Information Notice on Personal Data Protection

For the CFL, the customer is the main concern.

For this reason, naturally, the protection of your personal data is an absolute priority for CFL-Evasion, which processes your personal data for the purposes of its activity.

This information notice provides you with the necessary information and explains to you how we collect, use, share, store and protect your personal information. It also informs you of your rights and how to exercise them.

1.    Who is the controller?

CFL-Evasion S.A. – 13, Place de la Gare, L-1616 Luxembourg is the Controller of your personal data processed by us.

In this capacity, we are responsible for the way in which we collect, use, share, store and protect your personal data.

2. Which categories of personal data are processed and for what purposes?

To carry out our advisory and sales tasks, we collect and process some of your personal data, which may be the following:

Depending on the type of purpose pursued, in general the data categories are the following (for all the tour participants):

  • Identification data (surnames, first names, address(es), telephone number(s), electronic addresses, etc.) for all the tour participants,
  • Personal characteristics data (date of birth, gender, nationality, identity card and/or other identifying administrative documents, profession, etc.),
  • Data relating to the composition of your tour: in order to inform and obtain the consent of all the tour participants you wish to register with us with respect to their identification data and personal characteristics (surnames, first names, address(es), telephone number(s), date of birth, gender, nationality, identity card and/or other identifying administrative documents, etc.). Before communicating them to us, it is recommended downloading this information notice from our website www.cflevasion.lu with a view to prior consent,
  • Electronic identification data in the case of access to a CFL application (IP addresses, cookies, e-mail address, etc.),
  • Data relating to loyalty schemes of various types (e.g. train, hotels, airline, shipping line or other),
  • Data relating to your dates of arrival and departure, together with the other details of your reservations,
  • Data relating to your preferences and interests (e.g. smoker, non-smoker, cultural interests, etc.),
  • Financial data (credit card or bank account numbers) relating to your service purchase.

In certain cases, we also process specific categories of personal data, also known as sensitive data:

  • Data relating to health, such as organisation, at your request, of assistance / repatriation, etc. which may contain data relating to your health,

Processing purposes:

In all cases, we undertake to ensure that the data are collected for the specific purposes and that the processing is adequate, relevant and limited to what is necessary for the purpose pursued.

We use your personal data for general purposes and in order to complete your travel reservations with CFL-Evasion

to provide you with the products and services you request, to provide you with travel confirmations and updates, to manage your customer number, including to process invoices and send travel notifications, to communicate with you in general, to respond to your questions and comments, to enable us to contact you in the customer service context, if necessary; to gauge the interest in our products, services and website and to improve them, to inform you by e-mail or post of our special offers and of travel products and services which may interest you, to resolve disputes and for any other reason described in the paragraph relating to collection.

The purposes pursued are the following:

  • management of the services provided by CFL-EVASION,
  • management of the distribution and sale of travel services,
  • management of contractual relationships with customers,
  • records management,
  • management of customer and supplier accounts,
  • commercial management of travellers and prospects, analysis of traveller needs,
  • management of complaints and incidents,
  • management of insurance claims,
  • management of recovery,
  • compilation of statistics.

3. How do we collect, process and use your data?

We collect and use the personal data with which you provide us when you use our services.

Your data are collected and processed for each purpose described above

  • in accordance with the current regulations on the protection of personal data, including the GDPR (European Regulation (EU) 2016/679 of 27 April 2016), the related Guidelines and the national laws implementing the GDPR, where appropriate,
  • legally justified
  • by the fact that the processing of your personal data is necessary for the performance of a contract to which you are a party or for the performance of pre-contractual measures undertaken at your request,
  • or on the basis of your consent,
  • or by the fact that the processing is necessary for compliance with a legal obligation to which we are subject as controller
  • or when the processing of your data is necessary for the performance of a task of general public interest with which we are entrusted (passenger and staff safety, protection of property, prevention and identification of offences, etc.).

4.  Where are your data processed? Are your data transferred?

Your data are processed by our team, which takes all the appropriate technical and organisational measures to protect the security of your personal data and first and foremost the confidentiality, integrity and availability of your personal data.

Within the strict framework of the purposes referred to above and whenever it is necessary, we share your personal data with certain in-house departments of the CFL Group, with strict observance of the tasks assigned to these departments, such as: CLF IT department, CFL Legal and Insurance department, CFL Financial and Management Control department, CFL Logistics, our auditors, the Luxembourg authorities or the competent foreign authorities.

