Travel-Specific Privacy Notice

1. Scope of This Supplement

This Supplement applies to personal information collected or processed:

• In connection with leisure, group, corporate, VIP, or executive travel planning;
• In connection with charter travel programs;
• Through booking systems, supplier portals, global distribution systems (GDS), and travel management tools;
• Through communications with travel advisors;
• Through participation in preferred partner or network programs (including Signature Travel Network).

This Supplement does not apply to personal information processed solely for marketing, airline operations, or air carrier services, which may be subject to separate disclosures if and when applicable.

2. Categories of Personal Information Collected for Travel Services

In addition to the categories described in the Global Privacy Policy, Pan Am Travel may collect and process the following categories of personal information as necessary to provide Travel Services:

A. Identity and travel documentation information

• Full legal name (as it appears on passport or government ID);
• Date of birth;
• Gender marker (where required for travel documentation);
• Nationality and country of residence;
• Passport number, expiration date, and issuing country;
• Known traveler numbers (e.g., TSA PreCheck, Global Entry);
• Visa information;
• Government-issued identification details.

B. Companion and group information

• Names and details of accompanying travelers;
• Minor traveler information;
• Emergency contact information.

C. Health and accommodation information

Where voluntarily provided and necessary to fulfill travel arrangements: dietary preferences or restrictions, accessibility needs, mobility requirements, allergy disclosures, and medical accommodations relevant to travel logistics. Pan Am Travel does not use health-related information for profiling or marketing purposes. Such information is processed strictly for fulfillment and accommodation.

D. Booking and transaction information

• Itinerary details;
• Travel history;
• Supplier confirmations;
• Payment confirmations;
• Service fee records;
• Communication history with travel advisors.

E. Corporate travel reporting information

For corporate and group travel programs, we may process travel expense reports, booking summaries, traveler utilization reports, and company billing records. Corporate clients may export such reports for internal accounting, compliance, or expense management purposes.

3. Sources of Personal Information

We collect personal information directly from travelers; from corporate clients; from travel companions; through global distribution systems (including Sabre); from Signature Travel Network systems; from travel suppliers (airlines, hotels, cruise lines, tour operators, charter operators, ground transportation providers); from travel insurance providers; and from regulatory or accreditation bodies (including ARC).

4. How We Use Travel-Related Personal Information

Pan Am Travel processes personal information to:

• Research, plan, and book travel arrangements;
• Transmit traveler information to suppliers for fulfillment;
• Coordinate charter services;
• Process payments and service fees;
• Provide customer service and emergency support;
• Fulfill reporting obligations (including ARC reporting);
• Comply with legal and regulatory requirements;
• Provide corporate travel management services;
• Administer preferred partner programs;
• Improve service quality and traveler experience.

We do not sell travel-related personal information.

5. International Data Transfers Inherent to Travel

Travel services frequently require the transfer of personal information across international borders. When you book international travel, your personal information may be transferred to foreign airlines, hotels, cruise lines, destination management companies, charter operators, government authorities, immigration and customs authorities, and airport security authorities.

Such transfers are necessary to complete bookings and comply with travel regulations. By requesting international travel services, you acknowledge that your personal information may be processed in jurisdictions that may not provide the same level of data protection as your home jurisdiction.

6. Sharing of Personal Information with Travel Suppliers

Pan Am Travel acts as an intermediary between travelers and independent travel suppliers. To complete bookings, we may share relevant personal information with airlines, hotels, cruise lines, tour operators, charter operators (including Icelandair, Freedom Air Jet Charters, ACC Aviation, and Clipper Air Charters, when operational), ground transportation providers, travel insurance providers, and visa and documentation services.

Travel suppliers operate as independent data controllers and maintain their own privacy policies.

7. Signature Travel Network

Pan Am Travel is an independent and hosted member of Signature Travel Network. In connection with preferred partner programs, amenities, marketing programs, or booking facilitation, limited traveler information may be transmitted through Sabre or related booking systems to Signature Travel Network.

