Privacy Policy

Introduction

Crown Aviation Holdings Inc. (“Crown Aviation” or the “Company”) is committed to compliance with applicable legal and regulatory requirements relating to data protection, privacy and cybersecurity as further set out in our Code of Business Conduct and Ethics. At the Company, we respect your privacy and this “Privacy Policy”, together with our Terms of Use and our Cookie Policy govern how the Company collects, processes (as defined below) and uses your Personal Data (as defined below) when you use the Websites (as defined below).

This Privacy Policy applies to users of the Websites (as defined below). For the purposes of applicable laws and regulations relating to data protection and privacy (“Data Protection Legislation”), the Company acts as a controller in respect of your Personal Data.

Definitions

The following definitions shall apply to this Privacy Policy:

“Company”, “we”, “us”, “our” means: Crown Aviation Holdings Inc.
“Personal Data” has the meaning given to it or any similar term (e.g., “personal information”, “non-public personal information”, “PII”, “personally referable information”) in applicable Data Protection Legislation and for the avoidance of doubt means any information which directly or indirectly identifies or otherwise relates to an individual, which is in the possession or under the control of the Company (or its representatives or service providers). Such Personal Data may include, without limitation, the name, age, identification number, email address, address, telephone number, location data, financial data, or online identifier of that individual. In addition to facts, such Personal Data includes any expression of opinion about an individual and any indication of the intentions of the Company or any other person in respect of an individual.
“Sensitive Personal Data” has the meaning ascribed to this or any similar term provided by applicable Data Protection Legislation (e.g., “sensitive personal information”, “sensitive data”, or “special categories of personal data”).
“Websites” means websites that link to this Privacy Policy unless such websites have their own data protection privacy policy and/or privacy notice.

Types of Personal Data

The Company may collect and process the following categories of Personal Data about you from the sources identified as follows:

Website Data. When you browse the Websites, depending on how you interact with the Websites, we may collect (i) information submitted as part of completing online forms on the Websites (including, but not limited to, name, age, date of birth, e-mail address, address, telephone number, identification number, online identifier, location, gender, nationality, citizenship and contact information); and (ii) technical information collected by cookies (see below) about the services that you use and how you use them, which may include device-specific information, your navigation throughout the Websites, and other technical and browsing preferences including your location and entry point to the Websites. Please note that if you do not provide certain Personal Data to the Company when requested (and where relevant, provide your consent) we may not be able to provide you with access to all areas of the Website and associated services.
Identity Verification Data. We may collect identity verification information from you, such as images of your government issued ID, passport, national ID card, or driving license, as permitted by applicable laws, or other authentication information.
Communications Data. We may collect Personal Data that you provide when you contact the Company for any reason, such as to express an interest in obtaining additional information about our services, direct questions and/or concerns about our services to us, use a “Contact Us” form or similar features, sign up for our emails or attend an event, or download certain content. Such information may include contact information such as name, job title, company name, phone number, location, and email address.
Reputation & Background Check Data. If you are a service provider or a business partner or are a representative of one of our service providers or business partners, we may collect Personal Data from you and from third parties that includes contact details, information concerning business practices, creditworthiness, reputation and business history, and job titles or roles.
Data the Company Generates. We may generate Personal Data about you when we interact with you or perform services for you. This data may include information about your relationship with us or the services we are providing you.
Cookies: Refer to our Cookie Policy which forms part of this Privacy Policy.
Do Not Track: Your browser and other mechanisms may permit you to send “do-not-track” signals or other similar signals via your browser settings to express your preferences regarding online tracking. Due to the lack of any standard for how do-not-track signals should work on commercial websites, we do not currently respond to such signals. Third parties, such as our analytics providers, from time-to-time may collect Personal Data that relates to you on the Websites, over other websites. We cannot control third parties’ responses to do-not-track signals or other such mechanisms. Third parties’ use of Personal Data relating to you and responsiveness to do-not-track signals is governed by their respective privacy policies.

Collection of Personal Data

The Company may collect the types of Personal Data described above:

Directly from you, including, for example, through your use of the Website, when you send us an email, visit our premises, or contact or communicate with us;
From automated tracking technology and monitoring tools, for example, cookies that track your access and use of our Websites and other online services;
From within the Company and from our affiliates;
From a third party acting on your behalf, for example, an intermediary, lawyer or service provider;
From publicly available sources; and
From other organizations, for example fund administrators and other service providers.

