Introduction to data processing
We collect personal data within the framework of our website and the services we offer. This processing takes place exclusively in accordance with the provisions of the General Data Protection Regulation (GDPR). Below, we explain in detail what data we collect, for what purposes it is processed, and on what legal basis this is done.
1. Processing of access data, log files and cookies
When you visit this website, our web server automatically stores data and information from your device and browser. This includes information about the browser type and version, operating system, internet access provider, IP address, date and time of access, as well as the website from which you visit ours and the pages visited on our website. This technical information is processed in log files and not combined with other personal data about you.
We process this data to enable you to access our website, to ensure its functionality, and to guarantee the security of our IT systems. In particular, the processing serves to detect, analyse and defend against cyber-attacks, attempts at fraud and other security-relevant incidents, as well as to ensure the integrity, confidentiality and availability of our IT systems. In addition, it is undertaken to identify and prevent misuse of our website. The legal basis for this processing is Article 6(1)(f) GDPR, based on our legitimate interest in ensuring technical functionality, security and defence against cyber-attacks.
We also use cookies and tracking software on our website. You can find information about the cookies we use, their purpose and the respective legal bases in our separate Cookie/Tracking Information. The processing is undertaken either on the basis of our legitimate interest pursuant to Article 6(1)(f) GDPR or – if necessary – on the basis of your consent pursuant to Article 6(1)(a) GDPR.
2. Booking and passenger travel information
As part of your flight booking, we collect all the personal data necessary for processing the booking and carrying out your journey. These may be basic data such as your first and last name, your contact details (e.g. email address, telephone number), and information about the payment method. Depending on the requirements of the respective booking and flight operation, further data may also be required, such as passport or visa information, health data (e.g., for special needs or medical requirements) or information on special requests (e.g., seat selection, special diets). All required information is clearly marked on our website.
The processing of this data is undertaken to fulfil our contractual obligations pursuant to Article 6(1)(b) GDPR and includes in particular:
Issuance of flight documents: we provide you with all the necessary flight documents, such as tickets and boarding passes.
Check-in process: we enable and manage online and on-site check-in and issue you with your boarding pass.
Services: this includes, but is not limited to, baggage service, special baggage transportation, VIP services, lounge access and specific travel information.
Flight notifications and updates: we will inform you about flight status, changes, delays and other relevant information about your trip.
Lounge management: we offer and manage access to lounges for eligible passengers.
Special request management and assistance services: we process data necessary for the fulfilment of special requests such as meals (kosher, halal, vegetarian), preferred seats or assistance services.
Security and passenger controls: we collect data required to carry out security checks, e.g., for pre-flight identity checks.
Collection and transmission of contact details: in accordance with legal regulations, we may transfer your data to authorities or for security requirements in order to fulfil the contract of carriage.
Payment processing: your payment information will be processed in order to process the payment of tickets and additional services (e.g., seat reservations, additional baggage).
This data processing is required in order to fulfil the flight contract and to provide the services that you use in connection with your journey.
3. Passenger rights, accidents and loss of baggage
We process your personal data to safeguard your passenger rights in the event of flight delays, flight cancellations, overbookings, accidents or problems with your baggage. This processing is undertaken to fulfil our legal obligations, in particular within the framework of the European Union passenger rights regulations. The legal basis for this processing is Article 6(1)(c) GDPR, which stipulates the fulfilment of legal obligations. Data processing includes in particular:
Collection of booking data: to grant passenger rights in the event of flight delays, cancellations or denied boarding due to overbookings or aircraft changes in accordance with EU Regulation 261/2004.
Collection of health data: to safeguard the rights of passengers with disabilities or reduced mobility in accordance with EU Regulation 1107/2006.
Collection of baggage data: in the event of loss, damage or delayed arrival of baggage, as well as in the event of accidents, in accordance with EU Regulation 889/2002, which supplements Council Regulation (EC) No. 2027/97.
Collection of data on the transport of animals: to meet the requirements of EU Regulation 1/2005 regarding the transport of animals.
This data processing is required to safeguard your rights as a passenger in accordance with the applicable EU regulations and to protect your claims in the event of such incidents.
4. Transfer of data to authorities
As an airline, we are obliged to communicate certain passenger data in connection with entry, exit or transit, in accordance with legal requirements in various destination, departure and transit countries. This applies in particular to API data (Advance Passenger Information) and PNR data (Passenger Name Record). This data mainly includes information about the identity and travel documents (e.g., passport or visa data) of passengers and crew members. This data is collected regularly as part of the check-in or boarding process, in particular by reading the machine-readable area of travel documents. This data is communicated to the competent public bodies of the respective destination, departure or transit country, insofar as this is required by national or international law. The processing serves in particular the purposes of border control, aviation security, and the prevention and prosecution of criminal offences, including combating terrorism and serious crime. For flights to and from France, in accordance with Article L.232-7 of the French Code de la sécurité intérieure, we are required to transfer reservation, check-in and boarding data (PNR/API) collected as part of your booking and journey to the competent French authorities. The communication shall be made in accordance with the relevant French legal provisions (in particular Décret n° 2014-1095 and Décret n° 2018-714) for the purposes specified therein. The processing and transmission of the aforementioned data takes place in each case to fulfil our legal obligations pursuant to Art. 6(1)(c) GDPR. We only communicate personal data to the respective competent authorities insofar as, and for as long as, there is a corresponding legal obligation.
