Textron Aviation Inc. Privacy Policy

Last Updated and Effective: September 15, 2023

We at Textron Aviation Inc. ("TAI", "us", "our", or "we") are strongly committed to transparency, and we want you ("you" or "your") to understand how we collect, use, share and protect your personal information, as well as the rights and choices you have with respect to your personal information and how you can contact us to get answers to your questions. This Privacy Notice applies to the personal information we obtain in various contexts, both online and offline, including when you access or use our websites (txtav.com and its various sub domains), mobile applications, or any other applications or services that link to this Privacy Notice; interact or communicate with us; purchase or use our products, services, or features; engage with us on social media; interact with our advertising or marketing materials; or participate in any of our programs or events (collectively, our "Services"). This Privacy Notice also applies to individuals who apply for a position with us. Our privacy practices are subject to the applicable laws of the places in which we operate so you may see additional region-specific terms that only apply to customers located in those geographic regions, or as required by applicable laws. For example, Section 12 explains how to contact us for the purposes of EU and UK privacy laws. For certain products, services, and features, there may be additional notices about our practices and this Privacy Notice supplements any other privacy policies provided or communicated to you. Please read those additional privacy disclosures to understand how they apply to you.

By using our Services, you acknowledge the terms of this Privacy Notice. If you do not understand the terms of this Privacy Notice, please do not use our Services. If you have questions about this Privacy Notice, please contact us before using, or continuing to use, our Services. Our Services may include links to websites and/or applications operated and maintained by third parties. Please note that we have no control over the privacy practices of websites or applications that we do not own. We encourage you to review the privacy practices of those third parties.

We reserve the right to change our Privacy Notice from time to time by posting the changes here. If we choose to amend this Privacy Notice, we will revise the Last Updated date at the top of this Privacy Notice when we post the updated version. We may also provide you with notice by prominently posting on our website, via email or both, if we make any significant changes to this Privacy Notice. Your use of our Services after we have informed you in one of these ways that we made changes to our Privacy Notice will mean that you have accepted those changes.

1. TYPES OF INFORMATION WE COLLECT

We collect two basic types of information from you when you provide it to us or when you use or interact with our Services or through our advertising and media across the Internet: personal information and non-personal information.

Personal information includes all information that relates to you or which are opinions about you personally and either identifies or may be used to identify you personally (collectively, "personal information"). We may only collect the following, limited types of personal information from you depending upon the device you are using and how you interact with us or use or interact with our Services, such as your:

• Contact Information. Name, address, email address, phone and fax number, company name, title, and other contact information.
• Device Information. IP address, browser type and version, browser plug-in types and versions, operating system and platform, device type, device identifiers, and information about how you use our Services.
• Geolocation Data. Information generated from your IP address that permits us to determine your general location.
• Payment Information. Credit and debit card, bank account, and other financial information necessary to send and receive payments.
• Purchase Information. Customer ID, record of purchases and training programs, service schedules, other information as requested to facilitate or complete delivery or to make available and provide ongoing support, maintenance, repair, training, or other Services related to the Services being purchased.
• Video & Audio Recordings. Audio and video collected via our security systems deployed inside and outside of our facilities.
• Account Information. If you create an account, we may store and use your name, email address, zip or postal code and other personal information you may provide with your account. You can modify some of the personal information associated with your account. If you believe that someone has created an unauthorized account, you can request its removal.
• Aircraft Location, Maintenance, & Performance Information. Certain Services such as FDM or LinxUs may collect data from aircraft that includes precise location, maintenance-related data, equipment installed on the aircraft, and numerous signals from the aircraft about its performance.
• Passport Information. Certain in-person visitors to our facilities may be required by applicable law to submit their passports for copying and retention.
• Concierge & Flight Information. When you fly on a demo flight or any other flight arranged by us, we will collect basic information as mandated by the applicable national flight authority. We may also collect, if you provide it, information about your preferences and interests during the delivery process.
• Inferences. Inferences drawn from or created based on any of the information identified in this list.
• Job Applicants. As part of the application process, we may collect your contact information as well as certain information about you, including, race, ethnicity, previous employment and education history, references, information relating to disabilities, physical or mental health information, sexual orientation, veteran status, trade union membership, immigration or naturalization records, information relating to your criminal record and background check, interview notes, and any correspondence between us.

