1. Master Data and Status Data
When you apply to participate in the Miles & More programme, we collect some of your personal data in the application form. These data consist in particular of your last name, first name, gender, address and domicile. In addition, in certain processes you must provide additional compulsory information so that we can carry out your registration and the subsequent processes, such as sending out your cards or a confirmation e-mail, for example. This includes data such as your date of birth, e-mail address or a telephone number. Furthermore, along with your application or in the course of your membership of Miles & More, you can communicate other data to us of your own volition, for example a mobile telephone number, your academic title or other interests and preferences. To save you additional trouble in entering these data, we extract some information directly from the application form or when processing it. This includes the date of your registration and your preferred language for correspondence. All these data collected about you are called your “Master Data”.
In order to manage the status assigned by the operators or joint operators (such as Frequent Traveller, Senator or HON Circle Members), we also store data which are required to manage this status, such as the type of status or the number of Status or HON Circle miles you have earned (“Status Data”).
2. Miles & More Card Number
When you open your mileage account we provide you with a Miles & More card number. Your Miles & More card number is part of your Master Data. It is used to identify you clearly as a member.
Your Miles & More card number may change in the course of your membership. There are various triggers for this, such as when you reach a particular status or lose your card. By using a unique identification number in the background, we can continue to arrange for miles to be credited to your account and/or for you to redeem miles. This unique identification number is generated exclusively by the system and is used in any identification processes. If you lose your card, this also allows us to block your card number without you having to re-register.
3. Programme Data
When you earn or redeem miles as part of Miles & More, we record your so-called “Programme Data”.
When you earn miles, the program data include all the information required for mileage credit and the administration, ongoing development and marketing of Miles & More. This includes information about our Miles & More partner company where you earn miles, as well as information about the services and number of miles earned on which your mileage credit is based.
When you quote your Miles & More card number to an airline company to earn miles, the Programme Data also include other information, in particular information about the flight route, the flight date, the flight number, the price, the airline operating the flight and the booking class.
When you earn miles with another Miles & More partner company, the Programme Data include information about the services requested that relate to miles, i.e. in particular the products bought or services used, such as the price, quantity, goods category, time of purchase, time of execution or place of rental/stay.
When you earn miles with a Miles & More credit card, the program data include details of the amount spent with the Miles & More credit card. If you have given additional consent to your bank, further data may also be collected. You can find details of this in Section 8 of this Privacy Statement.
When you redeem miles, the Programme Data consist of details of the awards requested as well as the number of miles used (with a flight, the specific type of flight award, the flight route, the flight date and other information relating to the booking and with another award e.g. the type of award and product information such as the price, quantity, goods category, time of purchase, time of execution or place of rental/stay).
By storing these data, we can ensure that the mileage credit is correct, track account movements, in particular for fraud prevention, as well as ensure that detailed information is provided when requested, and that any possible complaints you may make are processed swiftly. If you give your consent, the data described above may also be used for advertising purposes (you can find more detailed information about possible uses in Section 6 of this Privacy Statement).
4. Treatment of your Personal Data
We process your personal data, i.e. Master Data, Programme Data and Status Data and web-tracking data, as described in Section 1 of the Privacy Statement for Miles & More website, app & communication media, as part of Miles & More; particularly to
- process your application for membership of Miles & More, to be able to send you your Miles & More card and other contract information about Miles & More,
- enable you to earn and redeem miles, in particular to be able to credit the miles earned by you with operators and Miles & More partner companies to your mileage account and be able to debit the miles used when you request an award,
- allow us to be able to check that when you earn miles, the correct number of miles is credited, and that when you debit the account for an award, the correct number of miles is calculated,
- be able to send you other contract information relating to your status when you fulfil the appropriate criteria of your Miles & More status card,
- be able to manage, develop and market Miles & More, and
- be able to inform you about current extensions or modifications to Miles & More.
The data are initially processed by us to fulfil your membership agreement with us (Art. 6 (1) b) GDPR) and to safeguard our justified interests (Art. 6 (1) f) GDPR). In addition to the purposes stated, justified interests are in particular the protection of our company against material and non-material damage, such as in particular for the prevention of fraud, appeals or filing legal claims.