Use of Personal Data

Your Personal Data may be collected, stored, disclosed, and processed by the Company for, but not limited to, the following purposes:

to provide you with marketing communications and inform you about news and information relating to our business and services, including new product launches, product updates and general business news (see Section 13 below for further information);
to assess your application for the Company products and services, where applicable;
to understand your needs and interests and to respond to your enquiries;
to analyze and improve our services;
for the management and administration of our business;
to provide you with the products and services for which you subscribe;
to comply with and to assess compliance with applicable laws, rules, and regulations (including tax reporting purposes pursuant to tax legislation), industry codes, voluntary codes we decide to adopt, or good practice, anywhere in the world and internal policies and procedures such as the Website’s Terms of Use;
to confirm and verify your identity (this may involve the use of a credit reference agency or other third parties acting as our agents) and to conduct due diligence, background, and related checks. We will also screen against publicly available government and/or law enforcement agency sanctions lists. We may use third party providers to conduct these verifications and searches;
to detect, investigate and prevent fraud and other crimes or malpractice;
for the purpose of, or in connection with, any legal proceedings (including prospective legal proceedings);
to obtain legal advice or to establish, exercise or defend legal rights;
the administration and maintenance of databases storing Personal Data;
to comply with our contractual obligations;
for ongoing review and improvement of the information, content and services provided on the Websites to ensure they are user friendly and to prevent any potential disruptions such as cyber-attacks;
to analyze and report on the Websites traffic, marketing and usage trends;
to allow you to use and access functionality provided by the Websites;
to conduct analysis required to detect malicious data and understand how this may affect your Information Technology (“IT”) system;
for statistical monitoring and analysis of current attacks on devices and systems for the on-going adaption of the solutions provided to secure systems and devices against current attacks;
for in-depth threat analysis; and
for purposes otherwise set out in this Privacy Policy or as otherwise determined by our management team, acting reasonably.

The Company is entitled to use your Personal Data for these purposes because one or more of the following legal bases applies:

We need to do so to perform its contractual obligations to you (for example, to verify the information you provide);
We have obtained your specific and informed consent (which may include written consent) unless an exemption provided under applicable law permits the use and disclosure of your Personal Data without your consent;
We have legal or regulatory obligations that must be discharged;
We may need to do so to establish, exercise or defend our legal rights or for the purpose of legal proceedings; or
the use of your Personal Data is necessary for our legitimate business interests or the legitimate interests of a third party provided such interests are not overridden by your rights or interests, including: (i) allowing the Company to effectively and efficiently administer and manage the operation of its business; (ii) maintaining compliance with internal policies and procedures; (iii) monitoring the use of our copyrighted materials; (iv) offering optimal, up-to-date security solutions for mobile devices and IT systems; or (v) for internal research purposes.

Notwithstanding the generality of the foregoing, if you are located in a jurisdiction which requires us to obtain your consent to collect, use, store, process, and/or disclose your Personal Data, you understand that by accepting the terms of this Privacy Policy you expressly provide your consent to the Company collecting, using, storing, processing, and disclosing your Personal Data as set out in this Privacy Policy.

Disclosure of Your Personal Data to Third Parties

The Company may share or provide access to your Personal Data among its affiliates and business units and third party agents, service providers and contractors outside of the Company:

Business Management. For the purpose of the management and administration of the Company business;
Provision of Services. To facilitate the provision and enhancement of services to you;
Database Management. For the purpose of the administration and maintenance of the databases storing Personal Data;
Vendor Services. For the purposes of the Company receiving services (for example, the Company accountants, administrators, auditors, service providers, custodians, depositories, third party managers, paying agents, professional advisors such as consultants and legal advisors, IT and communications providers or any entity we, acting reasonably, consider necessary for the purposes as generally outlined above). These third parties will be expected to be subject to confidentiality requirements (either by contract, professional obligation, duty or otherwise) that require them to only use your Personal Data as described above;
System Protection. For the purpose of detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible; debugging to identify and repair errors that impair intended functionality;
Compliance with Law. To the extent required by law (for example, if the Company is compelled by an obligation or a duty to disclose your Personal Data where we believe it is necessary or appropriate to comply with any legal obligation, rule, regulations or internal the Company policies and procedures, including (without limitation) to comply with tax reporting requirements and other statutory reporting and disclosures to regulatory authorities), or to establish, exercise or defend its legal rights. This may include disclosure to regulatory bodies or government agencies, law enforcement or courts, and in order to investigate unauthorized attempts to modify the Websites, install harmful files or cause damage to the Websites or to the Company;
Business Transactions. As part of a transaction, financing, or for other business needs (for example, if the Company sells any of its businesses or assets, applies for a loan, or opens bank accounts, in which case the Company may need to disclose your Personal Data to the prospective buyer, lender or bank, as part of certain due diligence processes); or
Change of Control. If the Company or any of its affiliates, divisions or business units is acquired by a third party, including in the unlikely event of a bankruptcy, in which case the Personal Data held by the Company about you will be accessible to, and may be acquired by, the third-party buyer.

