Privacy Notice of Stat Sync
In this data protection notice, Lufthansa Innovation Hub GmbH, Brunnenstraße 19–21, 10119 Berlin, Germany, e-mail: datenschutz@lh-innovationhub.com (“we”, “us”) would like to inform you about how we process personal data about you when you use Stat Sync. We process data in line with the EU General Data Protection Regulation (GDPR) and applicable national laws.
1. What Personal Data Do We Collect From You?
- Status Match data: if you submit a status match application, we process the data you enter (name, email address, country of residence, loyalty programme, membership number, status tier) and any documents you submit for verification (e.g. status certificates, screenshots, boarding passes, Apple Wallet passes).
- Marketing data: if you opt in to receive offers and campaigns, we process your contact details and status information for this purpose
- Inquiry data: if you contact our support, we process the information you provide to respond to you
- Server log data: when you use Stat Sync, technical data (IP address, browser type and version, device and operating system, date and time of access) is temporarily stored on our servers
2. For What Purposes, on What Legal Basis, and for How Long Do We Process Your Personal Data?
2.1 Your Status Match Application
If you submit a status match application, we process your loyalty programme data to verify and match your status. We generally use automated processes to verify and match your loyalty programme status. Where the automated process does not provide a sufficiently reliable result, we will conduct a manual review of your application to complete the verification.
The legal basis for this processing is your consent, Art. 6(1)(b) GDPR. We ask for this consent specifically for the matching itself, separate from any other purpose.
Your application data is retained for 12 months after your application has been processed, or until any dispute has been resolved. Documents you submit for verification are deleted within 30 days of verification, unless retention is required for legal defence.
Where you have separately consented to receive marketing communications (see Section 2.2), we continue to store the relevant contact and status data for that purpose until you withdraw that consent.
We may use verification service providers (e.g. document or identity checks) to support this process; these are engaged as processors under Art. 28 GDPR.
2.2 Storing Your Data for Future Offers
If you would like to receive relevant campaigns and offers from us in the future, we store your contact details and status data for this purpose.
The legal basis for this is your separate consent, Art. 6(1)(a) GDPR.
You can revoke your consent to the use of your personal data for advertising and product development purposes and the contact made for this purpose at any time. Please use the corresponding functions provided for you (e.g. the unsubscribe function in the newsletter) or send a corresponding message by e-mail to datenschutz@lh-innovationhub.com.
This data will be deleted after you withdraw your consent or otherwise at the latest after the end of use by us or only in aggregated, anonymized form.
We use the processors ActiveCampaign LLC (“Postmark”) to send our emails communication and newsletter. Postmark is certified in accordance with the EU-US Privacy Framework.
2.3 Your Inquiries
If you send us inquiries by email or via the contact form, we will process the information you provide in order to respond to your inquiry.
The legal basis for the processing is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR to answer your inquiry. If your request is aimed at the initiation or execution of a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.
You can object to the processing of your data on the basis of Art. 6 (1) lit. f GDPR. We can then continue the processing if we can prove compelling reasons for the processing. In this case, this may be necessary in particular to be able to prove past communication and inquiries with you. If there are no such compelling reasons, we will stop communicating with you and delete data that has already been collected.
This data will be deleted when our communication with you has ended, i.e. when the matter in question has been conclusively clarified and there are no further legitimate interests in storing it or there are no further legal obligations to store it.
2.4 Provision of the Website and Services
Processing server log data is necessary for technical reasons, to operate Stat Sync and ensure system security. The legal basis is our legitimate interest, Art. 6(1)(f) GDPR. The right to object under Art. 21(1) GDPR applies; however, due to the technical necessity of this processing, an objection may not require the processing to cease.
This data is deleted after 30 days at the latest.
In addition, we use the anonymized or aggregated data obtained with the help of analysis tools (in particular cookies) to track the surfing behavior of all visitors and thus improve the design of our website and our content in general.
The following web service providers are used to host and deliver this website:
- Render Services Inc. (“Render”) (USA)
- OpenRouter Inc. (“Open Router”) (USA)
- Hetzner Online GmbH (“Hetzner”) (Germany)
3. Security
We and our service providers take technical and organizational security precautions to protect the personal data we manage against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our data processing and security measures are continuously improved in line with technological developments.
When your personal data is transmitted to us, it is encrypted using Secure Socket Layer (SSL). Personal data that is exchanged between you and us is always transmitted via encrypted connections that correspond to the current state of the art.
Our employees and our contracted service providers are of course obliged to maintain confidentiality.
4. Our Data Protection Officer
Our data protection officer can be reached as follows:
Deutsche Lufthansa AG, Group Data Protection Officer, FRA CJ/D, Lufthansa Aviation Center, 60546 Frankfurt am Main, Germany. E-Mail: datenschutz@dlh.de
5. Your Rights
Every natural person whose personal data we process has the following rights vis-à-vis us (i.e. depending on the respective requirements):
- If you have any questions about the processing of your personal data by us, we will be happy to provide you with information about the personal data stored about you free of charge at any time (Art. 15 GDPR).
- You have the right to have incorrect data corrected and incomplete data completed (Art. 16 GDPR).
- You have the right to block/restrict the processing or erasure of your personal data that is no longer required or stored due to legal obligations (Art. 17, 18 GDPR)
- You have the right to receive the data in a structured, commonly used and machine-readable format if you have provided us with the data on the basis of consent or a contract between us and you (Art. 20 GDPR).
- You have the right to object at any time to the processing of your data for direct marketing purposes (Art. 21 (2) and (3) GDPR).
- You have the right to object to processing on the basis of a legitimate interest, whereby we can then demonstrate our compelling reasons (Art. 21 para. 1 GDPR). We have indicated above (see section 2) if this right exists.
- If you have given your consent to data processing, you can revoke this at any time with effect for the future, i.e. the legality of the data processing up to the time of revocation remains unaffected. Once you have withdrawn your consent, you may no longer be able to use our services.
Please address your concerns to datenschutz@lh-innovationhub.com or to the contact address stated in section 4. We reserve the right to verify your identity so that your personal data does not become known to unauthorized persons.
You also have the right to lodge a complaint with a data protection supervisory authority.
6. Changes
From time to time it is necessary to adapt the content of this data protection notice. We therefore reserve the right to amend it at any time. We will also publish the amended version of the data protection information here. If you visit us again, you should therefore read the data protection information again.