Data Privacy Statement

Data Protection Statement

Website: https://www.lufthansa-cargo.com

* * *

Thank you for visiting our website and our App. We are committed to transparency and integrity in processing your personal data. In processing personal data, we comply with requirements under data protection law, in particular the EU General Data Protection Regulation ("GDPR") and the German Federal Data Protection Act ("BDSG").

In this Data Protection Statement, we explain what information (including personal data) we process during your visit and use of our internet offerings on our website https://www.lufthansa-cargo.com and its subpages, such as https://developer.lufthansa-cargo.com/, as well as in our App (hereinafter the afore-mentioned websites and our App are collectively referred to as "Website") and which rights you have in relation to your personal data.

 

I.    Who is responsible for processing the data?
The party responsible for the processing of personal data under data protection law (the “Controller”) is Lufthansa Cargo AG, Frankfurt Airport - Gate 21, Building 322, D-60546 Frankfurt am Main, Germany (e-mail: [email protected]).

We often collaborate with our affiliate SWISS WorldCargo, the air freight division of SWISS International Air Lines Ltd, Obstgartenstrasse 25, 8302 Kloten, Switzerland, (https://www.swissworldcargo.com). 
Where Lufthansa Cargo AG and SWISS WorldCargo jointly determine the purposes and means of processing, we act as joint controllers within the meaning of Art. 26 GDPR. This applies in particular to online bookings, the provision of services, customer relationship management and the distribution of newsletters as described below. The parties have entered into an agreement on joint controllership which allocates responsibilities for compliance with data protection obligations, in particular with regard to the provision of data protection information and the handling of data subject requests. 
You may exercise your rights under section X against either joint controller. Where the words “we” or “us” are used in this Data Protection Statement, they refer to one or both companies, depending on the relevant processing activity. Information on the essence of the arrangement may be requested using the contact details set out in this Data Protection Statement.

We have appointed the Data Protection Officer of the Lufthansa Group as our company’s Data Protection Officer. If you have any questions regarding the processing of your personal data, you can contact the Data Protection Officer at any time by post (FRA CJ/C, Airportring - LAC, 60546 Frankfurt) or e-mail ([email protected]).

 

II.    Personal data
Personal data means any information relating to an identified or identifiable individual. On this Website we can also record items of information that, taken on their own, do not allow us to directly draw conclusions about your person. Nevertheless, this information may constitute “personal data” within the meaning of data protection law in certain cases, in particular if it is combined with other data. In addition, we may also record information on this Website that does not enable us to identify you directly or indirectly; this is the case, for example, with aggregated information on all users of this Website.

 

III.    What data do we process?
You can access our Website without directly providing personal data (such as your name, postal address or e-mail address). In this case, too, we have to process certain information to enable you to access our Website. Moreover, on this Website we use certain analytics methods and have integrated links to other Websites whose operators may process further (personal) data. Finally, on our Website we offer you the use of various services for the performance of which we require personal data from you. These are mostly your contact data, which we collect either when you contact us or when you register as a user of our various services. In detail, we process personal data on our Website as follows:

1. log files: When you visit this Website, our web server automatically stores the domain name or IP address of the requesting computer system (usually your internet access provider), including the date, time and length of your visit, the sub-sites/URLs you visit, and information on the applications and devices you use to view our Websites.

2. Cookies and similar technologies: We use cookies and similar technologies, including browser storage technologies, to operate our Website, to provide requested functions, and – subject to your selection – to enhance convenience, analyze the use of our Website, measure performance and enable certain third-party content. Further information on the individual technologies, providers, storage periods, third-country transfers and your choices is available in our Cookie-Information. In the Cookie Settings which you can access at any time via the link in the footer of our Website, you may withdraw or change your consent there at any time with effect for the future.

