner companies in certain countries, which may market Miles & More as their own programme (“Joint Operators”). Joint Operators are
We may share data with the Joint Operators for the administration, ongoing development and marketing of Miles & More as their own programme in the following cases:
If you have registered with Miles & More via a Joint Operator, your Master Data, Miles & More card number or a unique user name, as well as your Programme Data relating to the Joint Operator’s services, may be shared with the Joint Operator.
If the Joint Operator is an airline and your residence is located within the home market of this Joint Operator, we may share your Master Data, Miles & More card number and Programme Data with the Joint Operator.
If the Joint Operator is an airline and you take flights operated by this Joint Operator, we may share your Master Data and Programme Data with the Joint Operator.
If you have gained a status with a Joint Operator, in addition to the Master Data and the Programme Data related to the services provided by the Joint Operator, your Status Data may also be shared with the Joint Operator.
The Joint Operators send us the Programme Data set out in Section 3 of this Privacy Statement in order to enable us to credit miles.
5.2 Miles & More Partner Companies
Data is only shared with Miles & More partner companies, including in particular Miles & More Hotels, Miles & More Car Rental and Miles & More Gift Cards, which are not Joint Operators, if and to the extent you have requested a service from one of these Miles & More partner companies (e.g. an award) or you have given your consent (e.g. during login).
The Miles & More partner companies share with us the Programme Data listed in Section 3 of this Privacy Statement in order to allow us to allocate the mileage credit.
5.3 Lufthansa Group Airlines
The airlines of the Lufthansa Group (as set out under www.miles-and-more.com/joint-partner) have combined their customer loyalty activities. This means that the member’s Master Data and the Status and Programme Data obtained by a Lufthansa Group airline are managed in a joint database for all Lufthansa Group airlines. These data can be processed and used for analysis purposes without your separate consent (also see Section 6 of this Privacy Statement) in anonymised form (that is without the possibility of a particular member being identified), and for the management, continuing development and marketing of Miles & More. If you have given your consent, the data may also be used on a personal basis for marketing purposes (also see Section 6 of this Privacy Statement).
5.4 Other Third Parties and Processors
In order to be able to offer you our products and services, based on our contractual obligations or in accordance with our justified interests, we use service providers such as service centres or IT service providers as Processors in accordance with Art. 28 GDPR. These service providers have been carefully selected and work exclusively to our instructions. They provide sufficient guarantees to comply with their obligations under data protection law.
We also receive data from other third parties as part of processing where such third parties have commissioned us to process data. This may occur, for example, in the management of nominations as status customers based on contractual obligations. In addition, it is also possible that we might be obliged to share your personal data with government offices and authorities for specific purposes.
When data is shared with other third parties, it is possible that personal data is transmitted to third countries. For your protection and the protection of your personal data, safeguards are stipulated in the event of such data transmissions under and in accordance with the statutory regulations (in particular the use of EU standard contractual clauses - for more information see the website of the European Union).
Moreover, in certain cases we are legally obliged to hand over personal data to the German and international authorities; see Art. 6 (1) c) GDPR in conjunction with local and international regulations and agreements.
The legal bases for the sharing of data with Joint Operators, Miles & More partner companies, Lufthansa Group companies and other third parties and commissioned data processors are Art. 6 (1) b). GDPR (Fulfilment of your membership contract), Art. 6 (1) a) GDPR (Consent) and Art. 28 GDPR.
We can give you the option of giving MMG and Lufthansa separate consent to receive:
information about your mileage balance and our Miles & More newsletters (e.g. programme newsletters, WorldShop newsletters, Spend newsletters and Promotion newsletters),
market research surveys/customer satisfaction questionnaires to improve Miles & More and the offers from operators, Joint Operators and Miles & More partner companies.
Information and offers, such as the WorldShop catalogue, the Lufthansa Exclusive or Woman’s World, are sent by post unless you object to receiving such information and offers.
Moreover, we can give you the option of giving separate consent to individual Joint Operators to receive:
market research surveys/customer satisfaction questionnaires - your opinion on the respective Joint Operators (including partner companies, where applicable) and their offers and services
information and offers from the respective Joint Operators and their partner companies, where applicable,
regular information from the respective Joint Operators and their partner companies, where applicable, about special offers and valuable tips relating to travel from the airline, vehicle manufacturer, financial services, hotel, transport, lifestyle, shopping and telecommunications sectors
latest news on services and products from selected airline partner
Information and offers are sent by post unless you object to receiving such information and offers.
