Privacy Policy

Capstone Jet Charter, LLC, a Connecticut limited liability company ("Company", "we", "our", or "us") respect your privacy and are committed to protecting it through our compliance with this policy. This policy describes how we collect, process, retain, and disclose personal data about you when providing services to you through our websites, applications, products, and services that link to this policy (our "Services") and our practices for using, maintaining, protecting, and disclosing that information.

This policy applies only to information we collect:

• Through the Services.
• In communications, including email, text, chat, and other electronic messages, between you and the Services.
• When you interact with our advertising and applications (including mobile apps) on third-party websites and services, if those applications or advertising include links to this policy.

It does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by Company or any third party that does not link to this policy.
• Any third party including through any application or content (including advertising) that may link to or be accessible from or through the Services.

We may provide additional or different privacy policies that are specific to certain features, services, or activities.

Please read this policy carefully to understand our policies and practices regarding your information and how we treat it. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this privacy policy. As we continually work to improve our Services, we may need to change this Privacy Policy from time to time. Upon such changes, we will alert you to any such changes by placing a notice on the Company website, by sending you an email, or by some other means. Please note that if you've opted not to receive legal notice emails from us (or you haven't provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them.

Your continued use of the Services after we make changes as described here is deemed to be acceptance of those changes, so please check the policy periodically for updates.

1.Children's and Minors' Data

We do not knowingly collect or solicit Personal Data about individuals under 18 years of age; if you are an individual under the age of 18, do not attempt to register for or otherwise use the Services or send us any Personal Data. Any such attempt shall be considered a violation of our Privacy Policy. By signing up for an account or subscription with us or otherwise using our Services, you acknowledge you are over the age of 18 years of age and are permitted to use our services in accordance with our Privacy Policy. If we learn we have collected Personal Data from an individual under 18 years of age, we will delete that information as quickly as feasible and without undue delay. If you believe that an individual under 18 years of age may have provided Personal Data to us, please contact us at legal@capstonejet.com.

2.The Personal Data That We Collect or Process

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal data" is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, home address, or payment information (for example, account information such as name, postal address, and email address, credit card number, passport information or any other identifier we may use to contact you online or offline).

The types and categories of personal data we collect or process include:

• Account and contact information, including name, address (such as home address, work address, or other address), email address, phone number, username, and other contact information you provide us.
• Payment information, including credit card or debit card information and information about the payment methods and services you use in connection with the Services.
• Account history, including information about your subscription, account, transactions, purchases, order history, or discounts.
• Demographic information, including your age, gender, weight, and other information relevant to the provision of Services.
• Location information;
• Device information, including your IP address, device identifiers, operating system and version, preferred language, hardware identifiers, browser type and settings, and other device information.
• Content and information you elect to provide as part of your profile or in any reviews you make through the Services or emails, chats, or other communications sent to us.
• Identity document information, such as passport and driver's license numbers.
• Other information relevant to the provision of Services, including, but not limited to, food allergies, weight, and nationality.

Some of the information identified above, including passport or driver's license information, addresses, and other biometric information may be considered sensitive data under certain laws. If required under applicable law, we will collect and process sensitive personal data only with your consent. If you choose not to provide or allow us to collect some information, we may not be able to provide you with requested features, services, or information.

We also collect:

• Statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific Services feature.
• Technical information. Technical information includes information about your internet connection and usage details about your interactions with the Services, such as clickstream information to, through, and from our Services (including date and time), products that you view or search for; page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal information.

3.How We Collect Your Personal and Other Data

You Provide Information to Us

We collect information about you when you interact with our Services, such as when you create or update an account, place an inquiry for to book a trip, make a purchase or reservation, or create, upload, or post content or documentation to the Services, including reviews, passenger information, and passport information.

Automatically Through Our Services

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal data. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies, web beacons and other tracking technologies including details of your interactions with our Services, such as traffic data, location data, logs, and other communication data, and which resources and Services features that you access and use.

Using automatic collection technologies helps us to improve our Services and to deliver a better and more personalized experience.