3. Embedded media content: We have embedded various third-party media content on our Website, for example

  • own videos, which are also available on our channel on the YouTube platform (an offering from YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, U.S. – “YouTube”);
  • 3D tours of the Matterport data platform (a service of Matterport Inc., 352 e. Java Dr., Sunnyvale, CA 94089, USA);
  • Maps from Google Maps (a service of Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland) with the purpose of providing our users with information about our station network.

Embedded third-party content is generally displayed only after an activating user action. Before activation, the relevant content is blocked. Once you activate such content, personal data may be transmitted to the respective third-party provider, in particular your IP address, technical device and browser information and, depending on the provider and your settings, additional usage data or location data. Where the activation of embedded content involves access to information already stored on your device or involves storing information without being strictly necessary for the content to be provided, we will need your consent. Further details are set out below and in our Cookie Information. 

  • YouTube: If you activate and play an embedded YouTube video, a connection to the YouTube servers is established in order to display the video in your browser. In this context, YouTube may process personal data such as your IP address, device and browser information, information on the page from which the request originated and, depending on your user settings and whether you are logged into a Google service, further usage-related information. We use YouTube’s privacy-enhanced mode where available. Nevertheless, the activation of YouTube content may result in the processing of personal data by YouTube/Google and, depending on the implementation, in the use of Cookies or similar technologies. More information on data processing by YouTube and Google can be found at https://policies.google.com/privacy?hl=en
  • Matterport: If you activate and use a 3D tour on our Website, Matterport may process personal data such as your IP address, device and browser information, referrer and destination URL, time of access and identifiers associated with your device in order to provide the content and ensure security and functionality. For more information on data processing and privacy by Matterport, please visit: https://matterport.com/de/privacy-policy
  • Google Maps: If you activate and use Google Maps on our Website, a direct connection to Google servers is established. In this context, Google may process personal data such as your IP address, technical device information, usage data, search terms entered into the map and, if you separately allow this on your device or in your browser, your current location. Further information on data processing and data protection can be found at: https://policies.google.com/?hl=en. The additional terms of use of Google Maps/Google Earth also apply: https://www.google.com/intl/en_en/help/terms_maps/

4. Cloudflare: To ensure the security, performance, and availability of our website, we use the services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. As a Content Delivery Network (CDN) and security provider, Cloudflare routes website traffic through its global network to protect against attacks (e.g., DDoS), block malicious access, and optimize loading times. In this process, technical data such as IP addresses and browser information are processed. Further details on the use of Cloudflare-related cookies can be found in our Cookie-Information section. For more information, see Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.

5. Links to other Websites: Our Website contains links to other offerings (including our presence on Facebook, YouTube, LinkedIn and Instagram). Please note that when you access such external offerings, the respective provider processes personal data under its own responsibility. This may include information about your visit, your IP address, device and browser information, and other data generated by your interaction with the external offering. We have no control over the subsequent data processing carried out by the operator of the external offering. You can find more information in the relevant data protection statements of those providers.

6. Means of contact: On our Website, we provide various ways for you to contact us. If you use one of these ways, we process the information we request and/or that you provide in order to handle and respond to your inquiry. Depending on the nature of your inquiry, the processing may also involve the use of technical assistance systems, including AI-supported tools, to categorize, prioritize or support the handling of requests. Such tools are used only within the scope permitted by applicable law and do not replace human handling where this is required. If external service providers are involved, they act on our behalf or, where applicable, in their own responsibility in accordance with the applicable legal requirements. If necessary, the inquiry data may be stored beyond the handling of the inquiry to document the communication, preserve evidence, or assert, exercise or defend legal claims.

7. Registration and user account: On our Website we offer you the possibility of registering as a user, in particular so that you can use our e-services. However, registration as a user can also be carried out by us at your request if you confirm this registration to us. Only employees, contact persons and representatives (jointly termed “Contact Person(s)”) of existing customers and business partners (jointly termed “Business Partner(s)”) can register. Please note that we do not permit registration by Contact Persons who are minors in our General Terms and Conditions or special terms and conditions for use of our e-services. During registration, we collect not only details of the Business Partner, but also personal data on the Contact Person as defined specifically in the registration mask. Obligatory information is indicated as such. We may ask you to enter the data collected during registration again (in particular so that you can be identified) and collect further personal data if you use certain content or features on our Website.


