1. Controller

We, DEUTSCHE LUFTHANSA AG (Venloer Straße 151-153, 50672 Cologne, Germany) (hereinafter also “Lufthansa Group”, “we”, “us”), wish to inform you how your personal data is processed when you use our website www.lufthansagroup.com (“website”).

If you have any further queries regarding data protection in connection with our website or the services offered, please contact our data protection officer:

Group Data Protection Officer for the Lufthansa Group Email: datenschutz(at)dlh.de

2. Scope, purpose and legal basis of processing personal data

We collect and use personal data directly from our users and other sources (mentioned below) in the following situations: 2.1. Provision of the website and log file creation

Upon visiting our website, the system automatically records data and information about the user’s computer each time the website is accessed. The following data (“technical information”) is collected:

Information on the browser type and version used The user’s operating system The user’s internet service provider The user’s IP address Date and time of access Websites from which the user’s system accesses our website Websites accessed by the user’s system via our website The respective volume of data transmitted

The data is also saved in our system’s log files. This data is not stored together with other personal data of the user.

We collect and use this technical information for purposes of (network) security (for example, to ward off cyberattacks), to better understand our users’ needs, to continuously improve our website and to enable users to access the website from their computers.

The data is saved in log files in order to ensure website functionality. The data also helps us to improve the website and safeguard our information technology systems. The data is not analysed for marketing purposes in this context.

Art. 6 (1) (f) of the General Data Protection Regulation (GDPR) forms the legal basis for the temporary storage of the data and log files. 2.1.1. Use of cookies

Our website uses cookies. Cookies are text files stored in the web browser or by the web browser on the user’s computer system. When a user accesses a website, a cookie may be stored in the user’s operating system. This cookie contains a distinctive character string that allows for unique identification of the browser when the website is accessed again.

Cookies are stored on the user’s computer, which transmits these to our website. Therefore, users have full control over the use of cookies. You may disable or restrict the transmission of cookies by changing your web browser settings. Previously stored cookies can be deleted at any time. This may also be done automatically. If cookies are disabled for our website, you may no longer be able to use all of its functionality.

This website uses the following types of cookies, whose scope and functions are described below:

a) Transient cookies are deleted automatically when your close your browser. They particularly include session cookies. They store what is referred to as a session ID, with which your various browser requests can be assigned to a common session. As a result, your computer can be recognised again when you return to our website. The session cookies are deleted when you log out or close the browser. b) Persistent cookies are automatically deleted after a specified period, which can differ according to the cookie. You may delete the cookies in security settings of your browser at any time.

For further information on the cookies we use, their purposes and legal basis, please check our Cookie Policy. 2.1.2. Tracking tools

We use the following tracking tool on our website:

Sawmill

If details are accessed on our website, the following data (among others) is stored:

Two bytes of the IP address of the user system accessing the website The accessed web page The website from which the user has accessed the viewed web page (referrer) The sub-pages from which the viewed web page was accessed The time spent on the web page The frequency of accessing the web page

The software runs exclusively on our website’s servers. The user's personal data is only stored there. Distribution of the data to third parties is prohibited.

Our legitimate interest pursuant to Art. 6 (1) (f) GDPR in increasing the efficiency of our website is the legal basis for the use of the tool.

The processing of the user’s personal data enables us to analyse the browsing behaviour of our users. By analysing the data collected, we are in the position to compile information about the use of the individual components of our website. This helps us to steadily improve our website and its user friendliness. For these purposes, our legitimate interest in the processing of data is provided by Art. 6 (1) (f) GDPR. The anonymisation of the IP address adequately serves the interests of users in the protection of their personal data.

The data is deleted as soon as it is no longer needed for our record-keeping purposes.

In our case, this is after 90 days. 2.2 Information on data protection for the shareholders of Deutsche Lufthansa AG

Lufthansa shares are registered shares with transfer restrictions. Pursuant to Section 67 German Stock Corporation Act (AktG) and the provisions of the German Aviation Compliance Documentation Act (LuftNaSiG) applicable to Lufthansa, personal data is required for entering a shareholder in the shareholders’ register. You can find more detailed information on data protection for the shareholders of Deutsche Lufthansa AG here. 2.3. Use of the services offered on our website

We offer a range of different services on our website. We must collect and process user or customer personal data in order to perform these. 2.3.1. Ordering service for the sustainability report

You have the option of ordering the free delivery of the “Balance” sustainability report on our website. During the ordering process, the following data from the input screen is sent to us and processed:

Title* First name* Surname* Company/editorial team Department Email* Street / No.* Post code, town* Country*

The fields with a star next to them are mandatory. Unless this information is provided, the reports cannot be delivered. Our service provider will delete the data immediately after the report is sent. If you subscribe to the sustainability report, the data for delivery is stored until you cancel the subscription.

