NDPA 2023 COMPLIANT • DATA PROTECTION

Privacy Policy

EAN Aviation Limited (“EAN”, “we”, “us”, “our”) is committed to protecting your personal data in accordance with the provisions of the Nigeria Data Protection Act 2023 and applicable aviation data governance frameworks.

Last Updated: 15 October 2025Entity: EAN Aviation LimitedDPO Contact: info@ean.aero

Contact DPO Desk

Scope & Acceptance

Application of Policy

This privacy policy (“Policy”) applies to the website(s) and mobile application(s) (hereinafter referred to as, the “Sites”) provided by EAN Aviation Limited (“EAN”, “we”, “us”, “our”), including but not limited to flight operations, aircraft management, maintenance, ground handling, and other products/services of EAN. This Policy discloses our data protection practices on our Sites, products and service (“Services”), inclusive of the type of personal data that we collect, our method of collection of personal data, use of personal data and procedures for sharing personal data with third parties.

The Sites covered by this Policy include our existing websites, mobile applications and all other additional websites and mobile applications produced and managed by EAN. We are committed to protecting your personal data in accordance with the provisions of the Nigeria Data Protection Act 2023 and other applicable data protection laws, Regulations and Directives (“Data Protection Laws”).

By visiting the Sites or continuing to use our services, you accept and consent to the practices contained in this privacy policy.

SECTION 01Legal Framework

Lawful Basis for Collecting & Processing Data

Our processing operations adhere strictly to legal grounds recognized under the Nigeria Data Protection Act 2023 (NDPA 2023).

Consent

Where you have consented to our processing of your personal data for one or more specific reasons. Such consent is given by you through your continuous use of the Services and the Sites. Consent may be obtained through affirmative actions such as ticking a consent box, signing a consent form, or submitting information voluntarily for a specific service.

Performance of a Contract

In order to perform a contract we have with you or a contract to which you are a party to, and in order to take necessary steps at your request prior to entering into such a contract (such as booking jet charters, hangar leases, or FBO ground handling).

Legal Obligation

Where processing of personal data is required by law. For instance, we are required by law to retain personal data of our customers beyond the date such customers cease to carry on business with us to comply with civil aviation regulations and anti-money laundering frameworks.

Vital Interest

In order to process data for data subjects when they are in critical life-threatening situations where they may not be able to provide consent for data processing and which may be vital for the subjects’ survival (e.g. emergency medical evacuations or airside safety incidents).

Public Interest

Such processing is necessary for the performance of a task carried out in the interest of the public or in exercise of an official public mandate vested on us by relevant civil aviation and national security authorities.

🔒 Consent

✈️ Contract Performance

⚖️ Legal Obligation

🚑 Vital Interest

🏛️ Public Interest

SECTION 02Legal Framework

Information We May Collect From You

We collect personal data necessary to deliver executive aviation, FBO, maintenance, and flight operations safely.

Definition of Personal Data

Personal data/information in this context shall include all data relating to an identified or identifiable natural person who can be identified directly or indirectly by: name, identification number, location data, online identifier, address, photo, email address, posts on social networking websites, account and login details, financial and transactional information (payment card details, billing address, transaction history), flight details, travel itineraries, emergency contact information, passenger manifest data, aircraft ownership or operation details, health or medical details, and other unique identifiers such as MAC address, IP address, IMEI number, IMSI number, or SIM.

Specific Services Data Requirements

For the purpose of accessing our Services, the personal data we may collect includes: your full legal names, marital status, title, date of birth, gender, photo, facial recognition data, business name, email address, mailing address, telephone number, bank account number, payment card details, bank verification number (BVN), national identification number (NIN), international passport number, means of identification, guarantors contact details, bank statements, usernames, password, your preferences, interests, feedback and survey responses, preference in receiving marketing information from us and our third parties, and your communication preferences.

Primary Purpose of Collection

Our primary goal in collecting the above stated personal data is to provide you with a safe, efficient, smooth and customized executive aviation experience. This allows us to provide services and features that most likely meet your operational and luxury travel needs.

SECTION 03Legal Framework

How We Collect Information

Data is gathered through direct digital channels, facility visits, technical tracking, and authorized screening partners.

Direct Interactions

We collect information you provide directly to us—for example, when you register or log on to the Sites, create an account, subscribe to a Service, participate in interactive features, fill out a form, take part in surveys, post on message boards, upload documentation, request customer support, make an inquiry, communicate with us by email, phone, or post, or interact on social media.