To carry out our task and in accordance with your travel request, your data may be transferred to our suppliers, such as International Air Transport Association (IATA) airlines (http://www.iata.org/Pages/privacy.aspx), shipping lines, coach companies, railway undertakings, vehicle hire firms, hotels, suppliers of recreational activities, such as: Airtours, Aldiana GmbH, AMEROPA-REISEN GmbH, DER Touristik Frankfurt GmbH & Co. KG, DER Touristik Köln GmbH , Dr. Tigges GmbH, Gebeco GmbH & Co KG, Holiday Extras GmbH, Inter Chalet, Interhome AG, ITS Reisen, Jahn Reisen, Luxair Tours, Marco Polo Reisen, Meier`s Weltreisen, Neckermann Reisen, Novasol, OLIMAR Reisen Vertriebs GmbH, Studiosus Reisen München GmbH, Sunny Cars GmbH, Thomas Cook Reisen, Thomas Cook Vertriebs GmbH, Troll Tours, TUI Cruises GmbH, TUI Deutschland GmbH, Wolters Reisen GmbH, Tui Cruises, Aida, Msc Croisières, Norwegian Cruise Linde, Celebrity Cruises, Royal Caribbean International, Star Clippers, Celestyal Cruises, Holland America Linde, Hapag Llyod Cruises, Le Ponant, SilverSea, Seabourn, A-Rosa Flusskreuzfahrten, Cunard, Croisieurope & Croisimer, Hurtigruten, Phoenix Reisen Gmbh, Ameropa White Label, ACCOR, Bedsonline, Booking.com; Generaltours, Lernidee, Oboena, Restel; Schmetterling, Transeurope, Expedia.be, Neptun Cruises, RTK International , Union Luxembourgeoise de Tourisme; Cruisopolis, Voyages Emile Weber, Voyages Demy Schandeler, etc.,[1] which make your travel reservations.

We recommend, if you wish, that you should read the confidentiality policy of these third-party tour operators whose products you are buying from CFL-Evasion.

Please note that these suppliers may also contact you, if necessary, to obtain additional information concerning you, to facilitate your travel reservation or to respond to any criticism you may have made.

If you visit a non-EU country, please note that your data may also be transferred, stored and processed outside the EU and according to different laws.

5. How long do we store your data?

We store your personal data for as long as they are needed to carry out the purposes of their processing and for the time necessary for us to fulfil our obligations arising from limitation periods and/or any other legal provisions.

6. What are your rights in relation to your personal data?

Under the conditions provided for in the regulations, you have the right:

  • of access to the personal data we hold concerning you,
  • of rectification of the data if they are inaccurate or incomplete,
  • of erasure in certain cases, such as, for example, whenever your data are no longer necessary for the purpose pursued with a view to their collection and/or processing, which we have not yet done by virtue of the expiry of obligations arising from legal and regulatory requirements applicable to the data storage period,
  • to request the restriction of processing of your personal data, such as for example the restriction of processing of data of which you contest the accuracy, for the period enabling us to verify your request,
  • to request the portability of your personal data in order to transmit your personal data to you in a structured, commonly used, readable format or to have them transferred to another controller,
  • to withdraw your consent at any time to the processing of your personal data without this affecting the lawfulness of processing based on the consent given prior to withdrawal and unless the processing has a legal basis other than your consent,
  • to object to the processing of your data based solely on the pursuit of our legitimate interests or to prohibit us from processing them, including for direct marketing,
  • to lodge a complaint with the competent personal data protection authority of your country and/or the Grand Duchy of Luxembourg (Commission Nationale Pour la Protection des Données – CNPD, located at 1, avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette – cnpd.public.lu ).

7. How do you contact us and exercise your rights?

You can send your questions relating to the processing of your personal data and/or exercise your rights set out above for the attention of the Data Protection Officer (DPO) of the CFL:

  • on our website www.cflevasion.lu by clinking the link https://gdpr.cfl.lu
  • or by post for the attention of the Data Protection Officer (DPO)

CFL EVASION, 9 place de la gare – L-1616 Luxembourg

Any complaint relating to the processing of your personal data can be addressed to the e-mail or postal address above or to the supervisory authority of the Grand Duchy of Luxembourg, the Commission Nationale Pour la Protection des Données – CNPD, located at 1, avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette – www.cnpd.public.lu  ).

8. How do we update this information notice?

To ensure optimum compliance with the current regulations, we undertake to update the present information notice whenever necessary.

The latest version in force is placed online on our website.

[1] (Changes may be made to this list.)