5. Ensuring flight safety
To ensure flight safety, we process personal data, particularly in the event of breaches of our Terms and Conditions of Carriage or safety-related regulations. This includes, among other things, keeping watch or no-fly lists in order to identify potential security risks and ensure the safety of our passengers and the proper operation of flight operations. The processed data includes, among other things, name, booking details, flight routes, seat information and flight behaviour.
The legal basis for this processing is our legitimate interest in accordance with Article 6(1)(f) GDPR. This processing serves to ensure flight safety, prevent hazards, and maintain compliance with regulations that are necessary for safe operation. If necessary, this data may be communicated to other airlines.
The data will be stored for as long as is required to comply with the safety precautions and maintain flight operations. Data subjects have the right to obtain information about the processed data and, under certain conditions, to request its correction or deletion, unless this conflicts with flight safety and legal requirements.
6. Registration and accounts
On our website, we offer you the opportunity to create a myEurowings account or an EW4Business account to benefit from personalised features and easier management of your bookings.
myEurowings account
For registration, we collect your first and last name, mobile phone number, email address and a password. After registration, you can add further information to your account, such as payment details or preferences for future flight bookings. This data enables us to provide you with a personalised experience and efficiently manage your future bookings. Your data will be processed to fulfil the contract in accordance with Article 6(1)(b) GDPR.
EW4Business account
To register an EW4Business account, we also collect your first and last name, mobile number, and email address. Once you register, you will be able to add more details and view information on bookings made through this company account. Access to the EW4Business account also requires the entry of identification data.
For registration, we also collect your first and last name, mobile phone number, and email address. After registration, you can add further details and view information about bookings made using your company account. Your personal data will also be processed for the fulfilment of the contract in accordance with Article 6(1)(b) GDPR and for communication and the fulfilment of legal obligations.
The processing of both account types is carried out exclusively for the stated purposes. Without this personal data, we cannot provide the respective accounts.
Travel ID account
We also offer you the option of logging in with your existing Travel ID account. To do this, we process your e-mail address and your password for authentication and to manage your bookings. This processing is undertaken to perform the user agreement for the Travel ID in accordance with Article 6(1)(b) GDPR. You can find further information – including on group distribution and personalisation – in the Privacy Policy for Travel ID.
7. Contact, telephone calls and chatbot
There are several ways you can contact us, including via our contact form, e-mail, social media, and the form for checking a claim for compensation under Article 7 of EU Regulation 261/04. We will only collect the data you provide to the extent required to process your request. In certain cases, the data may be stored for longer for evidential purposes after processing has been completed. Your data will be processed on the basis of the performance of a contract pursuant to Article 6(1)(b) GDPR or to safeguard legitimate interests pursuant to Article 6(1)(f) GDPR.
If you call us, we process your data to handle your request. We only record telephone conversations with your express consent for training and quality purposes. The legal basis for this data processing is either your consent pursuant to Article 6(1)(a) GDPR or to fulfil your request pursuant to Article 6(1)(b) GDPR. Your data is usually processed by our customer service provider, with whom we have concluded a data processing agreement. You are not obliged to give your consent to the recording. However, if you do not provide us with the data required to process your request, we may not be able to process your enquiry by telephone.
When you use our AI-based chatbot, we process the data you enter (prompts) and technical information about your browser (browser fingerprint) to prepare the chatbot and handle your requests. Processing is usually undertaken by a service provider with whom we have concluded a data processing agreement. The legal basis for this processing is your consent pursuant to Article 6(1)(a) GDPR. In addition, processing to improve our service is undertaken on the basis of our legitimate interest in accordance with Article 6(1)(f) GDPR.
8. Creditworthiness check and fraud prevention
We process your personal data to check your creditworthiness and prevent fraud, such as credit card misuse, identity fraud or obtaining special terms by deception. For this purpose, the payment and reservation data provided by you or by third parties is compared with corresponding rule sets and block lists.
The legal basis for this processing is Article 6(1)(f) GDPR, since we have a legitimate interest in protecting ourselves from financial damage and preventing unlawful activities.
