Privacy and Data Policy Last updated: November 2021.

THR LIMITED  is committed to respecting the privacy and security of information received from User(s) of our website or services. This Privacy and Data Policy sets out our compliance with both New Zealand privacy laws (including the Privacy Act 1993), and the European Union General Data Protection Regulations (“GDPR”).

We’ve updated our Privacy and Data Policy to ensure that we communicate to Users, in the clearest way possible, how we comply with these legal requirements, how we collect, use, disclose or transfer personal information supplied by Users or collected by us and the ways in which Users can protect their privacy.

Our Privacy and Data Policy also specifies other requirements, such as how Users may access, correct and delete information held about them.

By using purchasing products on our website, registering warranty details for our products, or otherwise providing personal information to us, or accessing our website, Users agree to comply with the terms and conditions of this Privacy and Data Policy and agree that THR LIMITED may process (i.e. collect, use, store, transfer, disclose or otherwise process) User’s personal information in accordance with this Privacy and Data Policy (as well as for any other use authorised by the User).

Our Privacy and Data Policy explains:

(1) Consent;

(2) What information we collect and how;

(3) How we use personal information;

(4) Who we share personal information with and why;

(5) The steps taken to protect personal information under our control;

(6) Users’ data protection rights;

(7) Communications;

(8) Links and connections to third party services;

(9) International data transfers

(10) How THR LIMITED  retains and deletes personal information;

(11) How to access and update personal information; and

(12) How to contact us.

1. USER CONSENT

THR LIMITED provides a platform where Users can purchase products, and register warranty details for products. We collect personal information in order to be able to provide and improve our products, and for the other uses described below.

By purchasing products on our website, registering warranty details or otherwise providing personal information to us or accessing our website, Users consent to our collection, storage, use and disclosure of personal information (including any sensitive information provided) in accordance with this Privacy and Data Policy.

2. INFORMATION WE COLLECT

There are three ways we collect information:

(a) Information Users give us.

(b) Information we collect when Users access our website.

(c) Information we collect from third parties.

(a) Information Users Give Us

In order to purchase products from our website or register product warranty details, a User must provide us with certain personal information including name, address, phone number and email address.

Users may also provide us with personal information when they:

• Create or update User accounts and logins;

• Subscribe to receive the latest news on our products, and the goods and services of our partners and third party service providers; or

• Contact our support team.

Users can always choose not to provide us with personal information, however this may mean that we are unable to provide or support our products effectively, or at all.

(b) Information We Collect from Use of Our Services

We may automatically collect information (which may include personal information) when Users interact with our website. This information may include:

• System information: we may collect information about user system(s) including, but not limited to, the User operating system, applications, IP address(es) and other User system environment information.

• Usage information: we collect information about how Users and their system environment interact with our website. Information that may be collected includes:

• Information relating to the features Users use;

• The performance of the website and any problems experienced by Users;

• The pages that Users visit on our website;

• Website content accessed by Users;

• Length of the Users’ stay on a specific page; and

• Browser information.

• Location: when Users use our website, we may collect and process information about the User’s location. We use various technologies to determine location, including IP addresses and web analytics.

• Device information: When users use our website, we may receive information about the user device, such as the hardware model, operating system version, unique device identifier and mobile network information (including phone number).

• Cookies and similar technology:  We use cookies, analytical tools and similar technologies to provide our website and optimise content and performance for Users, and to help collect data.

For example, when Users visit our website, we collect information about the pages visited, the User’s browser and the User’s device. A cookie is a small element of data that a website can send to the User’s browser, which may then be stored on the hard drive (session ID cookies will terminate once Users simply close the browser, persistent cookies may however be stored on the User’s hard drive for an extended period of time). A cookie does not identify a User personally, but it does identify the User’s computer. Cookies allow us, among other things, to monitor traffic patterns, store User preferences and settings, analyse how our website is performing and enable Users to login. Users should be aware that most web browsers are set to accept cookies by default, but allow settings to be adjusted to remove or block cookies. Please note however that rejecting or removing cookies could affect the availability and functionality of our website features and services.

