Privacy Policy and Declaration of Consent

Protecting your privacy is our company’s top priority. We would like to inform you below how your personal data will be processed when you use the chatbot function of Austrian Airlines AG (hereinafter “Austrian”) on the service provided by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA (hereinafter “Facebook”) known as Messenger (hereinafter “Facebook Messenger”).

These conditions differ in part and supplement the General Data Protection Provisions of Austrian (retrievable under: ​Data protection). In case of deviations from the Austrian privacy statement, this privacy policy has overriding priority.

Under the General Data Protection Regulation (GDPR), the controller for the processing of personal data during the utilisation of the chatbot via Facebook Messenger is

Austrian Airlines AG
Office Park 2, PO Box 100
1300 Vienna Airport Austria

Tel.: ​+43 5 1766 1000
Web: www.austrian.com

Customers and interested parties with their own Facebook account can enter into a dialogue with the Austrian chatbot via the websites

or the

via the integrated or linked Facebook Messenger to receive information about flights and Austrian (“chat function”). A chatbot is a computer system that interprets and automates written chat text and responds to the written enquiries submitted. As well as the chat feature, users can subscribe to updates regarding their flight status and other operational notifications. The sending of operational notifications also takes place via Facebook Messenger.

In addition to the chat function, customers also have other ways to obtain information and services from Austrian such as via the ​Service Centre or the company’s own website.

Personal data is any information which identifies or makes identifiable a natural person.

Austrian will only use your personal data provided by you in the context of chatbot insofar as this is necessary for the use of chatbot via Facebook Messenger as described here in Section 4a). We may also contact you in the event of flight disruptions, if you have consented to this. We use your personal data exclusively in order to be able to respond to your individual query. You are free to decide whether you provide us with your data for the above-mentioned purposes. Austrian will only use your personal data given on the chatbot for any other purposes (notably advertising purposes) with your prior written consent.

We also advise you to exercise caution with any particularly sensitive personal data (such as details of your health or your religion).

We use the following personal data when using the chatbot via Facebook Messenger:

• Name
  
• Surname
• Username (chatbot)
• Gender
• Language
• Facebook username
• Facebook user ID
• Chatbot user ID
• IP address
• Booking code
• Email address
• Telephone number
• Contents of your messages
• Personal data from your austrian.com profile (customer profile)

We use the following personal data when using the chatbot on Austrian.com:

• Name
• Surname
• User ID (chatbot)
• Gender
• Language
• IP address
• Booking code
• Email address
• Telephone number
• Content of your communication
• Personal data from your austrian.com profile (customer profile)
• FeedbackID
• Language settings on your internet browser

Cognigy GmbH provides the NLP, which stands for Natural Language Processing and describes techniques and methods for the machine processing of natural language. This data is not shared with third parties on Austrian servers. Cognigy GmbH stores and reads the IP address on the following pages:

Only natural persons who have completed their 16th year are permitted to use the chatbot.

When you use the chat function, we will use your data as follows:

If your enquiry to Austrian is made via Facebook Messenger, Facebook will issue you with a session-based anonymised user ID. To process your enquiry, Facebook will transmit this pseudonymised user ID to Austrian together with an exclusive chatbot user ID and your Facebook username. This enables us to recognise you if you submit subsequent enquiries via this channel and to contextualise your enquiry in relation to previous chat dialogues. The provision of your Facebook username will further enable us to ensure that, in the event of a rebooking, the rebooking concerned can only be made by the person(s) entitled to do so. The communication of language and gender allows us to address you using a personalised form.

No further personal data or information of your Facebook Account will be transferred to Austrian. Austrian will store the above-mentioned anonymised information provided by Facebook only for evaluation purposes such as user volumes, breakdowns by language or areas of application or similar, with a view to further enhancing the chatbot service.

For a personalised service, we also offer the option of linking your user ID with your Austrian customer profile. This will enable us to tailor our response to your enquiry as closely as possible to your person - e.g. for baggage regulations, check-in times or similar. If you choose to link your user ID to your customer profile at Austrian, for instance, this information will be stored in our customer databases to enable us to draw on it again for future enquiries and offer you responses that are personalised.

All the data from your chat-function dialogue with the chatbot via Facebook Messenger will be stored and processed by the data processor Microsoft; insofar as this data is required to process your enquiry, it will also be processed by Microsoft to this end. If the chatbot software cannot process your enquiry via a dialogue provided within the software, the data you have entered will be processed by means of a special software. With this software, your data will be linguistically analysed and returned to Austrian in duly analysed form. In each case, the special software only receives the text you entered during the chat history. This also includes personal data that may have been disclosed in the text.