8. Customer Relationship Management: We use the Customer Relationship Management ("CRM") system Microsoft Dynamics 365 to store and manage business contact data, including contact details of customers, suppliers and other marketing contacts, as well as data of persons who submit an inquiry or claim or subscribe to a newsletter or register for an event. The provider of Microsoft Dynamics 365 is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. We use this system in particular to document contacts, manage communications, administer business contact data, process inquiries and claims, and manage newsletter subscriptions, event registrations and related consent records. Depending on the context, Microsoft Dynamics 365 is used as a processor on our behalf or, where legally required, as a separate recipient within the meaning of applicable data protection law. Further information about Microsoft Dynamics 365 is available at https://privacy.microsoft.com/en-us/privacystatement.

9. Our Services: The use of the services offered by us ("Services") is possible with and without registration:

  • Services for registered users: A large part of our Services can only be used by registered Contact Persons from our Business Partners. By registering, we give you the opportunity, in particular, to request offers from us, to place, change and delete orders, to initiate collection and after-sales processes, to make claims and provide feedback, and to call up information on current or already completed orders for the respective Business Partner within the framework of an existing business relationship. In addition, we can also proactively inform you about current orders and will do so in any case if there are certain irregularities in the course of the execution of an order. Depending on the type of Service, we may ask for further information, exceeding the personal data of the Contact Person that was collected during registration. This data is also as defined in the online screen(s) for the e-service in question; here too, obligatory data is indicated as such. 
  • Services for users who have not registered: In addition to the services for registered users, you can also use parts of our services without registration. For example, we also provide certain features, such as a consignment tracking application, outside the section of our Website where registration is required. As part of these features, we may not only ask for information related purely to the company or an order, but also personal data (for example the name of the user or contact information such as an e-mail address).

You can also book many of our services by telephone, e-mail or in person with us or our service providers. If you book one of our services, we will process the information you provide and confirm to us for this purpose in order to be able to provide the corresponding services to you. The personal data provided is usually contact information, such as names, addresses, telephone number or email addresses. After completion of the relevant transaction, we may continue to store the data to the extent necessary to administer the business relationship, facilitate follow-up bookings where appropriate, comply with legal retention obligations, and establish, exercise or defend legal claims.
In connection with your order, we may also offer you the possibility to provide information about the recipient of the consignment that we transport or a possible accompanying person (again, this is mostly the contact information mentioned above); this information can as well refer to individuals (for example, the recipient himself or a specific Contact Person in a legal entity).
Please ensure that the individuals you have named are informed of the processing of their personal data in connection with an order, as required by law. Where you provide us with personal data of other individuals, you must ensure that you are entitled to do so and that the affected people have been informed in accordance with applicable data protection law, unless an exception applies.
Please note that the provision of services may also require the disclosure of the aforementioned data to domestic and foreign authorities, such as airports, customs, police, etc. Such disclosures take place only where necessary for the performance of the service requested or where we are under a legal obligation to disclose the data.

10. Lufthansa Cargo Developer Portal: On the Lufthansa Cargo Developer Portal, we offer you the possibility to apply for an API-Key, which allows you to access Lufthansa Cargo APIs. If you register for an API-Key, we process the information we request and/or the information you provide in order to process your request. In addition, operational problems can be reported there, and the provided information provided will also be processed to resolve these concerns.

11. Newsletter: On our Website we may also offer you the possibility of registering for our newsletter. The necessary information is as defined in the registration form and usually comprises – as mandatory data – your title, your given name and surname, your company and your e-mail address. Mandatory information is indicated as such.
For the distribution and administration of our newsletter, we use the Customer-Relationship-Management ("CRM") system, Microsoft Dynamics 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. If you separately consent to newsletter performance measurement, we may also measure whether newsletters are opened and which links are clicked to evaluate the reach of our newsletters and optimize content and delivery. Such measurement may involve the use of tracking technologies contained in e-mails. Further information about Microsoft Dynamics 365 is available at: https://privacy.microsoft.com/en-us/privacystatement.