We also process your data so that we can send you individually compiled offers relating to Miles & More, providing you have given us your separate consent to do so; this way we can send you information that is relevant to you. The legal basis for this processing is Art. 6 (1) a) GDPR. You can find further details under Section 6 of this Privacy Statement.
5. Data Transmission in the context of Miles & More
5.1 Joint Operators
The operators of Miles & More can appoint selected partner companies in certain countries, which may market Miles & More as their own programme (“Joint Operators”). Joint Operators are
- Adria Airways
- Air Dolomiti
- Austrian Airlines
- Brussels Airlines
- Croatia Airlines
- LOT Polish Airlines
- Swiss International Airlines
We may share data with the Joint Operators for the administration, ongoing development and marketing of Miles & More as their own programme in the following cases:
- If you have registered with Miles & More via a Joint Operator, your Master Data, Miles & More card number or a unique user name, as well as your Programme Data relating to the Joint Operator’s services, may be shared with the Joint Operator.
- If the Joint Operator is an airline and your residence is located within the home market of this Joint Operator, we may share your Master Data, Miles & More card number and Programme Data with the Joint Operator.
- If the Joint Operator is an airline and you take flights operated by this Joint Operator, we may share your Master Data and Programme Data with the Joint Operator.
- If you have gained a status with a Joint Operator, in addition to the Master Data and the Programme Data related to the services provided by the Joint Operator, your Status Data may also be shared with the Joint Operator.
The Joint Operators send us the Programme Data set out in Section 3 of this Privacy Statement in order to enable us to credit miles.
5.2 Miles & More Partner Companies
Data is only shared with Miles & More partner companies, including in particular Miles & More Hotels, Miles & More Car Rental and Miles & More Gift Cards, which are not Joint Operators, if and to the extent you have requested a service from one of these Miles & More partner companies (e.g. an award) or you have given your consent (e.g. during login).
The Miles & More partner companies share with us the Programme Data listed in Section 3 of this Privacy Statement in order to allow us to allocate the mileage credit.
5.3 Lufthansa Group Airlines
The airlines of the Lufthansa Group (as set out under www.miles-and-more.com/joint-partner) have combined their customer loyalty activities. This means that the member’s Master Data and the Status and Programme Data obtained by a Lufthansa Group airline are managed in a joint database for all Lufthansa Group airlines. These data can be processed and used for analysis purposes without your separate consent (also see Section 6 of this Privacy Statement) in anonymised form (that is without the possibility of a particular member being identified), and for the management, continuing development and marketing of Miles & More. If you have given your consent, the data may also be used on a personal basis for marketing purposes (also see Section 6 of this Privacy Statement).
5.4 Other Third Parties and Processors
In order to be able to offer you our products and services, based on our contractual obligations or in accordance with our justified interests, we use service providers such as service centres or IT service providers as Processors in accordance with Art. 28 GDPR. These service providers have been carefully selected and work exclusively to our instructions. They provide sufficient guarantees to comply with their obligations under data protection law.
We also receive data from other third parties as part of processing where such third parties have commissioned us to process data. This may occur, for example, in the management of nominations as status customers based on contractual obligations. In addition, it is also possible that we might be obliged to share your personal data with government offices and authorities for specific purposes.
When data is shared with other third parties, it is possible that personal data is transmitted to third countries. For your protection and the protection of your personal data, safeguards are stipulated in the event of such data transmissions under and in accordance with the statutory regulations (in particular the use of EU standard contractual clauses - for more information see the website of the European Union).
Moreover, in certain cases we are legally obliged to hand over personal data to the German and international authorities; see Art. 6 (1) c) GDPR in conjunction with local and international regulations and agreements.
The legal bases for the sharing of data with Joint Operators, Miles & More partner companies, Lufthansa Group companies and other third parties and commissioned data processors are Art. 6 (1) b). GDPR (Fulfilment of your membership contract), Art. 6 (1) a) GDPR (Consent) and Art. 28 GDPR.
We can give you the option of giving MMG and Lufthansa separate consent to receive:
- information about your mileage balance and our Miles & More newsletters (e.g. programme newsletters, WorldShop newsletters, Spend newsletters and Promotion newsletters),
- combined offers we have put together for you to earn and redeem miles in exchange for services from operators, Joint Operators and Miles & More partner companies,
- market research surveys/customer satisfaction questionnaires to improve Miles & More and the offers from operators, Joint Operators and Miles & More partner companies.
