Privacy Notice (GDPR)

AlphaTech Aviation is the data controller responsible for your personal data in relation to the Investor Portal. If you have any questions about this notice or how we use your data, you can contact us at paul@flyalphatech.com.

To process your request for access to the investment proposal, we collect:

• Full name — to identify you as the signatory of the confidentiality agreement.
• Email address — to communicate with you and deliver your access password.
• Postal address — to confirm your identity and include in the signed agreement.
• Date of birth — to verify your identity and confirm you are legally able to enter into the agreement.
• Photographic identification (a scanned copy or clear photograph of a government-issued photo ID, such as a passport or driving licence) — to verify your identity before granting access to confidential business information.
• Typed e-signature — as your legally binding signature on the confidentiality agreement.
• IP address and timestamp — recorded at the time of signing for security and audit purposes.

We process your personal data for the following purposes, each with a lawful basis under UK GDPR Article 6:

• Identity verification before granting access — we collect your date of birth and photo ID to confirm your identity and protect our confidential business information from unauthorised access. Legal basis: our legitimate interests in securing sensitive commercial information (Article 6(1)(f)).
• Entering into and administering the confidentiality agreement — your name, address, email and signature are used to create and manage the agreement. Legal basis: performance of a contract (Article 6(1)(b)).
• Communicating with you about your access request — we use your email to send you your access password and related communications. Legal basis: our legitimate interests in responding to your enquiry (Article 6(1)(f)).
• Security and fraud prevention — we record your IP address and the time of signing to deter and detect unauthorised or fraudulent access. Legal basis: our legitimate interests in protecting our business (Article 6(1)(f)).

You are not legally obliged to provide your personal data, but without it we cannot verify your identity or grant you access to the confidential investment proposal.

We do not intentionally collect any special category data (such as information about your health, ethnicity or religion). If your photo ID happens to reveal any such information, we process it only to the extent necessary for identity verification. We will not use it for any other purpose.

• Your data is stored securely on our cloud-based platform provider’s servers, located within the United Kingdom and the European Economic Area.
• Your photo ID is uploaded to private storage — it is not publicly accessible. Only authorised AlphaTech administrators can view it.
• Access to your personal data is restricted to authorised AlphaTech personnel who need it to process your access request.
• We apply appropriate technical and organisational measures, including encryption in transit, access controls and audit logging, to protect your data against unauthorised access, loss or misuse.

We do not sell your personal data. We share it only as follows:

• With authorised AlphaTech administrators who review and approve access requests.
• With our cloud platform provider, who hosts the data on our behalf and acts as a data processor under strict contractual obligations of confidentiality and security.
• Where we are legally required to do so, or to protect our rights, property or safety, or that of others.

We retain your personal data for as long as is necessary for the purposes described in this notice:

• Your signed confidentiality agreement and associated details are retained for the duration of the confidentiality period (five years) and for a reasonable period thereafter to support legal or audit obligations.
• Your photo ID and date of birth are retained for the period necessary to verify your identity and manage your access. If your access request is declined or withdrawn, we will securely delete your photo ID within a reasonable period.

You have the following rights in relation to your personal data:

• The right to be informed — to be told how your data is used (this notice).
• The right of access — to ask what data we hold about you and for a copy.
• The right to rectification — to have inaccurate data corrected.
• The right to erasure — to ask us to delete your data in certain circumstances.
• The right to restrict processing — to ask us to limit how we use your data.
• The right to data portability — to receive your data in a structured, machine-readable format.
• The right to object — to object to processing based on legitimate interests.
• Rights in relation to automated decision-making — we do not use automated decision-making in this process.

To exercise any of these rights, contact us at paul@flyalphatech.com. We will respond within one month of receiving your request.

If you have given consent for any specific processing activity, you have the right to withdraw that consent at any time. Withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal. To withdraw consent or request deletion of your data, contact us at the email address above.

Your data is stored on servers located within the United Kingdom and the European Economic Area. We do not transfer your personal data outside these regions except where necessary to provide our services, in which case we ensure appropriate safeguards (such as Standard Contractual Clauses) are in place.

If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent authority for data protection. You can find more information at ico.org.uk or by calling their helpline on 0303 123 1113.

We may update this privacy notice from time to time. The date at the top of this page shows when it was last updated. We encourage you to review this notice periodically.