Stat Sync In cooperation with Miles & More

Privacy Notice of Stat Sync

In this data protection notice, Lufthansa Innovation Hub GmbH, Brunnenstraße 19–21, 10119 Berlin, Germany, e-mail: datenschutz@lh-innovationhub.com (“we”, “us”) would like to inform you about how we process personal data about you when you use Stat Sync. We process data in line with the EU General Data Protection Regulation (GDPR) and applicable national laws.

1. What Personal Data Do We Collect From You?

  • Status Match data: if you submit a status match application, we process the data you enter (name, email address, country of residence, loyalty programme, membership number, status tier) and any documents you submit for verification (e.g. status certificates, screenshots, boarding passes, Apple Wallet passes). Depending on the verification method selected, we additionally process the following: (i) Screen sharing: during a user-initiated screen-sharing session, we access the information displayed on your screen for the purpose of verifying your status. Screenshots may be temporarily captured and stored to facilitate the verification process and are deleted thereafter; (ii) Apple Wallet status card: we process and analyze the data contained in the Apple Wallet status-card file to verify the authenticity and validity of your status. The relevant data extracted from the file is processed for verification purposes and deleted thereafter; (iii) Document upload: you may upload verification documents (e.g. status certificates, screenshots, boarding passes), which are stored temporarily for verification purposes and deleted thereafter.
  • Marketing data: if you opt in to receive offers and campaigns, we process your contact details and status information for this purpose
  • Inquiry data: if you contact our support, we process the information you provide to respond to you
  • Server log data: when you use Stat Sync, technical data (IP address, browser type and version, device and operating system, date and time of access) is temporarily stored on our servers

2. For What Purposes, on What Legal Basis, and for How Long Do We Process Your Personal Data?

2.1 Your Status Match Application

If you submit a status match application, we process your loyalty programme data to verify and match your status. We generally use automated processes to verify and match your loyalty programme status. Where the automated process does not provide a sufficiently reliable result, we will conduct a manual review of your application to complete the verification.

For the purposes of this section, “application data” refers to the personal data you provide when submitting your application (name, email address, loyalty programme, membership number, status tier). “Verification documents” refers to any documents you upload to support verification (e.g. status certificates, screenshots, boarding passes).

The legal basis for this processing is your consent, Art. 6(1)(b) GDPR, as the processing is necessary for the performance of the status match service you have applied for. We ask for this consent specifically for the matching itself, separate from any other purpose.

Following successful verification, we share your application data with the partner you selected for the purpose of processing the status match. The application data shared with the selected partner includes your name, email address, loyalty programme, membership number and status tier. Any subsequent processing of your application data by the selected partner is subject to the partner's Privacy Notice.

Your application data is retained for 12 months after your application has been processed, or until any dispute has been resolved. Documents you submit for verification are deleted within 30 days of verification, unless retention is required for legal defence. Where you have separately consented to receive marketing communications (see Section 2.2), we continue to store the relevant contact and status data for that purpose until you withdraw that consent.

We may use verification service providers (e.g. document or identity checks) to support this process; these are engaged as processors under Art. 28 GDPR.

2.2 Storing Your Data for Future Offers

If you would like to receive relevant campaigns and offers from Lufthansa Innovation Hub GmbH in the future, Lufthansa Innovation Hub GmbH stores your contact details and status data for this purpose.

The legal basis for this is your separate consent, Art. 6(1)(a) GDPR.

You can revoke your consent to the use of your personal data for advertising and the contact made for this purpose at any time. Please use the corresponding functions provided for you (e.g. the unsubscribe function in the newsletter) or send a corresponding message by e-mail to datenschutz@lh-innovationhub.com.

This data will be deleted after you withdraw your consent or otherwise at the latest after the end of use by us or only in aggregated, anonymized form.

We use the processors ActiveCampaign LLC (“Postmark”) to send our emails communication and newsletter. Postmark is certified in accordance with the EU-US Privacy Framework.

2.3 Your Inquiries

If you send us inquiries by email or via the contact form, we will process the information you provide in order to respond to your inquiry.

The legal basis for the processing is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR to answer your inquiry. If your request is aimed at the initiation or execution of a contract, the additional legal basis for the processing is Art. 6 (1) lit. b GDPR.

You can object to the processing of your data on the basis of Art. 6 (1) lit. f GDPR. We can then continue the processing if we can prove compelling reasons for the processing. In this case, this may be necessary in particular to be able to prove past communication and inquiries with you. If there are no such compelling reasons, we will stop communicating with you and delete data that has already been collected.

