As of November 2021
In this data protection notice we inform you about the processing of your personal data in connection with the use of the Yilu platform ("Yilu platform").
The Yilu platform is operated by Yilu Travel Services GmbH, Gormannstr. 14, 10119 Berlin, Germany (“Yilu”) as the person responsible for the processing of your personal data within the meaning of the data protection regulation of the European Union (“GDPR”) and the Federal Data Protection Act (“BDSG “) Operated. You can find complete information on Yilu in the legal notice. Information on how to contact the Group data protection officer and the responsible supervisory authority can be found at the end of this data protection notice.
With regard to the services mediated on the Yilu platform, the partner is responsible for processing your data within the meaning of the GDPR and the BDSG.
When using the Yilu platform, the following personal data are processed:
Your payment data is collected by the payment processing platform of Stripe Inc., Delaware. Yilu does not process the credit card data.
The data collected by us will be processed by us to fulfill the brokerage contract and the contract for the use of the Yilu platform ("user contract") (Art. 6 Para. 1 S.1 lit. b GDPR - contract fulfillment and pre-contractual measures).
For example, we use your email address to send you booking confirmations or invoices as part of the user contract. We transmit your Miles & More service card number to Miles & More GmbH in order to fulfill our obligations under the user agreement.
In addition, we process your data for the purpose of fraud prevention and to assert legal claims (Art. 6 Para. 1 S. 1 lit.f GDPR - safeguarding legitimate interests - entrepreneurial interest in protecting the company from material and immaterial damage).
In order to be able to offer you our products and services based on our contractual obligations or in accordance with our legitimate interests, we use service providers such as IT service providers as contract processors in accordance with Art. 28 GDPR. The service providers have been carefully selected and work exclusively according to our instructions. They provide sufficient guarantees to comply with data protection obligations.
We transmit the data required to implement the service contract to our partners. This is a transfer between two responsible bodies (so-called controller-to-controller).
We transmit to Miles & More GmbH the data required for the mileage credit as part of the Miles & More program (Miles & More service card number, number of miles, type of service, location of the service provided, cost of the service).
If personal data is transmitted to third countries, suitable guarantees are provided for your protection and the protection of your data in accordance with the legal requirements (in particular the EU's adequacy decision, application of EU standard contractual clauses; information on EU standard contractual clauses can be found on the websites of the Europäische Union).
In addition, in certain cases we are legally obliged to provide personal data to German and international authorities (Art. 6 Para. 1 S. 1 lit. c GDPR - legal obligation).
The data collected by us will not be transmitted to other third parties.
We process your data as long as it is necessary for the fulfillment of our contractual and legal obligations. When the purpose for which your data was processed no longer applies, it will be deleted unless it is necessary to keep it for the following purposes:
As a data subject, you can exercise the following rights if the respective legal requirements are met:
In addition, you have the right to lodge a complaint with a supervisory authority, Art. 77 GDPR in conjunction with Section 19 BDSG.
The supervisory authority responsible for Yilu is:
Berlin Commissioner for Data Protection and Freedom of Information
You have the right, for reasons that arise from your particular situation, to object at any time to the processing of your personal data, which is based on Art. 6 Para. 1 lit. e or f GDPR.
We will no longer process your personal data unless we can prove compelling legitimate reasons for the processing that outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
If the personal data relating to you are processed in order to operate direct mail, you have the right to object at any time to the processing of the personal data relating to you for the purpose of such advertising.
If you object to processing for direct marketing purposes, the personal data relating to you will no longer be processed for these purposes.
In connection with the use of information society services - regardless of Directive 2002/58 / EC - you have the option of exercising your right of objection by means of automated processes that use technical specifications.
You can object to the processing of your personal data at any time.
Our partners provide you with information on how our partners handle your data, in particular on their respective websites.
This website uses Google Analytics, a web analysis service from Google Ireland Limited, (Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland). Use includes the "Universal Analytics" operating mode. This makes it possible to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus to analyze the activities of a user across devices.
You can prevent cookies from being installed by activating a corresponding setting in your browser software; however, we must inform you that, in this case, it is possible that you will not be able to use all the functions of this website entirely. Furthermore, you can prevent the capture of data by Google relating to your use of the website generated by the cookie (including your IP address), as well as the processing by Google of this data, by downloading and installing the browser add-on. Opt-out cookies prevent the future collection of your data when visiting this website. To prevent the capture of your data across multiple devices by Universal Analytics, you must complete the opt-out process on all systems you use.
This website uses Hotjar. The provider is Hotjar Ltd., Level 2, St Julians Business Center, 3, Elia Zammit Street, St Julians STJ 1000, Malta, Europe (website: https://www.hotjar.com).
Hotjar is a tool for analyzing your user behavior on our website. With Hotjar we can, among other things, Record your mouse and scroll movements and clicks. Hotjar can also determine how long you stayed with the mouse pointer on a certain point. From this information, Hotjar creates so-called heat maps, which can be used to determine which website areas are preferred by website visitors.
We can also determine how long you stayed on a page and when you left it. We can also determine at which point you canceled your entries in a contact form (so-called conversion funnels).
In addition, Hotjar can be used to obtain direct feedback from website visitors. This function serves to improve the website operator's web offers.
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when you close the browser. If cookies are deactivated, the functionality of this website may be restricted.
The use of Hotjar and the storage of Hotjar cookies are based on Art. 6 Para. 1 lit. f GDPR. The website operator has a legitimate interest in analyzing user behavior in order to optimize both its website and its advertising.Deactivating Hotjar
If you would like to deactivate data collection by Hotjar, click on the following link and follow the instructions there: https://www.hotjar.com/opt-out
Please note that Hotjar must be deactivated separately for each browser or for each end device.
For more information about Hotjar and the data collected, please refer to Hotjar's data protection declaration under the following link: https://www.hotjar.com/privacy
We use technical and organizational security measures to protect your data processed by us against accidental or deliberate manipulation, loss, destruction or against access by unauthorized persons. Our security measures are continuously improved in line with technological developments.
We regularly review this data protection notice and update it as necessary. We will inform you about significant changes to this data protection notice.
The group data protection officer of Deutsche Lufthansa AG is also the data protection officer of Yilu. If you have any questions about data protection, please contact the Group's data protection officer (e.g. by post: Deutsche Lufthansa AG, Group data protection officer, FRA CJ / D, Lufthansa Aviation Center, Airportring, 60549 Frankfurt or by email: email@example.com).