The technologies we use for this automatic data collection may include:

• Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our Services. Disabling these Cookies may make certain features and services unavailable.
• Functional Cookies. Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time and recognize you when you return to our Services. These Cookies help us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors use our Services. They do this by collecting information about the number of visitors to the Services, what pages or functionality visitors view on our Services and how long visitors are viewing pages or functionality on the Services.

• Retargeting/Advertising Cookies. Retargeting/Advertising Cookies collect data about your online activity and identify your interests so that we can provide advertising that we believe is relevant to you. For more information about this, please see the section below titled "Information about Interest-Based Advertisements."

You can decide whether or not to accept Cookies through your internet browser's settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our Services and some of the services and functionalities may not work.

You can visit the following sites for comprehensive information on how to manage cookies and how to opt out of cookies used for advertising and marketing purposes:

• For individuals in the United States:

  - The Digital Advertising Alliance's Consumer Choice tool at https://www.aboutads.info/choices

  - The Digital Advertising Alliance's AppChoices program at https://www.aboutads.info/appchoices

  - The Network Advertising Initiative's opt-out program at https://www.optout.networkadvertising.org/

• For EU/EEA-based individuals:

  - The EDAA opt-out program at https://www.youronlinechoices.eu

We may partner with third-party sponsors, affiliates, vendors, and other companies who might have links, content, or applications on the website. These third parties might also use tracking tools on our website or other sites to collect information about you when you use the sites. They may collect information about your online activities over time and across different sites and other online services. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about such a link, content, or application, you should contact the third entity directly. We are not responsible for the content or privacy practices on any websites, applications, tracking tools, or other technology that are not operated by us, even though our Sites might link to them or they might link to our Sites.

Artificial Intelligence and ChatBot Use

We may, from time to time, or consistently deploy and make use of tools developed and run by us or a third-party vendor which makes use of artificial intelligence ("AI") to better facilitate the provision of Services to you. AI chatbots may also be deployed to assist you with inquiries and customer service tasks. While these text chats may appear as if they are from a real human being, they are not and responses are automated.

When you interact with the Services, there are third parties that may use automatic collection technologies to collect information about your or your device. These third parties may include:

• Advertisers, ad networks, and ad servers.
• Analytics companies.
• Your device manufacturer.
• Your internet or mobile service provider.

These third parties may use tracking technologies to collect information about you when you use the Services. The information they collect may be associated with your personal data or they may collect information, including personal data, about your online activities over time and across different websites, apps, platforms, and other online services.

We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly.

From Business Partners and Service Providers

We may receive personal data about you from other sources and combine that with information we collect directly from you. For example, we may obtain information about you from service providers that we engage to perform services on our behalf, such as payment processors, analytics, and security and anti-fraud services.

4.How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data, to:

• Provide you with the Services and any contents, features, information, products, or services that we make available through the Services.
• Fulfill and manage bookings, payments, and refunds.
• Fulfill any other purpose for which you provide it.
• Improve our Services, including by analyzing your information and creating aggregated data derived from your information, to develop, maintain, analyze, improve, optimize, measure, and report on our Services and their features and how users interact with them. Our analysis may include the use of technology like machine learning and large language models, which may include training these models or sharing with third parties for model training.
• Carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• Notify you when Services updates are available and about changes to any products or services we offer or provide though them.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

The usage information we collect, whether connected to your personal data or not, helps us improve our Services and deliver a better and more personalized experience by enabling us to:

• Estimate our audience sizes and usage patterns.
• Store information about your preferences, allowing us to customize the Services according to your individual needs and interests.
• Speed up our Services.
• Recognize you when you return to our Services.

We use location information you provide us to arrange for travel accommodations in connection with our Services.

5.Who We Disclose Your Information To

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may also disclose personal data that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• To contractors, service providers, and other third parties we use to support our organization who use it only for the purposes for which we disclose it to them.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal data:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our Terms of Use and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

The categories of personal data we may disclose include:

• Account and contact information.
• Payment information.
• Account history, including information about your subscription, account, transactions, purchases, order history, or discounts.
• Demographic information.
• Location information.
• Device information.
• Content and information you elect to provide to us.
• Images submitted or stored in connection with the Services.
• Identity document information.
• Biometric information.