We strive to uphold data minimization principles and only seek to collect personal information from you for the purposes described in this Privacy Notice.

Non-personal information includes information that does not personally identify you or information that has been anonymized (collectively, "non-personal information"). When we combine non-personal information with personal information, we treat the combined information as personal information.

You can always refuse to provide your personal information, but please note that some personal information is necessary to provide our Services.

2. HOW WE COLLECT PERSONAL INFORMATION

We need to collect personal information from you in order to provide you with our Services, as well as to improve your experience. You may provide us with personal information in several ways, including, for example when you:

• Visit our website or use our Services, including using certain Services when operating an aircraft;
• Register or create an account;
• Correspond with us in any way, including through questionnaires, surveys, and job applications;
• Sign up to receive our newsletter or promotional information;
• Ask for customer service, support or other assistance; or
• Interact with us in any other way, online or offline, including through our Services.

Web Beacons & Cookies

Like many websites and apps, we use web beacons and "cookies", which are small text or image files that are stored on your computer or equipment when you visit certain online pages that record your preferences and actions, including how you use a website. We use this information for analytics purposes which allows us to improve your experience. The information we collect through these technologies will also be used to manage your session. Out of these, the files that are categorized as "necessary" are stored on your browser as they are essential for the working of basic functionalities of the website. Disabling these necessary files may result in a website or app not functioning properly.

You can set your browser or device to refuse beacons or cookies or to indicate when they are being sent. If you delete them or if you opt-out , or if you set your browser or device to decline these technologies, some Services may not function properly. Our Services do not currently change the way they operate upon detection of a Do Not Track or similar signal.

Online Analytics

We also use various types of online analytics including Google Analytics, a web analytics service provided by Google, Inc. ("Google"), on our website. Google Analytics uses cookies or other tracking technologies to help us analyze how users interact with and use the website, compile reports on the related activities, and provide other services related to website and app activity and usage. The technologies used by Google may collect information such as your IP address, time of visit, whether you are a return visitor, and any referring website or app. The information generated by Google Analytics will be transmitted to and stored by Google and will be subject to Google's privacy policies. To learn more about Google's partner services and to learn how to opt-out of tracking of analytics by Google, visit the Google Opt-out page.

Offline Interactions and Other Sources

We also may collect personal information from other sources, such as our partners or third-party service providers, or from our offline interactions with you for the purposes listed in the How We Use Personal Information section below, including to enable us to verify or update information contained in our records and to better customize the Services for you. For example, if you apply for a position with us, we may collect information from former employers, employment/recruiting agencies, credit reference agencies, or other background check agencies.

Social Media Integration

Our Services may, from time to time, contain links to and from social media platforms. You may choose to connect to us through a social media platform, such as Facebook, LinkedIn or X (formerly Twitter), and when you do, we may collect additional information from you, including the information listed in the Types of Information We Collect section above. Please be advised that social media platforms may also collect information from you. When you click on a social plug-in, such as Facebook's "Like" button or X's "Tweet" button, that particular social network's plugin will be activated and your browser will directly connect to that provider's servers. We encourage you to review the social media platforms' usage and disclosure policies and practices, including the data security practices, before using them.

Surveys

From time to time, and subject to your consent where required by applicable local law, we may provide you with the opportunity to participate in surveys, some of which might be sponsored or conducted by a third party. Participation in these surveys is completely voluntary. If you choose to participate, we will request certain personal information from you. If there is a third-party sponsor involved in the survey, we may provide certain personal information to the third-party sponsor. Please make sure to review the sponsor's privacy policy and be aware that any surveys offered by us may be governed by specific rules, terms and conditions that are separate from and in addition to this Privacy Notice. By participating in any such surveys, you will become subject to those rules, including but not limited to receiving emails containing survey communications.