For the purpose of customising and continually optimising our website, we use Google Analytics, a web analytics service provided by Google Inc ("Google"). In this service, pseudonymised usage profiles are created and cookies are used to generate information about your use of this website such as browser type / version, operating system, referrer URL (the previously visited page), IP address for your computer or device, date and time. This information is transmitted to a Google server in the US and stored there. The information is used to evaluate the use of our website, to compile reports on website activity and to provide other services related to website activity and internet usage for the purposes of market research and our website design. This information may also be transferred to third parties if required by law or if third parties process this data. Under no circumstances will your IP address be merged with any other data provided by Google. The IP addresses are anonymised. You can prevent the collection of data generated by the cookie and related to your use of the website (including your IP address) and the processing of this data by Google by downloading and installing a browser add-on ( https: //tools.google.com/dlpage/gaoptout?hl=en ). For more information about privacy related to Google Analytics, see the Google Analytics information at https://support.google.com/analytics/answer/6004245?hl=en).

• Social Media Plug-ins: We use social media plug-ins from Facebook on our website to make our company better known, and personalise usage. If you visit a page of our website that contains a Facebook plugin, your browser establishes a direct connection to the Facebook servers.

The content of the plugin is transmitted by Facebook directly to your browser. By integrating the plugins, Facebook receives the information that your browser has accessed the corresponding page of our website, even if you do not have a Facebook account or are currently not logged in to Facebook. This information (including your IP address) is transmitted from your browser directly to a Facebook server in the US and stored there. If you are logged in to Facebook, Facebook can assign the visit to our website directly to your Facebook account. If you interact with the plugins, for example by pressing the "LIKE" or "SHARE" button, the corresponding information is also transmitted directly to a Facebook server and stored there. The information will also be posted on Facebook and displayed to your Facebook friends. Facebook may use this information for the purpose of advertising, market research and tailoring Facebook pages. For this purpose, Facebook uses user, interest and relationship profiles (for example, to evaluate your use of our website with regard to the advertisements displayed on Facebook, to inform other Facebook users about your activities on our website and to further inform you about the use of related services). If you do not want Facebook to assign the data collected via our website to your Facebook account, you must log out of Facebook before visiting our website. For more information about the purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as your related rights and settings options for the protection of your privacy, please refer to the privacy policy of Facebook at https://www.facebook.com/about/privacy/.

(c) Information We Collect from Third Parties

We work closely with third parties (for example, our suppliers and service providers) in order to be able to develop and supply our products.

We may receive the same kinds of information described in (a) and (b) above from third parties.

3. HOW WE USE PERSONAL INFORMATION

We collect and use personal information in order to be able to provide and improve our products and customer service. We also use personal information to:

• Communicate, interact and build our relationship with Users, including to better understand User needs and interests, and ensure a quality experience for Users;

• Monitor, develop or optimise the performance of our products and customer service;

• Provide information and technical support;

• Allow our partners and third party providers to provide their services and support to Users;

• Conduct, manage, develop and protect our business;

• Enforce our terms of sale; and

• Enable third parties to provide services to us.

For these purposes we may receive, use, store, share, send, combine, reformat, transform, encrypt, mask, organise, geomap, update and delete personal information (and undertake any further processing activities expressed or implied in this Policy). The personal information that we collect will not be further processed in ways that are incompatible with the initial purposes for which the data was collected.

4. WHO WE SHARE INFORMATION WITH

We share information, including personal information, as necessary to provide Users the products and support services requested or authorised. For example, we may share information with:

• Affiliates, subsidiaries and related companies;

• Our partners and third party providers to provide products and services to the User, to communicate with Users (for example, information shared with communication service providers), and to provide Users with information on the performance of our products or the products and services supplied by our partners and third party providers;

• Our service providers or suppliers acting and working on our behalf. For example, companies we have hired to assist in protecting and securing our systems and customer support services may need access to personal information to provide those services. In such cases, we will require these entities to abide by our data privacy and security requirements, and restrict use of any personal information received from us;

• Other third parties, when we have a good faith belief that doing so is necessary to:

(1) Comply with any applicable law, regulation, legal process or enforceable governmental request;

(2) Protect our Users;

(3) Operate and maintain the security of our website, including to prevent or stop an attack on our computer systems or networks;

(4) Detect, prevent or otherwise address fraud; or

(5) Protect our rights and property, including enforcing our terms of sale and customer agreements.

