Personal data is any details that identifies you or could be used to identify you, regardless of its media.

The identifiable person can be recognized either directly or indirectly, including by reference to an identification number or other specific elements of their physical, physiological, mental, economic, cultural, or social identity, your travel arrangements, and purchase history. Also included is information about your usage of our website and/or any other media platform controlled by TAAG.

We collect and maintain personal information about you from many sources to understand and meet your needs, facilitate your travel, manage our business, and for other purposes disclosed to you. For example, we collect personal information about you from:

- You, when you voluntarily provide us with information.

- Your transactions with TAAG.

- Other third party sources, such as travel agents, other airlines (e.g. code share and special prorate

partners) and travel and hospitality service providers (e.g., transportation or tour operators).

If the information is to be collected directly from you, you may in some cases have the option to decline providing that information. However, your choice to not provide information may impact your use of certain features or services.

The personal information we collect about you through these various sources may include, but is not limited to:

- Name, addresses and telephone numbers.

- Date of birth and gender.

- Email addresses, and fax numbers.

- Umbi Umbi Club account number.

- Credit/debit card number(s), including associated billing address(es) and expiration date(s).

- Information required to facilitate travel or other services, including travel companion(s) names and

emergency contacts.

- Information about your travel, including booking and itinerary information, requests for assistance,

interactions with staff and cabin crew, and dietary restrictions.

- Details of your previous travel, such as previous flights and travel-related issues.

- Angolan National ID Card number for flights within Angola.

- Passport number, nationality and country of residence.

- Technical information such as your browser type, IP address, type of operating system you use, your geolocation, the name of your internet service provider, mobile advertising identifiers, and pages visited on our Services.

- Information provided via survey, focus group or other marketing research efforts.

- When you send us an email or online customer service request, we will retain the content of the message, your email address or any contact information you provide, and our response in order to handle any follow-up questions you may have. We also use this information to measure how effectively we address your concerns.

- Corporate-contract, employer and/or other corporate affiliation (e.g., employer name, title, work address and contact information), including business information (e.g., tax payer number, business type, number of employees, number of business travelers, and travel manager information).

We only base our use of personal data on our legitimate interests when we consider that our legitimate interest is not overridden by the individual's interests or rights in the data.

Please note that where you have provided your consent to us for processing your information, you can withdraw this at any time.

2.1 Information collected through our App.

- Whenever applicable we may use push notification tokens in the App to send notifications to your mobile device with updates for flight times, gate changes, and flight cancellations. If you choose, the App can access your device calendar to save itinerary information in your personal schedule. It can also bring up your default e-mail program, so you can send notes and reminders while traveling.

- At times, we may promote the App via internet advertising on external websites. If you click on these advertisements and navigate directly to a third party application or other platform, information such as your phone’s device identification number may be sent to the advertising network, so that they and we may track the effectiveness of our advertising. This information might also be used for capping the number of times a specific visitor to a website is shown a particular advertisement, estimating the number of unique users, debugging, or security and fraud detection.

2.2 Legal requirements and professional advice.

- We may also use your personal information where this is necessary to comply with a reasonable request by a law enforcement or regulatory authority, body, or agency, or in the defense of legal claims. We may also use your personal information when obtaining legal and other professional advice including for audits. We consider this to be in our legitimate interest in the management of our business.

2.3 What will happen if you do not provide information?

- In some cases, we are legally required to collect certain information from you so we can provide the services you have requested, such as Advance Passenger Information when you make a reservation to fly within, into, or out of Angola, or for overall international travel. Failure to provide this information will mean we cannot provide the service.

- Insomecircumstances,weneedyourinformationtoperformourcontractwithyouortoprovideproducts and services, such as payment details and, on occasion, credit checking information. If you do not provide this information, we may not be able to enter into, perform the contract, or provide the products and services.

2.4 Authorization on behalf of another passenger.

- Whenyouprovideinformationtousaboutyourtravelcompanions(if,forexample,youhavearrangedto make a booking on their behalf), you confirm to us that you have obtained their authorization to provide us their information and their consent to use their information in accordance with this Privacy Policy. If you cannot make these confirmations, you must not provide us with any personal information about these individuals.

We use personal information to complete transactions and fulfill requests for our products and services. For example, we require you to provide personal information when making a reservation to purchase airline tickets or related products and services such as renting cars or booking hotel rooms through a TAAG Reservations Agent, travel agent, the taag.com website or other travel-related website, or enrolling in the Umbi Umbi Club frequent flyer program.