The legal basis for the use of the described process is our legitimate interest pursuant to Art. 6 (1) (f) GDPR since we cannot send the requested report to you without your postal address. 2.3.2. Applications for cooperations

You can submit applications for cooperations with the Lufthansa Group by clicking on a link on our website. The following data is transferred and processed from the form when the application is submitted:

Title* Academic Title Surname* First name* Company/Organization Position (within the company/organization) Street/No. Post code Town Country Address add-on Email* Phone number for further inquiries Website

The fields with a star next to them are mandatory, otherwise we cannot refer adequately to the request. The data will only be used for internal processing and to respond to your inquiry.

Your consent for the processing of this data is obtained during the registration procedure and reference is made to this privacy policy.

Accordingly, Art. 6(1)(a) GDPR forms the legal basis for data processing following the user’s application process if the user has given consent. 2.3.3. Online services for shareholders

When registering for online services, you have the option to receive the invitation to the Annual General Meeting and additional important shareholder information by electronic delivery.

For this purpose, we collect the following data:

Shareholder number Access password Email address Surname, First name Street, No. Post code, Town Date of birth

The legal basis for the processing of the aforementioned personal data for the described purpose is your consent pursuant to Art. 6 (1) (a) GDPR, which you issue when registering for the online service.

The data is deleted after three years, according to legal requirements. 2.3.4. Newsletter

You have the option of subscribing to a free newsletter on our website. When you subscribe, the following data from the input screen is sent to us and processed:

Action* (start of subscription, change of personal data, unsubscribing) Title* First name* Surname* Email* Email (former)

The fields with a star next to them are mandatory. Unless this information is provided, the newsletter cannot be sent via email.

The following data is also collected when you subscribe:

IP address of the computer accessing the website Date and time of registration

The collection of other personal data during the registration process helps to prevent misuse of the services or the email address that is used.

We process your data in connection with the newsletter in order to send you news about the Lufthansa share. This includes:

Advance announcements/announcements of quarterly or annual publications Publications of traffic figures Possible ad-hoc news

If a link in the newsletter takes you to our website, you also permit us to process and use your IP address, as well as geodata, web beacons and similar technologies, in order to verify whether the offers have met your requirements.

Your consent for the processing of this data is obtained during the registration procedure and reference is made to this privacy policy.

The data is deleted as soon as it is no longer needed for achieving the purpose for which it was collected. As a result, the user’s email address is stored for as long as the subscription to the newsletter is active. Accordingly, Art. 6(1)(a) GDPR forms the legal basis for data processing following the user’s subscription to the newsletter if the user has given consent. 2.3.5. Cranespotter Newsletter

On our website you have the possibility to subscribe to the free Cranespotter Newsletter to be invited to Cranespotting events of the Lufthansa Group. When you register for the newsletter, the data from the input mask is transmitted to us and processed:

Salutation* First name* Last name* email* age Social media platforms*

The fields marked with asterisks are mandatory, otherwise the e-mail cannot be sent. In addition, the following data will be collected during registration:

IP address of the calling computer Date and time of registration

The collection of other personal data as part of the registration process serves to prevent misuse of the services or the e-mail address used. The data are deleted as soon as they are no longer required for the purpose of their collection. The user's e-mail address will therefore be stored as long as the newsletter subscription is active. The legal basis for the processing of the data after registration for the newsletter is therefore necessary for the operation according to Art. 6 para. 1 lit. f DSGVO. 2.3.6. Statistical analysis

There is a possibility that your data may be analysed in a data warehouse to evaluate the preferences of our registered customers (“statistical analysis”) for the purposes of possible distribution at the Annual General Meeting as well as the optimisation of our website. We undertake this processing in order to acquire a better understanding of what our customers expect from our web presence. This analysis also helps us with auditing and safeguarding security, which is why we perform this processing to protect our legitimate interests, in accordance with Art. 6 (1) (f) GDPR. 2.4. Our legitimate interest in processing personal data.