• A purchaser, as part of a corporate transaction such as an acquisition, merger or sale of assets.

From time to time we may use third-party data processors to provide some customer services for us. We will have contracts in place with all of our data processors, to prevent them from doing anything with Users’ personal information unless we or the User has instructed them to do so. Unless the User agrees otherwise, our data processors will.

• Not share Users’ personal information with any organisation apart from us; and

• Hold Users’ personal information securely and retain it for the period we instruct.

We require that our service providers, suppliers and business partners (data processors) agree to keep all User information we share with them confidential.

While we provide these third parties with no more information than is necessary to perform the function for which we engaged them, Users should be aware that any information provided by the User to these third parties independently/directly is subject to the third parties' respective privacy policies and practices.

We may also share or use non-personal information (i.e. information that is related to a person but does not personally identify that individual, such as aggregated, anonymised or de-identified data) publically or with third parties, such as our partners or third party suppliers. For example, we may share or use information publically to show trends about the general use of our products. This data or information will in no way identify Users or any other individual.

5. STEPS TAKEN TO PROTECT PERSONAL INFORMATION

Protecting the security of User personal information is of the utmost importance to THR LIMITED . We maintain a variety of safeguards and procedures in order to protect personal information from unauthorised access, use, interference, modification or disclosure.

For example, we store personal information on computer systems that have password-controlled access.

Users’ personal information will only be accessed by people at THR LIMITED  who need to use the information for the purposes discussed above.

Our website and some of our customer services do however require use of the internet, and the internet is not itself a secure environment. We therefore cannot give an absolute assurance or guarantee that User information will be secure at all times. Transmission of information over the internet or third-party networks is at the User’s own risk. We will notify Users at the first reasonable opportunity if we discover or are advised of a material security breach which has resulted in unauthorised access, disclosure or loss of User personal information.

To help maintain the security of information, Users agree to keep their passwords and account details private and confidential.

6. USERS’ DATA PROTECTION RIGHTS

Under data protection and privacy laws, Users have rights regarding the personal information that we hold/collect. The rights available to Users depend on our reason for processing Users’ information. These rights include:

• Right of access: Users have the right to ask us for copies of their personal information. This right always applies.

• Right to rectification: Users have the right to ask us to update or rectify information they think is inaccurate. Users also have the right to ask us to complete information that the User thinks is incomplete. Users are responsible for ensuring that personal information provided to us is accurate, complete and up-to-date. We will take reasonable steps to ensure that any further personal information that we collect (i.e. information obtained from other sources) is accurate, up-to-date, complete and not misleading.

• Right to erasure: Users have the right to ask us to erase their personal information in certain circumstances.

• Right to restriction of processing: Users have the right to ask us to restrict or cease the processing of their information in certain circumstances. This may (depending upon the circumstances) include the collection of personal information from third parties, collection of sensitive information, disclosure of personal information to third parties, transfer of personal information overseas, or processing of personal information in a particular way, or for a particular purpose, including direct marketing.

• Right to data portability: This only applies to information Users have given us. Users have the right to ask that we transfer the information Users have given us from one organisation to another, or give it to the User. This right only applies if we are processing information based on Users’ consent, or under (or in talks about entering into) a contract and the processing is automated.