6.SMS Messaging and Sharing Your Personal Data with Advertising and Marketing Partners

Some of the above sharing and use of your information is only done where we have obtained your consent to do so. For example, we may ask your consent to provide your Personal Data, including IP address information, interest data, unique IDs and other information to certain third parties that help us advertise and market our services. In those instances where we ask your consent, we will only share your information with those third parties where you have given us permission to do so. You can withdraw your consent at any time by contacting us using the contact information listed in the "Contact Information" section below.

No mobile information will be shared with third parties/affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

By sharing your phone number and consenting to this privacy policy, you agree to receive recurring automated marketing messages. Message and data rates may apply. SMS Messages shall be sent only during permissible hours and shall not occur during prohibited timeframes (often referred to as "quiet hours") under applicable law.

7.Data Security

We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative security measures based on the type of Personal Data and how we are processing that data. Encryption is our security strategy to ensure the stored Personal Data can be accessed only by the authorized roles and services with audited access to the encryption keys. Personal information/data is encrypted and stored in a private and isolated environment for extended security.

Although we work to protect the security of your data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

In particular, email, texts, and chats sent to or from the Services may not be secure, and you should carefully decide what information you send to us via such communications channels. Any transmission of personal data is at your own risk.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data against unauthorized use, disclosure, and access.

8.Data Retention

We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. When establishing a retention period for specific categories of data, we consider who we collected the data from, our need for the Personal Data, why we collected the Personal Data, and the sensitivity of the Personal Data. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

For example:

• We retain your profile information and credentials for as long as you have an account with us.
• We retain your payment data for as long as we need to process your purchase or subscription.
• We retain your device/IP data for as long as we need it to ensure that our systems are working appropriately, effectively and efficiently.

9.Your Rights and Choices About Your Information

This section describes mechanisms you can use to control certain uses and disclosures of your information and rights you may have under state law, depending on where you live.

Advertising, marketing, cookies, and other tracking technologies choices:

• Cookies and Other Tracking Technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. If you disable or refuse cookies or similar tracking files, some Services features may be inaccessible or not function properly. Some browsers include a "Do Not Track" (DNT) setting that can send a signal to the online services you visit indicating you do not wish to be tracked.
• Promotions by the Company. If you do not wish us to use your information to promote our own or third parties' products or services, you can opt out by sending us an email stating your request to legal@capstonejet.com.

10.Your Privacy Rights

Individuals may have certain rights over their personal information under particular laws. Please see the following sections regarding the rights you may have over your information:

Your Rights under the EU General Data Protection Regulation ("GDPR") and United Kingdom General Data Protection Regulation ("UK GPDR")

- For residents from the United Kingdom (UK), or the European Economic Area (EEA) and Switzerland, this section allows you to exercise your rights under the European Union's (EU) General Data Protection Regulation (GDPR) and the UK's version of the GDPR (UK GDPR), as applicable. Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Company takes reasonable steps to allow you to correct, amend, delete or limit the use of your personal information, and exercise other rights available under applicable law. Company therefore informs you that, where applicable under relevant law, you are entitled to the following:

• i.Right to Access / Disclosure: The right to have access to your personal data upon simple request - that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing.
• ii.Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
• iii.Right to Erasure / "Right to be Forgotten": The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
• iv.Withdrawal of Consent to Processing: The right to withdraw your consent to the data processing without affecting the lawfulness of processing, where your personal data has been collected and processed based on your consent and not any other basis.
• v.Right to Object: The right to object to the processing of your personal data under certain circumstances, in which case we may ask you to justify your request by explaining to us your particular situation.
• vi.Right to Restrict Processing: The right to request limits to the processing of your data, when allowed by and in circumstances set forth under applicable law, as well as to object to any direct marketing from us.
• vii.Right to Restrict Automated Individual Decision-Making (Profiling): The right to not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you.
• viii.Right to Data Portability: The right to have your personal data directly transferred by us to a third-party processor of your choice (where technically feasible; may be limited to situations when processing is based on your consent).