This data will be deleted when our communication with you has ended, i.e. when the matter in question has been conclusively clarified and there are no further legitimate interests in storing it or there are no further legal obligations to store it.

2.4 Provision of the Website and Services

Processing server log data is necessary for technical reasons, to operate Stat Sync and ensure system security. The legal basis is our legitimate interest, Art. 6(1)(f) GDPR. Processing server log data is technically necessary to operate Stat Sync and ensure system security. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. An objection to this processing under Art. 21(1) GDPR does not automatically result in its cessation where we can demonstrate compelling legitimate grounds, in particular the technical necessity of the processing.

This data is deleted after 30 days at the latest.

In addition, we use the anonymized or aggregated data obtained with the help of analysis tools (in particular cookies) to track the surfing behavior of all visitors and thus improve the design of our website and our content in general.

The following web service providers are used to host and deliver this website:

  • Render Services Inc. (“Render”) (USA)
  • OpenRouter Inc. (“Open Router”) (USA)
  • Hetzner Online GmbH (“Hetzner”) (Germany)

Additionally, this website uses Google Analytics 4, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, may process data as a sub-processor.

Google Analytics uses cookies and similar technologies to collect information about how visitors use this website (for example, pages viewed, referring website, approximate location derived from the IP address, device and browser data, and online identifiers such as cookie or client IDs). We use this information to understand website usage and to improve the design and content of the site.

The legal basis is your consent under Art. 6(1)(a) GDPR. Google Analytics is loaded only after you accept analytics cookies in our cookie banner. You may withdraw consent at any time with future effect via the cookie settings. You can also install the Google Analytics opt-out browser add-on.

IP addresses are anonymised before storage; no full IP address is retained by Google.

Google may process data in the United States. Where required, transfers are based on the EU–U.S. Data Privacy Framework and/or Standard Contractual Clauses. Further information: Google's privacy policy and How Google uses information from sites or apps that use our services.

Insofar as personal data is transmitted to third countries, appropriate safeguards are provided for the protection of your personal data in accordance with the statutory regulations (in particular the EU adequacy decision and the use of EU standard contractual clauses; you can find information about EU standard contractual clauses on the websites of the European Union).

3. Security

We and our service providers take technical and organizational security precautions to protect the personal data we manage against accidental or intentional manipulation, loss, destruction or access by unauthorized persons. Our data processing and security measures are continuously improved in line with technological developments.

When your personal data is transmitted to us, it is encrypted using Secure Socket Layer (SSL). Personal data that is exchanged between you and us is always transmitted via encrypted connections that correspond to the current state of the art.

Our employees and our contracted service providers are of course obliged to maintain confidentiality.

4. Our Data Protection Officer

Our data protection officer can be reached as follows:

Deutsche Lufthansa AG, Group Data Protection Officer, FRA CJ/D, Lufthansa Aviation Center, 60546 Frankfurt am Main, Germany. E-Mail: datenschutz@dlh.de

5. Your Rights

Every natural person whose personal data we process has the following rights vis-à-vis us (i.e. depending on the respective requirements):

  • If you have any questions about the processing of your personal data by us, we will be happy to provide you with information about the personal data stored about you free of charge at any time (Art. 15 GDPR).
  • You have the right to have incorrect data corrected and incomplete data completed (Art. 16 GDPR).
  • You have the right to block/restrict the processing or erasure of your personal data that is no longer required or stored due to legal obligations (Art. 17, 18 GDPR)
  • You have the right to receive the data in a structured, commonly used and machine-readable format if you have provided us with the data on the basis of consent or a contract between us and you (Art. 20 GDPR).
  • You have the right to object at any time to the processing of your data for direct marketing purposes (Art. 21 (2) and (3) GDPR).
  • You have the right to object to processing on the basis of a legitimate interest, whereby we can then demonstrate our compelling reasons (Art. 21 para. 1 GDPR). We have indicated above (see section 2) if this right exists.
  • If you have given your consent to data processing, you can revoke this at any time with effect for the future, i.e. the legality of the data processing up to the time of revocation remains unaffected. Once you have withdrawn your consent, you may no longer be able to use our services.

Please address your concerns to datenschutz@lh-innovationhub.com or to the contact address stated in section 4. We reserve the right to verify your identity so that your personal data does not become known to unauthorized persons.

You also have the right to lodge a complaint with a data protection supervisory authority.

6. Changes

From time to time it is necessary to adapt the content of this data protection notice. We therefore reserve the right to amend it at any time. We will also publish the amended version of the data protection information here. If you visit us again, you should therefore read the data protection information again.