3. HOW WE USE PERSONAL INFORMATION

We primarily use personal information to provide, maintain, and improve our Services, but we may also use personal information to do any or all of the following:

• facilitate your interactions and transactions with us, such as requests for support or additional Services;
• respond to your requests, communications, suggestions, comments, inquiries, and requests (including your feedback about our Services);
• administer our relationship with you;
• develop new products, features, and services;
• better understand and address the preferences of our customers;
• provide personalized Services, including personalized delivery experiences, content, and ads;
• provide and analyze aircraft maintenance, performance, and operations;
• provide you with, and improve, relevant marketing offers or information from us or relevant third parties;
• facilitate your participation in our surveys and promotions;
• ensure our systems and premises are secure;
• develop and manage relationships with our business partners;
• respond to legally binding requests from law enforcement, regulatory authorities, or other third parties;
• defend, protect or enforce our rights or applicable terms of service or to fulfill our legal or contractual obligations;
• manage any dispute and accidents and take legal or other professional advice;
• to prevent fraud or the recurrence of fraud;
• assist in the event of an emergency;
• comply with applicable law or legal directives; or
• any other purpose with your consent.

We may also combine your personal information collected through various sources, including information collected through our Services, and develop a customer profile that will be used for the purposes above.

If you are a job applicant, we will use your personal information as necessary to determine your fitness for the position applied for, to make any relevant adjustments during the recruitment process and for equal opportunities monitoring, as well as the purposes listed above.

Typically, we retain personal information for the period necessary to fulfill the purposes outlined in this Privacy Notice, unless a longer retention period is required or permitted by law. In many situations, we must retain some or all of your personal information to comply with our legal obligations; resolve disputes; enforce our agreements; protect against fraudulent, deceptive, or illegal activity; or for other legitimate business purposes, such as for auditing, accounting, or tax purposes.

We may use personal information to create non-personal information. We may use non-personal information for any legitimate business purpose.

4. WHY WE USE PERSONAL INFORMATION

We may use personal information for a number of reasons:

• to fulfill our contractual obligations to you, including to provide our Services to you;
• the individual has given consent for a particular purpose (for example, where an individual has given us consent to send them electronic marketing);
• when using the information is necessary for our legitimate interests or those of a third party, provided we have balanced these against the individual's rights and interests; and
• in order to comply with a legal obligation (for example, responding to government or law enforcement information requests).

Our legitimate interests for using personal information are:

• to effectively administer and manage our business;
• to ensure effective administration and management of the individual's relationship with us, including providing our Services;
• to understand how our customers use our Services and to manage our Services;
• to carry out research and analysis on what Services or products our customers want or how they would like us to improve our Services and products;
• to understand how our customers use our Services and identify any issues in how the Services are used and how we can improve the customer's experience;
• to tell our customers about the various products and Services we can offer;
• to understand and respond to inquiries and feedback;
• to better tailor and personalize the promotions and benefits that we can offer to our customers;
• to ensure our systems and premises are secure;
• to develop relationships with business partners;
• to ensure debts are paid;
• to operate suppressors to exclude you from direct marketing if you unsubscribe;
• to share data in connection with acquisitions and transfers of our business;
• to manage our relationships with business partners;
• to prevent, detect, or investigate unauthorized use of our Services and ensure we comply with the law and our policies; and
• to manage any dispute, accident or receive legal and other professional advice.

5. HOW WE SHARE PERSONAL INFORMATION

We do not sell personal information and we do not share personal information with third parties for cross-context behavioral advertising purposes.