Consent may include the following communication channels:
- messenger services
Information and offers, such as the WorldShop catalogue, the Lufthansa Exclusive or Woman’s World, are sent by post unless you object to receiving such information and offers.
Moreover, we can give you the option of giving separate consent to individual Joint Operators to receive:
- market research surveys/customer satisfaction questionnaires - your opinion on the respective Joint Operators (including partner companies, where applicable) and their offers and services
- information and offers from the respective Joint Operators and their partner companies, where applicable,
- regular information from the respective Joint Operators and their partner companies, where applicable, about special offers and valuable tips relating to travel from the airline, vehicle manufacturer, financial services, hotel, transport, lifestyle, shopping and telecommunications sectors
- latest news on services and products from selected airline partner
Consent may include the following communication channels:
- messenger services
Information and offers are sent by post unless you object to receiving such information and offers.
You can find further details on consent in the respective Data Protection Policiesprivacy statements of our Jjoint Ooperators. For the Lufthansa Group you will find these under
You can give all the consents referred to above, for example, in your application for membership of Miles & More, on our website or in a Miles & More communications medium. You can also give those parts of your consent that relate to the Joint Operators to them via their communication channels.
If you have given us your consent, we may evaluate your Master Data, Status and Programme Data and the analysis data collected when you use our offers (e.g. from our websites, our app, our newsletters or communications media) in order to send you personalised information about the Miles & More programme that is relevant to you and customised to your interests (so-called profiling). For example, in this way we use your place of residence, age, status level and your most recent mileage credits in order to adapt the offers on earning/redeeming miles in the Miles & More newsletter to your needs. If we refer in our consent to “personal data”, we understand this term to mean all the types of data defined in this Privacy Statement- in particular master data, status and program data.
If you have given your consent to one of the Joint Operators, the latter may evaluate all the data it has about you in order to send you personalised information that is uniquely relevant and customised to your interests. This includes data from the Miles & More programme shared under Section 5 of this Privacy Statement as well as the data it collects itself, such as flight data for example.
You can find further details on the usage of data by our joint operators in their respective privacy statements. For the Lufthansa Group you will find these under
We will only collect, process and use other personal data from other sources - such as websites operated by third parties - for the creation of personalised information if you have given the corresponding consent to the respective third party to do so.
The legal basis for the processing of the data is Art. 6 (1) a) GDPR (Consent).
You can edit your communication settings in your customer profile on www.miles-and-more.com at any time, and/or withdraw and/or restrict your consent in full or in part (e.g. by telephone at the Miles & More Service Centre). In addition, you can deactivate push notifications on mobile end devices in the respective Miles & More app.
If you do not give your consent, you will not receive information from MMG and Lufthansa Group airlines. You can find information about your mileage balance (including early reminders about mileage expiry) in your customer profile at www.miles-and-more.com.
MMG and Lufthansa can send you legally relevant information about the Miles & More programme (such as changes to the Terms and Conditions of Participation), irrespective of whether you have given or withdrawn your consent. The legal basis for processing the data in this case is Art. 6 (1) b) GDPR (Performance of contract).
7. Linking with Lufthansa Group ID Profiles
If you also have an ID profile with one of the Lufthansa Group airlines, a link to your Miles & More profile may also be required as part of this. This is used in particular to make you clearly identifiable via the various profiles. The background for this in particular is that we cannot manage your consent to the Lufthansa Group in aggregated form without clear identification and wish to save you having to enter or change your data several times in different profiles. If you do not create a link, we must point out that unfortunately we are unable to carry over the settings activated in the individual profiles into the other profiles (in particular about your consents).
The legal basis is Art. 6 (1) a) GDPR (Consent). You can find further details about linking here.
8. Miles & More Credit Card
When you apply for a Miles & More credit card, additional personal data are collected by the issuing bank (for example your profession, marital status and income). These supplementary data are processed and used exclusively by the issuing bank and are not shared with the operators or Joint Operators. We only receive the program data arising from the use of the Miles & More credit card and your Miles & More card number or other Master Data required to allocate the Programme Data to you as a member. If you have given a further consent to the issuing bank, the issuing bank may also share further personal data with us; we will use this data for the purposes stated in this Privacy Statement. The legal basis for sharing this data is Art. 6 (1) a) GDPR (Consent).