We process personal data in accordance with the provisions of the Angolan Data Protection Act and the General Data Protection Regulation of the EU, the legal basis pursuant to which we process your information. Listed below the purposes, for which we collect your data:

3.1 Administrative purposes, marketing, analytical purposes.

In addition to processing, confirming and fulfilling the travel or other services or products you request, TAAG may use personal information for administrative, analytical, and marketing purposes such as employee training, information systems management, accounting, billing and audits, credit card processing and verification, customer-relations correspondence, and/or operation of the Umbi Umbi program. TAAG also uses personal information to identify, develop, and market products and services that we believe you will value, including across browsers and devices, in accordance with applicable laws. Where we are required by applicable law, we will seek your consent prior to sending you communications for marketing purposes. Consent may be withdrawn at any time. Withdrawal of consent has effect for the future only and does not affect the lawfulness of data processed up until the withdrawal.

3.2 Contractual Obligations.

a) Issuing flight tickets.

b) Sending booking confirmations.

c) Providing flight-related services booked by you and flight-related information, such as à la carte menus,

pre-flight shopping (where available) and luggage services.

d) Administering the check-in process, wait list processing, and baggage handling.

e) Legal and regulatory obligations: To comply with legal, regulatory, or fiscal obligations, or in connection

with litigation or an internal investigation or audit.

3.3 Legitimate Interests.

a) Business purposes and communication: To provide flight services or information you requested, to communicate with you for business or customer service reasons, or for other such reasons such as changes to our policies or in response to your inquiry so that we can provide you with relevant information on your booked flight and travel destination.

b) For the purpose of preventing fraud, e.g. credit card or identity fraud, the use of fraudulent means to obtain special terms or fares.

c) To enforce legal claims, including debt collection and defense in the event of legal disputes.

d) For auditing purposes.

e) To safeguard the airline’s IT security and operations.

f) To guarantee flight safety.

g) For advertising, provided that you have not objected to the use of your data.

h) For the purpose of creating both domestic and international aviation statistics.

i) For compiling statistics to improve products and services. In individual cases, we may create customer

profiles for this purpose by processing reservation data; these profiles will be rendered anonymous immediately, however, and will not be used to analyze or predict aspects relating to your personal

preferences.

j) Financials transaction management: To facilitate payment for services or provide refunds.

k) Third party requests: To respond to and comply with outside requests initiated by you, as well as in

response to legal requests.

l) Audit and controls: To evaluate internal controls and audits for compliance (including those conducted

by TAAG’s internal and external audit service providers).

3.6 Specific purposes.

a) For sending out newsletters with regular offers from TAAG.

b) For receiving specific information and offers from TAAG.

c) For market research and customer surveys.

d) For personalized use of the website and personalized offers, including profiling.

e) To support processes relating to usage of the website, with reminder features and live chats.

f) For analytical purposes so that we can optimize our offering for you.

g) Tailored web experience: To personalize your advertising experience when visiting our sites, and to manage details about your accounts e.g. Umbi Umbi, when security updates are available, or when an action is required to keep the account active.

h) Improve our operations: To improve our route and service offerings as an airline operator, including reviewing our travel destinations, fare classes, and operations more generally.

i) Marketing and analytics: To perform data analyses and other processing for marketing purposes.

j) Site maintenance: To improve content, functionality, and usability of our sites and to offer opportunities

to participate in surveys and provide feedback to us.

k) Security management: To TAAG’s premises, assets, and information

There are Closed Circuit Television (CCTV) cameras in operation within and around our stations and other premises, which are used for these purposes:

1. To prevent and detect crime;

2. To protect the health and safety of TAAG’s customers and employees;

3. To manage and protect TAAG’s property and the property of TAAG’s guests and other visitors; and

4. For quality assurance purposes.

In addition, TAAG records all phone conversations made to our Call Centre operators for these purposes:

1. To ensure accuracy of customer’s requests and adequate treatment.

2. To aide and assist in auditing procedures.

3. To help resolve client’s complaints.

4. For conducting surveys.

TAAG makes sure that our customers are informed of the existence of both the CCTV systems as well of the phone calls recordings.

We may collect and process your personal information shown for the following purposes:

4.1 Identification.

This may include your name, gender, and date of birth, your nationality, and passport information. TAAG does not at any time collect nor process any information regarding your Race, Ethnicity, Religion, Sexual orientation, and Political affiliations and beliefs.

4.2 Contact details.

TAAG will process your address, telephone number and email address. We may also record your sign in details and other information you fill out on your personal account or registration form, when you create a personal account or register for a service. For business travelers, we may also collect information relating to your company, such as company name and business location.

4.3 Reservations details.

When you make a reservation or book a flight with us, we will process details about your flight, prices, and the date of your reservation or booking. We will also process information regarding upgrades, extra baggage, products you purchase, if applicable, preferred payment method, billing information, transaction and credit information.