Signature Travel Network does not have direct access to Pan Am Travel’s internal CRM systems. Data sharing is structured, limited, and tied to booking and program participation. Signature Travel Network maintains its own privacy practices.

8. Payment Processing

Pan Am Travel does not retain full credit card numbers in its internal CRM systems. When payment information is provided, card information may be transmitted securely through booking systems or directly to suppliers; card data is not stored by Pan Am Travel beyond transaction processing needs; and payment information may be processed by third-party payment processors.

For charter programs or group programs, funds may be collected through designated accounts and transmitted to suppliers in accordance with contractual arrangements.

9. ARC and Regulatory Reporting

Pan Am Travel complies with reporting requirements of the Airlines Reporting Corporation (ARC). Travel-related information may be disclosed to ARC for ticketing, settlement, auditing, and regulatory compliance purposes. Such disclosures are mandatory and necessary to operate as a travel agency.

10. Corporate Travel Programs

Pan Am Travel provides travel management services to corporate entities, executive teams, and group clients. In connection with such services, we may process personal information relating to individual travelers on behalf of a corporate client.

A. Information processed for corporate programs

For corporate travel programs, we may process employee and contractor identification information; company affiliation and job title; corporate contact details; booking and itinerary information; travel preferences; loyalty program details; expense-related data; billing and invoicing records; reporting and utilization metrics; and emergency contact information where provided. Such information may be collected directly from the traveler, from the corporate client, or through authorized travel management platforms.

B. Reporting and data exports

In connection with corporate travel management services, Pan Am Travel may generate and provide booking summaries, utilization reports, expense documentation, reconciliation reports, and other travel-related data to the applicable corporate client. Corporate clients may export or integrate such reports into their internal accounting, compliance, expense management, risk management, or human resources systems. Once such information is provided to the corporate client, the corporate client acts as an independent data controller with respect to the information in its possession and is responsible for its own privacy and data protection practices.

C. Role of Pan Am Travel

In the context of corporate travel services, Pan Am Travel may act as a service provider or processor to the corporate client; we process traveler information as necessary to fulfill travel management obligations; and we do not use corporate traveler data for unrelated marketing purposes unless independently authorized by the traveler. Where required by applicable law or contractual agreement, Pan Am Travel will process corporate travel data in accordance with written instructions from the corporate client.

D. Regulatory and reporting obligations

Certain corporate travel bookings may be subject to mandatory reporting requirements, including but not limited to reporting to the Airlines Reporting Corporation (ARC), travel suppliers, charter operators, and regulatory or tax authorities. Such disclosures are made solely to fulfill operational, contractual, or legal obligations.

E. International corporate travel

Corporate travel programs may involve cross-border transfers of traveler information to airlines, hotels, charter operators, ground transportation providers, and foreign authorities as required to complete travel arrangements. By participating in corporate travel programs administered by Pan Am Travel, travelers acknowledge that their information may be transferred internationally in connection with booked travel services.

11. Leisure Travel Services

Pan Am Travel provides personalized leisure travel advisory services to individual travelers, families, and private groups. In connection with such services, we may collect and process personal information directly from travelers or from a parent or legal guardian acting on behalf of a minor traveler. Leisure travel services may involve a more customized and advisory-based relationship between the traveler and the assigned travel advisor.

A. Information collected in connection with leisure travel

In addition to the categories described in this Supplement and the Global Privacy Policy, we may collect detailed travel preferences and interests; accommodation preferences; room configurations and bedding preferences; special occasion information (e.g., anniversaries, celebrations); dining preferences; passport and documentation information; loyalty program details; travel history; emergency contact information; travel insurance selections; and trip-related communications and advisory notes. Such information is collected for the purpose of planning, customizing, booking, and facilitating leisure travel experiences.