12.    Customer surveys: We may contact you as part of our regular or transactional customer surveys. Participation is voluntary. Where consent is required, we will contact you only on the basis of your consent. Regular customer surveys may be evaluated in anonymized or aggregated form. Transaction-related customer surveys, however, may, depending on the purpose of the survey, be carried out in a personalized form, so that we can understand and respond to your feedback regarding a specific transaction. In this context, we may process in particular your first name, last name, gender, e-mail address and, if applicable, your postal address, as well as information relating to the relevant transaction and your feedback.
To conduct our surveys, we may use the Customer-Relationship-Management ("CRM") system, Microsoft Dynamics 365. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Further information about Microsoft Dynamics 365 is available at: https://privacy.microsoft.com/en-us/privacystatement.

13. Online surveys: We can also conduct online surveys to improve our services, the participation of which is voluntary. These can take place anonymously or personalized. If we process personal data in connection with a particular online survey, we will provide you with the relevant data protection information at or before the time of collection, for example in a corresponding pop-up window or survey notice. In that case, we process the information requested from you and/or the information you provide in order to evaluate the survey and optimize our services.

14. Manage subscriptions / promotional consents: In our Subscription Center, we offer you the possibility to take out subscriptions (e.g. for receiving our newsletters) and to give us your consent to receive promotional information, as well as to view your existing subscriptions and the given consents and to adjust them at any time. If you give us your consent to send you advertising information, we will, for example, inform you about our company, our products and our events or, if necessary, carry out customer surveys with you. In the context of subscriptions and promotional consents, the following personal data in particular will be processed: First name, surname, gender, e-mail address and, if applicable, your postal address.

15. Chatbot: As part of our eServices, we offer you as a registered user an online consultation in the form of a chatbot on our Website. A chatbot is a computer program that interprets written text and automatically responds to written requests. To the extent necessary to provide the chatbot function and to process your request, we process the personal data contained in your entries as well as technical data required to maintain the chat session. We use such data primarily to answer your request, ensure secure and stable operation of the chatbot, and improve the quality of the service to the extent permitted by law. Please do not enter special categories of personal data or confidential information unless this is strictly necessary for your request.

We may also offer a live chat function. If you use the live chat function of our chatbot, your personal data and the chat history will be transferred to an employee or to an external service provider to answer your request. To identify a chat session, we use a pseudonymized session and user ID. For more information about these IDs, see our Cookie-Information. Your entries in the input mask of the chat will be transmitted to us and stored in order to answer your request. In this respect, the same applies as under III.6 Means of Contact. Furthermore, we use the chat data to improve and optimize the chatbot by analyzing it, e.g. with regard to categories of requests, abandonment rate, requests that cannot be matched, etc. 

 