If Art. 6 (1) (f) GDPR forms the legal basis for processing, our legitimate interests are, in addition to the purposes listed above:

To protect the Company against material and intangible damage. Professionalism (of our products and services) Cost optimisation (control and minimisation)

2.5. Other processing commitments

If obliged to do so by law, we process personal data in order to meet duties of retention under commercial or tax law or to meet legal security requirements (such as Section 7 of the Aviation Security Act [LuftSiG]). For further information on retention periods, please refer to “Duration of the data processing”. 2.6. Obligation to provide personal data

The input fields that are mandatory for performing the requested contract or service are marked accordingly on the website. The input is mandatory because of either legal or contractual requirements.

3. Duration of data processing

Your data is deleted as soon as it is no longer needed for the specified purposes. In certain circumstances, personal data is kept for the period during which claims against Deutsche Lufthansa AG may be enforced (statutory limitation period of three to thirty years). Personal data is also saved to the extent that and for so long as Deutsche Lufthansa AG is legally obliged to do so. Corresponding burdens of proof and duties of retention arise from, among others, the Commercial Code, Tax Code and Money Laundering Act. These prescribe retention periods of up to ten years.

4. Right to object pursuant to Art. 21 GDPR

You have the right to object, on reasons relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

The controller shall no longer process your personal data unless the controller demonstrates compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

Where your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data, which includes profiling to the extent that it is related to such direct marketing.

Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes.

In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you may exercise your right to object by automated means using technical specifications.

5. Disclosure of personal data to third parties or permitted recipients

In order to offer you our products and services, based on our contractual obligations or in accordance with our legitimate interests, we may have to disclose your personal data to third parties internal or external to the Lufthansa Group. These recipients can be categorised as follows:

Service providers

Printer (distribution of annual reports) Provider of our CRM tool (newsletter) Internet agency (website) Shareholder registrar

Personal data may be transmitted to third countries or international organisations as part of this. For your protection and the protection of your personal data, appropriate safeguards are provided for such data transmissions as per and in accordance with legal requirements (particularly the use of EU standard contractual clauses) or an adequacy decision has been issued by the European Commission (Art. 45 GDPR).

For information on EU standard contractual clauses, please visit https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:32010D0087&from=DE. The European Commission provides the relevant information relating to its adequacy decisions at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/adequacy-protection-personal-data-non-eu-countries_en#dataprotectionincountriesoutsidetheeu.

A copy of the security precautions used may also be requested from lufthansa-group(at)dlh.de.

We are also legally obliged to provide personal data to German and international authorities pursuant to Art. 6 (1) (c) GDPR with regard to local and international regulations and agreements.

6. Rights of the data subject

Deutsche Lufthansa AG is committed to ensuring fair and transparent processing. That is why it is important to us that data subjects can not only exercise their right to object but also the following rights where the respective legal requirements are satisfied.

Right of access, Art. 15 GDPR Right to rectification, Art. 16 GDPR Right to erasure (“right to be forgotten”), Art. 17 GDPR Right to restriction of processing, Art. 18 GDPR Right to data portability, Art. 20 GDPR

To exercise your rights, please email datenschutz(at)dlh.de. In order to process your request and for identification purposes, please note that we will process your personal data in accordance with Art. 6 (1) (c) GDPR.

You also have the right to lodge a complaint with a supervisory authority. The relevant supervisory authority for Deutsche Lufthansa AG is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit Postfach 3163 65021 Wiesbaden Telefon: +49 611 1408 - 0 Telefax: +49 611 1408 - 900 / 901 E-Mail: poststelle(at)datenschutz.hessen.de

7. Consent

If you have given your consent to us for processing your personal data, please note that you may withdraw this consent at any time.

If you have given your consent to receive our newsletter, you may withdraw this consent by using the “Unsubscribe” link in the newsletter.

In all other cases or if you have problems withdrawing your consent on this website, you can contact lufthansa-group(at)dlh.de.

Please note that your consent can only be withdrawn for future effect and such a withdrawal does not have any influence on the lawfulness of past processing. In some cases, we may be entitled regardless of your withdrawal to continue to process your personal data on a different legal basis – e.g. to perform a contract.

8. Disclaimer and limitations of these data protection notices

These data protection notices only apply to processing for the website www.lufthansagroup.com. Other websites are not covered by these data protection notices and provide their own specific data protection notices.