Privacy Statement for AirPlus’ Website

Below is an overview of how your personal data is processed when you visit AirPlus’ website.

Who is the controller?

With this Privacy Statement, Lufthansa AirPlus Servicekarten GmbH (Dornhofstraße 10, 63263 Neu-Isenburg, Germany) (hereinafter, “AirPlus,”) would like to inform you about how your personal data is processed as part of AirPlus’ online offerings. You can access AirPlus’ online offerings directly at airplus.com (hereinafter, “this Website”).

In the context of this Privacy Statement, the term AirPlus Group refers to Lufthansa AirPlus Servicekarten GmbH (Germany), AirPlus International Srl (Italy), AirPlus International Ltd (UK), AirPlus International SA/NV (Belgium), AirPlus International Inc (U.S.A.)., AirPlus Payment Management Co., Ltd (China), AirPlus Int. Soluções de Pagamento (Brazil) and AirPlus International AG (Switzerland).

What is the purpose and legal basis of AirPlus’ processing of your data?

AirPlus processes personal data in compliance with the provisions of the EU’s General Data Protection Regulation (hereinafter, “GDPR”).

AirPlus processes personal data to meet its contractual obligations under Article 6 1 p. 1 b) of the GDPR. These obligations include, but are not limited to,

  • entering into agreements regarding specific AirPlus products;
  • dispatching agreement confirmations; and
  • providing you with the information you need to use your AirPlus products.

AirPlus processes your data to comply with its legitimate interests under Article 6 1 p. 1 f) of the GDPR. These legitimate interests include, but are not limited to,

  • providing you with the information you need to use your AirPlus products;
  • preventing fraud, for example, credit card abuse, identity fraud, or the fraudulent obtainment of special conditions or rates;
  • ensuring IT security and operation;
  • preparing statistics to enhance AirPlus’ online offerings including using web tracking that enable limited profiling (find more information on objecting to this type of data processing in the section titled Data processing when you use this Website);
  • processing requests AirPlus received, for example, through contact forms or social media; and
  • using the AirPlus app.

AirPlus processes your data based on your consent under Article 6 1) p.1 lit. a) of the GDPR. This processing includes, but is not limited to, dispatching AirPlus Group newsletters which offer

  • information regarding AirPlus’ services and products;
  • news concerning the travel and payment services industries;
  • invitations to participate in events, market research, or customer surveys; and
  • invitations to participate in web seminars (hereinafter, “Webinars”).

If you participate in any Webinars, your consent includes your agreement to the evaluation of your participation.

AirPlus also processes your data to meet its legal obligation under Article 6 1 p. 1 c) of the GDPR. These obligations include, but are not limited to,

  • combatting money laundering and preventing terrorism including collecting data concerning the beneficial owners of companies and identifying credit card applicants; and
  • transmitting data to authorities in compliance with its legal obligations.

Which data is being processed when you use this website?

a. Cookies

This Website uses small text files, referred to as cookies, which web portals save on visitors’ computer systems (computer, tablet or smartphone). Cookies can be used to store personal data. You can set your browser to prevent your activities from being traced through cookies (do-not-track, tracking protection list) or to prohibit third-party cookies from being stored in general. To object to the use of some web tracking solutions, you also will be required to set cookies. Because deleting all the cookies (automatically or manually) means deleting opt-out cookies as well, you may need to re-execute the opt-out functions you executed in the past.

AirPlus wants to offer you the opportunity to make informed decisions regarding cookies that are not mandatory for using the technical functions of this Website.

AirPlus differentiates between cookies that are mandatory for using the technical functions of this Website, and optional cookies.

To enable you to adjust your data protection settings for your visit to this Website in an individualised manner, AirPlus offers you the opportunity to define your preferences in these four categories: Operational Necessity, Statistics, Convenience and Personalization. The full scope of this Website will be available to you even if you object to the setting of cookies.

1. Operational Necessity category

Cookies in this category are mandatory for operating this Website and providing the functions thereof, for example, language selection and Portal login.

2. Statistics category

To continue enhancing its offerings and Website, AirPlus captures data to prepare statistics and conduct analyses. AirPlus uses the cookies in this category, for example, to determine the number of visitors to and the user-friendliness of specific pages of this Website and to optimise AirPlus-related content.