Incomplete & Abandoned Forms

We will also collect your information where you partially complete and/or abandon any information inputted in the Sites and may use this information to contact you to remind you to complete any outstanding information.

Offline Aviation Operations

We may collect personal data offline in the course of providing aviation-related services, such as when passengers or clients visit our FBO facilities, complete check-in or access procedures, or participate in safety, security, and compliance checks at Murtala Muhammed International Airport (MMIA).

Automated Technologies & Server Logs

Every computer connected to the internet is given a domain name and an IP address. When you use the Sites, our web servers automatically recognize your domain name and IP address. This reveals technical browsing patterns and equipment data through cookies, server logs, and similar technologies. You can adjust your preferences via our cookie settings.

Third Parties & Public Sources

We may collect technical data from third parties/public sources such as analytics providers, identity verification providers, advertising networks, and search information providers. We may obtain contact, financial, and transaction data from providers of technical, payment, credit referencing, and delivery services based both inside and outside Nigeria. We also utilize third-party service providers to secure information related to financial crime, fraud, sanctions, and politically exposed persons (PEPs).

Data Protection Safeguards

We do not own personal data provided and will only store such data for a period reasonably needed. We will do our best to ensure that such personal data is secured against all foreseeable hazards and breaches such as theft, cyber-attack, viral attack, unauthorized dissemination, manipulation, rain, fire, or exposure to natural elements.

SECTION 04Legal Framework

Information We Collect From Other Sources

Combining internal data with verified external application records to maintain service quality.

External Integration

In order to provide you with access to the Services, or to provide you with better service in general, we may combine information obtained from other sources (for example, a third-party developer whose application you have authorized) and combine that with information we collect through the Sites.

SECTION 05Legal Framework

How We Use Your Personal Data

We utilize your data strictly to deliver reliable flight operations, security compliance, and customized support.

Operational & Service Delivery Purposes

We use your personal data to respond to inquiries and fulfill requests; process transactions and send transaction notices; verify your identity; resolve disputes and troubleshoot problems; improve services via customer preferences; manage and protect IT infrastructure; monitor traffic patterns to improve site design; record and store communications via phone, Skype, or chat; personalize your experience; send technical notices, updates, security alerts, and support messages; poll opinions through surveys; facilitate flight operations, passenger and crew management, and travel documentation; comply with aviation safety and security requirements; and communicate flight updates or operational notices.

Legal & Protection Compliance

We use data as EAN believes necessary or appropriate: to comply with a legal obligation under civil aviation law; to protect EAN’s legitimate interests, privacy, property, or safety (and those of third parties, provided your rights do not override those interests); and to protect your vital interests.

Communication Monitoring & Anonymization

We may monitor and record our communications with you, including emails and phone conversations, for training, quality assurance, and legal/regulatory compliance. Whenever we use information for legitimate interests, we ensure data is processed on an anonymized and aggregated basis that cannot be linked to any living individual.

SECTION 06Legal Framework

Your Rights as a Data Subject

Enshrined in the Nigeria Data Protection Act 2023 (NDPA 2023), giving you full control over your personal information.

Legal Rights Overview

Under Data Protection Laws, you possess the following rights: (1) Right to be informed whether EAN or its processors are storing or processing your data; (2) Right to request a copy of your personal data in a commonly used electronic format; (3) Right to correction or deletion of inaccurate, out-of-date, incomplete, or misleading data; (4) Right for erasure of personal data without undue delay; (5) Right to withdraw consent at any time; (6) Right to object to processing; (7) Right to object to automated decision-making and profiling; (8) Right to data portability; and (9) Right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

Fees & Procedure for Exercising Rights

Requesting copies of your personal data is generally free. However, a reasonable fee may be charged if requests are manifestly unfounded or excessive. To exercise your rights, submit your request in writing via registered email to info@ean.aero or use our Data Subject Access Request (DSAR) portal on our website.

Response SLA Window

We endeavor to process all subject access requests within thirty (30) days. If an extension is required due to complexity, we will communicate this through your consented channels at no cost. You may continue receiving standard operational notices during a brief transitional updating period.

Summary of Your 9 Core NDPA Rights

Right to be Informed

Right to Copy of Personal Data

Right to Correction / Rectification

Right to Erasure ("Right to be Forgotten")

Right to Withdraw Consent

Right to Object to Processing

Right to Object to Automated Profiling

Right to Data Portability

Right to Lodge a Complaint with the Nigeria Data Protection Commission (NDPC)

SECTION 07Legal Framework

Retention of Your Data

Data is kept only as long as necessary for flight services, legal mandates, and PCI DSS compliance.