IV. For what purposes and on what legal basis do we process your data?

  1. Personal data that may be contained in the log files is processed in order to provide our Website, ensure its stability and security, prevent misuse and remedy technical faults. Such processing is carried out on the basis of Article 6 paragraph 1 (f) GDPR in order to safeguard our legitimate interests in the secure and functional operation of our Website and, where applicable, on the basis of statutory provisions governing the use of telemedia and the security of terminal equipment and networks under applicable German law.
  2. The data collected using strictly necessary cookies and similar technologies is processed for the purpose of providing the Website, ensuring security, enabling core functions and storing your settings where this is necessary for the requested service on the basis of Article 6 paragraph 1 (f) GDPR and, where applicable, the statutory provisions governing access to and storage of information on terminal equipment under applicable German law. Data collected using non-essential and therefore optional cookies and similar technologies, including technologies in the categories "comfort", "statistics" and "performance" is processed for the purposes described in the Cookie Information only on the basis of your consent and Article 6 paragraph 1 (a) GDPR. Any pseudonymous user profiles based on non-essential technologies are created only on the basis of your consent, unless otherwise expressly permitted by law.
  3. The processing of the data collected by Cloudflare is carried out for the purpose of ensuring the security, performance, and availability of our Website in accordance with the requirements of Art. 6 paragraph 1 (f) GDPR, based on our legitimate interest in the secure and efficient operation of our online services.
  4. The processing of the data collected through the activation and playing of media content embedded on our Website is carried out for the purpose of displaying third-party content and providing the related functions. Where the activation of embedded media content involves the storage of information on your device or access to information already stored on your device and is not strictly necessary for the provision of the content requested by you, the activation and the related processing are based on your consent pursuant to Article 6 paragraph 1 (a) GDPR. In addition, subsequent processing that is strictly necessary to deliver the content after activation may be based on Article 6 paragraph 1 (f) GDPR depending on the specific function and context. Further details on the technologies used in connection with embedded media content, including information on Cookies, similar technologies, storage periods and your choices, are provided in our Cookie Information.
  5. Personal data provided to us as part of an inquiry directed to us using the channels specified on the Website is processed to deal with the inquiry so as to safeguard our legitimate interests in conducting an existing business relationship or performing our other business activities on the basis of Article 6 paragraph 1 (f) GDPR.
  6. Personal data of our Business Partners’ Contact Persons or other natural persons (recipient of the consignment or recipient’s Contact Person) that is collected as part of registration or use of a user account is processed for the purpose of setting up and administering user accounts, enabling access to digital services, verifying affiliation with a Business Partner and administering the related business relationship. Depending on the specific service context, the processing is based on Art. 6 paragraph 1 (b) GDPR, where the processing is necessary for the provision of requested services, and otherwise so as to safeguard our legitimate interests in administering customer and business partner access to our digital offerings in a secure and efficient manner to conduct existing business relationships on the basis of Article 6 paragraph 1 (f) GDPR.
  7. The processing of personal data collected from you in the course of using our services is carried out on the basis of Article 6 paragraph 1 (b) GDPR in order to provide the corresponding contractual services. Where data is stored beyond the provision of the respective service, this is done to protect our legitimate interest and only to the extent for the administration of the existing business relationship, for compliance with legal obligations, for documentation, or for the assertion, exercise or defense of legal claims on the basis of Article 6 paragraph 1 (c) and/or Article 6 paragraph 1 (f) GDPR.
  8. The processing of the personal data collected from you within the scope of the application for an API-Key on our Lufthansa Cargo Developer Portal is carried out for the purpose of processing your application, managing developer access, ensuring secure provision of the relevant APIs, preventing misuse and administering the related business relationship. Depending on the context, the processing is based on Article 6 paragraph 1 (b) GDPR and/or of Article 6 paragraph 1 (f) GDPR. 
  9. Personal data provided as part of registration for a newsletter, or in your participation in a customer survey, or an online survey or personal data provided as part of your registration to receive promotional information, is processed on the basis of your consent pursuant to Article 6 paragraph 1 (a) GDPR, where consent is required, in particular for newsletters, promotional communications, voluntary surveys and any associated measurement or personalization activities that require consent. Please note that you can withdraw any consent you have given at any time with effect for the future, for example by clicking on the relevant unsubscribe or preference-management link contained in a communication, via the Subscription Centre via the Cookie Settings where applicable, or by contacting us using the contact channels specified in Section I. of this Data Protection Statement (kindly also refer to Article X b) below). The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. Where customer surveys are conducted in connection with an existing customer relationship and do not require consent under applicable law, processing may alternatively be based on Article 6 paragraph 1 (f) GDPR on the basis of our legitimate interest in measuring customer satisfaction and improving our services. The applicable legal basis will be communicated in the relevant collection context.
  10. Personal data provided to us in the course of the use of our chatbot is processed in order to provide the chatbot function, answer the question(s) submitted there, ensure secure and stable operation and improve and optimize our chatbot service. Depending on the nature of the request, the processing is based on Article 6 paragraph 1 (b) GDPR where necessary for pre-contractual measures or the performance of a contract, and otherwise on Article 6 paragraph 1 (f) GDPR based on our legitimate interests in handling business-related inquiries and improving our digital services. Where specific chatbot-related analytics or optimization activities require consent under applicable law, such processing is carried out on the basis of your consent according to Article 6 paragraph 1 (a) GDPR.
  11. We can also process the personal data collected in connection with the use of our Website to comply with legal obligations to which we are subject; this is done on the basis of Article 6 paragraph 1 (c) GDPR.
     
