Privacy Policy

Website publication version | Version 1.1 | Effective date: 8 August 2026

ZARA9 LTD | Company No. 13663186 | www.zara9.com

ZARA9 LTD respects your privacy and is committed to handling personal information lawfully, fairly, transparently and securely. This Privacy Policy explains how we use personal information in connection with the current pre-launch Website, newsletter, enquiries, business relationships and prospective investor or partner contacts.

1. Who is responsible for your information

ZARA9 LTD is the controller for the processing described in this policy. We are registered in England and Wales under company number 13663186. Our registered office is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

Privacy contact: pc@zara9.com. Please use the subject line “Data Protection”. Telephone: +44 78 53 101 996.

2. Scope of this policy

This policy covers visitors to the Website, newsletter subscribers, people who contact us, prospective customers, partners, suppliers, advisers, investors and other business contacts.

It does not yet govern online flight bookings, passenger medical or fitness screening, payment processing, customer accounts, pilot-training enrolment, employment applications or other operational processes that are not currently offered through the Website. Before those activities begin, we will update this policy or provide a specific privacy notice at the point where information is collected.

3. Personal information we collect

Contact and identity information: your name, email address, telephone number, organisation, role and other contact details you choose to provide.

Newsletter information: your email address, subscription preferences, consent record, date and source of subscription, and unsubscribe or suppression status.

Enquiry and relationship information: messages, attachments, meeting notes, requested services, partnership, supplier or investor information, and our responses.

Prospective investor and due-diligence information: organisation, role, investment-interest information, professional contact details, communications and due-diligence material where relevant to a legitimate corporate or financing process.

Technical and security information: IP address, device or browser information, timestamps, requested pages, referral information, security events and server logs, to the extent collected by us or our hosting and security providers.

Cookie and preference information: consent choices and information generated by permitted storage or access technologies. See our Cookie Policy.

Public or third-party business information: professional information from public sources, referrals, events, counterparties or organisations with which you are associated, where relevant to a legitimate business relationship.

4. Information we do not currently request through the Website

Do not submit passport details, national identification numbers, payment-card information, detailed medical information, pilot-licence documents, criminal-record information, classified or export-controlled material, or other sensitive information through a newsletter field, general contact form or ordinary email unless we have expressly requested it and provided an appropriate secure process.

Future passenger eligibility or fitness screening may involve health information, which is special-category personal data. We will not begin that processing until the relevant operator has established the required legal basis and special-category condition, issued a specific participant privacy notice, defined retention and access controls, and completed any required data-protection impact assessment.

5. How and why we use personal information

5.1 Operate, deliver and secure the Website

We use technical, log and security information to deliver the Website, maintain availability, prevent abuse, investigate incidents and protect our systems. We rely on our legitimate interests in operating a secure and functional Website and on legal obligations where a specific security or regulatory duty applies.

5.2 Respond to enquiries and requested pre-contract steps

We use contact, identity, message and relationship information to respond to enquiries, provide information you request and take steps requested by you before entering into a contract. Depending on the context, the lawful basis is steps at your request before a contract or our legitimate interests in handling general and business enquiries.

5.3 Manage partners, suppliers, advisers and professional contacts

We use contact, organisation, role, correspondence and relevant due-diligence information to develop and manage business relationships, assess counterparties and administer contracts. We rely on legitimate interests, contract and legal obligations as applicable.

5.4 Manage prospective investors and corporate transactions

Where we engage with prospective investors, lenders, advisers or transaction counterparties, we may use professional contact information, communications and due-diligence information to assess and progress a potential financing, investment or corporate transaction. We generally rely on legitimate interests in financing and managing the business, steps requested before a contract, and legal obligations where applicable.

5.5 Send newsletters and promotional updates

We use your email address, preferences and consent record to send newsletters and promotional updates where you have actively opted in or another lawful permission clearly applies. For the current pre-launch mailing list, our intended basis is consent rather than the UK “soft opt-in”.

5.6 Keep suppression and compliance records

We keep limited records of opt-outs and objections so that we can respect your choices and avoid contacting you again inappropriately. We also retain information where necessary to comply with law, respond to regulators, protect rights, investigate misuse, prevent fraud or establish, exercise or defend legal claims.

6. Newsletter consent and electronic marketing

We send newsletter or promotional email to individuals only where we have the required permission. Consent must be freely given, specific, informed and unambiguous, and it must not be bundled with unrelated terms. We do not use pre-ticked boxes for consent.

You may withdraw consent at any time by using the unsubscribe link in a marketing email or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal. We may keep a minimal suppression record after an opt-out to ensure that your marketing preference continues to be respected.

We do not sell mailing lists.

7. Cookies and similar technologies

The Website may use strictly necessary storage or access technologies and, where a valid choice or consent is required, optional analytics, preference or marketing technologies. Our Cookie Policy explains the categories used and how to change your choices.