To exercise any of these rights, please contact us at the contact information listed in the "Exercising your Privacy Rights" section below. Note that we may ask you to verify your identity before responding to such requests.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

Your Rights Under Australia's Privacy Act of 1988

We intend to allow Australian residents to exercise their rights under the Privacy Act 1988 and associated Australian Privacy Principles. Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Company takes reasonable steps to allow you to correct and amend your personal information, and exercise other rights available under applicable law. We therefore inform you that, where applicable under relevant law, you are entitled to the following:

• i.Right to Access / Disclosure: The right to have access to your personal data upon simple request - that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing.
• ii.Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.

To exercise any of these rights, please contact us at the contact information listed in the "Exercising your Privacy Rights" section below. Note that we may ask you to verify your identity before responding to such requests.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

Your Rights Under Canada's Personal Information Protection and Electronic Documents Act

We intend to allow Canadian residents to exercise their rights under the Personal Information Protection and Electronic Documents Act ("PIPEDA"). Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Company takes reasonable steps to allow you to correct, amend, and delete your personal information, and exercise other rights available under applicable law. We therefore inform you that, where applicable under relevant law, you are entitled to the following:

• i.Right to Access / Disclosure: The right to have access to your personal data upon simple request - that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing.
• ii.Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
• iii.Right to Deletion: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.

To exercise any of these rights, please contact us at the contact information listed in the "Exercising your Privacy Rights" section below. Note that we may ask you to verify your identity before responding to such requests.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

Your Rights under China's Personal Information Protection Law ("PIPL") and Singapore's Personal Data Protection Act ("The PDPA")

- For residents from the People's Republic of China ("China"), or the Republic of Singapore ("Singapore"), this section allows you to exercise your rights under PIPL and the PDPA as applicable. Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Company takes reasonable steps to allow you to correct, amend, delete or limit the use of your personal information, and exercise other rights available under applicable law. Company therefore informs you that, where applicable under relevant law, you are entitled to the following:

• i.Right to Restrict and Refuse: The right to control and decide on the processing of your personal information. This includes the ability to refuse anybody from processing your information.
• ii.Right of Access and Portability: The right to request a copy of your personal information. This right also grants you the right to request a transfer of your personal information to a different data processor.
• iii.Right of Rectify: The right to request a copy of your personal information. This right also grants you the right to request corrections to your personal information.
• iv.Right to Delete: The right to obtain the deletion of your personal information in the situations set forth by applicable data protection law.
• v.Right to Explanation: The right to request an explanation of data processing rules and regulations provided to you in plain language, free of charge.
• vi.Right to Object: The right to object to the processing of your personal information under certain circumstances, in which case we may ask you to justify your request by explaining to us your particular situation.
• vii.Right to Restrict Automated Individual Decision-Making (Profiling): The right to request an explanation of any automated decisions that affect the processing of your personal information. The right to disallow any of these decisions.
• viii.Right to Withdrawal of Consent to Processing: The right to withdraw your consent to the data processing without affecting the lawfulness of processing, where your personal information has been collected and processed based on your consent and not any other basis.
• ix.Right of the Deceased: The right of near relatives of a recently deceased data subject to view, copy, correct, or delete the deceased's personal information unless the deceased states explicitly otherwise before their passing.
• x.Right to File Complaints: The right to file a complaint if you feel your data privacy was violated.

