Albatros Versicherungsdienste GmbH, Venloer Str. 151-153, 50672 Köln and Albatros Service Center GmbH, Venloer Str. 151-153, 50672 Köln (hereinafter also referred to as "Albatros", "we", "us“) companies of the Lufthansa Group, attaches great importance to your privacy when processing personal data in our daily business processes.

We process personal data that is collected when you visit our website in accordance with the legal provisions. Our data protection policy is also based on the data protection guidelines applicable to the Lufthansa Group. Below we inform you about the processing of your personal data in the context of the use of our website www.albatros.de ("website").

Should you have any further questions regarding data protection in connection with our website or the services offered, please contact our data protection officer:

Lufthansa Group Privacy – Representative
Deutsche Lufthansa AG
Abt. FRA CJ/D
Lufthansa Aviation Center
Gebäude 366
Airportring
60546 Frankfurt/Main

For data protection questions you can also send an e-mail:
datenschutz@dlh.de

We collect and use personal data directly from our users and other sources (mentioned below) in the following situations:
 

2.1. Provision of the website and log file creation
By visiting our website the system automatically records data and information about the user’s computer system each time the website is accessed. The following data (“technical information”) are collected:

(1)    Information on the browser type and version used
(2)    The user’s operating system
(3)    The user’s Internet service provider
(4)    The user’s IP address
(5)    Date and time of access
(6)    Websites from which the user’s system accesses our website
(7)    Websites accessed by the user’s system via our website

The log files contain IP addresses and other data which can be attributed to a user. This might be the case if, for example, the link to the website from which the user accesses the website or the link to the website to which the user switches contains personal data. The data are also saved in our system’s log files. These data are not stored together with other personal data of the user.

We collect and use this technical information for the purposes of (network) security (to for example ward off cyber-attacks), marketing and to better understand our users’ needs as well as to continuously improve our website and enable users to access the website from their computers.

The data are saved to log files to ensure website functionality. The data also help us improve the website and safeguard our information technology systems. The data are not analysed for marketing purposes in this context.

Art. 6 (1) (f) GDPR forms the legal basis for the temporary storage of the data and log files.
 

2.1.1. Use of cookies
Our website uses cookies. Cookies are text files stored in the web browser or by the web browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a distinctive character string which allows for unique identification of the browser when the website is accessed again. Art. 6 (1) (f) GDPR forms the legal basis for the use of cookies.

Our website uses cookies. Cookies are text files stored in the web browser or by the web browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user’s operating system. This cookie contains a distinctive character string which allows for unique identification of the browser when the website is accessed again.

Cookies are stored on the user’s computer, which transmits these to our website. Therefore, users have full control over the use of cookies. You may disable or restrict the transmission of cookies by changing your web browser settings. Previously stored cookies can be deleted at any time. This may also be done automatically. If cookies are disabled for our website, you may no longer be able to use all of its functionality.

For further information on the cookies used by us, their purposes and legal basis please check our Cookie Policy.

Here you can change your personal settings.
 

2.1.2. Consent management service
The legal basis for the use of the Consent Management Service of Usercentrics GmbH is the fulfilment of legal obligations in accordance with Art. 6 (1) (c) DSGVO
 

2.1.3.Tracking tools
We use the following tracking and (re)marketing tools on our website:

• Google Remarketing
• Google Adwords
• Matomo Version 3.5.0

Our legitimate interest pursuant to Art. 6 (1) (f) GDPR for the purposes of increasing the efficiency of our website and (direct) marketing is the legal basis for the use of the tools listed. For further information on the individual tools, please check Tracking Tool Policy.
 

2.1.4. Social media plugins
On our website, we use a “two-click solution” for the following social media plugins:

• Facebook
• Twitter
• Youtube
• Xing

With the two-click solution, your data are only transmitted to the relevant social networking provider after initial activation (approval) of the respective plugin button, Art. 6 (1) (a) GDPR. The basic provision of the plugin on our website is based on our legitimate interest for marketing purposes, Art. 6 (1) (f) GDPR.

For further information on individual plugins, please check Tracking Tool Policy.
 

2.2. Use of the services offered on our website
We offer a range of different services on our website. We must collect and process user or customer personal data in order to perform these. 
 

