1. General provisions

This Privacy Policy (hereinafter - the Policy) is a document, approved by the Private company 'OpenSky Limited', registered under the Acting law of Astana International Financial Centre (hereinafter - the AIFC) on 18.08.2011, registration certificate №201040900020, legal address: Republic of Kazakhstan, Astana city, Mangilik El av. 55/18, Block C 4.1, office 250; and defines the procedure for collecting, processing, storage and protection of personal data and other information of the Users of the website, located at https://www.opensky.biz and its subdomains (hereinafter the 'Site' or 'OpenSky'), on which the OpenSky platform is located.

Terminology

Policy – this document with all addendums, changes and obligatory documents, being an integral part of the contract, concluded with the User when using the Site.

Client – an individual or employee of a legal entity, visitor of the Site, who accepts the terms of the Policy, has full legal capacity, has his own e-mail address on the Internet, personal computer and/or mobile device, access to which is at his disposal. Client is supposed to be interested in flight organization services.

Operator – an individual or employee of a legal entity who is a visitor of the Site, accepts the terms of the Policy, has full legal capacity and has his own Internet e-mail address, personal computer and/or mobile device, access to which is at his disposal. The Operator is the service provider who organizes the flight and other services related to flight.

Service provider – a legal entity, which organizes flights and other services related to the flight.

Platform – the Company 'OpenSky Limited', independently or together with other legal entities belonging to its group of persons, organizing and (or) carrying out the processing of personal data, as well as determining the purpose of personal data processing, the composition of personal data to be processed, actions (operations) performed with personal data.

User – the Client or Operator who interacts with the platform and its employees (by visiting the site, interacting by e-mail, messengers, telephone or alternative means of communication).

Personal data – any information automatically processed by the Platform on the Site, related directly or indirectly to the defined User, or provided by the User independently when using the Site.

2. Purposes of processing of Personal Data and User Data

The Platform processes Personal Data to fulfill its obligations to provide the User with the full functionality of the Site's services and to maintain its functionality. In particular for:

—authorizing the User in any of the ways available on OpenSky, including for the purpose of creating an Account for the User;

—personalization of the Platform for the User;

—processing User requests to search for available planes and services;

—providing the User with the ability to edit their account;

—processing Operators' offers for Customer requests;

—providing Platform services to passengers that the User adds;

—providing access to OpenSky and its features (execution of contracts/offers) for the benefit of the User and at their request, including those formed through the user interface;

—protecting the software product OpenSky and User data from any interference by third parties, use for fraudulent purposes, detecting the facts of use OpenSky for purposes other than intended and / or in violation of the Terms of Use;

—conducting marketing, statistical, analytical and other research on the use of OpenSky for optimization of the Platform, its individual capabilities, development of products and services from OpenSky and suppliers, increasing their convenience for consumers;

—display and individualization of advertising on the Internet and directly on OpenSky and / or sending to the User advertising information by electronic communications networks (including via mobile communications, e-mail) that refer to OpenSky and the market of services for travelers, as well as relating to other offers of partners and suppliers;

—promoting OpenSky and its possibilities on the market, in particular, by means of direct contacts with Users through the contact information provided by the User, the disclosure of statistical data of the Platform and certain cases of use of its possibilities if such disclosure does not endanger the interests of the User;

—considering appeals of Users to the support service in connection with the use of OpenSky and providing advice and assistance in resolving issues related to the provision of services by providers.

The Platform, if there are sufficient grounds, has the right to process Personal Data to achieve both one or more purposes of processing.

3 Basis for processing of Personal Data and other information

The processing of Personal Data is carried out on the basis of:

—The Terms of Use of OpenSky and other agreements entered into with the User;

—Received consent to this Policy or individual consents of the User, which may be given by the User when using OpenSky;

—Compliance with the contractual and statutory obligations of the Platform reflected in the Offer;

The User, using the Site, on their own, on their free will and in their own interest, gives the Platform informed consent to the processing of their personal data and other information until the purpose of their processing or withdrawal of consent is achieved. By using OpenSky, participating in marketing or promotional projects, or by contacting the OpenSky support team, the User agrees at the time of registration or confirmation of the request to this Policy, the text of which is available in advance through the link on the Site with the text and hyperlinks: “By clicking continue, you accept Terms of use and Privacy policy”

The User may withdraw consent to the processing of his or her Personal Data at any time by sending a request to the Platform to cease processing Personal Data and delete it, including data received in connection with participation in marketing and advertising projects and any other data, to sales@openskyx.aero. The Platform shall cease processing and delete Personal Data within 30 calendar days of receipt of such request.

The Platform may not delete any User Data that is required to be stored in accordance with the Acting law of the AIFC. In this case, the Platform preserves such data in an anonymized form in its database systems.

The Platform is not responsible for the completeness and relevance of User data. The User has the right to independently change or update their Personal Data at any time by sending an appropriate request.