4.4 Travel details.

When you travel with us, we process information in relation to your journey. This includes details on your itinerary, (online) check-in, boarding pass and your travel companions. We will also process details of any medical needs, dietary requests and any additional assistance you require.

4.5 Umbi Umbi Club membership.

When you become a member of our loyalty program, we process your membership number, miles, rewards and benefits, level of membership and other information related to your membership. You can update most of your personal details yourself at any time by logging into your Umbi Umbi Club profile.

4.6 Communication details.

When you send us an email or chat with us online, we register your communication with us. When you call us, our customer support will register your questions or complaints in our database. We may also record telephone calls for training purposes or to prevent or combat fraud.

4.7 Sensitive data.

To the extent that the personal information we collect constitutes sensitive personal information under applicable law, including where such laws promote a substantial public interest, TAAG will collect and process this sensitive personal information within the limits provided by applicable law. Where required by law, TAAG will seek your specific consent before processing sensitive personal information.

Some examples of this type of information include:

a) We may collect or receive sensitive personal information, such as that relating to health, disabilities, biometrics, where permitted or required by applicable law. For example, we may collect and receive sensitive personal information from you when you:

b) Provide such information to us, a travel agent, or another third party involved in your travel arrangements at the time of or following your booking;

c) Disclose to us that you have a specific medical condition, will have an accompanying service animal, or request specific medical care or assistance, such as the provision of an accompanying nurse, stretcher, wheelchair assistance or oxygen, from us, an airport, or a third party involved in your travel arrangements; or

d) Make a request that implies or suggests something about you which could be interpreted as sensitive personal information, such as a request for a specific type of meal that may suggest that you have a certain medical condition or hold a particular religious belief.

e) We occasionally receive personal information from law enforcement agencies and other sources relating to criminal activity (or alleged criminal activity) and may use that information where necessary, and where permitted by applicable law, to detect or prevent unlawful activity occurring during air travel. We consider this to be in the substantial public interest.

f) Clearance from us to fly because you are up to 36 weeks pregnant.

g) Your Biometric information (for example, facial recognition) may be collected during the security

clearance process prior to, and after, flying with us to any applicable destination;

h) By providing any personal information that is or could be sensitive personal information, you agree that you have given us your consent to collect, store, use, and transfer this personal information for the purposes for which it was provided and otherwise in accordance with the terms of this Privacy Policy.

TAAG does not use such data to infer sensitive personal information about you.

We store your information for as long as legally required or for so long as necessary, to support business purposes described in this Privacy Policy and consistent with our record retention policies. In general, this storage will be (i) at least for the duration of our relationship, (ii) for as long as you can bring a claim against us and for us to be able to defend ourselves, and (iii) for any period required by tax, aviation, and other applicable laws and regulations.

Our App will store user-provided data for as long as you use the related feature of the App, unless you choose to delete the App. Only information provided for travel clearance, purchases, and related activities will be stored in our operational systems as needed to provide your requested services. As with the Website, if you delete your TAAG Umbi Umbi Club Account, we will delete the data stored in that account.

Information Security is important to us. We have established appropriate physical, electronic, and managerial safeguards to protect the information we collect in accordance with our Privacy Policy. These safeguards are regularly reviewed to protect against unauthorized access, disclosure, and improper use of your information, and to maintain the accuracy and integrity of that data.

If you have reason to believe that your access to the website is no longer secure (e.g. loss, theft or unauthorized disclosure or use of user names, passwords and personal identification numbers), you must promptly change the affected access information.

There is an Internet fraud practice known as ‘phishing’, which is the illegal gathering of personal information by deception. Unsolicited emails are sent to individuals from lists illegally gathered by a third party, and recipients are asked to enter or reconfirm bank or password details into a 'cloned' or illegal copy website.

We recommend not responding to these emails, to not click on any links or open any attachments and to provide no personal information.

Given the nature of our Services, we may collect travel information, which may include personal information, about children when it is required to comply with the law, including aviation or security regulations, or as otherwise required to provide transportation needs and services. We may retain personal information when required to provide transportation and related services to a child. TAAG does not knowingly collect personal information directly from children – persons under the age of 13, or another age if required by applicable law – other than when required to comply with the law or for safety and security reasons. If a child under 13 has provided us with personal information without parental or guardian consent, the parent or guardian may contact the Data Protection Offices. We will remove the information and unsubscribe the child from any of our electronic marketing lists. Where required by applicable law, we may ask children for consent from their parents or guardians before we book their flight or provide a product or service to them.

In addition, the collection of personal information from people under the age of 18 requires the consent of their parents or guardians.