Airside Facial Scan Policy

This Airside Facial Scan Policy (“Facial Scan Policy”) applies to users of the Airside Digital  Identity mobile application (the “Airside App”) who are located in the United States. This Facial  Scan Policy describes how, with your consent, Airside Mobile, Inc. (“Airside”) and its Providers  (collectively, “we”) will treat data from photos/videos of you and your identity documents captured  via your device camera or otherwise uploaded to the Airside App, including data that may be  construed as a scan of face geometry extracted from such images/videos of you and your identity  documents (“Scan Data”) and information, regardless of how it is captured, converted, stored, or  shared, based on your Scan Data that is used to identify you (“Scan Information”). Scan Data  and Scan Information (collectively, “Biometric Information”) may be considered to be biometric  identifiers or biometric information by applicable biometric privacy laws.

This Facial Scan Policy should be read in conjunction with Airside’s Terms of Use and Privacy  Policy which describe Airside’s services and use of personal data, including sensitive personal  data, in more detail. Notwithstanding any indication to the contrary, in Airside’s Privacy Policy,  Terms of Use, or any other document or policy, the terms of this Facial Scan Policy shall prevail  in the event of any inconsistency with other terms or notices provided to you.

This Facial Scan Policy may be periodically updated. We will post a notice for users at the top of  this policy with the last date of revision.

Why Airside is using Biometric Information: You are likely reading this Facial Scan Policy  because you wish to use the Airside App to share information about your verified identity with one  of Airside’s partners (such as airline company with whom you are taking a flight). Before Airside  can provide this service to you, it must first verify your identity. To do this, you will need to submit  a photo or video of yourself (a “Selfie”) and images and scans of your government-issued identity  document to the Airside App, and we will ask for your consent to collect, capture, obtain, possess,  store, use, process, disclose and re-disclose (“Processes”) your Biometric Information for the  purposes of:

(1) Verifying your identity by comparing Biometric Information (i.e. facial scan data) extracted  from your Selfie, to Biometric Information (i.e. facial scan data) extracted from the photo  in your government-issued identity document;

(2) Analyzing Biometric Information to detect and prevent fraud, including to determine  whether Onfido has previously verified your identity and/or to identify signs of coercion or  social engineering; and

(3) Evaluating the authenticity of your Selfie and government-issued identity document,  including detecting whether there is a genuine human or physical document in your  photos/videos or signs of tampering.

In addition to the Biometric Information, Airside will Process other personal data, including  sensitive personal data, (for example IP address and other data about your device and personal  data extracted from your identity document e.g. name, date of birth etc) (“Personal Data”) for the  purposes listed above. See Airside’s Privacy Policy for more information.

Airside will use reasonable standards of care, consistent with its industry, to store, transmit, and  protect from disclosure your Biometric Information, in a manner that is the same as or more  protective than the manner in which it stores, transmits, and protects other confidential and

sensitive information. Airside will not sell, lease, trade, or, other than for the purposes described  in this Facial Scan Policy, otherwise profit from Biometric Information.

If you do not consent to the use of your Biometric Information as described above, we will not  extract Biometric Information from your photos/videos, Process your Biometric Data, or verify your  identity.

Retention of your Biometric Information: We will delete your Biometric Information within 48  hours of having verified your identity. The only information we retain is a record of the fact that we  performed a verification of your identity. Since your Selfie and the information you provide  regarding your government-issued identity document is stored within the Airside App on your  mobile device, we are not able to delete this data, but you may delete this data yourself at any  time. (You may do this by opening the IDs tab of the Airside App, and scrolling to the bottom to  delete.)

Disclosure of your Biometric Data: When Processing your Biometric Information, Airside will  only disclose, redisclose or otherwise disseminate Biometric Information in the following  circumstances:

• As requested and authorized by you or your legally authorized representative; 
• To complete a financial transaction requested or authorized by you or your legally  authorized representative;
• As required by state or federal law, or municipal ordinance;
• As required pursuant to a warrant or subpoena issued by a court of competent jurisdiction;  or
• To a “Provider” acting on Airside’s behalf to help verify your identity. These include Thales, Inc., Thales DIS USA, Inc., Acuant, Inc., and Onfido, Inc. and its affiliate  companies*. These Providers may further disclose your Biometric Information, including to additional service providers that help them. For example, Onfido discloses your  Biometric Information to Amazon Web Services (who provide Onfido’s cloud storage) – see here for more information. Airside is in no way responsible for the practices of the  Providers. Airside encourages you to read any Provider’s privacy policies and terms and  conditions which may apply to the use of Biometric Information.

Your consent: The Airside App will ask you whether you consent to the processing of your  Biometric Information as described in this Facial Scan Policy. BY CLICKING ON THE “I  CONSENT” BUTTON, YOU AGREE THAT YOU: (1) HAVE READ, UNDERSTAND, AND  ACCEPT THIS AIRSIDE FACIAL SCAN POLICY AND AIRSIDE’S TERMS OF USE; (2) GRANT  CONSENT TO AIRSIDE, ONFIDO AND OTHER PROVIDERS TO PROCESS YOUR  BIOMETRIC INFORMATION AND OTHER PERSONAL DATA FOR THE PURPOSES  DESCRIBED IN THIS AIRSIDE FACIAL SCAN POLICY; (3) RELEASE IN FAVOUR OF AIRSIDE,  ONFIDO, AND THE OTHER PROVIDERS ANY CLAIMS RELATED TO YOUR BIOMETRIC  INFORMATION, PHOTO/VIDEO; AND (4) CONFIRM THAT YOU ARE NOT ACCESSING  AIRSIDE’S SERVICES IN ANY JURISDICTION WHERE THE SERVICES ARE NOT  PERMITTED BY APPLICABLE LAW.

Withdrawal of your consent: If you consent now but would like to later withdraw your consent,  please contact Airside using the details set out in Airside’s Privacy Policy.

*Onfido affiliate companies

• Onfido Ltd 14-18 Finsbury Square, 3rd Floor, London, England, EC2A 1AH • Onfido SAS Regus La Defense Tour Ariane, 5 place de la Pyramide, 92088 Paris La Defense Cedex
• Onfido Inc Paracorp Incorporated, 2140 South Dupont Highway, Camden, Delaware 19934
• Onfido GmbH Am Kaiserkai 69, 20457 Hamburg
• Onfido Unipessoal Avenida D João II, n°46 – 4A, 1990-095 Lisboa
• Onfido Services India Private Limited Unit No. 9, Corporate Park II, 9th floor, VN Purav Marg, Near Swastik Chambers, Chembur, Mumbai – 400071
• Onfido PTE Ltd 100 Tras Street, #16-01, 100 AM, Singapore (079027) • Onfido BV Ground, 1st, 2nd and 3rd Floor, Joop Geesinkweg 901-999, Amsterdam Duivendrecht, 1114 AB, Netherlands
• Entrust Corporation, 1187 Park Place, Shakopee, Minneapolis, MN 55379, Minnesota