Deutsche Version siehe unten/German version below
Data Protection Information for Visitors to Lufthansa Technik AG
In accordance with the EU’s GDPR, we hereby comply with our notification obligation pursuant to Art. 13 (1)(a)-(e) and (2)(a)-(e).
Name and address of the responsible entity
Lufthansa Technik AG
Weg beim Jäger 193
Telephone: +49 40 5070 8888
Data Protection Officer of Lufthansa Technik AG
Purpose of data collection, processing or use
We collect personal data directly from our visitors or from other sources (as indicated below) and use these personal data in the following situations:
Storage of a visitor data record or a visit event
When visitors visit the Lufthansa Technik site, the following data are collected in our visitor management system exclusively for the handling of one or more visits:
- Last name and first name of the visitor (master data record)
- Date of birth of the visitor (master data record)
- Company of the visitor (including the country in which this company is based) (master data record)
- Where applicable, motor vehicle registration (if a motor vehicle is required for entry) (master data record)
- Period of each visit (visit data record)
- Person visited during each visit (visit data record)
The basis in law for temporary storage of these data is Art. 6 (1)(c)(f) GDPR.
In addition, security requirements apply pursuant to § 7 of the German Aviation Security Act (Luftsicherheitsgesetz, LuftSiG) and § 8 of the German Regulation on Reliability screening for Aviation Security (Luftsicherheits-Zuverlässigkeitsüberprüfungsverordnung, LuftSiZÜV).
Checking of visitor data against international sanctions lists
Under export control law, visitors to Lufthansa Technik AG (both natural persons and legal entities) are required to undergo sanctions list screening at the latest prior to their access to the site. This is due to the statutory obligation incumbent upon the responsible entity to ensure compliance with the requirements of foreign trade legislation and regulations, including Art. 2 (1)(B) of Regulation (EC) No 2580/2001, Art. 2 (2) of Regulation (EC) No 881/2002 and Art. 3 (2) of Regulation (EU) No 753/2011. Within the scope of this screening, the person and/or company (firm) in question will be checked against the current sanctions lists of the Federal Republic of Germany, the European Union and the USA. In case of a verified match, the person and/or the company must be denied access to the site. The results of this check will be stored in the system for 5 years. Moreover, a sanctions list check will be implemented before any further visit.
Your personal data will be deleted as soon as they are no longer required for the purposes mentioned. The following data is stored for a period of 5 years after the data has been collected: last name and first name of the visitor; date of birth of the visitor; Company of the visitor (including the country of the company); visit period per visit. The reason is the obligation to provide evidence of compliance with export control regulations. 5 years after the last visit, all of the visitor's personal data will be automatically deleted. License plates (if available) and visited persons are already deleted one year after the last visit. If a registered first visit is not made, all data stored for this will be deleted in the night of the following day.
Right of objection under Art. 21 GDPR
You are entitled to object to processing of your personal data pursuant to Art. 6 (1)(f) GDPR at any time on grounds relating to your particular situation.
In this case, the responsible entity will no longer process your personal data unless obliged to do so under statutory requirements.
To enable a uniform visitor management system for the Lufthansa Technik Group, we will make your master data accessible to third parties (other Lufthansa Technik sites connected to our visitor management system) within the Lufthansa Technik Group.
Rights of the affected person
Lufthansa Technik emphasizes the fairness and transparency of its approach to data processing. It is therefore important to us that affected persons are able to exercise the following rights (in addition to their right of objection, subject to fulfillment of the relevant statutory requirement):
- Right to receive information, Art. 15 GDPR
- Right to rectification, Art. 16 GDPR
- Right to erasure (“right to be forgotten”), Art. 17 GDPR
- Right to restriction of processing, Art. 18 GDPR
- Right to data portability, Art. 20 GDPR
You may contact us by email in order to exercise your rights: email@example.com . Please note that we will process your personal data in order to deal with your request and for identification purposes.
You are also entitled to submit a complaint to a data protection supervisory authority.