We only share personal information in limited circumstances as described in this Privacy Notice. For example, we may share personal information with our corporate affiliates and subsidiaries as well as our third-party service providers, suppliers, vendors, professional advisors and business partners, which may include IT service providers, financial institutions and payment providers, customer relationship management vendors, social media platforms, other cloud-based solutions providers, lawyers, accountants, auditors and other professional advisors. We contract with such vendors and advisers to ensure that they only process your personal information under our instructions and ensure the security and confidentiality of your personal information. We share personal information with these third parties to help us:

• with the uses described in the How We Use Information section above;
• in the operation, management, improvement, research and analysis of our Services;
• with our marketing and promotional projects, such as sending you information about products and services you may like and other promotions (provided you have not unsubscribed from receiving such marketing and promotional information from us); and
• to comply with your directions or any consent you have provided us.

We may share personal information with law enforcement and regulatory authorities or other third parties as required or permitted by law for the purpose of:

• responding to a subpoena, court order, or other legal processes;
• defending, protecting, or enforcing our rights;
• assisting in the event of an emergency; and
• complying with applicable law.

If you are a job applicant, we may share your personal information with employment/recruitment agencies or background screening providers as part of the recruitment process.

In accordance with applicable law, we may also transfer or assign personal information to third parties as a result of, or in connection with, a sale, merger, consolidation, change in control, transfer of assets, bankruptcy, reorganization, or liquidation. If we are involved in defending a legal claim, we may disclose personal information about you that is relevant to the claim to third parties as a result of, or in connection with, the associated legal proceedings.

To see all of the categories of personal information we share, see Section 3.

We share non-personal information with third parties as reasonably necessary to meet our business needs.

Information You Share or Post Online Including Related to Our Services

Please be aware that there are public areas that interact with our Services, such as our social media channels, where individuals may voluntarily disclose personal information. This information may be seen and used by others. We encourage everyone to exercise good judgement when using these public areas and sharing personal information.

6. HOW WE PROTECT PERSONAL INFORMATION

We are dedicated to ensuring the security of your personal information. We use physical, electronic, and administrative security measures appropriate to the risks and sensitivity of the personal information we collect. Personal information is maintained on our servers or those of our service providers, and is accessible by authorized employees, representatives, and agents as necessary for the purposes described in this Privacy Notice. We aim to provide secure transmission of your personal information from your devices to our servers. We have processes to store personal information that we have collected in secure operating environments. Our security procedures mean that we may occasionally request proof of identity before we disclose your personal information to you. While we attempt to protect your personal information in our possession, no method of transmission over the internet or security system is perfect, and we cannot promise that information about you will remain secure in all circumstances. If you suspect an unauthorized use or security breach of your personal information, please contact us immediately.

For your convenience, some of our Services allow you to remain logged in so that you do not have to re-enter your password each time you want to access your account. If you choose to remain logged in, you should be aware that anyone with access to your device will be able to access, use, and make changes to your account. Accordingly, we strongly recommend that you take appropriate steps (such as enabling the “Passcode Lock” security feature on your mobile device) to protect against unauthorized access to, and use, of your account, particularly if you choose to remain logged into your account. Please also contact us as soon as possible if you suspect any unauthorized use of your account or password.

7. DATA TRANSFERS

We are a global business and therefore information we collect may be transferred to, stored, and processed in any country or territory where one or more of our business partners or service providers are based or have facilities which may be a different to your home country. While other countries or territories may not have the same standards of data protection as those in your home country, we will continue to protect personal information that we transfer in line with this Privacy Notice requiring that our business partners or service providers adhere to this Privacy Notice and the applicable privacy regulations in your home country.

8. CHILDREN'S PRIVACY

Our Services are not for children or those under the age of 18. We do not knowingly collect personal information from children or other persons who are under 18 years of age. Individuals who are children or those under the age of 18 should not attempt to provide us with any personal information. If you think we have received personal information from children or those under the age of 18, please contact us immediately.