  12. Where necessary, we also process personal data above and beyond the above-mentioned purposes to safeguard further legitimate interests or the interests of third parties; this is done on the basis of Article 6 paragraph 1 (f) GDPR. Our legitimate interests include
    a. establishing legal claims and defending ourselves in legal disputes;
    b. preventing and investigating criminal acts;
    c. ensuring security, including IT security, and
    d. controlling and further development of our business activities, including risk management and operation of our IT systems.

 

V.    Do I have an obligation to provide personal data?
As a rule, you are not legally obliged to provide us with your personal data when visiting our Website. However, certain personal data is technically required to access and use the Website and to ensure its secure operation. In addition, where you wish to use specific services, register for an account, request an API key, submit an inquiry, book a service, subscribe to a newsletter or take part in a survey, the provision of the data marked as mandatory is necessary for us to provide the relevant function or process your request. Thus, if you do not provide the mandatory data, we may be unable to provide the requested service, process your request, or conclude or fulfil the relevant contract. 
The particulars required for any account registration, as well as for registering for a newsletter are indicated as mandatory details in the relevant section of our Website (e.g. an online form); if you do not provide these mandatory details, we cannot enable you to use the feature in question.
​​​​​​​If we collect personal data from you above and beyond that, we notify you at the time whether the information must be provided under the law or a contract or is necessary so that a contract can be concluded. We usually indicate information that is provided voluntarily and does not have to be furnished pursuant to one of the above obligations or is not required to conclude a contract.

VI. Who receives personal data?
In general, personal data is processed inside our company. Only specific departments/organizational units can access personal data, depending on its nature. They include in particular the specialist departments tasked with providing our digital offerings (e.g. Websites) or the described business processes, and our IT department. A role and authorization concept restricts access at our company to the functions and the scope required for the purpose for which the data is processed.

We may also transfer personal data to third parties outside our company to the legally permissible extent. In particular, these external recipients may include

  • SWISS WorldCargo as a joint controller as described in section I above;
  • other affiliated companies in the Lufthansa Group to which we transfer personal data for internal administrative purposes and for the performance of central services (e.g. billing services);
  • those third parties we use to provide our services (e.g. to carry out flights or load and unload cargo), insofar as the transfer is necessary to fulfil the contracts concluded with us, such as ground handling service providers at the airports we operate;
  • ervice providers engaged by us, such as for example our transport, IT, security, CRM, communication, analytics, support, payment and operational service providers, including also our ground handling service providers, who process personal data on our behalf or, where applicable, in their own responsibility in accordance with the applicable legal requirements, as well as their approved sub-contractors or sub-processors;
  • non-public and public bodies (e.g. airports, customs or police authorities, etc.), where we are obliged to transfer your personal data pursuant to statutory obligations or where disclosure is otherwise necessary to comply with applicable law or to perform the requested service;
  • recipients of a consignment we deliver for one of our Business Partners; the consignments may also contain personal data from you in individual cases if you have been named as the Contact Person in the provided consignment data;
  • our Business Partners or a contact at this Business Partner in order to verify a Contact Person's affiliation with our Business Partner in the context of the registration of a Contact Person (see above under III.7 Registration) or in the further course of the business relationship; and
  • other Contact Persons at your organization if they are likewise registered to use our e-services; in this case, all Contact Persons within the organization of a Business Partner may be able to access details of all business transactions of that Business Partner (including information on your involvement in such a business transaction) using the e-services;
  • Furthermore, we may transfer further data to third parties within the scope of the use of cookies and tracking functions on our Website, according to the details set down in our Cookie-Information. These recipients may include analytics, security, media, communication and technology providers stated in the Cookie-Information.  