You can find further details on consent in the respective Data Protection Policiesprivacy statements of our Jjoint Ooperators. For the Lufthansa Group you will find these under
You can give all the consents referred to above, for example, in your application for membership of Miles & More, on our website or in a Miles & More communications medium. You can also give those parts of your consent that relate to the Joint Operators to them via their communication channels.
If you have given us your consent, we may evaluate your Master Data, Status and Programme Data and the analysis data collected when you use our offers (e.g. from our websites, our app, our newsletters or communications media) in order to send you personalised information about the Miles & More programme that is relevant to you and customised to your interests (so-called profiling). For example, in this way we use your place of residence, age, status level and your most recent mileage credits in order to adapt the offers on earning/redeeming miles in the Miles & More newsletter to your needs. If we refer in our consent to “personal data”, we understand this term to mean all the types of data defined in this Privacy Statement- in particular master data, status and program data.
If you have given your consent to one of the Joint Operators, the latter may evaluate all the data it has about you in order to send you personalised information that is uniquely relevant and customised to your interests. This includes data from the Miles & More programme shared under Section 5 of this Privacy Statement as well as the data it collects itself, such as flight data for example.
You can find further details on the usage of data by our joint operators in their respective privacy statements. For the Lufthansa Group you will find these under
We will only collect, process and use other personal data from other sources - such as websites operated by third parties - for the creation of personalised information if you have given the corresponding consent to the respective third party to do so.
You can edit your communication settings in your customer profile on www.miles-and-more.com at any time, and/or withdraw and/or restrict your consent in full or in part (e.g. by telephone at the Miles & More Service Centre). In addition, you can deactivate push notifications on mobile end devices in the respective Miles & More app.
MMG and Lufthansa can send you legally relevant information about the Miles & More programme (such as changes to the Terms and Conditions of Participation), irrespective of whether you have given or withdrawn your consent. The legal basis for processing the data in this case is Art. 6 (1) b) GDPR (Performance of contract).
7. Linking with Lufthansa Group ID Profiles
8. Miles & More Credit Card
When you apply for a Miles & More credit card, additional personal data are collected by the issuing bank (for example your profession, marital status and income). These supplementary data are processed and used exclusively by the issuing bank and are not shared with the operators or Joint Operators. We only receive the program data arising from the use of the Miles & More credit card and your Miles & More card number or other Master Data required to allocate the Programme Data to you as a member. If you have given a further consent to the issuing bank, the issuing bank may also share further personal data with us; we will use this data for the purposes stated in this Privacy Statement. The legal basis for sharing this data is Art. 6 (1) a) GDPR (Consent).
9. Period of Storage
We process your data as long as it is required to fulfil our contractual and statutory duties. It must be noted here that membership of the Miles & More programme is for an indefinite period and is thus set up for several years.
to retain evidence as part of the provisions on limitation periods. Under §§ 195 ff. of the Civil Code (Bürgerliches Gesetzbuch - BGB), these limitation periods can be up to 30 years, whereas the standard limitation period is three years. In these cases, your data are blocked so that they cannot be processed for other purposes.
Right to deletion (“Right to be forgotten”), Art. 17 GDPR
Right to limit processing, Art. 18 GDPR
Right to data transmissibility, Art. 20 GDPR
You may use our contact form in order to exercise your right. So that we can process your application and identify you, please note that we will use your personal data in accordance with Art. 6 (1) c) GDPR.
You also have the right to file a complaint with a supervisory authority, Art, 77 of the GDPR, § 19 BDSG.
Fax: 0611/1408-900 or 901
Regional Officer for Data Protection and Freedom of Information of the State of North Rhine-Westphalia
11. Right to Object according to Art. 21 GDPR
You can object to the processing of your personal data at any time, for example by using our contact form as described in Section 10 of the Privacy Statement.
12. Miles & More Website, App and Communication Media
More information about the handling of (personal) data collected via our website, our app or our online communication media can be found in the separate data protection policies for the website, app and communication media at www.miles-and-more.com/privacy-statement-onlineufuwbcquasdwyyctawdw.
We store your personal data on servers in Germany, in a European Union member state or in states which are party to the Agreement on the European Economic Area. When service providers are used, personal data may also be communicated to other countries in compliance with the applicable data protection regulations.
14. Updating
We check these Privacy Statements regularly and we will update these as necessary. Where there are significant changes made to these data protection policies, we will inform you (for example, on our website or in our app).
The Lufthansa Group data protection officer is also the data protection officer for Miles & More GmbH. If you have any questions about data protection at Miles & More, please contact Dr Barbara Kirchberg-Lennartz (e.g. by post: Group Data Protection Officer, FRA CY, 60546 Frankfurt/Main or by e-mail dsb@dlh.de).