Retention Principles

We will not retain your personal data longer than necessary for the purposes for which it is processed. When calculating appropriate retention periods, we evaluate the sensitivity of the data, the processing purpose, and statutory requirements.

PCIDSS 10-Year Obligation

Under our Payment Card Industry Data Security Standard (PCIDSS) obligation, we are legally required to retain customer personal data for a minimum of ten (10) years from the end date of our business relationship with you.

Secure Disposal Procedure

When personal data reaches the end of its retention timeline or upon a valid erasure request under Data Protection Laws, we ensure the data is securely deleted, anonymized, or destroyed.

PCI DSS Mandatory 10-Year Retention Mandate

Under our Payment Card Industry Data Security Standard (PCIDSS) obligation, we are legally required to retain transaction and identity records for a minimum of ten (10) years from the end date of our business relationship with you.

SECTION 08Legal Framework

Accuracy of Your Data

Maintaining current and accurate data is essential for aviation passenger clearance and service execution.

Keeping Data Current

It is important that the personal data EAN holds about you is accurate and current. Please inform EAN if your details change during our relationship. You can easily update your profile through customer-facing portals or by contacting our Data Protection Officer.

SECTION 09Legal Framework

Security of Your Data

Industrial-grade encryption, isolated server infrastructure, and proactive breach protocols protect your records.

Technical & Organizational Safeguards

We store data on dedicated and secure servers with at least 256-bit encryption. Access is strictly restricted to authorized employees. We enforce robust IT security systems and breach response procedures.

Data Breach Notification Protocol

In the unlikely event of a data breach, EAN will take immediate mitigating action and, where appropriate, notify you and the Nigeria Data Protection Commission (NDPC) without delay.

Account Credentials & User Responsibility

You assume full responsibility for maintaining the confidentiality of your password and credentials. You must never share your password or allow third-party access to your account.

SECTION 10Legal Framework

Data Transfers & Sharing

Cross-border data transfers adhere strictly to international aviation frameworks and NDPA regulations.

Regulatory & Mandatory Disclosures

Operating in a regulated aviation environment means private communications and identifiable information may be disclosed to governments, regulatory bodies, civil aviation authorities, and law enforcement in the public interest.

Third-Party Service Providers

We share data with trusted third parties for site maintenance, identity validation, analytics, IT software, and regulatory compliance. We may also share aggregated non-identifiable statistics with partners and advertisers.

Cross-Border International Transfers

When personal data is transferred outside Nigeria (to international service providers, flight authorities, or cloud systems), we ensure full compliance with Data Protection Laws, international frameworks, and treaties.

SECTION 11Legal Framework

Cookies Policy

Cookies enhance browsing experience, secure sessions, and customize operational features.

Types of Cookies Used

(1) Necessary Cookies: Essential for website functionality and security (cannot be disabled). (2) Performance & Analytics Cookies: Help analyze site performance and traffic patterns. (3) Advertising & Targeting Cookies: Deliver tailored promotions and content.

Purpose & Control

Cookies are used for personalization, security, analytics, and functionality. You can manage, disable, or delete cookies at any time through your browser settings.

Cookie Type	Description	User Control
Necessary Cookies	Essential for core security, session login, and flight engine features.	Mandatory (Cannot Disable)
Performance & Analytics	Gathers technical metrics and traffic patterns to optimize layout.	Configurable via Settings
Advertising & Targeting	Delivers tailored aviation offers and relevant announcements.	Configurable via Settings

SECTION 12Legal Framework

Updates to the Privacy Policy

Periodic reviews ensure alignment with evolving data protection laws and technological standards.

Policy Revision Notice

We reserve the right to update this Policy as needed. Material changes will be communicated via website notices or email. Your continued use of the Sites signifies acceptance of updated terms.

SECTION 13Legal Framework

Contact Information & DPO

Our dedicated Data Protection Officer handles all inquiries, privacy concerns, and DSAR requests.

Data Protection Officer (DPO) Details

If you have questions or wish to exercise your rights under the Nigeria Data Protection Act 2023, please contact our DPO using the official channels below.

Official Contact Desk

Data Protection Officer (DPO)

Address

EAN Jet Center, FAAN Transit Camp Road, MMIA, Ikeja, Lagos State, Nigeria.

Official Email

info@ean.aero

Legal & DPO Line

+234 (0) 1295 0960