Data Protection Notice and Declaration of Consent

As of: May 2019

The protection of your privacy is our paramount priority. We would like to inform you below how your personal data will be processed when you use the Chatbot function of Austrian Airlines AG (hereinafter “Austrian”) on the service provided by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (hereinafter “Facebook”) known as Messenger (hereinafter “Facebook Messenger”).

These conditions differ in part and supplement the General Data Protection Provisions of Austrian (retrievable under: Data protection). In case of deviations to the Austrian privacy statement, this data protection notice has overriding priority.

1. Responsible authority

The responsible authority for the processing of personal data when using Chatbot via Facebook Messenger in line with the GDPR is

Austrian Airlines AG
Office Park 2, PO Box 100
1300 Vienna Airport Austria

Tel.: +43 5 1766 1000
Web: www.austrian.com

2. Data processors

Microsoft Ireland Operations Limited
Atrium Building Block B
Carmenhall Road
Sandyford Industrial Estate
Dublin 18
Ireland

Bertelsmann Arvato
Arvato Direct Services GmbH
An der Autobahn 2
33333 Gütersloh
Germany

Lufthansa Global Tele Sales GmbH
Ullsteinstrasse 118
Haus 1A
12109 Berlin
Germany

Mindpearl Ltd.
Caribbean Plaza, 2nd Floor, North Building
878 West Bay Road
Grand Cayman
KY1-1003
Cayman Island

3. Data Subjects

Customers and interested parties with their own Facebook account can enter into a dialogue with Austrian Chatbot via the Austrian Facebook page or via the integrated Facebook Messenger to receive information concerning flights and Austrian (hereinafter the “chat function”). A Chatbot is a computer system that interprets and automates written chat text and responds to the written question or inquiry submitted. In addition to this chat function, Chatbot users may also register to be updated on their flight status and/or receive other operational information. The operational notifications provided are also sent via Facebook Messenger.

In addition to the chat function, customers also have other ways to obtain information and services from Austrian such as via the Service Centre or the company website.

4. Processing of your personal data

Personal data is all information that identifies a natural person or makes a natural person identifiable.

Austrian will only use your personal data provided by you in the context of Chatbot insofar as this is necessary for the use of Chatbot via Facebook Messenger as described here in Section 4a). We can also contact you in cases of flight irregularities if you have given your consent. We will only use your personal data to process your question, inquiry or request. It is entirely up to you whether you wish to provide us with such personal data for the purposes concerned. Austrian will only use your personal data given on the Chatbot for any other purposes (notably advertising purposes) with your prior written consent.

We also advise you to exercise caution with any particularly sensitive personal data (such as details of your health or your religion).

We use the following personal data:

  • First name
  • Last name
  • Username (Chatbot)
  • Gender
  • Language
  • Facebook Username
  • Facebook User ID
  • Chatbot User ID
  • IP Address
  • Booking code
  • Email address
  • Telephone
  • Contents of your messages
  • Personal data of your austrian.com (customer profile)

4.1. Chat Function

Please note that Chatbot users must have reached the age of 16.

If you use the Chatbot’s chat function, we will use your personal data as follows:

If your inquiry to Austrian is made via Facebook Messenger, Facebook will issue you with a session-based anonymized user ID. To process your inquiries, Facebook will transmit this pseudonymized user ID to Austrian together with an exclusive Chatbot user ID and your Facebook username. This will enable us to identify you again if you send any further inquiries via this channel and will allow us to view and handle these in the context of our previous communications. The provision of your Facebook username will further enable us to ensure that, in the event of a rebooking, the rebooking concerned can only be made by the person(s) entitled to do so. The provisions of language and gender will allow us to address you in a more personalized manner.

No further personal data or information of your Facebook Account will be transferred to Austrian. Austrian will store the above-mentioned anonymized information provided by Facebook only for evaluation purposes such as user volumes, breakdowns by language or areas of application or similar, with a view to further enhancing the Chatbot service.

For a personalized service, we also offer the option of linking your user ID with your Austrian customer profile. This will enable us to tailor our response to your inquiry as closely as possible to your person - e. g. for baggage provisions, check-in times or similar. If you choose to link your user ID to your customer profile at Austrian, for instance, this information will be stored in our customer databases, to enable us to draw on it again for future inquiries and offer you responses that are personalized.

All the data from your chat-function dialogue with the Chatbot via Facebook Messenger will be stored and processed by the data processor Microsoft; insofar as this data is required to process your inquiry, it will also be processed by Microsoft to this end. If the Chatbot is unable to process your inquiry via a dialogue provided in its software, the data you have entered will be analysed by a special software application. With this software, your data will be linguistically analysed and returned to Austrian in duly analysed form. In such cases, only the text you entered in the course of your Chatbot chat will be analysed. This also includes any personal data you may have provided in the text.

