Data privacy statement
1. Applicant data protection
Protecting your personal data is very important to us. Therefore, in the following we would like to inform you about our data protection principles. The respective Lufthansa company to which you are applying is committed to upholding these principles, allowing you to apply within a trustworthy process.
Why do we process your data (purpose of data processing) and what is the legal basis for this?
We process personal data in accordance with the provisions of the EU General Data Protection Regulation (GDPR) and the German Data Protection Act (BDSG):
- On the basis of your consent (Art. 6 (1) a GDPR in conjunction with Art. 88 GDPR and section 26 (2) BDSG)
If you have given us your consent to process personal data for specific purposes (e.g. storing application details for an extended period), the processing of this data is lawful on the basis of your consent. Consent can be withdrawn at any time.
On the basis of statutory or other legal provisions (Art. 6 (1) c GDPR and Art. 88 GDPR and section 26 BDSG) or in the public interest (Art. 6 (1) e GDPR)
1.1 Data usage in the application management system
1.1.1 User accounts
To register for our application management system each user has to set up a user account. A user account consists of at least the following information:
- First name
- Last name
- User name
- E-mail address
The storage retention period of a user account is 6 months. After 6 months the acceptance of the data protection regulations must be renewed by the user. If the renewal is made, account storage is prolonged for a further 6 months.
If the user still has an open application in process at the time of expiration, then the storage retention period is automatically prolonged until this application process is completed.
1.1.2 Login via Social Media Networks
This function enables you to register with one of your existing social media network user accounts (LinkedIn, Xing, Google, Facebook). In so doing, the only thing that is verified is whether you have a valid account with the selected social media network, which you can use to login here. The result of this check is then automatically transferred to the application management system. However, be reassured that no further exchange of data takes place between www.Be-Lufthansa.com and your selected social media network.
1.1.3 Application relevant data
Following the completion of the application process, the answers and information you have given during your online application process will be stored along with your name. After this time, your results will be stored in an anonymous way, without your name, for further statistical evaluation purposes. This statistical data record does not allow any type of inference to the actual person and serves solely as a basis for statistical evaluations.
Further recruitment procedures may follow in subsequent application steps.
A negative test result will also be relevant for applications to similar jobs within the LH Group.
In order to continuously improve the application process and to know how you rate the experience of applying to the Lufthansa Group, your email address may be used for online feedback before the selection process is completed.
If you voluntarily make use of the option to pull your master data from one of your social media accounts, we process the account data of your external social media platform. These data are processed for the purpose of importing your profile information into the Lufthansa applicant management system.
The processing of personal data is necessary to achieve the above-mentioned purposes, including the fulfillment of a contractual relationship or a pre-contractual activity.
Unless expressly stated otherwise, the legal basis for data processing is Art. 6 (1) (a) or Art. 6 (1) (b) and (f) of the General Data Protection Regulation (GDPR):
- Your consent;
- the processing is necessary for the performance of a contract to which the data subject is party, or for the execution of pre-contractual measures;
- the processing is necessary to protect the legitimate interests of the person responsible or a third party.
If you provide us with special categories of personal data (for example, racial and ethnic origin, political opinions, religious or ideological beliefs or union membership, health data), we process these based on your express consent.
If the personal data mentioned are not provided or are not provided to the required extent or if Lufthansa cannot collect the data, the individual purposes described cannot be achieved or the application cannot be processed.
If you send us your application data by e-mail, we reserve the right to record it in our applicant management system. This ensures efficient processing of the applications we receive.
1.1.4 Psychological aptitude test
If necessary, a psychological aptitude test will be conducted as part of the application process to determine overall aptitude.
1.1.5 Compliance with laws and regulatory compliance obligations
We use your data to comply with compliance obligations and regulations, as well as for forwarding to supervisory authorities and other authorities to which the companies of the LH Group are subject to.
This may include using it to help detect or prevent crime (including terrorism financing, money laundering and other financial crimes). We’ll only do this on the basis that it’s needed to comply with a legal obligation or it’s in our legitimate interests and that of others.
1.1.6 Applications to a job offer
If you have applied to a job offer your data will be made available to the specialized department which posted the position as well as to the relevant personnel department.
You agree that the personal data you submit may also be compared with other vacancies and passed on for screening within the Lufthansa Group.