All requests should be sent to us at contact@libertyflights.co.nz, and include the words 'Attention: The Privacy Officer'. User choices in relation to personal information may affect our ability to provide or support our products, or the performance of the website. We will respond to Users as soon as reasonably practicable regarding the impact of the User’s requests, any other issues arising and to confirm the User’s intention to proceed. If we are unable to comply with the request, we will give the User reasons for this decision when we respond (for example, the information may not be readily retrievable and it may not be reasonable or practicable for us to process the request in the manner sought. In some instances, it may also be necessary for us to arrange access to User personal information through a third party e.g. a third party supplier).

7. COMMUNICATIONS

We are committed to full compliance with the Unsolicited Electronic Messages Act 2007.

By subscribing to email communications, or otherwise providing an email address, Users consent to receiving emails which promote and market our products and services, or the products and services of others, from time to time.

Users can unsubscribe from our email communications at any time by clicking the "Unsubscribe" link in any promotional or marketing email, or by emailing contact@libertyflights.co.nz, and include the words 'Attention: The Privacy Officer’.

Once a User has unsubscribed from the email communications, the User will be removed from the corresponding email/distribution list as soon as is reasonably practicable.

8. LINKS AND CONNECTIONS TO THIRD PARTY SERVICES

Our website contains links to (and may be used by Users in conjunction with) third-party services, tools, and websites that are not controlled or managed by us. This Privacy and Data Policy does not cover how these organisations process personal information. These websites may use cookies. It is the responsibility of those third parties to collect appropriate consents from Users in order to permit their own cookies (to the extent this is required by law) and to inform Users about the cookies they use. Users should check the privacy policy on all third-party websites to ensure they are comfortable with third party cookies.

We have no responsibility for linked websites, and provide them solely for Users’ information and convenience. We specifically disclaim responsibility for their content, privacy practices and terms of use, and we make no endorsements, representations or warranties about their accuracy, content or thoroughness.

Disclosure of personal information by Users to third party service providers is at the User’s own risk, and we encourage Users to read the privacy policies applicable to these third-party services. We are not responsible for the security or privacy of any information collected by these third-parties.

• Windcave

An example of a linked website used by us is Windcave. If a User wishes to purchase one of THR LIMITED ’s products, the User will be directed to Windcave’s website to complete the transaction. In order to do this the User will leave our website and be directed to Windcave’s  website, where the transaction will be completed. The User will then be directed back to our website once the transaction is completed. Windcave is not controlled or managed by us, Windcave has its own processes and policies (including a Privacy Policy) for how it handles its users information, including any personal information provided.

In order to review the purpose and scope of the data collection and the further processing and use of the data by Windcave, as well as your related rights and settings options for the protection of your privacy, please refer to the privacy policy of Windcave at https://sec.windcave.com/pxmi3/privacy-policy

9. INTERNATIONAL DATA TRANSFERS

When we disclose, use or store data, it may be transferred to, and processed in, countries other than New Zealand. In those countries, there may be differences with New Zealand's privacy laws. For example, we use GSuite (Gmail for business) within our business, a cloud service provided by Google Inc. which processes and stores New Zealand user data in Google data centres (see https://www.google.com/about/datacenters/inside/locations/index.html). For more information on GSuite’s data protection and privacy, see Google’s privacy policy at https://policies.google.com/privacy?hl=en-NZ.

We also use Dropbox, a cloud based storage service provided by Dropbox International Unlimited Company which processes and stores New Zealand user data in data centres across the United States. For more information on Dropbox’s data protection and privacy, see https://www.dropbox.com/privacy.

We use Shopify as our business management platform. Shopify is completely cloud-based and hosted, meaning that User data will be stored either locally in New Zealand (via a Content Delivery Network), or in Shopify’s main data centres located in the United States. For more information on Shopify’s data protection and privacy, see https://www.shopify.com/legal/privacy.

For accounting functions, we use Xero. Xero is a cloud-based accounting service provided by Xero Limited and related companies. Xero processes and stores New Zealand user data in the United States. For more information on Xero’s data protection and privacy, see https://www.xero.com/nz/about/privacy/ and https://www.xero.com/nz/about/security/.

