1. Introduction

EnterJet Limited ("EnterJet", "we", "us" or "our") is a company registered in England and Wales whose registered office is at Harben House, Finchley Road, London, NW3 6LH, United Kingdom. We operate a direct-to-operator marketplace for private aviation, connecting our members with a vetted network of aircraft operators, together with related concierge and booking services.

Some members hold a partner account. A partner account is simply a type of membership: it gives the member access to the Platforms so that they can procure flights and related services on behalf of their own ultimate clients. A partner account holder is a member, not a business partner, agent or joint venturer of EnterJet, and references in this Policy to members include partner account holders unless we say otherwise. Where a partner account holder provides us with personal data about their ultimate clients or those clients' passengers, the responsibilities set out in section 4.3 apply.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you interact with us, whether you visit our website or mobile application (together, the "Platforms"), become a member, request or take a flight, communicate with our team or our AI booking assistant, or engage with us as an operator or supplier. It also sets out your rights under UK data protection law and how to exercise them.

We are committed to handling your personal data lawfully, fairly and transparently. This Policy is designed to comply with the UK General Data Protection Regulation (as retained in UK law by the Data Protection Act 2018) (the "UK GDPR"), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (the "PECR"). We are a UK company and handle personal data under UK data protection law wherever our members are located. We serve members in the UK, across Europe and in the United States, and additional provisions applying to individuals in certain jurisdictions are set out in section 21.

Please read this Policy carefully. If you do not agree with it, you should not use the Platforms or our services. The Platforms may contain links to third-party websites, applications or services that are not operated by us; this Policy does not apply to those, and we encourage you to review their own privacy notices.

2. Who we are and how to contact us

EnterJet Limited is the data controller responsible for your personal data in connection with your membership, your use of the Platforms, and the services we provide. Where a partner account holder procures a flight on behalf of their own ultimate client, the partner account holder and EnterJet each act as independent controllers of the personal data they respectively hold: the partner account holder is responsible for its own relationship with, and handling of data about, its clients, and this Policy governs how EnterJet uses personal data for its own purposes.

You can contact us about this Policy or about your personal data using the details below:

By email: [email protected]
By post: Data Protection, EnterJet Limited, Harben House, Finchley Road, London, NW3 6LH, United Kingdom

We have appointed a privacy contact who oversees compliance with this Policy and handles questions and requests. If you have any concern about how we use your personal data, please contact us first so that we can try to resolve it.

3. Who this Policy applies to

This Policy applies to all individuals whose personal data we process, including:

• Members who register for and hold an EnterJet account, including partner account holders who procure flights on behalf of their own clients;
• Passengers and travelling companions named on a booking, including guests, family members and others travelling with a member;
• Prospective members and enquirers who contact us or express interest in our services;
• Visitors to our Platforms;
• Operators and suppliers in our network, and their staff and representatives; and
• Job applicants who apply for a role with us.

4. The personal data we collect

We collect and process the following categories of personal data. Not every category will apply to every individual — what we hold about you depends on how you interact with us.

4.1 Information you provide to us

• Identity and profile data — full name, title, date of birth, nationality, gender (where relevant to travel documentation), photograph, and your membership status and preferences.
• Contact data — postal address, email address, and telephone or mobile number.
• Government and travel identification — passport number and copy, national identity or other government-issued identification, visa information, and other documentation required to arrange and lawfully undertake a flight.
• Financial and payment data — billing address, bank account details, card details (processed through our payment providers), payment history and, where relevant, information required for anti-money-laundering and fraud checks.
• Booking and travel data — your flight requests, itineraries, departure and arrival airports, dates and times, catering, ground-transport and concierge requirements, luggage details, and the names and details of the passengers travelling with you.
• Preferences — favourite airports and routes, cabin, catering and service preferences, communication-language preference, and any other information you provide so we can tailor your experience.
• Communications — the content of, and records relating to, your correspondence with us and with our AI booking assistant, including emails, messages sent through WhatsApp and other messaging channels, in-app messages, social-media interactions, survey responses and testimonials.
• Marketing and consent data — your preferences for receiving marketing from us and your consent records.

