The client is placed at the center of CFL’s concerns.

Likewise, and by its very nature, the protection of your personal data is a priority for CFL-Evasion, or rather for each entity of the CFL Group that is authorized to process your personal data for the needs of its activities.

This notice provides you with the necessary information and explains how we collect, use, share, store and protect your personal data. It also informs you about your rights and how to exercise them.

1. who is responsible for the treatment?

CFL-Evasion établie et ayant son siège social au 13 Place de la Gare, L-1616 Luxembourg et inscrite au Registre de Commerce et des Sociétés (Luxembourg) sous le numéro XXXXX, is the person responsible for the processing of personal data concerning you that we process.

A ce titre, nous sommes responsables de la manière dont nous recueillons, utilisons, partageons, stockons et protégeons vos données personnelles.

2. which categories of personal data are processed and for what purposes?

In order to fulfill our consulting and sales tasks, we collect and process certain of your personal data, which may include the following:

Depending on the type of purpose pursued, the categories of data (for all participants in a trip) are generally as follows:

• Personal details (surnames, first names, address(es), telephone number(s), e-mail addresses, etc.) for all participants on a trip.
• Data on personal characteristics (date of birth, gender, nationality, identity card and/or other official identification documents, profession, etc.),
• Data relating to the participants on your trip: In order to inform and obtain the consent of all fellow travelers you wish to register with us about their personal details and personal characteristics (surname, first name(s), address(es), telephone number(s), date of birth, gender, nationality, identity card and/or other official identification documents, profession, etc.), it is recommended that you download this information from our website www.cflevasion.lu before submitting the data for the purpose of obtaining their prior consent,
• Data for electronic identification in the event of access to a CFL application (IP addresses, cookies, e-mail address, etc.),
• Data relating to customer loyalty programs by type (e.g. train, hotels, airline, shipping company or other),
• Data relating to your arrival and departure dates and other booking details,
• Data relating to your preferences and interests (e.g. smoker, non-smoker, cultural interests, etc.),
• Financial data (credit card or bank account number), in relation to your purchase of services.

In certain cases, we also process special categories of personal data, also known as sensitive data:

• Data relating to health, such as the administration of assistance/ repatriation etc. at your request, which may include data relating to your health.

Purposes of the processing:

In all cases, we undertake to ensure that the data is collected for the specified purposes and that it is processed in an appropriate and reasonable manner and only for what is necessary in view of the purpose pursued.

We use your personal data for general purposes and with the aim of completing your travel bookings that you make with CFL-Evasion.

To provide you with the products and services you have requested, to provide you with travel confirmations and updates, to manage your customer number, including processing invoices and sending travel notifications, generally to communicate with you, to respond to your questions and comments, to enable us to contact you as part of our customer service when necessary; to assess interest in and improve our products, services and website, to inform you by email or post about our special offers and travel products and services that may be of interest to you, to resolve disputes, and for all other purposes described in the collection section.

The following are the purposes pursued:

• The management of the services provided by CFL-EVASION,
• The management of the distribution and sale of travel services,
• The management of contractual relationships with clients,
• The management of archiving,
• The administration of customer and supplier accounting,
• Commercial management of travelers and prospective customers, analysis of travelers’ needs,
• The management of complaints and incidents,
• The underwriting administration of claims,
• The management of the recovery,
• The preparation of statistics.

3. how do we collect, process and use your data?

We collect and use the personal data you provide when you use our services.

Your data will be collected and processed for each of the purposes described above:

• in accordance with the applicable regulations on the protection of personal data, including the GDPR (European Regulation UE 2016/679 of April 27, 2016), the associated guidelines and the national laws that implement the GDPR, if applicable,
• on the legal basis of:
• either the fact that the processing of your personal data is necessary for the performance of a contract to which you are party or for the implementation of pre-contractual measures taken at your request,
• or on the basis of your consent,
• or on the basis that the processing is necessary for compliance with a legal obligation to which we are subject in our capacity as controller of the processing,
• or if the processing of your data is necessary for the performance of a task carried out in the public interest in which we are involved (safety of passengers and staff, protection of goods, prevention and identification of infringements, etc.)

4. where will your data be processed – will your data be transferred?

Your data is processed by our team, which takes all appropriate technical and organizational precautions to protect the security of your personal data and, in particular, the confidentiality, integrity and availability of your personal data.