3. Personalization category

Cookies in this category are used to provide you with personalized content that matches your interests so that AirPlus’ offerings are particularly relevant to you.

To be able to adjust its advertising so that it is relevant to you and matches your current interests, AirPlus wants to draw conclusions concerning your current interests based on your visit to AirPlus pages and on your browsing behaviour. AirPlus uses third-party cookies and creates pseudonym usage profiles to address visitors returning to this Website (retargeting, remarketing) and to measure conversion rates. These third-party cookies and usage profiles then are analysed for advertising and monitoring purposes; they cannot be used to identify individual visitors.

AirPlus uses advertising cookies, for example, to

  • store your visits to this Website to ascertain your interests;
  • determine whether you clicked an advertisement;
  • monitor the number of visitors who click specific advertisements;
  • use third-party services to display advertisements tailored to your needs, interests or preferences;
  • determine which advertisements and means of advertising prove efficient for AirPlus;
  • display advertisements for products which you previously clicked or searched for;
  • measure the number of advertisements displayed to avoid showing the same advertisements repeatedly; and
  • display other interesting advertisements based on your use of this Website.

AirPlus uses the following cookies including third-party cookies:

Description of third-party cookies used for usage-based online advertising

AirPlus uses the following companies to collect data for the provision of usage-based online advertising. The tools used for tracking and remarketing are categorised as follows:

  • HubSpot – Personalisation category
  • LinkedIn – Personalisation category
  • Google Analytics 4 – Statistics category

Personalizsation category:
HubSpot

This Website uses HubSpot, a web analyst service offered by HubSpot Inc. (Cambridge, MA 02141, U.S.A.). The software helps AirPlus analyze and measure user behaviour based on statistical evaluations and to improve its inbound marketing activities continuously. The software uses cookies (personalized cookies). You can object to the use of cookies by adjusting the respective settings in your browser. Find more information in Hubspot Inc.’s general terms and conditions and privacy statement available at https://legal.hubspot.com/terms-of-service and https://legal.hubspot.com/privacy-policy . HubSpot Inc. is bound by the EU-US Privacy Shield Framework and is in compliance with European data protection laws.

Personalisation category:
LinkedIn

On our website, we use the conversion tracking technology and the retargeting function of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter, “LinkedIn”).

This technology helps display personalized ads on LinkedIn to visitors of our website. In addition, it provides us with the opportunity to create anonymous reports regarding ad performance and information on website interaction. To this end, the LinkedIn Insight tag which connects to the LinkedIn server has been incorporated into our website provided you are logged into your LinkedIn account when you visit our website. The LinkedIn Insight tag facilitates the collection of data concerning visits to our website including the URL, referrer URL, IP address, device and browser characteristics (user agent), and time stamp. IP addresses are truncated or (if used to reach members across devices) hashed.

LinkedIn does not share any personal data with us; it only offers reports (in which you are not identified) on the website target group and on ad performance. Moreover, LinkedIn offers retargeting for website visitors and the resulting data helps us display targeted ads outside of our website without identifying you. In addition, we use data which does not identify you to improve the relevance of ads and to reach members across devices.

The LinkedIn Privacy Policy available at https://www.linkedin.com/legal/privacy-policy contains further information on data collection and use as well as options and rights to protect your privacy. If you are logged into LinkedIn, you can click on this link at any time to deactivate the collection of data: https://www.linkedin.com/psettings/enhanced-advertising.

Statistics category:
Google Analytics 4

If you have given your consent, this website uses Google Analytics 4, a web analytics service provided by Google LLC. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google").

Nature and purpose of the processing

Google Analytics 4 uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in EU and stored there.

When collecting data, Google Analytics 4 does not log or store IP addresses.

Analytics drops any IP addresses that it collects from EU users before logging that data via EU domains and servers.

We use Google Signals. This allows Google Analytics to collect additional information about users who have personalised ads enabled (interests and demographics) and ads can be delivered to these users in cross-device remarketing campaign.