4.2 Special category and other sensitive data

Because of the nature of our services, we may need to process special category data: for example, health or medical information where you require disability assistance, medical transportation, particular catering for allergies or dietary needs, or where a medical condition affects your travel. We only collect such data where it is necessary to provide the service you request, and we rely on an appropriate lawful basis (see section 6). We may also process information about criminal convictions or carry out background and sanctions screening where required for security, regulatory or fraud-prevention purposes.

Other than where we specifically request it, for example, to arrange assistance or accommodate a dietary or medical need, please do not send us, or disclose to us, any sensitive personal data about yourself or others. Where you provide such data unprompted, you consent to our handling it in accordance with this Policy.

4.3 Information about others

Where you provide us with personal data about other people — for example passengers, guests, family members or colleagues travelling with you, or emergency contacts — you confirm that you have their authority to do so and that you have made them aware of this Policy. You are responsible for ensuring the information you provide about others is accurate.

If you hold a partner account and provide us with personal data about your ultimate clients or their passengers so that we can arrange flights for them, you confirm that you have a lawful basis to share that data with us, that you have provided those individuals with appropriate privacy information, and that they are aware their data will be processed by EnterJet as described in this Policy. You remain responsible for your own relationship with your clients.

4.4 Information operators provide about crew and staff

Where an operator in our network provides us with personal data about its crew, pilots or other staff — for example to schedule, confirm or fulfil a flight — the operator is responsible for ensuring it has the authority to share that data with us and has made those individuals aware of how we use and process it. We process such data only as necessary to arrange and administer flights and to meet our operational, safety and regulatory obligations.

4.5 Information we collect automatically

When you use the Platforms, we automatically collect certain technical and usage data through cookies and similar technologies (see section 9), including:

• Device and connection data — IP address, device type and identifiers, operating system, browser type and settings, and mobile network information.
• Usage data — pages and screens viewed, search queries on the Platforms, features used, referring and exit pages, traffic and log data, and dates and times of access.
• Location data — approximate or precise geolocation (where you permit it), used to suggest relevant charter options, identify your nearest departure airport, and tailor the services offered to you.

4.6 Information from third parties and public sources

We may receive personal data about you from: our operator network (for example, to confirm a booking); a partner account holder who has arranged a flight on your behalf; payment providers and fraud-prevention agencies; identity-verification, sanctions and background-screening providers; publicly available sources and public records where permitted by law; and social-media platforms where you interact with us through them.

5. How and why we use your personal data

We use your personal data to:

• Register and administer your membership and account, and maintain the connection of your account across devices;
• Receive, arrange, fulfil and manage your flight requests, bookings and related concierge, ground-transport and catering services, including liaising with operators and suppliers;
• Communicate with you about your bookings, requests, account and membership — including confirmations, itineraries, updates, changes, service messages and administrative notices — by email, telephone, WhatsApp and other messaging channels, and through our AI booking assistant;
• Provide customer care and respond to your enquiries, requests and complaints;
• Take payment, manage billing and collection, and prevent, detect and investigate fraud, money laundering and other unlawful activity;
• Verify identity and carry out security, sanctions and regulatory screening;
• Personalise your experience and make relevant recommendations based on your preferences and history;
• Send you marketing communications about our services and, where you have agreed, those of selected third parties, in line with your preferences;
• Operate, maintain, secure and improve the Platforms and our services, including analytics, research and product development;
• Comply with our legal, regulatory, aviation-safety and security obligations, and establish, exercise or defend legal claims; and
• Manage our relationships with operators and suppliers, and assess job applicants.

6. Our lawful bases for processing

We only process your personal data where the law allows us to. The lawful bases we rely on are set out below. Where we rely on legitimate interests, we have carried out a balancing assessment to ensure our interests do not override your rights.

Our legitimate interests include running and growing our business, providing and improving our services, keeping our Platforms and members secure, and preventing fraud. You can ask us for more detail about our balancing assessments at any time.