The Company may share anonymous or aggregated data with third parties such as service providers to facilitate our business operations. To the extent such data constitutes de-identified data under Virginia’s Consumer Data Protection Act, the Company will maintain and use such data without attempting to re-identify the data. We may process some of your Personal Data automatically, but we do not use computer algorithms to make automated decisions based on your Personal Data.

Links to Other Websites

The Websites may contain links to other third-party websites that are not governed by this Privacy Policy. Linked sites may have their own privacy notices or policies, which you should review. the Company is not responsible for the content of links or third-party websites and your use of such third party websites is at your own risk.

Transfers of Personal Data

The Company operates globally. This means Personal Data may be processed and disclosed as described above, in any country in which we conduct business or have a service provider. Accordingly, when you provide your Personal Data to the Company, you acknowledge and agree that we may disclose your Personal Data to recipients (including, but not limited to service providers, the Company affiliates or agents, and the Company IT servers) located in jurisdictions other than your own.

To the extent that applicable Data Protection Legislation does not allow or permit us to obtain your valid consent by virtue of providing this Privacy Policy to you, or otherwise rely on the other grounds set out in this Privacy Policy for disclosing your Personal Data outside of your jurisdiction, we will obtain your explicit consent through other means (if applicable) or, where relevant, ensure that the recipient is required to provide a standard of protection to your Personal Data that is equivalent to that under the Data Protection Legislation of your jurisdiction (e.g., by using standard contractual clauses for such international transfers).

In other circumstances, Data Protection Legislation may permit the Company to otherwise transfer your Personal Data outside your jurisdiction provided it complies with such Data Protection Legislation.

Safeguard Your Personal Data

The Company believes to have implemented commercially reasonable controls and appropriate technical and organizational measures to protect Personal Data, as well as to maintain the security of our information and information systems in respect of Personal Data. Appropriate controls (such as restricted access) are placed on our computer systems and used where appropriate. Management believes commercially reasonable measures are taken to ensure physical access to Personal Data is limited to authorized personnel only.

As a condition of employment, Company employees are required to follow applicable laws and regulations, including in relation to Data Protection Legislation. Unauthorized use or disclosure of confidential investor information by a Company employee is prohibited and may result in disciplinary measures.

Retention and Destruction of Personal Data

The period for which the Company will hold your Personal Data will vary and will be determined by the following criteria:

The purpose for which the Company is using it. the Company is required to retain the Personal Data for as long as is necessary to satisfy or meet the purposes for which it was obtained including applicable legal or regulatory requirements; and
Legal Obligations. Laws or regulations may set a minimum period for which the Company must retain your Personal Data.

Depending on the requirements of the Data Protection Legislation of your jurisdiction, the Company will take reasonable steps using appropriate technical methods in the circumstances to delete or destroy your Personal Data when we no longer have a legal basis to retain it or to ensure that the information is anonymized or irrecoverable.

Your Rights

To the extent provided by the law of your jurisdiction, you may have legal rights in relation to the Personal Data about you that the Company holds. These rights may include:

