Collection and Use of Data
In order to access or request certain functionalities or services available on our website, you may be required to enter information that qualifies as personal data.
Personal data means any information relating to an identified or identifiable natural person (“Personal Data”).
The Controller, Star Alliance Services GmbH, Frankfurt Airport Center 1, 5th Floor, 60546 Frankfurt/Main, Germany (“Star Alliance”) only collects Personal Data to the extent that you provide it to us in relation to specific features in our app or on our website, such as enrolling into and using our Biometrics program or your subscription to our newsletter.
Personal Data may also be collected by third party service providers through external websites to which we provide a link, as shall be described below.
In addition, Star Alliance collects information in a form that does not, on its own, permit direct association with a specific natural person, such as but not limited to, language choices, your current location (city), or your IP address (to the extent that it cannot be traced back to a specific street address) and user activity on the Star Alliance website (“Non-Personal Data”). If Star Alliance combines Non-Personal Data with Personal Data (“Data”), the combined data will be treated as Personal Data for as long as it remains combined.
The means in which your Data is collected on or through our website, regional websites or linked third party websites shall be described in the following sections.
- Star Alliance App
Specifically for Enrolment and Usage of the Star Alliance Biometrics Hub ("Profile" section):
Scope and Purpose of the Personal Data Processing
With your enrolment into the Star Alliance Biometrics Hub ("SBH"), you create a personal account in the SBH which is operated by Star Alliance.
For such account creation and the usage of the SBH services require the following Personal Data of yours:
- pictures of your face including its biometric characteristics
- type of passport
- passport expiry date
- date of birth
- boarding pass data
- first and last name
- FFP number (please note that your first and last name and your FFP number will be provided to us by the airline entertaining your FFP membership based your consent given to such airline).
We process your Personal Data based on your consent pursuant to Art. 6, Subparagraph 1(a) GDPR for the specific purpose of providing the SBH services to you, namely the creation and maintenance of a biometric template of your face (unique mathematical representation of your face created by the SBH) to serve as your unique identifier at your selected airports to whom your respective boarding pass data will be provided by your selected Airline partners for passenger servicing (e.g. security control, boarding, lounge access) by your selected Airport or Airline Partner. A list of all available Airport and Airline Partners as well as their privacy statements can be found here .
You can withdraw your consent by unselecting any previously selected Airport or Airline Partner or by deleting your account. Your account will also be deleted if you have not selected any Airport or Airline Partners for two years. Please note that a withdrawal of your consent does not affect the prior processing of your data.
Storage of Personal Data
We will store
- your enrolment picture and up to four additional pictures taken at the airport checkpoints (to improve accuracy) in an encrypted form,
- the expiry date and type of your ID document,
- your frequent flyer number,
- the contents of your consent including your selection of Airport and Airline Partners, and
- your answers to the two security questions you have chosen
for as long as you wish to receive the SBH services.
Your other Personal Data provided by you for the enrolment (first and last name, nationality, date of birth) are immediately deleted after successful enrolment.
Once you trigger the deletion of your account, we will immediately delete your Personal Data unless storage is necessary for the establishment, exercise or defence of legal claims. We may then retain your Personal Data until the statutory limitation periods have expired (maximum up to four years) in accordance with Art. 6, Subparagraph 1(f) GDPR. Thereafter, the relevant Personal Data are routinely erased.
Your boarding pass data provided to us by the Airline Partner you have selected in you account will be deleted shortly after the departure of your respective flight.
Star Alliance and other Recipients of your Personal Data
Prior to taking a flight, your selected Airline Partner will submit the flight date, flight number, departure airport, arrival airport, frequent flyer number and boarding pass information to us, provided that you have supplied your frequent flyer number upon check-in at the latest.
Provided we confirm your identity after entering into the dedicated areas for biometric identification and have consented to be identified at this airport and by this Airline Partner operating the flight you are going to take, we will transmit your boarding pass data to the Airport Partner and/or the Airline Partner to let you pass the respective SBH enabled checkpoint.
