When choosing to travel with AirConnect, the airline will be able to process the personal data you provide (both yours and your family members and other people you travel with) for the following purposes:

a) Providing air passenger transport or freight air services, that is issuing and modifying the flight ticket, providing check-in and boarding service, as well as providing additional services.

b) Providing tourist services packages through travel partner agencies.

c) Providing special services for persons with disabilities or those in need of special medical care.

d) Provision of on-board catering services to passengers requiring a special diet.

e) Confirmation of services purchased on-line and provision of additional services (notifications regarding program changes, route, operating program, etc.).

f) Invoicing and collecting the sum of money representing services ordered by you from us and making payments online.

g) Ensuring transaction security / online payment by applying anti-fraud filters to online payment.

h) Immigration control and customs control to ensure transport safety and legality.

i) Responding to requests and complaints.

j) Carrying out surveys on customer satisfaction, performance of statistics aimed at improving the quality of AirConnect services.

k) Submitting offers, advertising and marketing messages about the products or services provided by AirConnect or its partners to measure the success of our advertising campaigns or personalize the services according to your needs.

The processing of personal data for the purposes set out in points a) to i) is required for the provision of air transport services (performance of the contract), the fulfillment of the legal obligations of AirConnect or the legitimate interest of AirConnect or third parties. The processing of personal data for the purposes set out in points j) and (k) will only take place with the express consent of the person concerned.

In order to achieve the above goals, AirConnect processes the following categories of personal data:

Passenger identification data:

• first and last name,

• home/residence address,

• e-mail address,

• personal identification number,

• fixed / mobile phone number,

• ID number and series, passport series / number, visa data,

• Information about the services you have purchased (provided directly by AirConnect or the partner agencies),

• Data on credit / debit cards used for payment, bank accounts,

• Details of your trip (e.g. booking details and additional services requested and provided),

• Information about your communication with AirConnect and its staff,

• Processing of special categories of personal data.

In some cases, AirConnect processes passenger health data to ensure optimum travel conditions and to provide special services for people with disabilities or those in need of special medical assistance (e.g. when you are applying for a diet in particular, you need medical assistance or assistance to travel to and from the aircraft, etc.).

For processing these categories of data, passengers must express their consent to this effect.

Refusal to provide such consent will make AirConnect unable to provide the required services.

These data may also be used by AirConnect to establish, exercise or defend a right in court, and when processing is necessary for reasons of major public interest.

AirConnect may disclose personal data of passengers to third parties in order to meet a legal obligation of the air operator to perform the transport contract as well as to provide the services purchased or where such actions are necessary to protect and defend the property rights of AirConnect or emergency response to protect the personal safety of passengers.

These data recipients can be:

• Travel agencies and other providers from whom you have purchased services (such as travel insurance, airport transfer, etc.) through AirConnect

• AirConnect partners in whose programs you have signed up

• Banks and other payment service providers to process payments initiated by you

• Providers of handling and catering services

• External service providers and AirConnect customer support

• Market research companies, customer satisfaction studies and marketing and advertising services, etc.

• AirConnect’s contractual partners, in order to promote the products and services marketed by them

• Public authorities (General Customs Directorate, Border Police, etc.), in accordance with the legal obligations established by AirConnect

• International bodies (EUROPOL, INTERPOL, IATA)

• Courts of arbitration or arbitral tribunals and competent authorities to investigate criminal offenses

• Other subcontractors of AirConnect.

Personal Data collected by AirConnect cannot be kept longer than is necessary for the purposes for which they are processed, in compliance with applicable law.

After this period, your personal data will be completely deleted from the systems or converted to anonymous data in accordance with the company’s procedures.

Personal Data collected for the purpose of transmitting commercial communications will be processed until the date of withdrawal of the consent expressed by the data subject.

Your personal data may be transferred outside Romania under legal or contractual obligations.

The recipient companies processing the personal data of AirConnect passengers within the European Union/ European Economic Area are subject to the same legal provisions and offer the same level of protection as that offered by AirConnect. However, if the fulfillment of the objectives set by AirConnect will require the transfer of passengers’ personal data to recipients outside the European Union / European Economic Area or to States which do not provide adequate protection, AirConnect will require the respective recipients to protect personal data in accordance with the requirements of the Regulation.

When we collect data directly from you, we may ask you whether you wish to receive our marketing communications or join the KONnectibles program. In this sense, please keep in mind that these marketing communications may be about our products and services that may be of interest to you, but they may also promote products and services of other members of our group or of a third party.

We will respect your decision regarding which communications you wish to receive and the way you want to receive them.

Data subjects whose personal data are processed by AirConnect may exercise the following rights set out in Regulation:

a. The right to be informed about Personal Data processed.

b. The right to obtain confirmation that it processes the Personal Data of the data subject and, if so, access to that data and information such as the purposes of the processing,

the categories of personal data concerned, the recipients or the categories of recipients, where possible, the expected storage period.

If Personal Data is not collected directly from the data subject, the source of such data as well as, where appropriate, the existence of an automated decision making process including the creation of profiles.

c. The right to rectify inaccurate Personal Data or to fill them out.

d. The right to delete Personal Data, in accordance with the provisions of the Regulation.

e. The right to restrict processing when one of the following cases applies: the data subject disputes the accuracy of the data, the processing is illegal, the data subject opposes the deletion of the data when no longer needs Personal Data for processing but the data subject seeks for the establishment, exercise or defense of a right in court or where the data subject opposes processing for the period of time to verify whether the legitimate interests of prevail over those of the data subject.

f. The right to data portability, which consists in requesting AirConnect to transmit Personal Data provided by the data subject in a structured format that is currently used and readable automatically, and the data subject sends it to another operator (within the limits set by the Regulation and provided that the necessary technical means are available to secure this right).

g. The right to object to the processing of Personal Data at any time, free of charge and without justification for situations such as:

i. personal data processing activities, for situations where the consent of the data subject does not need to be obtained

ii. adopting an automated decision, including profile creation

iii. conducting processing activities necessary for the fulfillment of a legitimate interest of AirConnect.

In case of unjustified opposition, AirConnect is entitled to further process Personal Data.

If the data subject repeatedly and unjustifiably exercises his right to object, AirConnect reserves the right to cease responding to such requests.

The right of opposition shall not be exercised with respect to the processing of the Personal Data required for the execution of the air transport contract or the fulfillment of the legal obligations of AirConnect.

h. The ability of the person concerned to request AirConnect not to be the subject of a decision based solely on automatic processing, including profile creation and producing legal effects that affect the data subject or significantly affect it.

With regard to the adoption of a decision based solely on automatic processing, the data subject has the opportunity to express his/her point of view, to request the intervention of a human operator and the possibility of challenging such a decision in the manner described in this information.

We inform you that AirConnect does not apply decision-making procedures based solely on automatic processing.

i. If the data is processed based on your consent, you have the right to withdraw your consent at any time, without prejudice to the lawfulness of the processing performed up to that point.

j. The right to file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP).

In order to exercise the rights, set forth in subparagraphs a) – i) above, you may submit to AirConnect written, dated and signed request at the Headquarters:

Str. Aurel Vlaicu, nr. 9, Otopeni, Ilfov, Romania or you may submit such a request on the email to the Personal Data Protection Officer at the email address dpo@air-connect.com.