the right to refuse to provide any Personal Data and the right to object at any time to the processing of your Personal Data. Please note that such refusal or objection may prevent us from providing services to you;
the right to confirm whether we process your Personal Data and to obtain information regarding the processing of your Personal Data and access to the Personal Data about you that the Company holds (including any available information as to the source of the Personal Data and any safeguards that may have been used to transfer Personal Data outside of your jurisdiction, as referred to in this Privacy Policy);
where consent was provided for certain processing activities, the right to withdraw your consent to the collection, processing, use and/or disclosure of your Personal Data at any time. However, this will not affect the lawfulness of any collection, processing, use, or disclosure undertaken before your withdrawal and that the Company may still be entitled to process your Personal Data if it has another legitimate reason (other than consent) or a consent exception for doing so. In some cases, withdrawing your consent to the collection, use process or disclosure of some or all of your Personal Data may prevent us from providing services to you;
in some circumstances, the right to receive a copy of some Personal Data in a structured, commonly used, and machine-readable format and/or request that the Company transmit that data to a third party where this is technically feasible. Please note that this right may, depending on the jurisdiction, only apply to Personal Data that you have provided to the Company;
the right to request that the Company correct or rectify your Personal Data if it is inaccurate or incomplete;
in some circumstances, the right to request that the Company delete or erase your Personal Data. Such a request may prevent us from providing services to you and there may be circumstances where the Company is legally entitled to retain Personal Data regardless of any such request;
in some circumstances, the right to request that the Company restrict, anonymize, or block its processing of your Personal Data. Such a request may prevent us from providing services to you and there may be circumstances where the Company is legally entitled to retain Personal Data regardless of any such request;
in some circumstances, the right to obtain information about the public and private entities with which the Company made shared use of the Personal Data as a joint controller;
in some circumstances, the right to receive information on the possibility of not providing consent and on the consequences of the refusal;
in some circumstances, the right to non-discrimination against you for exercising your legal rights in relation to your Personal Data;
where applicable, the right to lodge a complaint with the data protection regulator in your jurisdiction if you think that any of your rights have been infringed by the Company; and
the right to request information concerning the measures that the overseas recipient of your Personal Data is taking to protect your Personal Data and its details, countries to which the relevant personal data is transferred, and the existence or non-existence of data protection legislation in the countries and the details thereof.

You can enquire about your rights, which are applicable to you, by contacting the Company using the details listed below in this Privacy Policy.

Children

The Websites are intended for use by those aged 18 years and older. We do not knowingly solicit or collect personal information on the Websites from children under the age of 18.

Processing of Personal Data

To the extent permitted by applicable law, we may contact you by mail, e-mail, SMS/text, telephone, and other electronic means to provide information on products and services that we believe will be of interest, unless you object to receiving such information. If you do not want to receive such communications from us, please contact our Privacy Officer.

Your option not to receive promotional and marketing material: (a) shall not preclude us from corresponding with you, by email or otherwise, regarding your relationship with us; (b) shall not preclude us, including our employees, directors, officers, contractors, agents and other representatives, from accessing and viewing your Personal Data for our internal business purposes; and (c) shall not preclude us from disclosing your Personal Data as described in this Privacy Policy for purposes other than sending you promotional and marketing materials.

Use of Personal Data in Relation to Data Subjects in Canada and Australia

Canadian Anti-Spam Legislation requires that Commercial Electronic Messages (“CEMs”) sent within Canada or into Canada from another jurisdiction may only be sent to individuals who opt into receiving them, subject to certain exceptions. Similar legislation applies in Australia (Spam Act 2003 (Cth)). Such consent may be implicit, such as by engaging in a prior business relationship, or by virtue of having one’s email address listed in a public directory. These anti-spam laws also require senders to include an opt-out function such as an “unsubscribe” mechanism within a CEM. You may opt-out of the collection or use of your information by the Company. In some cases, withdrawing your consent to the collection, use or disclosure of some or all your personal information will prevent us from providing services to you. To opt-out, please contact the Company Privacy Officer using the details set out below or use the opt-out facility provided in the CEM. In some cases the Company is permitted to send you certain CEMs after you opt out, such as where required to enforce legal rights.

California Privacy Rights

If you are a California resident, this section of the Privacy Policy is intended to provide you with information concerning your rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”) regarding Personal Data (referred to as “Personal Information” under the CCPA and throughout this section of this Privacy Policy).

Our collection, use, retention, and disclosure of Personal Information.

Sales and Sharing of Personal Information. We do not, and have not, sold any categories of Personal Information to third parties or shared any categories of Personal Information for the purpose of cross-context behavioral advertising.

We do not knowingly collect or solicit any categories of Personal Information from any individual under the age of eighteen (18).

Sensitive Personal Information. Sensitive Personal Information under the CCPA may include Social Insurance Numbers (“SI Numbers”), driver’s license numbers, or passport numbers; account credentials; precise geolocation; racial or ethnic origin; religious beliefs; biometric data; personal information concerning a consumer’s health or sex life or sexual orientation; as well as contents of a consumer’s mail, email, and text messages. To the extent we may collect your Sensitive Personal Information, we will not use or disclose such information for purposes other than (A) to perform services that you reasonably expect from us; (B) to prevent, detect and investigate security incidents; (C) to resist illegal actions directed at the business and to prosecute and defend our rights; (D) to ensure the physical safety of others; (E) for short-term, transient use; (F) to perform services necessary for the business; (G) to verify and maintain the quality and safety of our product or services; and (H) generally for purposes that do not infer characteristics about you.