2.2.1. Contact form
By filling out the contact form on our website, you provide us with your personal data. This information includes, for example, your name, contact details such as e-mail address, telephone number and your personal wishes. We use this personal data to process your inquiries and/or to provide the requested services or to provide the requested information. The data will be processed for the purpose of contacting us in accordance with Art. 6 (1) (a) GDPR on the basis of your voluntary consent.
 

2.2.2 Spotlight Newsletter
You have the option of subscribing to a free newsletter on our website. When you subscribe, the following data from the input screen is sent to us and processed: email address and surname

Without this information the Spotlight Newsletter cannot be sent via E-Mail.

The following data is also collected when you subscribe:

• IP address of the computer accessing the website
• Date and time of registration

The collection of other personal data during the registration process helps to prevent misuse of the services or the email address that is used.

We process your data in connection with the newsletter in order to send you messages informing you about interesting topics from the Albatros world. In addition, we process and use the email address you enter to send you personalised offers in connection with the newsletter.

If a link in the newsletter takes you to our website, you also permit us to process and use your IP address, as well as geodata, web beacons and similar technologies, in order to verify whether the offers have met your requirements.

Your consent for the processing of this data is obtained during the registration procedure and reference is made to this privacy policy.

The data is deleted as soon as it is no longer needed for achieving the purpose for which it was collected. As a result, the user’s email address is stored for as long as the subscription to the newsletter is active.

Accordingly, Art. 6 (1) (a) GDPR forms the legal basis for data processing following the user’s subscription to the newsletter if the user has given consent.
 

2.2.3 Statistical analysis
There is a possibility that your data may be analysed in a data warehouse to evaluate the preferences of our registered customers (“statistical analysis”) for the purposes of interest-led marketing, individual approaches and continuous optimisation of our business processes. We undertake this processing in order to acquire a better understanding of what our customers expect from us and to allow us to offer you communication that is tailored to you personally. This analysis also helps us with fraud detection, auditing and safeguarding security, which is why we perform this processing to protect our legitimate interests, Art. 6 (1) (f) GDPR.
 

2.2.4. Real estate contact form
You have the option to fill in a real estate contact form on our website. By doing so, you make your personal data available to us. This data includes, for example, your name, contact details such as email address, telephone number and your personal wishes. We will forward this data to Immowings Berlin GmbH, Fredericiastr. 7, 14050 Berlin for the purpose of contacting you. The legal basis for data processing is Art. 6 (1 sentence 1) (a) GDPR.
 

2.2.5 "Cancellation Alarm Clock" and "Interest Alarm Clock"
The data collected within the scope of our "Cancellation Alarm Clock" and "Interest Alarm Clock" service offer is used exclusively to carry out the reminder function. The legal basis for the processing of the data by the user is Art. 6 (1) (a) GDPR.
 

2.2.6 Video consultation and text chat
You have the option to communicate with our consultants via video consulting and/or text chat. Further technical information on online consulting can be found under the following link on our homepage: www.albatros.de/online-beratung.

The use of the video consultation and the text chat is basically possible without you having to give information about your person. The use is also possible using a pseudonym (any chat name). We use the data collected by us within the scope of a request made by you exclusively for the purpose of processing your request. We store and use your feedback for video consulting and/or text chat only in anonymized form. When using video consulting via our website, the following information is stored in a log file: Actions such as start and end, date and time of use and a number assigned to the video consultation (session ID). This data is collected, processed and used for the technical administration and optimisation of the websites and exclusively within the legally permissible framework. The legal basis for the temporary storage of data and log files is Art. 6 (1) (f) GDPR. We only store further data if we have your consent. In this case, the legal basis for processing is Art. 6 (1) (a) GDPR.

Data security in video consulting and text chat
In video consulting and text chat, all data is transmitted in encrypted form. Our employees will never ask you to transmit confidential information via text chat; there is no provision for such data to be entered. For security reasons, do not enter any account or contract numbers or passwords in the text chat. This applies in particular to PIN and TAN.
 

2.2.7 Changes to personal data
You have the option to change your personal data on our website. The legal basis for the processing of the data after the amendment is Art. 6 (1) (a) GDPR.
 

2.2.8 AirlinePortal
You have the option to use the AirlinePortal on our website. This requires you to register as a person (and not your company). Identification is based on your name, position within your company, business e-mail address or telephone number. We need this information to verify your identity, for example. Furthermore, we need the data to send you important notifications (e.g. changes to the terms of use). The legal basis for the processing of data is Art. 6 (1) (a) GDPR.
 