In case your inquiry cannot be answered sufficiently, the data you have entered will be sent to the data processor Bertelsmann Arvato. It will be linguistically analysed by a special software application and matched with a knowledge database. Information matching your inquiry will be sent back to you. In such cases, Bertelsmann Arvato will only receive the text you sent to the Chatbot chat (including any personal data which you may have provided in the same text).

4.2. Message Notifications

If you have registered for Chatbot, you will also receive messages with information about your flight (e.g. information about the departure gate, gate changes, cancellations, rebooking, etc.). If you do not wish to receive these messages, you can unsubscribe at any time and without giving reasons.

4.3. Check-in Function

If you use the Chatbot’s check-in reminder function, we will use your personal data as follows:

If you want a check-in reminder via Chatbot, you must provide us with your booking code and last name. You may be asked if you want to be reminded when check-in for your flight is open. Once check-in for your flight is available, we will then send you an unencrypted notification to check in. We will send you an encrypted link containing your personal data (booking code and last name) to further the check-in process.

4.4. Live Chat Function

If you use the Chatbot’s live chat function, we will use your personal data as follows:

In situations where the Chatbot cannot answer your question or you request/inquiry, it can offer you the option to be forwarded to our service centre. You may also reach this service centre by using the Live Chat function. When you use the Live Chat function, we will pass on your information to our service centre and the data processor Lufthansa Global Telesales or Mindpearl, who will answer you via Facebook messenger.

4.5. Feedback Function

If you use the Chatbot’s feedback function, we will use your personal data as follows:

You also have the option to rate your conversation with the Chatbot and provide feedback. If you decided to share your opinions with us, the feedback you provide will be sent via an unencrypted email. The email will not contain personal details apart from your pseudonymized user ID.

4.6. Declaration of Consent

I give my consent to Austrian to process my above-mentioned personal data to use the Chatbot. I may revoke this consent at any time and without any stated reason. However, I accept that in this case the Chatbot will no longer be available. To revoke your consent, you can select “More” from the Facebook Messenger menu, followed by “Legal & Data Protection” and click on “Revoke Permissions”.  Use is then only possible after renewed consent.

To document your given consent, we store your Facebook user name (first name, last name), gender, Facebook user ID, pseudonymized User ID, IP-address as well as the timestamp of your consent.

5. Retention period of your personal data

Your personal data, which were processed in the context of the Chatbot, will be stored by us for 60 days. The storage period is longer if the date of a flight booking you have entered exceeds this period. In this case, your data will be deleted when the latest flight in your booking is reached, or after a maximum of six months. The storage period is longer if your personal data is required to defend, exert and assert legal claims or there is a legal obligation.

6. Transfer of personal data

In the course of processing your Chatbot inquiry, Austrian may transfer your personal data to other affiliated companies within the Lufthansa Group or to external processors (data processors named specifically in this data protection notice and others) acting solely on our behalf and in compliance with our instructions and all relevant legal provisions. Such external providers may include, for example, those commissioned to provide servers, or those transmitting our news messages.

Apart from the above, we will not transfer any personal data to any other third party without your prior consent and will never sell or rent out your personal data. However, we reserve the right to disclose your personal data if we are compelled to do so by law or if such disclosure is demanded of us by legally empowered bodies or prosecuting authorities.

7. Use of your personal data by Facebook

We have no influence of the nature or the scope of the data which may have been collected by Facebook or beyond the scope described here. The purpose and scope of data collected by Facebook, and Facebook’s further use and processing of such data, and your rights and setting options to protect your privacy can be found on Facebook’s Data Protection Information at https://www.facebook.com/policy.php.

8. Data subjects’ rights

It is an important concern for us to make our data processing clear and transparent. Our customers are not only able to withdraw their consent, but also to exercise the following rights:

  • Right of access
  • Right of rectification of your personal data
  • Right to deletion
  • Right to restriction of processing
  • Right of data portability

You must submit your information request in writing with proof of your identity (scan or copy of an official photo ID). You can submit your information request via our internet form or by post to

Austrian Airlines AG
Data Protection Officer
Office Park 2. Post-box 100
1300 Vienna Airport
Austria

 

If you have any concerns regarding data protection law, please contact us by post at the address given above or contact our company using our Data Protection Officer’s online form for the rights of data subjects.

You also have the right to file a complaint with the Data Protection Authority as the supervisory authority with jurisdiction. The data protection authority with jurisdiction for Austrian is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna

Telephone: +43 1 52 152-0
Email: dsb@dsb.gv.at

9. Data security

Austrian Airlines AG implements technical and organisational data security procedures to protect your personal data against incidental and wilful manipulation, loss and destruction, or against access by unauthorised persons. Data security measures at Austrian are continuously evolving to ensure our technical security procedures reflect the latest standards in technological development. At the same time, our staff at Austrian in the data security and data protection divisions undergo training and are subject to organisational procedures designed for secure data processing.

10. Updates and Amendments

Parts of this data protection notice may be amended or updated by us without prior notification. Please always consult our data protection notice before you use the relevant products and services to ensure that you are fully aware of the latest status hereof.