Retention of Personal Information. We retain Personal Information for as long as is reasonably necessary in connection with the purposes for which the Personal Information was collected. For additional information on how we store your Personal Information, refer to the Retention and Destruction of Personal Data section of this Privacy Policy.

Your California Privacy Rights.

Your CCPA Privacy Rights. You have certain choices regarding our use and disclosure of your Personal Information, as described below.

Know. You have the right to request, twice in a 12-month period, that we provide (1) certain information about: (w) the categories of Personal Information we have collected about you; (x) the categories of sources from which the Personal Information is collected; (y) the business or commercial purpose for collecting your Personal Information; and (z) the categories of third parties to whom we have disclosed your Personal Information; and/or (2) the specific pieces of Personal Information we have collected, used, and disclosed about you during the past 12 months or as practicably reasonable.
Deletion. You have the right to request that we delete certain Personal Information we have collected from you and to tell our service providers to do the same, subject to certain exceptions.
Correction. You have the right to request that we correct or amend certain Personal Information we maintain about you if it is inaccurate.
Limit. You have the right to request that we limit the use and disclosure of Sensitive Personal Information we have collected. If the Company collects any Sensitive Personal Information, it will use it only for purposes listed above in Section 15(a)(iii) of this Policy. As such, any Sensitive Personal Information that we collect does not come within this right to limit use.
Opt-out. You have the right to opt out of the sale of your Personal Information to third parties and/or the sharing of your Personal Information for cross-context behavioral advertising. As stated above, the Company does not sell or share any Personal Information (as such terms are defined in the CCPA).
Non-Discrimination. You have the right to not experience discriminatory treatment and we will not discriminate against you because you have exercised any California privacy rights. We do not use the fact that you have exercised or requested to exercise any CCPA rights for any purpose other than facilitating a response to your request.

To Submit a Request. You may submit a request by emailing us at: info@crownaviation.ca.

Verifying Your Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your Personal Information or complying with your request. If we are successful in validating your identity, we will respond to your request within the time and in the manner required by the CCPA. If we are unable to verify your identity, we will need to deny your request. We reserve the right to deny requests in certain circumstances, such as where we have a reasonable belief that the request is fraudulent.

Individual Verification. If you request to know, access, delete, and/or correct your Personal Information, we may require you to provide any of the following information: address, date of birth, state or country of residence, telephone number, email address, or details of a transaction. In addition, if you ask us to provide you with specific pieces of Personal Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request. We will use the information you submit and the Personal Information we have in our systems to try to verify your identity and to match the Personal Information we have collected about you, if any, to your authorized Agent. If you designate an authorized agent to make an access or deletion request on your behalf, we may require you to (1) provide the authorized agent written permission (e.g., via a notarized letter) to do so, and (2) verify your own identity directly with us (as described above), and confirm with us that you provided the authorized agent permission to submit the request.

Additional California Privacy Disclosures

Shine the Light Notice. California residents may request and obtain from us, once a year and free of charge, information about categories of Personal Information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared Personal Information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by emailing us at: info@crownaviation.ca.

Do Not Track Signals. Your browser and other mechanisms may permit you to send do-not-track signals or other similar signals via your browser settings to express your preferences regarding online tracking. Due to the lack of any standard for how do-not-track signals should work on commercial websites, we do not currently respond to such signals.

Additional Privacy Notice Information Required for Australian Residents

We will deal with your Personal Data (which has the same meaning as “Personal Information” under the Privacy Act 1988, namely any information from which your identity is apparent or can be reasonably ascertained), in accordance with Australian privacy requirements including the Privacy Act 1988 and Australian Privacy Principles, the Spam Act 2003, the Do Not Call Register Act 2006, and any applicable state/territory privacy laws or industry codes. Information that is not “about” an individual is not considered “Personal Data” under Australian law.

If you contact us to access your Personal Data, to seek to correct it, or to make a complaint about privacy, we will respond as soon as we reasonably can, and in any event within any timescales stipulated by applicable law. We do not impose any charge for a request, but we may charge you a reasonable fee for our costs associated with providing you access and retrieval costs. For complaints about privacy, we will establish in consultation with you a reasonable process including time frames, for seeking to resolve your complaint.

Questions and Concerns

If you have any questions or concerns about the Company handling of your Personal Data, or about this Policy, contact us by email at info@crownaviation.ca.

This Privacy Policy may change from time-to-time, and you should review it periodically. This Privacy Policy was last updated on May 2, 2024.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Crown Aviation Holdings Inc. | A growth by acquisition company