VII. Is automated decision-making used?
As a rule, we do not use automated decision-making (including profiling) within the meaning of Article 22 GDPR in connection with operation of our Website and the services described in this Data Protection Statement. If we were to use such methods in individual cases in the future, we would inform you separately where required by law.

VIII. Is personal data transferred to countries outside the EU/EEA?
In many cases, personal data is processed within the EU or the European Economic Area (EEA) and, where applicable, Switzerland.
Since the Lufthansa Group operates globally and we also perform our services worldwide, we also transfer information to recipients in what are called "third countries". "Third countries" are countries outside the European Union or not party to the Agreement on the EEA and Switzerland where it cannot be readily assumed that they have a level of data protection comparable to that in the European Union, EEA and Switzerland. Recipients in third countries may be, for example, service providers we engage (such as our call center) or our own offices abroad, which are part of our international presence, but also non-public and public bodies (e.g. airports, customs or police authorities, etc.), in case we are obliged to transfer specific information in the course of the provision of our services pursuant to statutory obligations.
Where personal data is transferred to recipients in third countries, we ensure an adequate level of data protection as required by law, unless a statutory exception applies. Depending on the recipient and the destination country, that may be done in particular by relying on an “adequacy decision” by the European Commission, by entering into the EU Standard Contractual Clauses, and/or by implementing supplementary measures where necessary. Certain providers named in this Data Protection Statement or in the Cookie Information may process data in the USA or allow remote access from the USA. Further information on the relevant safeguards can be requested using the contact details set out in Section I. 
For information about the EU Standard Contractual Clauses, click here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en, and for information about the adequacy decisions click here: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en#dataprotectionincountriesoutsidetheeu. As exceptions provided by law, transfers to countries without adequate protection may also be permissible in other cases, e.g. based on consent, in connection with legal proceedings abroad or if the transfer is necessary for the execution of a contract. 

IX. For how long is personal data stored?
As a general rule, we store personal data only for as long as is necessary for the purposes described in this Data Protection Statement. Thereafter, such data is deleted, unless further storage is required to comply with legal retention obligations, to establish, exercise or defend legal claims, or unless another lawful basis for continued storage applies.
​​​​​​​In determining the appropriate retention period, we take into account in particular the nature and sensitivity of the data, the purpose of the processing, whether and how long a contractual or business relationship exists, statutory limitation periods, and applicable statutory retention obligations. We erase or restrict personal data when it is no longer needed for the relevant purposes and no legal basis for further storage exists. 

As a rule

  • log data is erased within seven days, unless it needs to be stored further for purposes envisaged under the law, such as detection of misuse and the identification and rectification of technical faults;
  • data processed in connection with a business relationship is generally stored for the duration of the business relationship and thereafter until the expiry of the applicable statutory retention periods and limitation periods, unless a shorter storage period applies in the specific case; 
  • data stored in connection with a registration as a user is erased when the customer account is deleted, unless further retention of it is required to comply with statutory retention periods in connection with the business relationship in question. If applicable, information (including personal data) is also erased before the customer account is deleted if a shorter period of time is envisaged in the respective e-service, if such shorter period can be defined by you or the Business Partner in question or if the purpose for further processing such personal data ceases to apply otherwise;
  • your entries in the chatbot are automatically deleted after their analysis for the optimization of our chatbot as described above under III.15, at the latest after 6 months.