2.2.9 Google Maps
We use Google Maps to visually display geographic information. When Google Maps is used, Google also collects, processes and uses data on the use of map functions by you. You can find more detailed information about data processing by Google in the Google data protection information. There you can also change your personal data protection settings in the data protection centre.

Detailed instructions on how to manage your own data in connection with Google products can be found here.
 

2.2.11 WebinarGeek (Webinars)
Albatros Versicherungsdienste GmbH and Albatros Service Center GmbH (Albatros) uses the software Webinargeek from the provider WebinarGeek B.V. (contract processor) to conduct customer webinars. Personal data is collected/stored as part of the registration process on Webinargeek's infrastructure (Chroomstraat 12 in Zoetermeer, Netherland). In particular, this includes last name, first name, company, telephone number and email address. The legal basis for data processing is Art. 6 para. 1 lit. f of the Basic Data Protection Regulation.

The processing of the data by Webinargeek (as a processor) is based on Article 28 of the Basic Data Protection Regulation. The data is processed within the legally permissible framework in Germany, the European Union and the USA. For data processing in the USA, an adequate level of protection has been established by agreeing the EU standard contractual clauses. In this context, please also refer to the Webinargeek privacy policy: https://www.webinargeek.com/en/privacy

The deletion of the data is carried out in accordance with the legal retention periods.

A use of the data for another than the aforementioned purpose of contract fulfillment or a transfer to other third parties will only take place on the part of Albatros if this is legally permissible or the user has expressly consented.

----

Google Analytics
Webinargeek uses Google Analytics, a web analysis service of Google Ireland Limited, (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). It includes the use of “Universal Analytics” technology, which makes it possible to assign data, web sessions and interactions on several devices to an anonymised user ID, thus enabling an analysis of a user’s activities across multiple devices.

Google Analytics uses so-called “cookies”, text files which are saved on your computer and which enable an analysis of your usage of the website. Information generated by the cookie about your usage of this website is generally transferred to a Google server in the USA and stored there. In the event that IP anonymisation is activated on this website, your IP address will be shortened by Google within the member states of the European Union or in other states which are party to the Agreement on the European Economic Area before the transfer takes place. Only in exceptional circumstances will the complete IP address be transferred to a Google server in the USA and shortened there. The following data-sharing settings in Webinargeeks Google Analytics account have explicitly been disabled:

- Google products and services
- Benchmarking
- Technical support
- Account specialists

The information collected by Google is anonymized as much as possible. This includes enabling the option IP Anonymization. The IP address of your browser conveyed in the context of Google Analytics will not be joined with other Google data. Google will use this information on behalf of the operator of this website to evaluate your usage of the website in order to compile reports about the website activities and to provide the website operator with additional services in connection with the usage of the website and the internet. These purposes also constitute our legitimate interest in the data processing. The legal basis for the use of Google Analytics is Section 15(3) German Telemedia Act (TMG) and Art. 6(1), Subparagraph 1(f), GDPR. Sessions and campaigns are terminated on expiry of a fixed period. The fixed period for the termination of sessions is generally 30 minutes without activity, and for campaigns the limit is six months. The maximum permissible time limit for campaigns is two years. More information about conditions of use and data protection can be found at http://www.google.com/analytics/terms/de.html or at https://policies.google.com/?hl=de.

2.3. Our legitimate interest in processing personal data
If Art. 6 (1) (f) GDPR forms the legal basis for the processing, our legitimate interests are, in addition to the purposes listed above:

• To protect the company against material and immaterial damage
• Professionalism (of our products and services)
• Cost optimisation (control and minimisation)

2.4. Other processing commitments 

If obliged to do so by law, we process personal data in order to meet duties of retention under commercial or tax law or to meet legal security requirements (such as Section 7 of the Aviation Security Act [LuftSiG]). For further information on retention periods, please refer to “Duration of the data processing”.
 

2.5. Obligation to provide personal data
The input fields which are mandatory to be filled out for performing the requested service are marked accordingly on the website. The input is either mandatory because of legal or contractual requirements.

Your personal data are deleted as soon as they are no longer needed for the specified purposes. In certain circumstances, personal data are kept for the period of time during which claims against Albatros may be enforced (statutory limitation period of three to thirty years). Personal data are also saved to the extent that and for so long as Albatros is legally obliged to do so. Corresponding burdens of proof and duties of retention arise from, among others, the Commercial Code, Tax Code and Money Laundering Act. These prescribe retention periods up to ten years.