9. Period of Storage
We process your data as long as it is required to fulfil our contractual and statutory duties. It must be noted here that membership of the Miles & More programme is for an indefinite period and is thus set up for several years.
If the purpose for which your data were processed no longer applies, such data are deleted, unless the retention thereof is required for the following purposes:
- to fulfil retention periods under commercial and tax law that derive from the Commercial Code or the Tax Code; these periods can be up to 10 years
- to retain evidence as part of the provisions on limitation periods. Under §§ 195 ff. of the Civil Code (Bürgerliches Gesetzbuch - BGB), these limitation periods can be up to 30 years, whereas the standard limitation period is three years. In these cases, your data are blocked so that they cannot be processed for other purposes.
10. Your Privacy Rights
As an affected person you can exercise the following rights where the respective statutory conditions exist:
- Right to information, Art. 15 GDPR
- Right to correction, Art. 16 GDPR
- Right to deletion (“Right to be forgotten”), Art. 17 GDPR
- Right to limit processing, Art. 18 GDPR
- Right to data transmissibility, Art. 20 GDPR
- Right to object, Art. 21 GDPR
You may use our contact form in order to exercise your right. So that we can process your application and identify you, please note that we will use your personal data in accordance with Art. 6 (1) c) GDPR.
In your customer profile on our website, you can also check the current status of most of your Master Data yourself at any time. Please update your personal data immediately after any changes occur (for example, your postal address, e-mail address or telephone number).
You also have the right to file a complaint with a supervisory authority, Art, 77 of the GDPR, § 19 BDSG.
The competent supervisory authority for MMG is:
The Data Protection Commissioner of Hesse
PO Box 3163
Fax: 0611/1408-900 or 901
The competent supervisory authority for Lufthansa is:
Regional Officer for Data Protection and Freedom of Information of the State of North Rhine-Westphalia
Postfach 20 04 44
11. Right to Object according to Art. 21 GDPR
For reasons arising from your specific situation, you have the right to submit an objection to the processing of your personal data based on Art. 6 (1) e) or f) GDPR at any time.
We will no longer process the personal data that concern you, unless we can prove that there are compelling reasons for the processing that are worthy of protection and that outweigh your interests, rights and freedoms, or if the processing is used to enforce, exercise or defend legal claims.
If the personal data concerning you are processed to operate direct advertising, you have the right to submit an objection against the processing of your personal data for the purposes of such advertising at any time.
If you object to processing for the purposes of direct advertising, the personal data concerning you will no longer be processed for these purposes.
You have the option of exercising your right of objection in connection with the use of the services of the information company using an automated procedure - notwithstanding Directive 2002/58/EC - in which technical specifications are used.
You can object to the processing of your personal data at any time, for example by using our contact form as described in Section 10 of the Privacy Statement.
12. Miles & More Website, App and Communication Media
More information about the handling of (personal) data collected via our website, our app or our online communication media can be found in the separate data protection policies for the website, app and communication media at www.miles-and-more.com/privacy-statement-onlineufuwbcquasdwyyctawdw.
13. Data Security
We use technical and organisational security measures to protect your data that we process against accidental or deliberate manipulation, loss, deletion or access by unauthorised persons. Our security measures are being improved continuously as new technology develops.
We store your personal data on servers in Germany, in a European Union member state or in states which are party to the Agreement on the European Economic Area. When service providers are used, personal data may also be communicated to other countries in compliance with the applicable data protection regulations.
We check these Privacy Statements regularly and we will update these as necessary. Where there are significant changes made to these data protection policies, we will inform you (for example, on our website or in our app).
15. Data Protection Officer
The Lufthansa Group data protection officer is also the data protection officer for Miles & More GmbH. If you have any questions about data protection at Miles & More, please contact Dr Barbara Kirchberg-Lennartz (e.g. by post: Group Data Protection Officer, FRA CY, 60546 Frankfurt/Main or by e-mail firstname.lastname@example.org).