Data Processing Policy

1. Introduction

This Data Processing Policy describes how PRONTEER COMPUTER SYSTEMS & COMMUNICATION EQUIPMENT SOFTWARE DESIGN – FZCO, trading as Pronteer ("Pronteer", "we", "us" or "our"), processes and protects personal data in connection with the Pronteer software platform.

Pronteer is registered in Dubai Silicon Oasis, Dubai, United Arab Emirates, under Trade Licence No. 30906.

Pronteer provides a software-as-a-service (SaaS) platform designed to support private aviation operators, aircraft management companies and authorised aviation personnel through operational coordination, documentation management, crew workflows and related services.

This policy should be read alongside our Privacy Notice and SaaS Terms of Service & End User Licence Agreement.

Where a separate Data Processing Agreement (DPA) applies, that agreement governs the parties' contractual data-processing obligations.

2. Data Protection Roles

Pronteer generally acts as a data processor when processing passenger, crew and operational personal data on behalf of its business customers.

Customers, including aircraft operators and aircraft management companies, generally act as data controllers and determine the purposes and lawful basis for processing the personal data they upload or manage through the platform.

Pronteer may act as an independent data controller for information processed for its own business purposes, including account administration, billing, customer communications, website analytics, marketing, security and compliance.

The applicable roles depend on the nature and purpose of the processing activity.

3. Categories of Personal Data

Depending on the services used, Pronteer may process the following categories of personal data on behalf of customers:

• Passenger and crew names, contact details and identification information.

• Dates of birth, nationalities and passport or visa details.

• Copies of passports, visas and other uploaded documents.

• Travel itineraries, flight-related information and operational records.

• Crew assignments, schedules and related personnel information.

• Passenger preferences and service requirements.

• Customer-uploaded files, checklists and operational documentation.

• Communications and records associated with platform activities.

Customer-uploaded information may include sensitive personal data or information relating to minors.

Customers are responsible for ensuring they have an appropriate lawful basis and authority to collect and provide such information to Pronteer.

4. Purpose and Instructions for Processing

When acting as a processor, Pronteer processes personal data to provide, maintain, secure and support the services requested by its customers.

These activities may include:

• Operational workflow and crew coordination.

• Passenger and crew information management.

• Documentation storage and access.

• Trip and itinerary management.

• Operational checklists and handovers.

• Supplier coordination and related communications.

• Technical support, troubleshooting and platform maintenance.

• Security monitoring and prevention of unauthorised access.

Pronteer processes customer-controlled personal data in accordance with the customer's documented instructions, the applicable service agreement and relevant legal requirements.

Pronteer does not independently determine the aviation operator's purposes for processing passenger or crew information.

Where an instruction appears to conflict with applicable data protection requirements, Pronteer may seek clarification or take appropriate action consistent with its legal obligations.

5. Data Hosting and Storage

Pronteer uses third-party cloud infrastructure and supporting services to operate its software platform.

The principal infrastructure providers currently include:

• Railway, California, United States — application hosting, customer databases, uploaded documents and database backups.

• Supabase Auth, London, United Kingdom — user authentication and related account information.

• Convex, United States — real-time communications, chat functionality, attachments and notifications.

Additional processing may occur through authorised third-party service providers supporting email delivery, subscription management, payments, analytics, error monitoring and related services.

Personal data may be processed outside the United Arab Emirates and outside the country in which a Customer or data subject is located.

Pronteer will address applicable international data-transfer requirements and relevant contractual safeguards in accordance with applicable data protection laws.

6. Security and Confidentiality

Pronteer maintains technical and organisational measures intended to protect Customer Data against unauthorised access, disclosure, alteration and loss.

These measures include:

• HTTPS/TLS encryption for data transmitted through supported secure connections.

• Authentication and role-based access permissions.

• Logical separation of customer organisations and their information.

• Restricted database and administrative access.

• Time-limited access links for uploaded documents, where applicable.

• Hosting on Railway infrastructure that has undergone SOC 2 Type II auditing.

• Database backup and recovery arrangements.

• Security monitoring and incident-response procedures.

Security measures are maintained and reviewed according to the nature of the Services, identified risks and applicable legal and contractual obligations.

7. Sub-Processors and Third-Party Providers

Pronteer may engage third-party service providers to support the operation, hosting, security, maintenance and delivery of the platform.

These may include cloud infrastructure providers, authentication services, communication providers, technical support providers and other necessary service providers.

Pronteer requires relevant service providers to comply with appropriate confidentiality, security and data-protection obligations through applicable contractual arrangements.

