We look forward to your visit to our website, where we offer you personalized information about our company and our services. We consider transparency and integrity important issues to consider in the processing of your personal data. We observe the provisions of data protection law, particularly those of the EU General Data Protection Regulation (“GDPR”) and of Germany’s Federal Data Protection Act (“BDSG”) and Telemedia Act (“TMG”).
In this Privacy Notice, we explain what information (including personal data) we process during your visit and use of our above internet offering (“Website”) and what rights you have over your personal information.
I. Who is responsible for data processing?
The entity responsible for ensuring that personal data are processed in compliance with data protection law is Eurowings Digital GmbH, Waldstrasse 249, 51147 Cologne. The pronouns “we” and “us” as used in this data protection notice refer to the aforementioned company.
Our group data protection officer at the Lufthansa Group can be reached using the contact information provided above and at email@example.com.
If you have questions or are seeking information on the subject of data protection, you may also contact us at firstname.lastname@example.org.
II. What principles do we observe?
In compliance with data protection regulations, we process your personal data only if permitted by law or if you have given your consent. This also applies to the processing of personal data for advertising and marketing purposes.
We may also collect information on this website that cannot be used by itself to identify you personally. In certain cases, especially when combined with other data, this information can nonetheless be considered ”personal data” as defined by data protection legislation. We may also collect information on this website that does not allow us to identify you, either directly or indirectly; this includes, for example, aggregated information about all users of this website.
III. What data do we process? For what purposes and on what legal basis does this processing take place?
You can access our website without providing direct personal information (such as your name, postal address, or email address). Again, we do need to collect and store certain information so as to enable you to access our website. We also use certain analytical methods and integrated third-party functionalities on our website. In addition, we offer some functions on our website, for which you must provide personal data.
We collect and process personal data in the following scope:
Log files: When you visit this website, our web server automatically stores data and information about the device and browser you are using. This information includes the browser type and version used, the operating system, the Internet Service Provider, the IP address of your device, the date and time of access, the website from which you visited our website, and the pages you visited on our website. We process this technical information in the log files of our systems and do not combine them with other personal data about you. We process technical information in order to enable you to access our website, to ensure the functionality of our website and the security of our IT systems, and to optimize our website. The legal basis for this type of processing is Article 6, Section1 (f) of GDPR and § 15 Section 1 of TMG.
Tracking software collects pseudonymous usage data to be able to clearly identify the browser. Apart from cookies (see above), no other data are stored on your device. We have compiled further information on the cookies and tracking software we use, the purposes for which we use them and their underlying legal basis in a separate Cookie/Tracking Notice.
Applications: If you decide to apply for a specific position, you will be required to provide certain information such as your contact details and application documents. The fields for these disclosures on the application form within the career portal are marked accordingly as mandatory fields. You may revoke your consent to this at any time with future effect. A text message to email@example.com is sufficient for this purpose. Please note that your application cannot be processed if you revoke your consent. Data submitted in an application is processed on the basis of the applicant’s consent pursuant to Article 6(1) a) GDPR.
Contacting us by email: Email is one of several means by which you can contact us. We collect all the information you provide and keep it only as long as we need it to process your request. After processing is complete, the data could be kept longer for reasons of evidence. We would like to point out that the communication method by e-mail for technical reasons is only possible unencrypted. The legal basis for this is Article 6(1) a) and f) GDPR.
Web chat: If you use our Online Chat support, we process only the data you have directly provided. The provision of name and address is voluntary. We save this data only for the duration of the chat session. The legal basis for this is Article 6, Section 1 (a) and (f) of GDPR.
Statistical analyses: If necessary, we may evaluate your personal information in order to evaluate your preferences, for the purposes of interest-based marketing, an individualized approach, and the continuous optimization of our business processes. We do this in order to gain a better understanding of what our customers expect from us and to be able to provide you with personalized communications. In addition, these evaluations help us detect fraud, audit our records, and ensure security; we therefore perform this type of processing to safeguard our legitimate interests. The legal basis for this is Article 6, Section 1 (f) of GDPR.