In order to ensure correct payment processing and fraud prevention, your data will also be checked against national and international sanctions lists. This is to ensure that no unauthorised persons use our services.
This processing may result in automated decision-making, which may result in the purchase process not being completed. In such cases, you have the right to object to the processing (Article 21 GDPR). If you exercise this right, your information will be reviewed, and a decision will be made as to whether the process will continue.
Your data will be processed for as long as it is required to safeguard the legitimate interests mentioned above. Your data will be deleted after completion of the check or after completion of the purchase process, unless there are other statutory retention obligations.
9. Processing within the framework of data subject rights
As part of exercising your rights as a data subject in accordance with Chapter 3 of the General Data Protection Regulation (GDPR), we process your personal data as far as this is required. This includes, in particular, the data that you provide to us or that we request from you, such as your name, email address, address or a copy of your ID. We collect this data exclusively to verify your identity and to enable you to exercise the rights specified in the GDPR, such as the right to access, rectification or erasure of your data. If you do not provide us with this information, we may not be able to process your request.
The legal basis for the processing of your data is Article 6(1)(c) and Article 6(1)(e) GDPR, since we are required to fulfil legal obligations in connection with the processing of data subject rights. The retention period for the data collected in connection with data subject rights is three years, so that any legal claims and deadlines may be properly taken into account.
10. Processing of data for marketing purposes and personalised communication
Social media: Eurowings processes image and video recordings for reuse for marketing purposes on various social media channels such as Instagram, Facebook, Twitter, LinkedIn and TikTok. We search public channels for appropriate content and request permission to use it using the public comment function. As soon as the user’s consent is provided, we use the content for reposting on our own social media channels. The legal basis for processing your data is Art. 6(1)(a) GDPR.
Personalised customer communication: we process information about your previous bookings and preferences stored in your profile to create target groups, so-called "Custom Audiences". This allows us to personalise our customer communication and the booking process. This way we can show you relevant offers, options and default settings to make the booking process more efficient and convenient. The legal basis for this is your consent in accordance with Article 6(1)(a) GDPR.
Profiling for personalised customer communications: we process data from various Eurowings systems to personalise our customer communications. This includes, in particular, information from your myEurowings account, previous booking data, travel and preference information, web and app usage data collected through cookies or similar technologies, information about your consent preferences, as well as your interactions with our emails and campaigns through tracking pixels—provided that you have given your additional consent—and responses to customer satisfaction surveys. Based on this information, we create customer segments so that we can show or send you content, offers, options and communications that are more relevant to you. We process your data only within the scope of your consent and in accordance with your current consent preferences. There is no automated decision-making within the meaning of Article 22 GDPR, as personalised customer communications do not produce legal effects concerning you and do not significantly affect you in any similar way. This data is deleted after two years. The legal basis is your consent in accordance with Article 6(1)(a) GDPR.
Flight recommendations: when you are logged into your myEurowings account, we process your information about previous bookings to display suitable flight recommendations on the dashboard. This makes it easier for you to choose connections that you have used in the past or that are similar. The legal basis for this is your consent in accordance with Article 6(1)(a) GDPR.
Newsletter: if you have subscribed to our newsletter, we process your email address and, if applicable, information stored in your myEurowings account in order to send you personalised offers and information about our services as well as about partner companies from the travel and mobility sectors. We analyse the data on the delivery, opening and click rates of our emails in order to assess the success and use of the newsletter. We also assess your interactions with our emails to further personalise them. The legal basis for this is your consent in accordance with Article 6(1)(a) GDPR. You can withdraw your consent with future effect at any time.
Direct marketing to existing customers: we use your email address to send you advertising and flight-related offers by email, such as reminders about check-in, additional services for your flight, or surveys. This processing only takes place if you have provided your email address in connection with the purchase of a product or service and you have not objected. The legal basis for this is our legitimate interest in accordance with Article 6(1)(f) GDPR and Section 7(3) UWG (Gesetz gegen den unlauteren Wettbewerb [Unfair Competition Act]).
Meta lead ads: we use the “lead ads” function of Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland (“Facebook”), to collect and process certain personal data of interested parties – so-called leads – via a contact form displayed on Facebook websites (so-called “instant form”). The processing of the data (clearly identified in the form) is strictly limited to the purposes pursued with the respective lead ad campaign before the specified data is communicated. This data can also be stored on the servers of Meta Platforms, Inc., 1601 Willow Rd, Menlo Park, CA 94025, USA. When using “lead ads” from Facebook, both Facebook and Eurowings, as advertisers, are jointly responsible for data processing in compliance with Art. 26 GDPR. The legal basis for this is your consent in accordance with Article 6(1)(a) GDPR (for example, for direct advertising measures such as registration for the newsletter mailing list) or our legitimate interest in the optimal marketing of our offer in compliance with Art. 6(1)(f) GDPR. Further information on data processing via Facebook lead ads can be found in the Facebook Privacy Policy.