To exercise any of these rights, please contact us at the contact information listed in the "Exercising your Privacy Rights" section below. Note that we may ask you to verify your identity before responding to such requests.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

Your Rights under Brazil's General Data Protection Law ("LGPD"), Chile's Personal Data Protection Law ("The PDPL"), Mexico's Federal Data Protection Law of Personal Data Held by Private Parties ("FLPPDPP"), Columbia's Data Protection Law ("CDPL") and Peru's various data privacy laws

- For residents from the Federative Republic of Brazil ("Brazil"), this section allows you to exercise your rights under LGPD as applicable. Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Company takes reasonable steps to allow you to correct, amend, delete or limit the use of your personal information, and exercise other rights available under applicable law. Company therefore informs you that, where applicable under relevant law, you are entitled to the following:

• i.Right to Confirmation: The right to obtain confirmation of the existence of data processing from the data controller.
• ii.Right to Access and Portability: The right to obtain access to data being processed by the controller from the controller. This right also grants you the right to request a transfer of your personal data to another service provider or product provider, by the means of an express request, pursuant with the regulations of the national authority, and subject to commercial and industrial secrets.
• iii.Right of Rectify: The right to request a copy of your personal information. This right also grants you the right to request changes to your personal data.
• iv.Right to Anonymization: The right to obtain anonymization, blocking, or deletion of unnecessary or excessive data from the controller.
• v.Right to Delete: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
• vi.Right to Know: The right to obtain information about public and private entities with which the controller has shared your personal data.
• vii.Right to Object: The right to object to the processing of your personal data.
• viii.Right to File Complaints: The right to file a complaint if you feel your data privacy was violated.

To exercise any of these rights, please contact us at the contact information listed in the "Exercising your Privacy Rights" section below. Note that we may ask you to verify your identity before responding to such requests.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

For residents from the Republic of Chile ("Chile"), the Republic of Peru ("Peru") and the United Mexican States ("Mexico"), this section allows you to exercise your rights under the PDPL, Peru's various data privacy laws, and FLPPDPP as applicable. Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Company takes reasonable steps to allow you to correct, amend, delete or limit the use of your personal information, and exercise other rights available under applicable law. Company therefore informs you that, where applicable under relevant law, you are entitled to the following:

• i.Right of Access: The right to request a copy of your personal data.
• ii.Right of Rectify: The right to request corrections to inaccuracies in your personal data.
• iii.Right to Delete: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
• iv.Right to Object: The right to object to the processing for specific purposes, including direct marketing, of your personal data.

To exercise any of these rights, please contact us at the contact information listed in the "Exercising your Privacy Rights" section below. Note that we may ask you to verify your identity before responding to such requests.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

For residents from the Republic of Columbia ("Columbia") this section allows you to exercise your rights under the CDPL. Although applicable data protection legislation in relevant jurisdictions may afford similar rights, there may be circumstances where some of these rights do not apply under or are modified by, local law. Company takes reasonable steps to allow you to correct, amend, delete or limit the use of your personal information, and exercise other rights available under applicable law. Company therefore informs you that, where applicable under relevant law, you are entitled to the following:

• i.Right of Rectify: The right to request corrections to inaccuracies in your personal data.

To exercise any of these rights, please contact us at the contact information listed in the "Exercising your Privacy Rights" section below. Note that we may ask you to verify your identity before responding to such requests.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

Your Rights under various United States state data privacy laws

- For residents from the state of Texas and Nebraska this section allows you to exercise your rights under the applicable state law.

• i.Right to Access / Disclosure: The right to have access to your personal data upon simple request - that is, you may receive a copy of such data upon receipt of a verifiable request, along with other information related to the processing of your data.
• ii.Right to Correction/Rectification: The right to correct your personal data if you find it is inaccurate, incomplete or obsolete.
• iii.Right to Deletion: The right to obtain the deletion of your personal data in the situations set forth by applicable data protection law.
• iv.Right to Opt-Out: The right to opt out of the processing of your personal data for targeted advertising, as defined by applicable law. This right also allows you to opt out of the sharing of your personal data for cross-context behavioral advertising.
• v.Right to Appeal: You may also have the right to appeal the denial of any of these rights by submitting a form that will be provided to you if we deny a data request.

To exercise any of these rights, please contact us at the contact information listed in the "Exercising your Privacy Rights" section below. Note that we may ask you to verify your identity before responding to such requests.