During your website visit, your user behavior is recorded in the form of "events". Events can be:

  • Page views
  • First visit to the website
  • Start of session
  • Duration of Session
  • Airplus Web pages visited
  • Your "click path", interaction with the website
  • Scrolls (whenever a user scrolls to the bottom of the page (90%))
  • Internal search queries
  • Interaction with videos
  • File downloads
  • Seen Ads / clicked Ads

Also recorded:

  • Your approximate location (region)
  • Date and time of your visit
  • Technical information about your browser and the end devices you use (e.g. language setting, screen resolution, device type)
  • the referrer URL (via which website/advertising medium you came to this website)

Purposes of the data processing

On behalf of the operator Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics 4 serve to analyze the performance of our website and the success of our marketing campaigns.

Recipients

Recipients of the data are/may be

  • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor under Art. 28 DSGVO).
  • Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
  • Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA

Third country transfer

For the USA, the European Commission adopted a news adequacy decision on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider to establish an appropriate level of data protection in those countries.

Retention period

The data sent by us and linked to cookies are automatically deleted after 14 months.

The maximum lifespan of Google Analytics cookies is 2 years. The deletion of data whose retention period has been reached occurs automatically once a month.

Legal basis

The legal basis for this data processing is your consent pursuant to Art.6 para.1 p.1 lit.a GDPR and § 25 para. 1 p.1 TTDSG.

Withdrawal of Consent

You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.

You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP address) by Google, and the processing of this data by Google, by not giving your consent to the setting of the cookie.

For more information on Google Analytics' terms of use and Google's privacy policy, please visit https://marketingplatform.google.com/about/analytics/terms/us/ and at https://policies.google.com/?hl=en .

b. Customer Portal

You can register on our customer portal to use additional features. We use the data you enter to do this only for authentication purposes. The required information requested during the registration process must be provided in full. Otherwise, we will reject the registration.

We will use the e-mail address provided during the registration process to communicate with you regarding important changes that concern things like the range of products and services we offer or changes that are necessary for technical reasons.

Within the scope of operation of the AirPlus app, we process your personal data to provide you with various features relating to your AirPlus Account after you install the AirPlus app on your smartphone. The AirPlus app mainly provides the same features as the portal. For example, you can use the app to manage your data and review them at any time.

c. Identification Portal

When you use AirPlus’ Identification Portal, AirPlus processes only the data you enter into the Identification Portal to meet its obligations under anti-money laundering laws, namely to identify the person acting on behalf of AirPlus’ contracting partner when entering into an agreement or to prevent money laundering and terrorism financing.

After you have entered your data and verified your e-mail address, a personal identifier (hereinafter, “PID”) will be created. The personal data provided by you will be stored in connection with the PID together with the additional data collected during identification by the entity you selected. If you enter into additional agreements with AirPlus in the future, entering your PID will suffice; you will not need to undergo the identification process again.

d. Contact form

On this Website you have the opportunity to communicate with AirPlus through a contact form. To be able to respond to your requests, AirPlus will collect the information you provided concerning the form of address, your last name, first name and e-mail address. If you provide your telephone number and check the Call-back box, AirPlus will be happy to call you in response to your requests. You are free to provide additional data to facilitate the allocation and processing of your requests by AirPlus.

All data collected in contact forms will be used exclusively to respond to your requests. To this end, your requests along with your data may have to be forwarded to the AirPlus company in charge of supporting you as a customer.

If you submit a request via a contact form, AirPlus will save the information you provide in the form, including your contact information, to process your requests and, if applicable, to answer any follow-up questions you may have. AirPlus will not disclose this data to third parties.

e. Newsletter

You can subscribe to the AirPlus Group’s newsletter in the Newsletter section of this website.

The AirPlus Group’s newsletter provides you with

  • the latest information about AirPlus’ services and products;
  • news including about trends concerning the travel and payment services industries;
  • information about and invitations to selected events (trade fairs, customer events, training, etc.) hosted or attended by AirPlus;
  • invitations to participate in market research and/or customer surveys; and
  • invitations to participate in Webinars.

AirPlus processes the data you provide for dispatching AirPlus Group newsletters to you only with your consent. Your consent applies to the processing of personal data you provide including, but not limited to, your

  • e-mail address;
  • last and first name;
  • title, gender/form of address; and
  • newsletter language preference.

AirPlus uses the double opt-in process to confirm your subscription and your consent. AirPlus saves your confirmation as documentation and proof of your consent.