Displaying personalised advertising: we process your data in order to display advertising personalised for target groups relevant to you. We use “custom audiences” and “lookalike audiences”, which define target groups similar to our existing customers in order to attract new customers. We create these audiences using a hashed version of your email address to protect your privacy. This data (hashed email addresses, interests, purchase history and usage behaviour) is transmitted to platforms such as Meta Ads Server, Google Ads, DV360 and Microsoft Advertising in order to deliver advertising specifically within their networks. If the email address can be matched with an existing profile on these platforms, the target group is matched, and the corresponding advertising is then displayed in a targeted manner. The legal basis for this is your consent in accordance with Article 6(1)(a) GDPR. The data used for determining the target group is processed for 31 days and deleted after 2 years. There is no automated decision-making within the meaning of Article 22 GDPR, as the advertising displayed has no legal effect and similarly you are not significantly affected. For more information on data processing and privacy policies, please refer to the Meta Privacy Policy, the Google Privacy Policy and the Microsoft Privacy Policy.
Statistical evaluations: we carry out statistical evaluations in order to continuously improve our marketing measures and communication with our customers. We analyse aggregated data on the use of our offers in order to provide you with even more relevant content and personalised advertising. This data helps us to optimise our services and develop customised campaigns. The legal basis for this is our legitimate interest in compliance with Article 6(1)(f) GDPR.
Special occasions: if you voluntarily (optionally) enter your date of birth in your myEurowings account, we process this information exclusively in order to provide you with personalised messages on special occasions (such as birthday greetings or anniversary offers). The processing is based on your consent in accordance with Article 6(1)(a) GDPR (by means of double opt-in). You can withdraw your consent at any time with effect for the future in the settings of your myEurowings account or via the unsubscribe link contained in our communications.
11. Partner offers and frequent flyer programmes
Partner offers: as part of the booking process, we will show you offers for partner services such as car rental, rail transport, hotels and travel insurance. If you accept such an offer, we will communicate the necessary data to the partner company so that you can make use of the corresponding services. The legal basis for this is Article 6(1)(b) GDPR.
Frequent flyer programmes: when you book a flight, you can collect award points/miles from our partners’ frequent flyer programmes. For this purpose, we need your respective programme number (e.g. Miles & More number). In order to process the booking, we also collect the required data, such as surname, first name, booking class, flight route, flight price, booking code, seat number, and ticket number, which we pass on to our partner so that the award points/miles can be credited to you. The legal basis for this processing is Article 6(1)(b) GDPR. Without providing this information, you cannot use the services of the frequent flyer programme. You will find further information about the processing of your personal data as part of the Miles & More programme here.
12. Use of Artificial Intelligence (AI)
We use Artificial Intelligence (AI) technologies in individual processing operations to provide our services as well as to support and optimise our business processes. The use of AI does not in itself constitute data processing in these cases; the AI is used solely as a technical means of fulfilling the processing purposes described in this privacy notice, on the applicable legal basis. In particular, AI-based systems may be used to automatically classify customer concerns and forward them to the relevant departments, to assess damage to travel luggage based on the information and images provided, to analyse or summarise documents and information, to support communication processes, to process enquiries more efficiently and to automate standardised business processes. Depending on the respective use case, the data processed may include, in particular, master data, contact details, booking and travel details, the content of communications, documents, images and other information you provide during the respective process. Insofar as we use external providers for the operation or provision of AI-based systems, we do so solely on the basis of a data processing contract in accordance with Article 28 GDPR or another basis permitted under data protection law. Appropriate technical and organisational measures are taken in selecting, implementing and operating the systems used.
The use of AI is fundamentally intended to support our employees and to carry out our business processes more efficiently. Insofar as AI systems are used in individual cases in preparing for or assisting with decision-making, Eurowings shall fundamentally remain responsible for the respective decision. If, in exceptional cases, a decision is based solely on automated processing and has legal effects or a similarly significant adverse impact within the meaning of Article 22 GDPR, we will inform you of this separately and ensure that the legally stipulated data subject rights are upheld. The use of AI complies with the principles of the GDPR, in particular with the lawfulness, purpose limitation, data minimisation, transparency, accuracy, and integrity and confidentiality of processing. AI systems are only used to the extent required for the respective processing purpose and permitted by data protection law.
13. In-flight entertainment
When you use our in-flight entertainment portal, we process technically required connection data to securely provide you with the requested content and features. For this purpose, strictly necessary information may be stored on your device or read from it. We process this data on the basis of our legitimate interest under Article 6(1)(f) GDPR in providing you with a functional and secure in-flight entertainment service. We carry out any further data processing only with your consent, pursuant to Article 6(1)(a) GDPR.