If you have provided consent to Airport and/or Airline Partners based in countries outside of the EU, and if such countries have not been acknowledged by the EU Commission as providing an adequate level of data protection as the EU Data Protection Law, we will use special contractual safeguards (the “Standard Contractual Clauses”) to ensure that your Personal Data remains protected. The Standard Contractual Clauses can be accessed here .
In order to provide the SBH services to you, your Personal Data may also be processed by our service providers (e.g. to technically enable the SBH services and answer customer queries).
For all app functions EXCEPT FOR Biometrics Enrolment ("Profile" section):
No Personal Data
The data obtained through the Star Alliance App („App“) is anonymized and is therefore not considered Personal Data (the „Information“).
Information that the App collects:
Information on your then-current location throughout the time you are using the App.
Information about your use of the App for each session: (i) date & time of use, (ii) the duration of the use, (iii) which functionalities were used.
Device and Network information
Information about the device (mobile phone, tablet, laptop etc.), its IP address, its screen size and its operating system.
Storage and Processing of Information:
The anonymized location information collected is only kept within the App and is deleted immediately when you close the App.
Who may process the Information
The anonymized Session, Device and Network information are processed by the analytics tools Fabric and Mixpanel. This anonymized Information is thereby accessible by Google (Alphabet Inc.), Mixpanel Inc. and Nagarro Software GmbH (as the App developer). Such (anonymized) data might be processed outside the EEA.
- Star Alliance Website
Collection and Use of Personal Data by Star Alliance for Newsletter Services
Scope and Purpose of Collection
Star Alliance collects Personal Data in relation to the newsletter subscription service available on certain regional websites.
Star Alliance collects the following Personal Data:
your first name, last name, email address and optionally your company name.
The purpose of the collection and further processing of your Personal Data is (i) registering your subscription; (ii) providing you, on a regular basis, with selected news articles regarding our Member Carriers; and (iii) sending you, from time to time, special offers made available by our Member Carriers.
By subscribing to our newsletter, you consented to the processing of your Personal Data for the purpose specified above in accordance with Art. 6, Subparagraph 1(a) GDPR.
You may, at any time, withdraw your consent by unsubscribing from our newsletter by either (i) clicking on the “Unsubscribe” link in the footer of each newsletter you receive, or (ii) visiting the subscription webpage, choosing the ‘Unsubscribe’ option and filling-in your subscriber information.
Your Personal Data will then be automatically deleted from our mailing list and a confirmation email will immediately be sent to you.
Alternatively, you may send us an email at email@example.com with your request to trigger the deletion of your Personal Data.
Because our newsletter is delivered on a continuous and regular basis, your Personal Data shall be stored as long as necessary for the provision of the newsletter subscription service to you outlined above, unless otherwise notified by you using the unsubscribing means specified above (see ‘Consent’ section).
Star Alliance shall treat your Personal Data with utmost care and store it securely in accordance with the applicable laws. Therefore, we only use computer systems with limited access housed in facilities using physical security measures.
Your Personal Data will only be available to the limited number of Star Alliance administrators administering the newsletter.
- Your Rights
Right to Access, Correct or Delete (Art. 15-17 GDPR)
You have the right to access your Personal Data by requesting a copy of it using the contact details indicated below. You also have the right to demand its correction or deletion using the same means of communication.
Right to Restrict/Object (Art. 18 GDPR)
In addition, you have the right to restrict/object to the processing of your Personal Data and withdraw your consent to its future processing.
Right to Personal Data Portability (Art.20 GDPR)
You further have have the right to receive the Personal Data you have provided to Star Alliance, in a structured, commonly used and machine-readable format and to transmit those Personal Data to another controller. Where technically feasible, you may request Star Alliance to transmit the Personal Data directly to the other controller of your choice.