For individuals in the European Economic Area (EEA), this means that Users’ personal information may be transferred to locations outside of the EEA. However, where we disclose personal information to a third party in another country, we place or obtain safeguards to ensure Users’ personal information is protected. Where Users’ personal information is transferred outside the EEA, it will only be transferred to countries that have been identified as providing adequate protection for EEA data (like New Zealand), or to a third party where we have transfer mechanisms in place to protect Users’ personal information (e.g. by ensuring that the recipients of the personal information have agreed to data protection and privacy commitments as specified in the GDPR). For further information, please contact us using the details set out in the contact section below.

10. RETENTION AND DELETION OF PERSONAL INFORMATION

The period of time for which we hold personal information that we have collected varies according to what the personal information is used or required for, and whether we have an ongoing need to retain it (for example, to provide Users with product warranty support they have registered or to comply with applicable legal requirements such as financial record-keeping legislation).

Unless there is a legal requirement or justification for us to keep the personal information, we will retain it for no longer than is necessary:

• To provide the services requested by the User;

• As part of our usual business record-keeping practices;

• To fulfil the purpose(s) for which the personal information was originally collected;

• In accordance with our internal retention policies and practices; or

• For any other purpose(s) authorised by the User. Once personal information is no longer required, the personal information will be deleted, securely destroyed or anonymised.

11. ACCESSING AND UPDATING USER PERSONAL INFORMATION

Users are responsible for ensuring that personal information provided to us is accurate, complete and up-to-date. This includes personal or sensitive information contained in their User account. We will also take reasonable steps to ensure that any personal information that we collect (i.e. information obtained from other sources) is accurate, up-to-date, complete and not misleading.

Requests for access to, or the correction of, personal information should be emailed to contact@libertyflights.co.nz, and include the words 'Attention: The Privacy Officer’.

We will process requests as soon as reasonably practicable, provided we are not otherwise prevented from doing so by law. If we are unable to meet a User’s request, we will explain the reasons why when we respond to the User’s request.

12. HOW TO CONTACT US

Please contact us if you have any questions or complaints about this Privacy and Data Policy, if you wish to access, update, erase and/or correct personal information, or if you otherwise have a question or complaint about the manner in which we, our service providers or our partners treat personal information.

Users may write to THR LIMITED Privacy Officer by email, including any supporting documentation, at contact@libertyflights.co.nz, and include the words 'Attention: The Privacy Officer’.

Alternatively, you can write to us at: THR LIMITED  Attention: Privacy Officer c/o NZ Tax Accountants Suite 817, Level 8 West Plaza Building, 3 Albert Street, Auckland AUK 1010 New Zealand.

We will endeavour to respond within 30 days.

Application of this Privacy and Data Policy

Our Privacy and Data Policy applies to all of the products and services offered by us. Our Privacy and Data Policy does not cover the information practices of other companies and organisations (such as our partners or third party service providers) that supply, contract and advertise using our website.

Changes to this Privacy and Data Policy

We keep this Policy under regular review to make sure it is up to date and accurate. We also reserve the right to change this Policy from time to time, as our practices evolve to meet new requirements, standards, technologies and customer feedback.

We will post any privacy policy changes on our website (www.libertyflights.co.nz) and will update the “last updated” date at the top of this Policy.

Continued use of our website by Users, or the subsequent provision of personal information to us by Users, will be deemed acceptance of any amended Policy.

We recommend that Users regularly review this Policy to learn how we protect personal information.

Definitions

In this Policy, unless the context requires otherwise:

person means and includes any natural person, company, corporation, firm, partnership, joint venture, society, organisation or other group or association of persons (whether incorporated or not), trust, state or agency of state, statutory or regulatory body, local authority, government or governmental or semi-governmental body or agency (in each case whether or not having separate legal personality);

personal information means information about an identifiable individual and includes, without limitation, names, addresses, phone numbers, email addresses and IP addresses;

User(s) means all persons accessing our website and/or purchasing our products, and/or registering product warranties with us and/or otherwise providing personal information to us;

User account means any User’s account with us;

we, us, our, THR means THR Limited.