7. Who we share your personal data with

We share personal data only where necessary and with appropriate safeguards in place. We may share it with:

• Aircraft operators in our network, to source, quote and fulfil your flights;
• Service and concierge suppliers — including ground transport, catering and other suppliers engaged to deliver services you request;
• Partner account holders — where you are the ultimate client of a member who holds a partner account and who arranges flights on your behalf, we may share booking-related information with that member so they can manage your booking;
• Payment processors, banks and fraud-prevention agencies to take payment and protect against fraud;
• Technology and service providers who support our operations — including cloud hosting, communications, CRM, scheduling, analytics and AI-assistant infrastructure — acting as our processors under contract;
• Professional advisers such as lawyers, auditors, accountants and insurers;
• Regulators, law-enforcement and public authorities where required to comply with a legal or regulatory obligation, or to protect our rights, property or safety, or those of others; and
• Parties to a corporate transaction — in connection with any merger, acquisition, financing or sale of business assets, a prospective buyer and its advisers.

We require all processors to protect your personal data, to act only on our instructions, and to comply with applicable data protection law. We do not sell or rent your personal data, and we do not share it with third parties for their own direct-marketing purposes.

8. International transfers

Given the global nature of private aviation, your personal data may be transferred to, and processed in, countries outside the United Kingdom — including where an operator or supplier involved in your booking is located abroad. Where we transfer personal data outside the UK, we ensure a similar degree of protection by relying on one of the following safeguards:

• A UK adequacy decision (or 'adequacy regulations') recognising that the destination country provides an adequate level of protection;
• The International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum; or
• Another lawful transfer mechanism, including, where strictly necessary, the performance of your contract or your explicit consent.

You may request a copy of the relevant safeguards by contacting us at [email protected].

9. Cookies and similar technologies

We and our third-party providers use cookies, web beacons, pixels, device identifiers, software development kits and server logs to operate the Platforms, remember your preferences, keep you signed in, measure and improve performance, and — where you consent — to deliver and measure marketing.

We use the following broad categories:

• Strictly necessary — required for the Platforms to function; these cannot be switched off.
• Performance and analytics — help us understand how the Platforms are used so we can improve them.
• Functionality — remember your choices and personalise your experience.
• Marketing — used to deliver and measure advertising relevant to you.

Non-essential cookies are set only with your consent, which you give and manage through our cookie preference tool. You can also control cookies through your browser or device settings, though disabling some may affect how the Platforms work. Server logs cannot be disabled by users.

10. Our AI booking assistant

We provide an AI-powered booking assistant that helps you make and manage flight requests through messaging channels. When you interact with it, we process the content of your messages together with your account, booking and preference data so that it can understand and act on your requests. The assistant identifies itself as AI at the outset of any conversation.

Interactions with the assistant may be logged, reviewed and used to fulfil your requests, provide support, ensure quality and safety, and improve our services. A member of our team may take over a conversation where appropriate. Decisions that produce legal or similarly significant effects are not taken by automated means alone without a lawful basis and, where required, human involvement (see section 11).

11. Automated decision-making and profiling

We use limited profiling to personalise our services and recommendations and to support fraud prevention and security screening. We do not make decisions producing legal or similarly significant effects about you based solely on automated processing, except where permitted by law — for example where necessary for a contract with you or required by law to prevent fraud — in which case you have the right to obtain human intervention, to express your point of view and to contest the decision.

12. Call and message recording

Calls to and from our team may be recorded, and messages retained, for security, training, quality, dispute-resolution and regulatory purposes. Where we do so we will make this clear, and we handle any recordings in accordance with this Policy.

13. How long we keep your personal data

We keep personal data only for as long as necessary for the purposes for which we collected it, including to satisfy any legal, regulatory, tax, accounting, safety or reporting requirements, and to establish, exercise or defend legal claims.

As a general rule, we retain member and booking records for the duration of your membership and for a period afterwards determined by the applicable limitation periods and our legal obligations. Financial and transaction records are retained for the periods required by tax and accounting law. Job-applicant data is retained for up to 12 months following an unsuccessful application, and longer only with your consent. When personal data is no longer required, we securely delete or anonymise it.