8. Sharing personal information

We share personal information only where reasonably necessary and subject to appropriate controls. Recipients may include:

Hostinger entities that provide Website Builder, hosting, forms, infrastructure, support and related services under applicable data-processing terms;

Cloudflare or similar content-delivery, network-security and anti-abuse providers used by the hosting environment;

email, communications, document-storage, CRM, data-room and IT-support providers used by ZARA9;

professional advisers, insurers, auditors, banks, lenders, investors and due-diligence providers where relevant to a legitimate financing or corporate process and subject to appropriate confidentiality controls;

a Croatian operating subsidiary, future group company or contracted operator where responsibilities are defined and the relevant privacy information has been updated;

courts, regulators, law-enforcement bodies, aviation authorities, government bodies or other persons where disclosure is required by law or reasonably necessary to protect rights, safety or security; and

a buyer, investor, lender or successor in connection with a proposed or completed financing, reorganisation, sale or other corporate transaction, subject to appropriate confidentiality and data-protection safeguards.

Our service providers may use approved subprocessors. Where a provider acts as our processor, we require it to process information on documented instructions, protect the information and assist us with applicable data-protection obligations.

9. International transfers

ZARA9 is established in the United Kingdom and the Website targets users in Croatia and elsewhere. Personal information may therefore be transferred between the European Economic Area and the United Kingdom. The European Commission’s adequacy decision for the United Kingdom was renewed in December 2025 and permits covered transfers while that decision remains in force.

Some service providers may process information in other countries. Where an adequacy decision does not apply, we use an appropriate transfer safeguard where required, such as the European Commission Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum, together with supplementary measures where appropriate. You may contact us for information about the relevant safeguard, subject to protection of confidential and security information.

10. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, regulatory, accounting, safety, security and dispute-resolution requirements. Our current retention approach is:

Newsletter subscription records: while you remain subscribed. Evidence of consent and a minimal suppression record may be retained for up to six years after the last relevant communication or opt-out where necessary to demonstrate compliance and prevent re-contact.

General enquiries that do not lead to a contract: normally up to 24 months after the last meaningful interaction, unless a shorter period is appropriate or longer retention is required for a legal, safety or dispute reason.

Partner, supplier, investor and contractual records: for the duration of the relationship or transaction and normally up to seven years afterwards, subject to applicable accounting, tax, limitation, aviation or regulatory requirements.

Website and security logs: normally up to 12 months, unless specific security evidence must be retained longer to investigate an incident or legal claim.

Legal claims and compliance records: for the period necessary to comply with the relevant duty or protect legal rights, generally aligned with applicable statutory limitation periods.

We may delete or anonymise information earlier where it is no longer required. Backup copies are protected and removed through normal backup rotation. Retention periods will be reviewed when booking and operational systems are introduced.

11. EU GDPR representative

Where Article 27 of the EU GDPR requires ZARA9 to appoint a representative in the European Union, the representative provides a contact point for individuals and supervisory authorities in relation to processing covered by the EU GDPR.

EU GDPR representative

PRAGUSA.ONE d.o.o.

Slavonska avenija 1c

10000 Zagreb, Croatia

Email: pc@zara9.com

12. Security

We use organisational and technical measures proportionate to the nature and risk of the information we handle. Measures may include access controls, authentication, encrypted transmission where supported, restricted permissions, provider security controls, backups and incident-response processes.

No internet service is completely secure. You should not send sensitive information through ordinary email unless an appropriate secure method has been agreed.

13. Your data-protection rights

Depending on the law that applies, you may have the right to:

receive information about how your personal information is used and obtain a copy of it;

ask us to correct inaccurate or incomplete information;

ask us to erase information in circumstances where the right applies;

ask us to restrict processing in circumstances where the right applies;

receive information you provided to us in a portable format where data portability applies;

object to processing based on legitimate interests and object at any time to direct marketing;

withdraw consent at any time where processing is based on consent;

be protected from certain solely automated decisions that produce legal or similarly significant effects, where that right applies; and

complain to a supervisory authority and seek a judicial remedy.

To exercise a right, email pc@zara9.com with the subject line “Data Protection Request”. We may request proportionate information to verify your identity or authority. We normally respond within one month, subject to lawful extensions or exceptions.

14. Data-protection complaints

You may complain directly to us at pc@zara9.com using the subject line “Data Protection Complaint”. Please describe the issue, relevant dates, information concerned and the outcome you seek.

We will provide a clear route for complaints, acknowledge receipt within 30 days, take appropriate steps to investigate without undue delay, keep you appropriately informed of progress and communicate the outcome without undue delay. This process does not affect your right to complain to a supervisory authority.

For UK matters, you may contact the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom, or visit ico.org.uk.

For Croatian or other EU matters, you may contact the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia, or another competent supervisory authority in the EU Member State where you live, work or consider that an infringement occurred. AZOP information is available at azop.hr.

15. Children

The current Website is not directed to children and we do not knowingly use the Website to collect information from children for marketing. If you believe that a child has provided information without appropriate involvement of a parent or legal guardian, contact us so that we can assess the situation and, where appropriate, delete the information.

16. Automated decision-making

We do not currently use personal information collected through the Website to make solely automated decisions that produce legal or similarly significant effects. If that changes, we will provide the information and safeguards required by applicable law before the processing begins.

17. Changes to this policy

We may update this policy to reflect changes in law, guidance, technology, providers, Website functionality or our operations. Material changes will be highlighted where appropriate. The effective date at the top shows when this version applies.

We will review and, where necessary, replace or supplement this policy before introducing online booking, payment, passenger health or fitness screening, customer accounts, training enrolment, systematic profiling or other materially different processing activities.

18. Contact

ZARA9 LTD, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Email: pc@zara9.com. Telephone: +44 78 53 101 996.