B. Information relating to children and minors

Pan Am Travel does not knowingly collect personal information directly from children under the age of 18. However, in connection with family or group leisure travel bookings, we may collect personal information about minors when provided by a parent or legal guardian, including full legal name, date of birth, passport details, dietary restrictions, accessibility needs, and emergency contact information. Such information is processed solely for the purpose of fulfilling travel arrangements, complying with airline and supplier requirements, and ensuring appropriate accommodations. Pan Am Travel does not use minor traveler information for marketing, profiling, or independent commercial purposes. Parents or legal guardians may request access to or deletion of minor-related personal information by contacting privacy@panam.com, subject to applicable legal and operational limitations.

C. Advisory-based relationship

Leisure travel advisors may maintain notes, preferences, and service history related to returning clients in order to provide continuity of service, personalize future recommendations, facilitate repeat bookings, and coordinate loyalty program benefits. Such information is retained in accordance with the data retention practices described in this Supplement and is not used for purposes unrelated to travel advisory services without appropriate authorization.

D. Direct communications and marketing

Leisure travelers may independently opt in to receive marketing communications, newsletters, or promotional offers. Participation in leisure travel services does not automatically enroll a traveler in marketing communications unless consent is provided. Travelers may manage communication preferences in accordance with the Global Privacy Policy.

E. International travel and minor documentation

When leisure travel involves international destinations, personal information of both adults and minors may be transferred to foreign travel suppliers and governmental authorities as required for booking, immigration, or entry compliance. Parents or guardians are responsible for ensuring that appropriate travel documentation for minors is valid and complete.

12. Travel Technology Platforms & Service Providers

To provide Travel Services, Pan Am Travel relies on various third-party software platforms, booking systems, and service providers. These providers process personal information solely for operational, administrative, compliance, or fulfillment purposes. Below is a non-exhaustive list of the primary platforms used in connection with Travel Services.

A. Global distribution & booking systems

• Sabre — global distribution system (GDS) for airline, hotel, and travel bookings. Processes traveler identity information, itinerary details, ticketing information. United States. Privacy policy
• Cvent — event management and group booking coordination. Processes traveler identity and event-related booking details. United States. Privacy policy
• Concur (SAP Concur) — corporate travel booking and expense management. Processes booking records, expense reports, itinerary information. United States. Privacy policy

B. Travel management & back-office systems

• ClientBase — travel agency CRM and client management. Processes client profiles, booking history, communication logs. United States.
• TRAMS — back-office accounting and reporting for travel agencies. Processes booking and financial records. United States.
• GRASP Technologies — travel data analytics and reporting. Processes travel activity and reporting data. United States.
• Trondent — travel management technology solutions. Processes operational travel records. United States.

C. Customer relationship & communications

• HubSpot — CRM, email communications, client engagement. Processes contact details, marketing communications, inquiry forms. United States. Privacy policy

D. Accounting & reporting

• Airlines Reporting Corporation (ARC) — airline ticket settlement, reporting, and compliance. Processes ticketing records, settlement data. United States. Privacy policy

E. Payment processing

Pan Am Travel utilizes secure third-party payment processors and booking platforms to transmit payment information to suppliers. Pan Am Travel does not retain full credit card numbers in its internal CRM systems. Payment processors maintain their own privacy and security standards in accordance with PCI-DSS requirements.

F. Document storage & operational tools

• Dropbox — secure document storage and file sharing. United States. Privacy policy
• Google Drive — secure document storage and collaboration. United States. Privacy policy

G. Future technology use

Pan Am Travel may implement additional technologies in the future, including but not limited to customer support chat platforms, SMS communication tools, travel loyalty management systems, marketing automation tools, and optimization tools. Any such implementation will be subject to appropriate privacy review and disclosure updates where required.

13. Data Retention

Travel booking records may be retained for as long as necessary to complete travel services; comply with ARC and regulatory requirements; satisfy accounting and tax obligations; resolve disputes; enforce agreements; and maintain historical travel records for returning clients. Payment information is retained only for the duration necessary to complete transactions and reconcile bookings.