Where required by an applicable DPA or data protection law, Pronteer will provide information about relevant sub-processors and applicable changes.

Third-party analytics and marketing services used by Pronteer for its own website and business activities are described separately in our Privacy Notice and Cookie Policy.

8. International Data Transfers

Because Pronteer uses cloud infrastructure located in the United States and may engage service providers in other jurisdictions, personal data may be transferred internationally.

Pronteer will take appropriate steps to address applicable international data-transfer requirements, including those under the UAE Personal Data Protection Law and the GDPR or UK GDPR where applicable.

Depending on the circumstances, such steps may include contractual safeguards, assessments of applicable transfer requirements and other legally recognised mechanisms.

Customers remain responsible for identifying any sector-specific, contractual or jurisdictional restrictions applicable to the personal data they choose to process through Pronteer.

9. Personal Data Breaches

Pronteer maintains procedures intended to identify, assess, contain and respond to suspected or confirmed personal data breaches.

Where Pronteer becomes aware of a personal data breach affecting customer-controlled personal data, it will notify the relevant customer without undue delay, in accordance with applicable law and contractual obligations.

Pronteer will take reasonable steps to investigate the incident, mitigate its impact and support the customer's response obligations.

Where legally required, Pronteer will cooperate with relevant notification and regulatory processes according to its role in the processing activity.

10. Data Retention, Export and Deletion

Pronteer retains Customer Data for the purposes of providing its Services and fulfilling applicable contractual, operational and legal obligations.

Subscription cancellation does not automatically trigger deletion of Customer Data. Following cancellation, Customer Data may remain stored to support data export, account reactivation and other legitimate retention purposes, subject to applicable law and Pronteer's retention arrangements.

The authorised organisation owner may export available Customer Data using the Platform's supported export functionality.

The authorised organisation owner may request deletion of Customer Data through the Platform. Following receipt and verification of a valid request, Pronteer will delete the relevant Customer Data from active systems within twenty-four (24) hours, except where retention is required or permitted by applicable law.

Residual database backups may retain copies for up to thirty (30) days before expiry under the normal backup lifecycle.

Pronteer will apply appropriate retention limits and will not retain personal data longer than necessary for the purposes for which it is processed.

11. Assistance With Data Protection Requests

When acting as a processor, Pronteer will provide reasonable assistance to customers in responding to applicable data protection requests, taking into account the nature of the processing and the information available to Pronteer.

Such requests may include access, correction, deletion, restriction or other rights available under applicable law.

Individuals whose information has been provided by an aviation operator should generally direct requests concerning that customer-controlled information to the relevant operator or management company.

Requests relating to personal data for which Pronteer acts as an independent controller may be submitted directly to Pronteer.

12. Data Protection Responsibilities of Customers

Customers are responsible for:

• Establishing an appropriate lawful basis for collecting and processing personal data.

• Providing required privacy information to passengers, crew members and other relevant individuals.

• Ensuring the accuracy and relevance of uploaded information.

• Managing authorised user access and permissions.

• Complying with applicable aviation, privacy and data-protection requirements.

• Providing appropriate processing instructions to Pronteer.

• Identifying applicable restrictions on international data transfers and sensitive information.

Pronteer provides software infrastructure and processing services but does not replace the customer's legal responsibilities as a data controller.

13. Applicable Data Protection Laws

Pronteer seeks to conduct its processing activities in accordance with applicable data protection requirements, including:

• UAE Federal Decree-Law No. 45 of 2021 regarding the Protection of Personal Data, where applicable.

• The European Union General Data Protection Regulation (EU) 2016/679, where applicable.

• The United Kingdom General Data Protection Regulation and relevant UK data protection legislation, where applicable.

• Other applicable data protection laws relevant to the services and processing activities.

The applicability of particular laws depends on the relevant processing activities, parties and jurisdictions.

14. Changes to This Policy

Pronteer may update this Data Processing Policy to reflect changes in its services, security arrangements, processing activities, legal requirements or operational practices.

The latest version will be published on our website with an updated revision date.

Where required by applicable law or contractual obligations, customers will receive appropriate notice of material changes.

15. Contact Information

For questions about this Data Processing Policy or the processing of personal data through Pronteer, please contact:

PRONTEER COMPUTER SYSTEMS & COMMUNICATION EQUIPMENT SOFTWARE DESIGN – FZCO

Trading as Pronteer

Dubai Silicon Oasis, Dubai, United Arab Emirates

Trade Licence No. 30906

Email: info@pronteer.com

Website: https://www.pronteer.com

For additional information, please refer to our Privacy Notice.