Strictly within the scope of the aforementioned purposes, and whenever necessary, we share your personal data with certain internal departments of the CFL Group, and in strict compliance with the tasks assigned, with departments such as: CFL’s IT department, CFL’s legal and insurance department, CFL’s finance and controlling department, logistics, our auditors, the Luxembourg or foreign competent authorities.

For the proper fulfillment of our tasks and in accordance with your travel request, your data may be passed on to our suppliers, such as the airlines of the IATA or International Air Transport Association(http://www.iata.org/Pages/privacy.aspx ), maritime shipping companies, bus companies, railroad companies, vehicle rental companies, hotels and suppliers of activities such as: BREVO, Aldiana GmbH, AMEROPA-REISEN GmbH, DER Touristik Deutschland GmbH, Dr. Tigges GmbH, Gebeco GmbH & Co KG, Holiday Extras GmbH, Inter Chalet, Interhome AG, ITS Reisen, Jahn Reisen, Luxair Tours, Marco Polo Reisen, Meier`s Weltreisen, Novasol, OLIMAR Reisen Vertriebs GmbH, Studiosus Reisen München GmbH, Sunny Cars GmbH, Troll Tours, TUI Cruises GmbH, TUI Deutschland GmbH, Wolters Reisen GmbH, Tui Cruises, Aida, Msc Croisières, Norwegian Cruise Linde, Celebrity Cruises, Royal Caribbean International, Star Clippers, Celestyal Cruises, Holland America Linde, Hapag Llyod Cruises, Le Ponant, SilverSea, Seabourn, A-Rosa Flusskreuzfahrten, Cunard, Croisieurope & Croisimer, Hurtigruten, Phoenix Reisen Gmbh, Ameropa White Label, ACCOR, Bedsonline, Booking.com; Generaltours, Lernidee, Oboena, Restel; Schmetterling, Transeurope, Expedia.be, RTK International, Union Luxembourgeoise de Tourisme; Cruisopolis, Voyages Emile Weber, Voyages Demy Schandeler etc. [1], who carry out your travel bookings.

We recommend, if you wish, that you read the confidentiality policies of these third party suppliers of travel services whose products you purchase from CFL-Evasion.

Please note that these suppliers may also contact you if necessary to obtain additional information about you, to facilitate your travel booking or to respond to any criticism you may have expressed.

If you are visiting a country outside the EU, please note that your data may also be transferred, stored and processed outside the EU and in accordance with other legal systems.

5 How long do we store your data?

We store your personal data for as long as it is necessary to fulfill the purpose and for your processing, and also for as long as we can fulfill our obligations due to limitation periods and/or other legal regulations.

6. what rights do you have in relation to your personal data?

You have the following rights under the conditions set out in the Regulation:

• Access to the personal data we hold about you,
• Arrange for data to be corrected if it is incorrect or incomplete,
• Erasure, in certain cases, such as each time your data is no longer necessary for the purpose for which it was collected or processed and if we have not yet done so due to obligations arising from laws and regulations relating to data retention periods,
• Request restriction of processing of your personal data, such as restricting the processing of data whose accuracy you contest and for the period necessary for us to consider your request,
• Request portability of your personal data in order to provide you with your personal data in a commonly used structured format or to transmit it to another controller,
• Withdraw your consent to the processing of your personal data at any time , without affecting the lawfulness of processing based on consent before its withdrawal, except where the processing is based on a legal basis other than your consent,
• Object to the processing of your data based solely on the pursuit of our legitimate interests or to prohibit us from processing it, including for direct marketing,
• lodging a complaint with the authority responsible for data protection in your country and/or the Grand Duchy of Luxembourg (Commission Nationale Pour la Protection des Données – CNPD, located at 1 avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette – cnpd.public.lu ).

7 How can you contact us to exercise your rights?

You can send your questions about the processing of your personal data to CFL’s Data Protection Officer/DPO or exercise your aforementioned rights:

• On our homepage www.cflevasion.lu by clicking on the link https://gdpr.cfl.lu
• or by post to the attention of the Data Protection Officer/ DPO

CFL EVASION , 13 place de la gare – L-1616 Luxembourg

Complaints regarding the processing of your personal data can be sent by e-mail or by post to the address below, or to the supervisory authority of the Grand Duchy of Luxembourg, Commission Nationale Pour la Protection des Données – CNPD, located at 1 avenue du Rock’n’Roll, L-4361 Esch-sur-Alzette – www.cnpd.public.lu.

8. how do we update this information?

We undertake to update this information whenever necessary to ensure that we comply as closely as possible with the applicable regulations.

The latest valid version will be published online on our homepage.

[1] (This list is subject to change.)