Your consent is obtained so AirPlus can process your personal data to dispatch the AirPlus Group newsletters and can customize the newsletters to meet your needs. To enhance its newsletter service continuously and to provide you with content tailored to your interests, AirPlus will evaluate your use of the newsletters in a statistical and individual manner (e.g., open and click rates). This means, for example, that AirPlus can obtain information regarding your special interests from the content on which you click in the AirPlus Group newsletters.

The AirPlus Group reserves the right to discontinue its dispatch of newsletter at any time.

If you participate in Webinars, your consent includes your agreement to the statistical and individual evaluation of your participation in any Webinars in which you do participate including, without limitation, how much attention you pay to the material offered and your level of satisfaction. This means AirPlus can determine at what time you leave the Webinar. Also, AirPlus can detect at any given time whether you are participating in the Webinar actively in a separate window or whether the Webinar is running in the background. Based on the results, AirPlus can determine when a Webinar participant’s interest diminishes. AirPlus uses this information to improve the contents, structure, and design of its Webinars continuously.

You can revoke your consent at any time with immediate effect. To do so, please note the information in the section titled Revoking your consent.

How long will your data be stored?

Your personal data will be erased once it is no longer needed for the purpose intended. Subject to legal regulations, AirPlus will store your data until the legal retention period expires. Depending on the legal basis, retention periods typically are between six and 10 years. In addition, your data will be stored until the legal statute of limitations expires (typically, three years) provided storing your data is required for asserting, exercising or defending legal claims. After this date, the respective data will be erased routinely.

Which recipients will your data be shared with?

Your personal data may be shared with persons in the categories specified below for the purposes described in this Privacy Statement and for the respective legal reasons (fulfilment of agreements, legitimate interests, consent, or legal obligations):

1. Data processors

Carefully selected partners who deliver services on behalf of AirPlus will be involved in the processing of your data. These service providers only will handle your personal data as data processors on behalf of AirPlus and according to AirPlus’ instructions.

AirPlus uses service providers in the following categories:

  • IT services providers (hosting and web infrastructure services) in Europe;
  • service providers for customer relationships (call center services, online advertising) in Europe and the United States; and
  • service providers for compliance with anti-money laundering regulations (anti-money laundering audits) in Europe.

For details regarding the transmission of data to service providers located in countries outside the European Union or the European Economic Area (hereinafter, “Third Countries”), please refer to the section titled Transmission of your data to Third Countries.

2. Third parties

AirPlus also may share your personal data with reliable third parties that support AirPlus with the provision of this Website, the Customer Portal, the Identification Portal and contract documents provided these third parties undertake to treat your personal data confidentially and to comply with the GDPR.

In addition, AirPlus may share your personal data with third parties in the following categories:

  • external auditors in the case of audits or investigations due to legal obligations or legitimate business interests;
  • external attorneys or courts as part of the assertion of legal claims;
  • authorities (e.g., Federal Financial Supervisory Authority and/or other national financial market supervisory authorities, financial authorities, the Bundeszentralamt für Steuern (Federal Central Tax Office) and/or other national tax authorities) to comply with the applicable laws; and
  • all of the AirPlus Group and the Lufthansa Group
  • partners in the context of joint campaigns, marketing activities and/or webinars, provided that you have explicitly consented to the disclosure.

3. Transmission of your data to Third Countries

Your personal data will be transmitted to Third Countries only within the scope required to meet the respective purposes (e.g., reporting obligations under tax laws). Before personal data is transmitted to a processor or a third party in a Third Country, AirPlus will ensure that a GDPR-compliant transmission mechanism is in place (e.g., the sample clauses regarding the transmission of personal data to Third Countries provided by the European Commission). To obtain a copy of the applicable guarantees, please contact AirPlus at the information available under Contact at the end of this Privacy Statement.

What are your rights regarding data protection?