We maintain a retention schedule setting out specific retention periods, which is available on request.

14. How we protect your personal data

We maintain appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include access controls, encryption in transit, secure hosting, staff confidentiality obligations and training, and vendor due diligence. We limit access to those who need it to do their jobs. No system can be guaranteed completely secure; where we are legally required to do so, we will notify you and the relevant regulator of a personal data breach.

15. Your rights

Subject to conditions and exemptions under UK data protection law, you have the right to:

• Be informed about how we use your personal data (as set out in this Policy);
• Access a copy of the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your data in certain circumstances (the 'right to be forgotten');
• Restrict our processing in certain circumstances;
• Data portability — to receive certain data in a portable format or have it transferred to another controller;
• Object to processing based on legitimate interests, and to direct marketing at any time; and
• Withdraw consent at any time where we rely on it, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, and we will tell you if that is the case. There is normally no charge, though we may charge a reasonable fee or refuse a request that is manifestly unfounded or excessive.

16. Marketing and your choices

We send marketing communications only in line with your preferences and the law. You can opt out at any time by using the unsubscribe link in any marketing email, adjusting your communication preferences in your account, or contacting us. Opting out of marketing does not affect service and booking communications, which we need to send you to administer your membership and bookings.

17. Children

The Platforms are not directed at children under 16, and we do not knowingly collect their personal data through the Platforms without appropriate consent. However, because of the nature of our services, we may hold information about children who travel — for example a member's family members — where necessary to arrange transport and comply with aviation and security requirements, and we use that information only for those purposes. If you believe a child has provided us with personal data without the consent of a parent or guardian, please contact [email protected] and we will delete it where appropriate.

18. Third-party links

The Platforms may contain links to third-party websites, plug-ins and applications. Clicking those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy notice of every site you visit.

19. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or the law. When we make material changes we will, where appropriate, notify you by email or through the Platforms. We encourage you to review this Policy periodically.

20. Complaints

If you have a concern about how we handle your personal data, please contact us first at [email protected] so that we can address it. You also have the right to lodge a complaint with the Information Commissioner's Office ("ICO"), the UK supervisory authority for data protection, at www.ico.org.uk or by calling 0303 123 1113. If you are in the EEA, you may also complain to your local supervisory authority. We would, however, appreciate the chance to deal with your concerns before you approach the regulator.

21. Country-specific provisions

The following provisions supplement this Policy and apply to members and other individuals in the jurisdictions identified. Where they conflict with the rest of this Policy, these provisions prevail for the relevant individuals.

21.1 Members outside the United Kingdom

EnterJet is a company established in and operating from the United Kingdom. Our services are provided by, and your membership and any bookings are made with, the UK company, and our processing of personal data is governed by UK data protection law. This applies wherever you are located when you use our services.

We welcome members based outside the UK, including in the European Economic Area (the EEA). If you are located in the EEA, you contract with us as a UK company and by using our services you understand that your personal data is handled by us in the United Kingdom in accordance with this Policy. We extend the rights described in section 15 to all our members regardless of location, and you may raise any question, request or concern with us at [email protected].

21.2 Residents of the United States

This section supplements the rest of this Policy and applies to members and other individuals who are residents of the United States. Depending on your state of residence and subject to applicable law and its exceptions, you may have the following rights in relation to the personal data we hold about you:

• Right to know what personal data we collect about you and how we use and disclose it;
• Right to access a copy of the personal data we hold about you;
• Right to correct inaccurate personal data;
• Right to delete personal data we hold about you;
• Right to opt out of the 'sale' or 'sharing' of your personal data and of targeted advertising (including cross-context behavioural advertising); and
• Right to limit the use and disclosure of sensitive personal information.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising, in the way those terms are defined under US state privacy laws. Where permitted by applicable law, you may use an authorised agent to submit a request on your behalf, and you may appeal a decision we make about your request by contacting us. You have the right not to receive discriminatory treatment for exercising any of these rights.

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before acting on your request, and we will respond within the timeframe required by applicable law.

EnterJet Limited · Registered in England and Wales · Harben House, Finchley Road, London, NW3 6LH