If your enquiry cannot be answered satisfactorily, your input texts will be forwarded to the data processing company Bertelsmann Arvato. These input texts will be speech analysed there with the aid of a special software and compared with a knowledge database. Entries matching your input text will be sent back to you. Bertelsmann Arvato only receives the text you have written within the chatbot chat (including all personal data which you have disclosed in the same context).

If you have registered for chatbot, you will also receive messages with information about your flight (e.g. information about the departure gate, gate changes, cancellations, rebooking, etc.). If you do not wish to receive these messages, you can unsubscribe at any time and without giving reasons.

If you utilise the check-in feature provided via the chatbot, the following personal data from you will be used:

If you would like to receive a check-in reminder via the chatbot, you must supply us with your booking code and surname. It is possible that you will be asked whether you would like to receive a message as soon as your flight is ready for check-in. Once check-in for your flight is available, we will then send you an unencrypted notification to check in. For the further check-in procedure, we will send you an encrypted link which contains personal data (booking code and surname).

If you use the live-chat feature provided by our chatbot, we will process the following personal data from you:

In cases, where the chatbot cannot process your queries or your requests, there is an option to contact our Service Center. You may also reach this service centre by using the Live Chat function. When you use the Live Chat function, we will pass on your information to our service centre and the data processor Lufthansa Global Telesales or Mindpearl, who will answer you via Facebook messenger.

If you use the feedback feature provided by our chatbot, we will process the following personal data from you:

You also have the option to rate your conversation with the chatbot and provide feedback. If you decide to let us know your opinion about it, your feedback will be sent to us via an unencrypted email. The email contains no personal data except for your pseudonymised user ID.

I give my consent to Austrian to process my above-mentioned personal data to use the chatbot. This consent can be revoked at any time without giving reasons. It is then no longer possible to use the chat. To revoke your consent, you can select “More” from the Facebook Messenger menu, followed by “Legal & Data Protection” and click on “Revoke Permissions”. Chat can then only be used once consent has been given again.

In order to document the submission of your declaration of consent, we store your Facebook username (first name and surname), gender, your Facebook user ID, your pseudonymised user ID, IP address and the date of submission of your consent.

As a basic principle, the data provided by you in the context of the chatbot will be stored by us for 60 days. This storage time will be longer if the date of a flight in a booking you have entered exceeds this period. In this case, your data will be deleted when the latest flight in your booking is reached, or after a maximum of six months. The storage time will also be longer if your personal data is required for the defence, exercise and establishment of legal claims or a statutory obligation to preserve records exists.

In the course of processing your chatbot enquiry, Austrian may transfer your personal data to other affiliated companies within the ​Lufthansa Group or to external commissioned processors (data processors named specifically in this data protection notice and others) acting solely on our behalf and in compliance with our instructions and all relevant legal provisions. Such external providers may include, for example, those commissioned to provide servers, or those transmitting our news messages.

Moreover, we do not pass on the personal data received in the context of the chatbot to third parties without your consent, nor do we sell or rent your personal data. However, we reserve the right to disclose your personal data if we are compelled to do so by law or if such disclosure is demanded of us by legally empowered bodies or prosecuting authorities.

We have no influence over the type and extent of the data that may be collected by Facebook or beyond the extent described here. Information about the purpose and extent of the data collection and the further processing and use of the data by Facebook, and your related rights and settings options to protect your privacy, can be found in the Facebook Privacy Policy at

It is an important concern for us to make our data processing clear and transparent. Our customers are not only able to withdraw their consent, but also to exercise the following rights:

• Right of access to personal data
  
• Right to rectify their personal data
• Right of deletion
• Right to limit processing
• Right to data portability

The application for information is to be submitted in writing with evidence of identity (scan or copy of an official photographic identification). You can submit your information request via our internet form or by post to

Austrian Airlines AG
Data protection officers
Office Park 2. PO box 100
1300 Vienna Airport
Austria

Germany.

If you have any concerns regarding data protection law, please contact us by post at the address given above or contact our company using our Data Protection Officer’s online form.

Moreover, you have the right to contact the data protection authority as the relevant regulatory body if you have a complaint. The data protection authority with jurisdiction for Austrian is:

Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna

Tel.: ​+43 1 52 152-0
Email: ​dsb@dsb.gv.at

Austrian Airlines AG implements technical and organisational data security procedures to protect your personal data against incidental and wilful manipulation, loss and destruction, or against access by unauthorised persons. Data security measures at Austrian are continuously evolving to ensure our technical security procedures reflect the latest standards in technological development. At the same time, our staff at Austrian in the data security and data protection divisions undergo training and are subject to organisational procedures designed for secure data processing.

Parts of the data protection policy may be changed or updated by us without notifying you in advance. Please check the data protection policy in each case before using our service to stay up-to-date with any changes or updates.