1. Data subjects’ rights

Every data subject has the right to information under Article 15 of the GDPR, the right to correction under Article 16 of the GDPR, the right to erasure under Article 17 of the GDPR, the right to restrict the processing of data under Article 18 of the GDPR, the right to object under Article 21 of the GDPR (find more information in the section titled Your right to object under Article 21 of the GDPR), the right to portability of data under Article 20 of the GDPR, and the right to lodge a complaint with a supervisory authority under Article 77 of the GDPR, in particular, the supervisory authority responsible for your habitual residence or your country or the supervisory authority responsible for AirPlus named below:

Data Protection Officer of the State of Hesse
Gustav-Stresemann-Ring 1
65189 Wiesbaden
Germany

E-mail: poststelle@datenschutz.hessen.de
Telephone: +49 611 1408 – 0

If you wish to exercise your rights, please contact us at:

Lufthansa AirPlus Servicekarten GmbH
Data Protection Officer, JX LD
Dornhofstraße 10
63263 Neu-Isenburg
Germany

E-mail: dataprotection@airplus.com

How can you revoke your consent?

You can revoke your consent to AirPlus processing your personal data at any time. Please note that your revocation will apply to the future only and will not concern any past activities or processing.

To revoke your consent to receiving AirPlus’ newsletter, please click on the Unsubscribe link included in each newsletter. In addition, you can contact AirPlus at the information indicated below under Contact.

Your right to object under Article 21 of the GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data which is based on Article 6 1 f) of the GDPR, including profiling based on those provisions. Your objection notice does not need to be in a specific form. Please contact AirPlus at the information indicated below under Contact.

Social media functions

This Website includes several social media functions including, but not limited to,

  • functions you can use to forward or recommend AirPlus-related content (e.g., Share and Like buttons); and
  • links from AirPlus’ offerings to social media, for example, when you log into your personalised section on this Website (hereinafter, “Social Login”).

As part of its online offerings, AirPlus offers you the opportunity to distribute and recommend content in social media. When you visit this Website and use the recommendation functions, AirPlus will share the URL with the social media you selected.

This Website includes the following social media plug-ins equipped with the two-click solution:

  • Facebook
  • Twitter
  • YouTube
  • LinkedIn
  • Spotify

With the two-click solution, your data will not be transmitted to the respective social media network company until after the respective plug-in button has been activated (consent).

To this end, this Website uses the social sharing button developed as part of c’t magazine’s Shariff project to protect visitors’ privacy against prying social media such as Facebook, Twitter, YouTube, Xing or LinkedIn. To share pages with friends, visitors only need to click on the Shariff button.

Thanks to the Shariff button you can use social media without unnecessarily compromising your privacy. Shariff replaces the conventional share buttons offered by social media and protects your browsing behaviour from prying eyes. Nonetheless, you only have to click the button if you want to share information.

Conventional social media buttons transmit your user data to the social media every time you access their pages and provide precise information regarding your browsing behaviour (user tracking) even if you are not logged in or have joined the respective social medium. In contrast, the Shariff button only establishes direct contact between the social medium and you, the visitor, when you actively click the button. In this way, Shariff prevents you from leaving a digital trace on every page you visit.

Please note that AirPlus has no knowledge of or influence on how social media handle information you shared and whether this information is provided to other websites. AirPlus suggests that you read the respective data protection notices carefully.

Who can you contact?

If you have any questions regarding data protection in connection with this Website or the services offered through this Website, please contact AirPlus’ Data Protection Officer at

Lufthansa AirPlus Servicekarten GmbH
Data Protection Officer, JX LD
Dornhofstraße 10
63263 Neu-Isenburg
Germany

E-mail: dataprotection@airplus.com

If you contact us by e-mail, your communications will not be encoded.

In addition, you can contact AirPlus via the contact form or AirPlus’ social media pages.

Country & Language

Select a country and language below

Europe

Austria
Bulgaria
Croatia
Czech Republic
Denmark
Estonia
Finland
France
Hungary
Ireland
Italy
Latvia
Lithuania
Luxembourg
Malta
Netherlands
Norway
Poland
Portugal
Romania
Slovakia
Spain
Sweden
United Kingdom

Americas

Argentina
Brazil
Canada
Chile
Colombia
Costa Rica
Dominican Republic
El Salvador
Guatemala
Mexico
United States

Asia Pacific

Australia
Hong Kong (China)
India
Indonesia
Japan
Malaysia
New Zealand
Philippines
Singapore
South Korea
Thailand

Middle East

Israel

Africa

South Africa