9. YOUR CALIFORNIA PRIVACY RIGHTS

We do not share personal information with third parties for their own direct marketing purposes without your consent. California residents under 18 years old, in certain circumstances, may request and obtain removal of personal information or content that you have posted on our Services. Please be mindful that this would not ensure complete removal of the content posted by you on our Services. To make any request pursuant to California privacy law, please contact us.

10. YOUR CHOICES AND CONTROLS

In accordance with applicable law, you may exercise certain choices and rights in connection with our Services as described in this section. Some of the rights may vary depending on your country, province, or state of residence.

Access to your personal information

You have the right to request access to the personal information that we collect, use, and disclose about you. You also have the right to not receive discriminatory treatment for exercising your access right. To submit a request or designate an authorized agent to make a request, please contact us using the information below.

Deleting your personal information

You have the right to request that we delete your personal information, subject to some exceptions under applicable law. Once we have received and confirmed your request, we will delete (and direct our partners and service providers to delete) your personal information, unless an exception under applicable law applies. You have the right to not receive discriminatory treatment for exercising your deletion right. To submit a request or designate an authorized agent to make a request, please contact us using the information below.

Correcting your personal information

You have the right to request that we update or correct the personal information we collect. You also have the right to not receive discriminatory treatment for exercising your correction right. To submit a request or designate an authorized agent to make a request, please contact us using the information below.

Email Communications / Direct Marketing

You may have the opportunity to receive certain communications from us related to our Services. If you provide us with your email address in order to receive communications, you can opt-out of marketing emails at any time by following the instructions at the bottom of our emails and adjusting your email preferences. Please note that certain emails may be necessary for the operation of our Services. You will continue to receive these necessary emails, if lawful and appropriate, even if you unsubscribe from our optional marketing communications.

11. THIRD PARTY WEBSITES AND APPS

Our website and Services may contain links to other websites or apps operated by third parties. Please be advised that the practices described in this Privacy Notice do not apply to information gathered through these third-party websites and apps. We have no control over, and are not responsible for, the actions and privacy policies of third parties and other websites and apps.

12. EUROPE / UNITED KINGDOM

This section only applies if you are a resident of a member state of the European Union (EU), the United Kingdom, or the European Economic Area (EEA).

If you have questions or concerns regarding the use of your personal information, please contact us.

International Transfers

The personal information we collect from you may be transferred to and stored by our group companies, or IT vendors and other service providers who operate on our behalf (as specified in How We Share Personal Information above). We also transfer information to a number of providers of business applications - such as CRM and marketing applications - as well as marketing service providers. These providers are primarily located in the United States, but may also be located in other jurisdictions.

In certain cases, there may not be an adequacy decision by the European Commission and/or United Kingdom authorities in respect of those countries. Adequacy of data protection is instead ensured by Standard Contractual Clauses approved by the European Commission in accordance with Article 46(2)(c) of the General Data Protection Regulation, or any equivalent clauses approved by the authorities in the United Kingdom including any additional safeguards as required by EU / UK data protection laws that we have in place with that third party. A copy may be requested by contacting us.

Data Retention

We retain your personal information for as long as necessary for the purpose(s) for which it was initially collected. The criteria we use to determine the retention period is as follows:

• whether there are contractual or legal obligations that exist which require us to retain the information for a certain period of time;
• whether there is an ongoing legal claim that relates to any business (or otherwise) relationship you have with us, or that is otherwise related to your relationship with us; and
• whether any applicable law, statute, or regulation allows for a specific retention period.

Your Privacy Rights

You may have - in accordance with applicable data protection laws - the following rights when it comes to our handling of your personal information. Please note that many of these rights are not absolute, and we may have grounds for refusing to comply with your request to exercise them (for example, where we are (a) required or permitted by law to process your personal data in a way that is incompatible with your request, or (b) able to rely on exemptions under data protection law which entitle us to process your personal data in a way that is incompatible with your request). Where such circumstances apply, we will inform you of this at the time you make a request to exercise your rights.