Other legitimate interests: To the extent necessary, we process your data beyond the above purposes for the protection of our legitimate interests or the interests of third parties; this is done on the basis of Article 6, Section 1 (f) of GDPR. Our legitimate interests include:
- the assertion of legal claims and the defence of legal disputes;
- the prevention and investigation of criminal offences; and
- the management and further development of our business activities, including risk management.
IV. Am I required to provide data?
The information that is required before an application can be submitted is marked as mandatory information in the appropriate area of the web page (an on-line form). We are unable to enable your use of the feature in question unless the mandatory information is provided.
In addition, if we collect personal information from you, we will tell you at the time we collect it whether the provision of that information is required by law or is required to execute a contract. In doing so, we generally identify any information that is provided on a voluntary basis and not according to any of the above obligations or not required to execute a contract.
V. Who will obtain my data?
If you do nothing more than register with the career portal, the data you provide will only be stored for your registration. If you send off an actual application, those data are then processed exclusively for the purpose of processing that application. Your personal data will only be seen by persons at Eurowings Digital GmbH who are involved in the actual application process; these persons are bound to confidentiality and observance of data protection law.
If outside service providers are involved, they will only see your data on the basis of a contract processing agreement within the meaning of Article 28 GDPR. At this time, the only outside service provider is our technology partner d.vinci HR-Systems GmbH.
Finally, personal data may be disclosed to third parties if provisions of law and/or orders issued by a court or public authority obligate us to do so.
VI. Is an automatic decision-making process used?
In general we do not use any automated decision making (including profiling) in connection with users of our website, as per Article 22 of GDPR. If we use such procedures in individual cases, we will inform you separately about this to the legally required extent.
VII. Will data be transmitted to countries outside of the EU/EEA?
In principle, the processing of your personal data takes place within the EU or the European Economic Area.
VIII. How long will my data be saved?
In principle, we store your personal data as long as we have a legitimate interest in its storage, and we do not consider our importance to outweigh your interests in the non-continuation of the storage.
Even without a legitimate interest, we can continue to store the data if we are legally obligated to do so (for example, to fulfil record-keeping obligations). We also delete your personal data without your involvement as soon as its retention is no longer necessary to fulfil the purpose for which it was processed, or in cases where storing your data is otherwise legally inadmissible.
- deletes the log data within thirty days, unless further storage is required for lawful purposes such as the detection of misuse and the detection and removal of technical malfunctions;
- the data that are processed in connection with the recruiting process remain with us until you request that we delete them, you revoke your consent to their storage, or the purpose for which the data have been stored no longer applies. Mandatory provisions of law, particularly those concerning retention periods, remain unaffected.
- Any personal data we need to keep in order to fulfil our retention obligations will be kept until the end of the respective retention obligation. Any personal data kept solely for the purpose of fulfilling retention requirements are generally blocked so that they can only be accessed if necessary with respect to the purpose of the retention obligation.
IX. What rights do I have?
Right to object according to Art. 21 GDPR
You have the right to raise an objection at any time, for reasons arising from your particular situation, to the processing of personal data relating to you that is undertaken on the basis of Article 6(1) e) or f) GDPR (firstname.lastname@example.org); this applies also to any profiling that is based on those provisions. In the event of your objection, we will no longer process the personal data concerning you, unless we can demonstrate compelling legitimate grounds for processing that outweigh your interests, rights, and freedoms, or if the processing is for the purpose of asserting, exercising, or defending legal claims. If we process the personal data relating to you for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such advertising; this also applies to profiling insofar as it is associated with such direct mail. If you object to the processing for purposes of direct marketing, the personal data related to you will no longer be processed for these purposes. Regardless of Directive 2002/58/EG, you have the option, in the context of the use of information society services, of exercising your right to object through automated procedures that use technical specifications.
Other rights As a data subject, you have the right
- to information about what personal data has been collected and saved, according to Article 15 of GDPR;
- to correction of incorrect or incomplete data, according to Article 16 of GDPR;
- to the deletion of personal data, according to Article 17 of GDPR;
- to the restriction of processing, according to Article 18 of GDPR, and
- to data portability, according to Article 20 of GDPR