1.1.7 Recognition of declined applicants
If your application does not lead to an employment contract, a recognition data record will be stored. We need this data record in order to recognize you if you apply to the same position anew. All of your specialized qualifications will be deleted from this data record. The recognition data record only includes the following information:
- Last name
- First name
- E-mail address
- Job ID
- Date of rejection letter
A recognition data record is permanently deleted after 365 days.
1.1.8 Simultaneous application for jobs in different companies within the Lufthansa Group
In the event that an applicant applies to multiple job positions with different companies in the Lufthansa Group, those personnel departments which were directly applied to will be made aware of all simultaneous applications. This is done to ensure efficient handling of applications. Application data will not be shared.
This does not have any effect on the actual application process.
1.1.9 Transfer of personal data to third parties
- To the application provider as the entity responsible for the technical operation of the recruiting system
Should technical problems or questions arise in the application process, the provider's support will assist the user in solving the problems. - To external psychologists as responsible controllers of the psychological aptitude test
If a psychological aptitude test is required as part of your application to determine your interdisciplinary aptitude, your data may be forwarded to external psychologists as responsible controllers. - To the "CV parsing" service provider
If you voluntarily take advantage of the option to have your application documents analyzed so that your master data is automatically transferred to the fields of the application form (CV parsing), your data will be commissioned by the Lufthansa order processor (JoinVision E-Services GmbH) to process your personal data. This order processor is contractually obligated to comply with the provisions of data protection law.
1.2 Particularities for special applicant groups
1.2.1 Particularities for Flight Attendant applications
Within the framework of their application process, applicants applying for Flight Attendant positions must state specifics regarding their height, diopter left eye and diopter right eye. This data is collected at a later time by the Deutsche Lufthansa AG’s Medical Service during the medical examination. In order to check whether you fulfill the entry requirements, we collect this data early on in the application phase. At this stage the individual data isn’t stored but rather only a qualifying value is stored in encrypted form in the application management system. This qualifying value is then only made available to the personnel department responsible for Flight Attendant selection within the respective company of the Lufthansa Group to which you have applied. If your application is successful and you receive a Flight Attendant contract, a flight fitness medical examination is required according to EU regulation 1178/2011, which sets the regulations for flight fitness criteria for flying personnel. Furthermore, a pre-employment examination according to the employer’s provisions will take place along with additional occupational medical precaution examinations in accordance with occupational medical precaution provisions (ArbMedVV). Only the result of this flight fitness examination (solely the information regarding the result of "fit to fly" yes, no or with limitations) is passed on to the responsible personnel department and then stored in the application management system until the application process has been completed. In the case of employment as a Flight Attendant, the pre-employment examination and EASA Medical data is stored along with the occupational medical precaution examination data in the medical EDP system of the Deutsche Lufthansa AG Medical Service. According to legal requirements, the data must be stored for at least 10 years. In some special cases, it may even be stored for 30 years. You have the right to request information regarding any of your stored personal data along with the right to correction or deletion or even to the limitation of or objection to the processing of your personal data. However if you decide to exercise your right to deletion or limitation of or objection to the processing itself, then we can no longer proceed with your application process. Since the data given is required within the framework of your application until the completion of the application process, should you demand the deletion or limitation of or objection to the processing, you will also be automatically retracting your application.
1.2.2 Particularities for Pilot Training applications
Within the context of applications for pilot training positions, personal data is passed on to third parties within or outside the Lufthansa Group such as:
- Deutsche Lufthansa AG
- SWISS
- Interpersonal GmbH
- Deutsches Zentrum für Luft- und Raumfahrt e.V.
-Austrian Airlines
Lufthansa Aviation Training GmbH has engaged Deutsche Lufthansa AG to process online applications and administer the screenings/aptitude tests for the European Flight Academy’s ab initio courses. In this context, personal data may be transferred to third countries or international organizations. For your protection and the protection of your personal data, such data transfers are subject to appropriate safeguards pursuant to and in accordance with the applicable legal requirements (in particular application of EU standard contractual clauses) or an adequacy decision adopted by the EU Commission (article 45 of the GDPR). Information about EU standard contractual clauses can be found here. The EU Commission provides information on its adequacy decisions here. If you submit an application yet are not accepted onto a course, we save a recognition record with your personal data. We need this record in order to recognize you if you apply again. This recognition record contains the following information: Your last name, first name, date of birth, and history of your participation in screenings/aptitude tests. When your data is transferred to the applicant management system, it is automatically encrypted by LAT. In this context, the data security measures we implement always correspond to the current state of the art.
