Privacy Notice

1. Introduction

Merlin Atlantic Aviation Ltd., trading as Merlin Atlantic ("Merlin Atlantic", "we", "us" or "our"), is an aviation investment, leasing and asset trading business based in Shannon, Ireland.

This Privacy Notice explains how Merlin Atlantic processes personal data in connection with its website, business activities and professional relationships.

Our activities are principally business-to-business ("B2B"). Accordingly, the personal data we process generally relates to individuals acting in a professional or representative capacity on behalf of companies, financial institutions, investors, lessors, lessees, airlines, MRO providers, manufacturers, suppliers, advisers and other aviation industry counterparties.

This Privacy Notice applies to personal data processed when you:

• visit merlinatlantic.com (the "Website");
• contact Merlin Atlantic or submit a business enquiry;
• act for or on behalf of an existing or prospective counterparty;
• participate in an existing or proposed aviation asset, leasing, financing, investment, trading or related transaction;
• provide professional or advisory services to Merlin Atlantic; or
• otherwise interact with us in a professional or business capacity.

This Privacy Notice should be read together with our Cookie Policy and any transaction-specific or other privacy information that may be provided where appropriate.

For the purposes of Regulation (EU) 2016/679 (the "GDPR"), the Data Protection Act 2018 and other applicable data protection legislation, Merlin Atlantic Aviation Ltd. is the data controller in respect of personal data processed as described in this Privacy Notice.

2. Who We Are

Merlin Atlantic Aviation Ltd. Trading as Merlin Atlantic Company Registration Number: 821511 Registered in Ireland

Registered Office: Suite 315, Airport House Shannon, Co. Clare V14 E370 Ireland

Email: info@merlinatlantic.com

Questions concerning this Privacy Notice, our processing of personal data or the exercise of data protection rights may be directed to the email address above.

3. Scope of Personal Data

"Personal data" means information relating to an identified or identifiable natural person.

As a B2B organisation, much of the information handled by Merlin Atlantic concerns companies, aircraft, engines, aviation assets, transactions and other corporate or commercial matters and is therefore not personal data.

Personal data may nevertheless arise where information identifies or relates to an individual acting in a professional capacity.

This may include directors, officers, employees, representatives, beneficial owners, investors, lenders, advisers and other professional contacts associated with organisations with which Merlin Atlantic conducts or considers conducting business.

4. Personal Data We May Process

Depending on the nature of our relationship or interaction, we may process the following categories of personal data.

Professional identification and contact information

This may include:

• name;
• job title and professional role;
• company or organisation;
• business email address;
• business telephone number;
• business address; and
• other professional contact information.

Business relationship and transaction information

In connection with our aviation investment, leasing, trading and financing activities, we may process information concerning:

• the organisation you represent;
• your role or authority in relation to a transaction;
• professional correspondence;
• transaction and contractual documentation;
• aircraft, engine, component or other aviation asset transactions;
• leasing and financing arrangements;
• investment and MRO-related opportunities;
• USM, parts and inventory transactions;
• due diligence;
• meetings, negotiations and transaction history; and
• other information relevant to an existing or proposed business relationship.

Compliance and due-diligence information

Where necessary in connection with a transaction, financing arrangement or legal or regulatory requirement, we may process appropriate information concerning directors, officers, authorised representatives, beneficial owners or other relevant individuals.

This may include identification, corporate authority, ownership or other information reasonably necessary for applicable know-your-counterparty, sanctions, anti-money laundering, fraud prevention, compliance or due-diligence purposes.

The nature and extent of such processing will depend on the particular transaction and applicable requirements.

Correspondence and enquiries

Where you contact Merlin Atlantic, we may process:

• information submitted through our Website;
• the nature and content of your enquiry;
• business correspondence;
• documents or information you provide; and
• records of subsequent communications.

Website and technical information

When you access our Website, we or authorised service providers may process limited technical information such as:

• IP address;
• browser and device information;
• operating system;
• date and time of access;
• referring source;
• pages accessed;
• server and security logs; and
• cookie or similar technology information.