U.S. supplemental privacy notice

1.1

This U.S. Supplemental Privacy Notice (US Supplement) supplements OAG's main Privacy Notice and applies to personal information of residents of the U.S.

1.2

In the event of any conflict between this US Supplement and our main Privacy Notice, this US Supplement shall prevail for US residents covered by applicable US privacy laws.

2.1

Please note that OAG does not sell personal information for money. However, some disclosures (e.g., to marketing or analytics partners) may be considered a "sale" or "sharing" under state privacy laws. U.S. residents have the right to opt out of such sharing.

2.2

Sale of Personal Information: Under the broad definition of "sale" applied by applicable US state privacy laws (which extends beyond monetary transactions), in the preceding twelve (12) months, we may have sold or shared the following categories of personal information:

1. identifiers;
2. commercial information; and
3. internet or other similar network activity.

2.3

Sharing for Cross-Context Behavioral Advertising: We may have shared personal information with third parties for cross-context behavioral advertising purposes, including:

1. identifiers;
2. commercial information; and
3. internet or other similar network activity.

2.4

Categories of Third Parties: We share personal information to the following categories of third parties:

1. advertising networks;
2. data analytics providers;
3. marketing partners; and
4. social networks.

2.5

We do not knowingly sell or share the personal information of consumers under 16 years of age without affirmative authorization.

3.1

Under United States privacy laws, certain types of personal information are considered "sensitive" personal information or data and require additional data privacy rights and obligations. We collect financial information, account login, and precise geolocation, which may be considered "sensitive" personal information under privacy laws. Where required by law, we will obtain your consent before processing your sensitive personal information. We will also generally use your sensitive personal information for limited purposes, such as to provide the goods or services you requested; to prevent, detect, and investigate security incidents; to resist malicious, deceptive, fraudulent or illegal actions; and to verify or maintain the quality or safety of our products or services.

4.1

Right to Know: You have the right to request that we disclose certain information about our collection and use of your personal information over the past twelve (12) months, including:

1. the categories of personal information we collected about you;
2. the categories of sources from which the personal information is collected;
3. our business or commercial purpose for collecting, selling, or sharing personal information;
4. the categories of third parties with whom we share personal information;
5. the categories of personal information that we sold or shared and the categories of third parties to whom we sold or shared particular categories of personal information; and
6. the specific pieces of personal information we collected about you.

4.2

Right to Delete: You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.

4.3

Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.

4.4

Right to Opt-Out of Sale and Sharing: You have the right to opt out of our sale or sharing of your personal information.

4.5

Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of your sensitive personal information to purposes necessary to perform services reasonably expected by an average consumer.

4.6

Right to Data Portability: You have the right to receive your personal information in a portable and readily usable format that allows you to transmit the data to another entity without hindrance, where technically feasible.

4.7

Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising any of your consumer privacy rights.

4.8

Right to Appeal: Where required by applicable law, you have the right to appeal our decision if we deny your request to exercise any of the consumer rights described in this Section 4. We will inform you of the outcome of your appeal within the timeframe required by applicable law and will provide a written explanation of the reasons for our decision. If your appeal is denied, you may have the right to contact your state's Attorney General or applicable data protection authority.

5.1

To exercise your consumer rights, you may:

1. submit a request through our online privacy rights portal;
2. email us at privacy@oag.com; or
3. mail us at OAG Aviation Worldwide Limited, 1 Capability Green, Luton, Bedfordshire, LU1 3LU, United Kingdom, Attn: Privacy Rights.

5.2

Verification Process: We will verify your identity before processing your request. The verification process may require you to:

1. provide personal information to match against our records;
2. respond to verification questions; or
3. provide additional documentation as reasonably necessary.

5.3

Authorised Agents: You may designate an authorised agent to make requests on your behalf. The authorised agent must:

1. provide written authorisation signed by you; or
2. provide a power of attorney valid under applicable state law.

5.4

Response Timeline: We will respond to your request within forty-five (45) days, with the possibility of one forty-five (45) day extension where reasonably necessary.

5.5

Appeal Process: To appeal a decision to deny your privacy rights request, please contact us at privacy@oag.com with the subject line "Privacy Rights Appeal". Your appeal should include:

1. a description of the request that was denied;
2. the date of our denial; and
3. the reasons why you believe the denial was incorrect.

We will respond to your appeal within forty-five (45) days of receipt, or such other period as required by applicable law, and will provide written notice of our decision and the reasons for it. If your appeal is unsuccessful, we will provide information about how to contact your state Attorney General or other applicable authority.

6.1

An opt-out preference signal is a signal that is sent by a platform, technology or mechanism on your behalf that communicates your choice to opt-out of the sharing for targeted advertisements or sale of your personal information. You can learn more about implementing opt-out preference signals at globalprivacycontrol.org or by exploring other developing technologies and services that offer this tool.

6.2

We treat opt-out preference signals as valid requests to opt-out of the sale or sharing of your personal information under privacy laws. Ordinarily, your opt-out preference signal is sufficient for us to honour your request, but in some instances we may request additional information to help facilitate your request for offline sales or sharing. We will not use, disclose or retain this additional information for any purpose other than to facilitate the request.

6.3

If, for any reason, your opt-out preference signal cannot be honoured directly (for example, due to technical limitations or signal loss), you may opt out by submitting a request through our designated privacy contact at privacy@oag.com. We will not discriminate against you or take any adverse action because you opt out.

7.1

We retain personal information for as long as necessary to fulfill the purposes for which it was collected and processed, unless a longer retention period is required or permitted by law.

7.2

Retention Criteria: We determine retention periods based on:

1. the nature and sensitivity of the personal information;
2. the purposes for which we process the personal information;
3. applicable legal requirements;
4. our legitimate business interests; and
5. the potential risks to individuals.

7.3

Deletion: When personal information is no longer needed, we will securely delete or anonymise it in accordance with our data retention and deletion policies.

8.1

Our services are not directed to children under 13 years of age, and we do not knowingly collect personal information from children under 13.

8.2

COPPA Compliance: If we learn that we have collected personal information from a child under 13 without verification of parental consent, we will delete that information as quickly as possible.

8.3

Teen Privacy: For consumers between 13 and 16 years of age, we require opt-in consent before selling or sharing their personal information.

9.1

Shine the Light Law: California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes during the preceding calendar year.

9.2

CCPA Private Right of Action: California residents have the right to pursue remedies in civil court for certain data breaches involving personal information.

9.3

California Consumer Privacy Rights: This section supplements the consumer rights described in Section 4 with additional rights specific to California residents under the CCPA/CPRA.

If you have any questions about this U.S. Supplemental Privacy Notice, please contact us:

Email us at privacy@oag.com; or

Mail us at OAG Aviation Worldwide Limited, 1 Capability Green, Luton, Bedfordshire, LU1 3LU, United Kingdom; Attn: Privacy Rights.

11.1

We may update this US Supplement from time to time to reflect changes in our practices or applicable law.

11.2

We will post any updates on our website and, where required by applicable law, provide notice of material changes.

11.3

The effective date at the top of this US Supplement indicates when it was last revised.

12.1

This US Supplement is effective as of the date specified above.

12.2

This US Supplement shall be governed by and construed in accordance with applicable US federal and state privacy laws.

12.3

Any disputes arising under this US Supplement shall be resolved in accordance with the dispute resolution mechanisms provided under applicable privacy laws.