1.2.3 Particularities for Pilot applications for Swiss/Edelweiss
The applicant hereby authorizes the executives in charge of staff selection for both companies to inspect the assessment results of previous and current aptitude tests for employment as a pilot with the responsible department of Swiss International Air Lines Ltd.
1.2.4 Particularities for trainee applications
The Lufthansa Group uses the Wepow platform to conduct an online-based, asynchronous video interview as part of trainee recruitment. As a first step, an applicant will be given access to the Wepow platform via a personalized link. Applicants will receive questions from a DLH staff member in a video, which they can then answer in a video via the Wepow platform. The video responses are evaluated by Lufthansa Group employees according to a fixed evaluation catalog and the results are sent directly to the recruiters.
As part of the process, the following personal information is processed:
- Video responses of the applicants
- IP address
- A session cookie
The data are collected to distinguish the participants from one another and to attribute statements to a participant. These data are not visible to third parties. Participation in the online-based, asynchronous video interview is not possible without a processing of the data.
The permissible processing of applicant data is based on the legal basis of Art. 6 (1) (b) GDPR within the context of initiation of an employment contract.
The data recorded during recruitment will be used solely for the purpose of assessing and evaluating application questions. The videos are analyzed by Lufthansa Group employees according to a fixed evaluation catalog. These employees have no access to other personal information. The results of the analysis are made available to the recruiters, who assign the results to the applications and decide on the continuation of the recruitment process. After an application is completed or terminated, the videos are no longer needed and are authorized for deletion.
The processing of personal data begins with obtaining an IP address when the website is visited. The data are then used in the preparation, execution and post-processing of the respective asynchronous video interview.
The data recipient is the company Wepow with a cloud in the EU as the operator of the tool for displaying and recording asynchronous video interviews. If applicants contact Wepow for support, the company may have access to the data in order to provide appropriate support.
The data deposited with Wepow is authorized for deletion after a completed or terminated application with the Wepow platform.
Wepow currently uses session cookies, which provide general information about the use of their website. A cookie is a small file that is stored on the hard drive of an applicant’s computer. Cookies contain information that is transferred to the hard drive of the computer. They help Wepow to further improve its website and offer applicants a better and more personalized service.
Applicants are able to change cookie settings depending on the browser they are using. Changing the cookie settings might limit the functionality of the service.
1.2.5 Particularities for Flight Instructor applications
Within the context of applications for flight instructor positions, personal data is passed on to third parties within or outside the Lufthansa Group. These recipients are:
- Deutsche Lufthansa AG
- Interpersonal
- Deutsches Zentrum für Luft- und Raumfahrt e.V.
Lufthansa Aviation Training GmbH has engaged Deutsche Lufthansa AG to process online applications and administer the screenings/aptitude tests for the European Flight Academy’s ab initio courses. In this context, personal data may be transferred to third countries or international organizations. For your protection and the protection of your personal data, such data transfers are subject to appropriate safeguards pursuant to and in accordance with the applicable legal requirements (in particular application of EU standard contractual clauses) or an adequacy decision adopted by the EU Commission (article 45 of the GDPR). Information about EU standard contractual clauses can be found here. The EU Commission provides information on its adequacy decisions here. If you submit an application yet are not accepted onto a course, we save a recognition record with your personal data. We need this record in order to recognize you if you apply again. This recognition record contains the following information: Your last name, first name, date of birth, and history of your participation in screenings/aptitude tests. When your data is transferred to the applicant management system, it is automatically encrypted by LAT. In this context, the data security measures we implement always correspond to the current state of the art.
1.2.6 Particularities for applications via WhatsApp at Lufthansa Technik and Lufthansa Technik Logistik Services
Lufthansa Technik AG and Lufthansa Technik Logistik Services GmbH use the IT service provider PitchYou for handling an application via WhatsApp. If you use this option, the legal base for communication via WhatsApp is your consent (Art. 6 para. 1 lit. a GDPR), which you can revoke at any time. The application via WhatsApp feature is provided by an IT service provider (PitchYou), who as a processor can access your data. More information can be found here: https://www.pitchyou.de/en/data-privacy. Data protection information from WhatsApp, acting here as an independent controller, e.g. about their processings or about exercising your data protection rights against WhatsApp, can be found here: https://www.whatsapp.com/legal/privacy-policy-eea?lang=en.