Complaints (Art. 77 GDPR)
You have the right to lodge a complaint of an alleged infringement of the applicable data protection laws with the supervisory authority pursuant to Art. 77 GDPR in combination with Art. 19 GDPR. The relevant supervisory authority for Star Alliance is:
The Officer for Data Protection and Freedom of Information of the State of Hesse
- Collection and Use of Personal Data by Third Parties
Book & Fly Tool
The Book& Fly tool is a functionality on our website which enables you to book a Round The World Ticket with a third party by whom Personal Data is collected. The following shall explain the extent and purposes of such Personal Data collection.
The Book & Fly tool is based on the technology of AMADEUS IT GROUP, S.A. (c/. Salvador de Madariaga 1, 28027 Madrid, Spain) and tickets are issued by Deutsche Lufthansa AG (Venloer Straße 151-153, 50672 Cologne, Germany), both being a controller in relation to your Personal Data.
By using the Book & Fly tool for booking and purchasing your ticket though our website, these parties collect and process the data required for your purchase.
Star Alliance does not collect, store or process any of the Personal Data you fill-in using the Book & Fly tool, as your request is redirected from our domain to an external website at the time of booking.
You can find the abovementioned parties' privacy statements here:
• Amadeus’ data privacy statement
• Data Protection Information of Deutsche Lufthansa AG
The baggage tracing feature on our website allows you to track mishandled baggage and requires you to enter certain Data (i.e. your baggage number and last name) in order to process your request.
By using this feature, you are redirected from our domain to the external website of SITA INFORMATION NETWORKING COMPUTING USA INC, (3100 Cumberland Blvd., Suite 200, Atlanta, Georgia 30339, USA).
The Data is then only collected by such third party service provider and not by Star Alliance.
SITA’s privacy statement can be found here .
Share Flight Info (“Flight Tracker”)
The flight tracker feature allows you to be kept informed or share such flight data with a third party. The Personal Data (email address and last name) you insert as part of the Share Flight Info feature is collected by OAG Aviation Worldwide Ltd (1 Capability Green, Luton, Bedfordshire, LU1 3LU, United Kingdom).
The Data is collected by such third party service provider and not available to Star Alliance.
OAG’s privacy notice can be found here.
Star Alliance United Kingdom (Regional Website) – ‘Arrange a Meeting’
This feature requires Personal Data, namely your name, email address, telephone number and company name in order to process your request for a meeting with a representative of the chosen member airline. The information you fill-in is not collected or stored by Star Alliance but directly sent either to an individual member carrier’s representative.
- Collection and Use of Non-Personal Data by Star Alliance
When you use the opportunity to share user feedback by clicking on the ‘Website Feedback’ button, please note that no Personal Data is required or should be included in your message. Star Alliance does not collect and will immediately delete any Personal Data that you provide as part of this feedback function.
Certain Non-Personal Data, such as your IP address, device information, city and language, is collected by default together with your feedback and stored on third party servers. This information is made available to a limited number of Star Alliance staff for analytical purposes and cannot be traced back to any individual.
Our lounge survey for lounge customers only collects the IP address of users for analytical purposes.
- Contact Details
Star Alliance Services GmbH
Frankfurt Airport Center 1
60546 Frankfurt / Main
+49 69 936 75-500
Star Alliance Data Protection Officer: privacy(at)staralliance.com
For any queries in relation to the Star Alliance Switzerland Newsletter only, please write to firstname.lastname@example.org.
To be able to process your request, as well as for identification purposes, please note that we will use your Personal Data in accordance with Art. 6, Subparagraph. 1(c) GDPR. Please provide the following details so that we can identify you:
- FFP no.
- E-mail address
- Changes to this Policy
Star Alliance reserves the right to make changes and amendments to this policy from time to time in accordance with the applicable laws. Any material changes in the way we use your Data will be posted on this page.
For any material changes in the way we wish to use your Personal Data we will ask for your consent.