4 The scope and categories of Personal Data processed

The Platform may process the following data received from the User

a. Data provided by the User within the framework of the use of the OpenSky Platform:

—Name, last name, gender, passport data, date of birth, citizenship;

—E-mail address;

—Phone number;

—Other data provided during the use of the Site, including data received from third parties on behalf of the User;

—Information about the payment instrument when there is a need to make mutual payments in connection with the use of OpenSky;

—Aircraft names, Aircraft registration number, Aircraft photos.

b. Processed automatically when the User visits the Site:

—IP-address, ID (identification number) in the social network, cookies and similar technologies in accordance with section 5 of the Policy, parameters and settings of Internet browsers and devices of the User;

—Statistics of the User's use of the functions of the Platform, as well as other technical information, such as search directions.

—Information about the location of the connection to the Platform.

The Platform is not responsible for the completeness and relevance of information about Users.

By providing data of third-parties, the User guarantees having an authority to provide such data to the Platform.

The Platform is not responsible for any processing of Personal Data that may occur following the User's access to third-party resources available on OpenSky and which is not subject to the terms of this Policy.

5. Cookies and similar technologies

Cookies and similar technologies (such as pixels, tags, cache, local storage, etc.) are small pieces of data, most often implemented in the form of text files-identifiers that are installed on the device or connection platform of the User when visiting Internet resources, individual pages, interaction with them to create information. OpenSky uses cookies of various kinds, which may be created by the Platform itself or by third-party partners providing, for example, functional and technical solutions within the Platform.

Cookies and similar technologies make it possible to personalize the settings of the Platform and the display of advertising information, making OpenSky more convenient and optimized for Users by storing information about the actions performed, such as information about the authorization in the Account, the viewed/requested advertisements, impersonal information about interests, the effectiveness of the user interface on a particular page, the choice of language of the Platform or the activation or deactivation of certain features.

Types of cookies used on the site (including cookies and similar third-party technologies) to achieve processing purposes:

—Technical - the cookies, without the installation of which OpenSky or its individual features cannot be accessed by the User in accordance with the Terms and other obligations of the Platform;

—Functional - the cookies which help personalize the experience of Users during their interaction with OpenSky and make it more convenient, as well as analyze behavior and data about events on the Platform;

—Advertising/Marketing - the cookies whereby the Platform monitors the effectiveness and performance of advertising information on OpenSky, and Users can see more personalized advertising on the Internet and influence its display in the future, including advertisements that are shown and customized through advertising platforms of suppliers Google, Facebook, Yandex or others.

The user can customize settings for installation or blocking, refuse cookies in the configuration of the browser, such as Chrome or Safari, or the device through which you access OpenSky. Information on setting, blocking and deleting cookies can be found in the help sections of the User's browser or device. The User may also configure third-party cookies on the pages of the relevant advertising platforms or analytical services, such as Yandex.Metrika, Google Analytics, Facebook, whose cookies are (may be used) on the Platform. At OpenSky also within the user interface may have its own options for managing cookies.

Removing or prohibiting the installation of certain cookies may cause the inaccessibility of the functionality of the OpenSky online service or parts of it.

6. Procedure for processing of Personal Data

Processing is performed by the Platform and third parties on its behalf, such actions as collection, recording, systematization, accumulation, storage, clarification (update, change), extraction, use, transfer (distribution, provision, access), depersonalization, blocking, deletion, destruction of personal data. Processing may be carried out both by automated and non-automated means.

When processing Personal Data, the Platform ensures its protection from unauthorized access and dissemination in accordance with its internal rules and regulations and applicable data protection legislation.

Personal Data will remain confidential, unless the Site technology or the settings of the browser or device used by the User provide for an open exchange of information with other users of the Site or with any Internet users.

The Platform shall be entitled to disclose Personal Data and other information about the User to the bodies of inquiry and investigation and other authorized bodies on the grounds stipulated by the Acting law of the AIFC.

The Platform may transfer Personal Data to third parties, including cross-border transfer to a foreign legal entity in order to achieve the purposes set out in this Policy. Acceptance of this Policy is equivalent to the User's written consent to cross-border data transfer. In such cases the Platform guarantees observance of Personal Data protection measures by such persons in accordance with the standards of this Policy and the Acting law of the AIFC.

Upon achieving all of the intended purposes of processing or withdrawal of consent to processing, the User shall be guaranteed the destruction of their Personal Data by all third parties, regardless of the location of the data.

7. Concluding Provisions

The Policy shall be governed by and construed in accordance with the Acting law of the AIFC and shall be binding upon all Users. All matters not regulated in the Policy shall be resolved in accordance with the Acting law of the AIFC.

The Policy may be amended by the Platform. The new version of the Policy shall become effective upon posting at https://www.opensky.biz/policy.

If the current version is amended, the date of the last update shall be specified. In case of any questions on processing of Personal Data on the Site and the Policy, do not hesitate to contact OpenSky support at sales@openskyx.aero, or send a letter to Platform's address.