The retention of personal information processed in connection with Pan Am Travel services is further governed by the Data Retention section of the Pan Am Global Privacy Policy, which is incorporated herein by reference. For additional details regarding retention periods and applicable criteria, please refer to the Data Retention section of the Global Privacy Policy.

14. Emergency Situations

In the event of travel disruptions or emergencies, Pan Am Travel may share necessary traveler information with airlines, local authorities, emergency responders, consular services, and corporate clients (where applicable). Such disclosures are made solely to protect traveler safety or fulfill travel obligations.

15. Your Rights

Travelers retain the rights described in the Pan Am Global Privacy Policy, including rights of access, correction, deletion, and opt-out where applicable under law. Requests related specifically to Travel Services may be submitted to privacy@panam.com. We may require identity verification before processing requests.

16. European Economic Area (EEA) and United Kingdom Privacy Disclosures

This section applies to individuals located in the European Economic Area (“EEA”) and the United Kingdom (“UK”) whose personal data is processed by Pan Am Travel. For purposes of applicable data protection law, Pan Am Global Holdings, LLC (on behalf of Pan Am Travel) acts as the data controller for personal data processed in connection with Travel Services, except where otherwise stated.

16.1 Lawful bases for processing

Performance of a contract (Article 6(1)(b)). Processing is necessary to plan and book travel arrangements; transmit traveler data to airlines, hotels, cruise lines, charter operators, and other suppliers; coordinate charter programs; provide corporate travel management services; and provide emergency travel support. Without this processing, Travel Services cannot be performed.

Legal obligations (Article 6(1)(c)). Processing may be required to comply with ARC reporting requirements; comply with aviation, immigration, and customs regulations; and meet accounting, tax, and regulatory reporting obligations.

Legitimate interests (Article 6(1)(f)). Processing may be necessary for managing client relationships, improving service quality, maintaining travel history for repeat clients, fraud prevention, risk management, and business continuity. Where processing is based on legitimate interests, we conduct balancing assessments to ensure that our interests are not overridden by your rights.

Consent (Article 6(1)(a)). Where required by law, we rely on consent for marketing communications, processing certain optional data fields, and non-essential cookies and tracking technologies. Consent may be withdrawn at any time.

16.2 Special categories of personal data (Article 9)

Certain travel arrangements may require processing of special category data, including accessibility or mobility requirements, dietary restrictions, and medical accommodations relevant to travel logistics. Such data is processed only where explicit consent has been provided, or where processing is necessary for reasons of substantial public interest in connection with international travel compliance. Pan Am Travel does not process health data for profiling, marketing, or analytics.

16.3 International data transfers

Because Travel Services inherently involve international travel, personal data may be transferred outside the EEA or UK, including to the United States; airlines and hotels located globally; charter operators; and government authorities in destination countries. Where required, Pan Am Travel relies on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, adequacy decisions (where applicable), and contractual necessity for international travel fulfillment. By requesting international travel services, you acknowledge that international transfers are inherent to the nature of the services provided.

16.4 Data subject rights (EEA and UK residents)

If you are located in the EEA or UK, you have the right to access your personal data; rectify inaccurate data; request erasure (subject to legal and regulatory obligations); restrict processing; object to processing based on legitimate interests; request data portability; withdraw consent at any time (where processing is based on consent); and lodge a complaint with your local supervisory authority. Requests may be submitted to privacy@panam.com. We may require verification of identity before responding.

16.5 Data retention (EEA & UK clarification)

Personal data will be retained only for as long as necessary to provide Travel Services; comply with ARC and aviation reporting requirements; meet tax and accounting obligations; resolve disputes; and enforce contractual rights. Retention periods are determined based on regulatory requirements, business necessity, and risk exposure.

17. Supplemental Nature of This Notice

This Supplemental Privacy Notice applies solely to Pan Am Travel’s Travel Services and is intended to be read in conjunction with the Pan Am Global Privacy Policy.