Personal data we have to store in order to comply with retention obligations is stored until the obligation to retain it ends. If we store personal data solely to comply with retention obligations, it is usually blocked, meaning it can only be accessed when that is required for the purpose for which the data had to be retained.

 

X. What are your rights as a data subject?

a. Right of objection under Article 21 GDPR
As a data subject you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning yourself which is based on Article 6 paragraph 1 (e) or (f) GDPR, including profiling based on those provisions. In the event of such an objection, we will no longer process your personal data, unless (i) we can demonstrate compelling legitimate grounds for the processing, which override your interests, rights and freedoms, or (ii) the processing serves the establishment,  exercise or defense of legal claims.
In case we process your personal data for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning yourself for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object to the processing for direct marketing purposes, the relevant personal data will no longer be processed for these purposes.

b. Withdrawal of consent 
If you have given us your consent to process your personal data, we hereby inform you that you can withdraw this consent at any time, e.g. by clicking on the corresponding link in each of our newsletters or in our e-mails or with regard to cookies, by selecting the appropriate boxes in the Cookie Settings, which you can access at any time via the link in the footer of our Website, by sending us a corresponding message by post, fax or e-mail via one of the contact channels mentioned in Section I. of this Data Protection Statement. You can also withdraw or modify your consent to the use of cookies at any time by clicking on this link. In all other cases or if you have problems withdrawing your consent, you can also contact our Data Protection Officer, also mentioned in Section I. of this Data Protection Statement.

Please note that the consent you have withdrawn will only have effect for the future and has no influence on the lawfulness of processing based on consent before its withdrawal. In some cases, despite your withdrawal, we are entitled to process your personal data on a different legal basis - for example, to fulfil a contract.

c. Additional rights
As a data subject, you also have the following rights:
•    Right of access (Art. 15 GDPR) You have the right to request information about the personal data we process. 
•    Right to rectification (Art. 16 GDPR) You can request that incorrect or incomplete personal data be corrected, supplemented or updated. 
•    Right to erasure (Art. 17 GDPR) You have the right to request the deletion of your personal data, provided that there are no statutory retention obligations, or the data is no longer required for the processing of relevant processing purposes. 
•    Right to restriction of processing (Art. 18 GDPR) Under certain conditions, you have the right to request the restriction of the processing of your data. 
•    Right to data portability (Art. 20 GDPR) You have the right to receive your personal data in a structured, commonly used and machine-readable format or to have it transmitted to a third party – provided that it is data that you have provided to us. 
•    Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) You have the right to complain to a data protection supervisory authority if you believe that the processing of your personal data violates the GDPR. 
Competent supervisory authority in Hesse: 
The Hessian Commissioner for Data Protection and Freedom of Information 
Gustav-Stresemann-Ring 1 
65189 Wiesbaden P.O. Box 31 63, 
65021 Wiesbaden Phone: 0611 1408-0 
Email: [email protected] 
https://datenschutz.hessen.de
In order to exercise these rights, you can contact us at any time, e.g. by using the channels specified in Section I. of this Data Protection Statement.
If you have questions relating to the processing of data, you can also contact our Data Protection Officer, whose contact information you can also find in Section I. of this Data Protection Statement.
You also have the right to lodge a complaint with another competent supervisory authority in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, subject to the conditions of Article 77 GDPR.

XI. Changes to the Data Protection Statement
Due to the further development of our Website and our offers or due to changed legal or official requirements, it may become necessary to change this Data Protection Statement.
​​​​​​​If this results in material changes to the processing described herein or if we are required to do so by law, we will inform you of such changes in an appropriate manner, for example by a notice on our Website or, where required, by separate notification.
​​​​​​​ You can access and print out the current Data Protection Statement on our Website at any time.

Last change: August 2026

* * *

External media content is blocked here. When loading or playing the embedded media content, connections to the servers of the respective provider are established. Personal data may be communicated to the provider in the process. For more information, please see our data privacy statement.