1.3 TalentHub participation
A user account and a completed talent profile are required in order to participate in TalentHub. The collection and processing of personal data takes place only to ensure network activities such as i.e. to contact Talents, to send vacant job offer suggestions and for event invitations. TalentHub is a Lufthansa Group-wide network. Access to Talent profiles is therefore available across all companies within the LH Group. Data processing outside of the Lufthansa Group does not occur. The Talents must renew their data protection policy consent every six months, if the extension consent is not granted, the data is deleted.
1.4 Recommendation by Lufthansa Group staff members
Depending on the desired position and which company posted it, there may be an option for entering the name of the staff member who recommended the position to you. By entering the name you are also declaring your consent that this person be informed whether your application resulted in a contract or not. The reason here is that a bonus may result for the recommending staff member.
1.5 Placement through recruitment agency
Depending on the desired position and which company posted it, there may be an option for entering the name of the recruitment agency that brought the job offer to your attention. By entering the name you are also declaring your consent that this agency be informed whether your application resulted in a contract or not. Reason for this is that a placement fee may result for the respective recruitment agency.
1.6 Security when dealing with person-related data
Your data is automatically encrypted during its transfer into our application management system. The precautions taken to protect data always correspond to the current status of technology.
1.7 How long is your data stored?
Your personal data will be deleted after one year at the latest according to the legal deadlines in so far as Article 17, para. 3, DSGVO applies to possibly keeping them longer.
1.8 Which data protection rights do you have?
It is an important issue for Deutsche Lufthansa to make our processing procedures fair and transparent. Therefore it is important to us that aside from the right of objection, the concerned person may make use of the following rights, when the individual legal requirements below are met:
- Right to obtain information, Art. 15 DSGVO
- Right of correction, Art. 16 DSGVO
- Right of deletion (“Right to be forgotten”), Art. 17 DSGVO
- Right of processing limitation, Art. 18 DSGVO
- Right of data transmission, Art. 20 DSGVO
- Right of objection, Art. 21 DSGVO
Based on Article 15 of the EU General Data Protection Regulation (GDPR), you have the right to submit a request for information regarding collected and processed personal data.
In order to exercise this right, please email ma-datenauskunft@dlh.de, providing a detailed description of your request for information and the following:
- Last name, first name
- Applicant number
- Email address
- Group company to which you have applied
Please note that information regarding your personal data can only be provided on submission of a valid copy of your ID and that only one company can be queried per request for information.
We will review your request for completeness and correctness and inform you of the following once you have been successfully identified:
- The data concerning you which we have stored (presented in categories, where applicable)
- The purpose of the processing of these data
- The origin of the data
- If the data are transferred, the recipients of these transfers (information regarding appropriate safeguards for transfers to third countries, where applicable)
- Criteria for determining the planned duration of storage/actual duration of storage, where applicable
- Automated decision-making including profiling, if relevant
- Your data protection rights
Please note that we will store your request for information for a period of three years. The Applicant Management department of the recruiting Group company is responsible.
If you should send us a copy of your ID, then we ask you to kindly “black out” all other data except for your first and last name and address.
Please note that in the case of an objection your application process cannot be continued.
In order to process your request as well as for identification purposes, we would like to point out that we will process your personal data in accordance with Art. 6 para. 1 lit. c DSGVO.
Furthermore you have the right to lodge a claim with the supervisory authority according to Article 77 DSGVO in combination with § 19 BDSG. The supervisory authority responsible for Deutsche Lufthansa AG is:
Der Hessische Beauftragte für Datenschutz und Informationssicherheit
Postfach 3163
65021 Wiesbaden
Gustav-Stresemann-Ring 1
65189 Wiesbaden
poststelle(at)datenschutz.hessen.de
Enforcing and complying with data protection statements
Deutsche Lufthansa AG commits itself to complying with the data protection points stated above.
For questions or suggestions regarding data protection in our application management system, please contact:
Deutsche Lufthansa AG
Konzerndatenschutz FRA CJ/C
Lufthansa Aviation Center LAC
Airportring
60546 Frankfurt am Main
Germany
datenschutz(at)dlh.de