• Right of access - you may have the right to request a copy of the personal information we have about you and to request supporting information explaining how the personal information is used;
• Right of rectification - you may have the right to request that we rectify inaccurate personal information about you;
• Right of erasure - you may have the right to request that we erase personal information about you;
• Right to restrict processing - in some situations, you may have the right to request that we do not use the personal information you have provided (for example, if you believe it to be inaccurate);
• Right to data portability - you may have the right to receive your personal information in a structured, commonly used and machine-readable format and to transmit such information to another controller;
• Right to withdraw consent - where we process your personal information based on consent (including direct marketing consents), you have the right to withdraw consent at any time. However, this will not affect the lawfulness of the processing based on consent before its withdrawal. Furthermore, even in case of a withdrawal we may continue to use your personal information as permitted or required by law; and
• Right to object - where we are processing your personal information based on a legitimate interest (or those of a third party) you may challenge this. However, we may be entitled to continue processing your personal information where we can demonstrate that we have compelling legitimate grounds to process your information (which override your rights and freedoms), or where continuing to process your personal information is relevant to the establishment, exercise or defense of legal claims. You also have the right to object where we are processing your personal information for direct marketing purposes.

If you would like to exercise any of these rights or in case you should have any concerns about how we process your personal information, please contact us using the information below.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information, or access someone else's personal information on their behalf (or to exercise any of the other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is complex or you have made a number of requests. In this case, we will notify you and keep you updated. Should we be unable to comply with your request, we will provide an explanation.

Data Protection Contact Information

You may contact us with any issues or questions you have regarding our processing of personal information.

EMAIL
privacy@txtav.com

MAILING ADDRESS
Textron Aviation Inc.
One Cessna Blvd.
Wichita, Kansas 67215
Attn: General Counsel, Legal Department

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). Alternatively, you can also make a complaint to the supervisory authority in the Member State of the EU or EEA in which you are resident. We would however appreciate the chance to deal with your concerns before you approach the ICO or a supervisory authority, so please contact us in the first instance.

13. CONTACT US

We welcome requests, questions, comments, and feedback on this Privacy Notice and our management of personal information. If you have requests, questions, concerns, or feedback, you can always contact us in the following ways. For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file.

EMAIL
privacy@txtav.com

MAILING ADDRESS
Textron Aviation Inc.
One Cessna Blvd.
Wichita, Kansas 67215
Attn: General Counsel, Legal Department

Submitting a Privacy Request

You can submit a request as described in the Your Choices and Controls section by:

• Submitting a Request Form;
• Calling 1.833.991.5190; or
• Emailing privacy@txtav.com

Verification Process and Required Information

Some of the requests under Your Choices and Controls must be verified to confirm the request came from you. We may contact you by phone or e-mail to verify your request. This process may require us to request additional personal information from you, including, but not limited to, your email address, mailing address, account name, and/or date of last interaction with us. In certain circumstances, we may decline a request to exercise a privacy right, particularly where we are unable to verify your identity.

Responding to Requests

Once you have submitted your request, we will respond within the time frame permitted by the applicable law. We may charge a reasonable fee for multiple requests in the same 12-month period, as permitted by law.

Appealing Requests

You may appeal our decision to your request regarding your personal information. To do so, please contact us in any of the ways listed above. We respond to all appeal requests as soon as we reasonably can, and no later than legally required. To review our appeals process, visit our privacy rights appeals process page.

Authorized Agent

You may designate an authorized agent to submit a request on your behalf. To do so, you must (1) verify your own identity directly with us; and (2) provide the authorized agent with written documentation of their authority to act on your behalf, such as: (a) a power of attorney; or (b) sufficient evidence to show that you have provided the authorized agent signed permission to act on your behalf and directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

CALIFORNIA PRIVACY LAW APPENDIX

This appendix seeks to provide additional information to residents of California and supplements the information provided in the Privacy Notice above.

To learn more about the categories of personal information we collect, how we collect it, why it is collected, with whom we share it, and how long we retain it, please see the items below.