If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

Your California Privacy Rights Regarding Direct Marketing Information

California law allows California residents once a year to request information regarding our disclosure of your personal information, if any, to third parties for those third parties' direct marketing purposes during the preceding calendar year. This information includes:

• a. The categories of information we disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year;
• b. The names and addresses of third parties that received the information; and
• c. If the nature of the third party's business cannot be determined from their name, to obtain examples of the products or services marketed.

11.Profiling Disclosure

Company does not engage in profiling of consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Colorado Privacy Act.

12.Exercising your Privacy Rights / Non-Discrimination

We will not discriminate against you if you exercise your privacy rights. If we receive a request from you to exercise any of the above rights, we may ask you to verify your identity before acting on the relevant request; this is to ensure that your data is protected and kept secure.

Please bear in mind that if you exercise such rights, this may affect our ability to provide our products and services.

As described above, you may have certain rights to access, delete, or otherwise control the use, collection, and/or disclosure of their information. Once Company receives and confirms a verifiable consumer request, we will work to promptly process such request. The need to verify an individual's identity is critical to protecting your information, and ensuring that your information is not shared with anyone pretending to be you or someone who is not authorized to act as your agent on your behalf. To that end, we must be able to verify your information in order to process your request.

You may submit a verifiable request via the following:

By submission portal: Contact Us - Company

By telephone: +1 (212) 217-2277

By email: legal@capstonejet.com

By mail:

102A Broad Street,
Guilford, CT 06437
United States

Please provide sufficient information for us to determine if this applies to you. Please include "Privacy Rights Request" in the Subject line of your email. In the body of your request, please include your full name, year of birth, telephone number, email address, complete mailing address (street name and number, city, state, and zip code) so that we can process your request.

We will ask you to provide information about yourself so that we can verify your identity as part of this process. This information may include your name, address, account information, and any other information deemed necessary by Company to reasonably verify your identity, to ensure that your information is not shared with anyone impersonating you. Once we have verified your identity, we will work to fulfill your request in a timely manner. Please note there may be some situations in which we are unable to fulfill your request, such as if we cannot find any information about you within our systems. Additionally, we may not be able to honor a deletion request in some situations, such as if your information is necessary to fulfill the Services you requested or meet a legal obligation. We will inform you whether we can fulfill your rights request.

We may ask for additional information if we have difficulty confirming your identity. We will not share your information or honor other requests in those situations in which we are unable to confirm a request for your information is a "verifiable request."

13.Lodging A Complaint

Company only processes your personal information in compliance with this privacy notice and in accordance with the relevant data protection laws. If, however you wish to raise a complaint regarding the processing of your personal information or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with your local supervisory authority. If you would like to raise an issue or lodge a complaint directly with Company, please contact us using the information below.

By submission portal: Contact Us - Company

Address:

102A Broad Street,
Guilford, CT 06437
United States

Telephone: +1 (212) 217-2277

Email: legal@capstonejet.com

14.Transfers of Personal Data

The Services are hosted and operated in the United States ("U.S.") through Company and its service providers, and if you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside. By using the Services, you acknowledge that any personal data about you, regardless of whether provided by you or obtained from a third party, is being provided to Company in the U.S. and will be hosted on U.S. servers, and you authorize Company to transfer, store and process your information to and in the U.S., and possibly other countries. In some circumstances, your personal data may be transferred to the U.S. pursuant to: (i) a data processing agreement incorporating standard data protection clauses, (ii) binding corporate rules for data protection that align with the GDPR's requirements, or (iii) adherence to an industry- or technology-specific approved code of conduct blessed by the European Commission.

15.Changes to Our Privacy Policy

We may update this policy from time to time, and we will provide notice of any such changes to the policy as required by law. The date the privacy policy was last updated is identified at the top of the page. We will notify you of changes to this policy by updating the "last updated" date and posting the updated policy on the Services. We may email or otherwise communicate reminders about this policy, but you should check our Services periodically to see the current policy and any changes we have made to it.

16.Contact Information

Submission portal: Contact Us - Company

Address:

102A Broad Street,
Guilford, CT 06437
United States

Telephone: +1 (212) 217-2277

Email: legal@capstonejet.com