4.1. SSL - Secure Socket Layer Method
To ensure the most secure transmission of your data between your web browser and our Internet system, we use Secure Socket Layer (SSL) encryption technology. SSL enables encrypted communication or document transmission via the Internet between web browsers and web servers. The URL of a web page with SSL connection to your browser starts with https://.

If your current browser is not SSL-enabled, you can download the latest version of the most widely used web browsers.
 

4.2. Use of Google reCaptcha
To protect your orders via contact form we use the service reCAPTCHA of the company Google Inc. (Google). The query serves to differentiate whether the input is made by a person or abusively by automated, machine processing. The query includes sending the IP address and any other data required by Google for the reCAPTCHA service to Google. For this purpose your input will be transmitted to Google and used there. By using reCaptcha you agree that the recognition you have made will be incorporated into the digitisation of old works. However, if IP anonymisation is activated on this website, Google will reduce your IP address within Member States of the European Union or in other states party to the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of the operator of this website, Google will use this information to evaluate your use of this service. The IP address transmitted by your browser within the scope of reCaptcha is not merged with other Google data. The deviating data protection regulations of the company Google apply to this data. For more information about Google's privacy policy, please visit: https://policies.google.com/privacy?hl=en.

You have the right to object, on reasons relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

The controller shall no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or processing is necessary for the establishment, exercise or defence of legal claims.

Where your personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes. In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

In order to offer you our products and services, based on our contractual obligations or in accordance with our legitimate interests, we may have to disclose your personal data to third parties internal or external to the Delvag Group. These recipients can be categorised as follows:

• Insurers
• Financial Institutions
• Building Societies
• Broker Pools, Service Companies
• Sub-Broker, Cooperation Brokers
• External contract processors (service companies according to Art. 28 GDPR)
• Providers of investments within the meaning of section 1(2) of the Investment Act
• Providers of units or shares in domestic open-ended investment funds, EU open-ended investment funds or foreign open-ended investment funds that may be marketed under the Investment Act
• Governmental bodies and authorities (including the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin)

Personal data may be transmitted to third countries or international organisations as part of this. For your protection and the protection of your personal data, appropriate safeguards are provided for such data transmissions as per and in accordance with legal requirements (particularly, the use of EU standard contractual clauses) or an adequacy decision has been issued by the EU Commission (Art. 45 GDPR).

For information on EU standard contractual clauses, please visit here. The EU Commission provides the relevant information relating to its adequacy decisions at Link.

A copy of the security precautions used may also be requested from datenschutz@delvag.de.

We are also legally obliged to provide personal data to German and international authorities, Art. 6 (1) (c) GDPR together with local and international regulations and agreements.

Albatros is committed to ensuring fair and transparent processing. That is why it is important to us that data subjects can not only exercise their right to object but also the following rights where the respective legal requirements are satisfied:

• Right of access, Art. 15 GDPR
• Right to rectification, Art. 16 GDPR
• Right to erasure (“right to be forgotten”), Art. 17 GDPR
• Right to restriction of processing, Art. 18 GDPR
• Right to data portability, Art. 20 GDPR

To exercise your right, please email datenschutz@delvag.de. In order to process your request and for identification purposes, please note that we will process your personal data in accordance with Art. 6 (1) (c) GDPR.

You also have the right to lodge a complaint with a supervisory authority. The relevant supervisory authority for Albatros is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen

Postfach 20 04 44
40102 Düsseldorf

Kavalleriestr. 2-4
40213 Düsseldorf

Phone: 0211/38424-0
Fax: 0211/38424-10
E-Mail: poststelle@ldi.nrw.de

If you give your consent to us for processing your personal data, please note that you may withdraw this consent at any time. In order to withdraw consent, you can contact: datenschutz@delvag.de

Please note that your consent can only be withdrawn with future effect and such a withdrawal does not have any influence on the lawfulness of past processing. In some cases, we may be entitled in spite of your withdrawal to continue to process your personal data on a different legal basis – e.g. to perform a contract.

These data protection notices only apply to processing for the website www.albatros.de.

Other websites are not covered by these data protection notices and provide their own specific data protection notices. 

You can find our data protection information here.

This data protection information is currently valid and is valid as of May 2018.