A Driver Public Information

*

Swissport North America Holdings, Inc., and U.S. Affiliates

Employee Privacy Policy

Dated: January 1, 2023; revised from July 1, 2020, version This Employee Privacy Policy will regularly be updated to reflect any changes in the way Swissport handles your personal information or any changes in applicable laws. Privacy of Employee Personal Information

Swissport North America Holdings, Inc., and its U.S. affiliates (“Swissport”) are committed to protecting the personal information of prospective, current, and former employees with regard to Swissport employment-related activities (collectively, “Employee Personal Information”), while complying with applicable privacy laws and contractual obligations, including agreements and undertakings by, between, and among Swissport and its parent, subsidiaries, and affiliates.

This Swissport Employee Privacy Policy describes how Swissport Human Resources

(“Swissport HR”) interprets and applies the California Consumer Privacy Act and the California Privacy Rights Act (“CCPA/CPRA”) and other applicable privacy laws to Employee Personal Information.

What is Employee Personal Information?

Employee Personal Information is any information from or about a prospective, current, or former employee and any persons they may identify in an employment-related context, including spouses, beneficiaries, and dependents, that either identifies that person directly or that makes that person identifiable when the information is combined with other information from or about that person.

Employee Personal Information does not include personal information that has been aggregated, excerpted, de-identified, or otherwise anonymized sufficiently that the individual is no longer identified or identifiable and cannot be reidentified using reasonable efforts, resources, and technology.

What Employee Personal Information does Swissport HR collect or access? Swissport HR collects, creates, maintains, or accesses many types of Employee Personal Information, including:

Employee identifiers or personal information, including name, postal address, email address, telephone number, employee number, Social Security number, driver’s license number, passport number or other similar identifiers;

Education and employment information;

Payroll-related information, including financial institution information, wage and 2

benefits information, and tax information;

Benefits-related information, including eligibility, enrollment, and changes in health, welfare, and retirement benefits, including long- or short-term disability, leaves of absence, medical and dental care;

Spouse, beneficiary, dependent, and emergency contact information;

National and governmental identification information required for Form I-9;

Trade union membership;

Photographs and video; and

Biometric data, including hand geometry or finger measurements. In general, Swissport HR does not collect the following information, except for in the limited circumstances described below:

Racial or ethnic origin;

Political opinions;

Religious, philosophical, or other similar beliefs;

Physical or mental health;

Veteran status;

Sex or sexual orientation; and

Criminal record.

Swissport HR does not collect this information except to the extent necessary for employment- related or security clearance purposes, to satisfy Swissport legal or contractual or governmental reporting obligations, and/or when a prospective, current, or former employee has voluntarily provided such information to Swissport HR.

Whenever possible, Swissport HR collects Employee Personal Information directly from the individuals, for example, through employment applications and new employee paperwork, or uses personal information that individuals have provided to another Swissport entity or to a third-party acting on Swissport’s behalf.

How Does Swissport Use Employee Personal Information? Swissport uses Employee Personal Information solely for lawful business purposes, including but not limited to functions related to Swissport’s employment relationships. For example, Swissport utilizes Employee Personal Information for the following purposes:

Determining eligibility for employment, including the verification of references, education, and qualifications;

Administering pay and benefits;

Coordinating borrowed resources, transfers, and similar activities in Swissport;

Processing work-related claims (e.g., worker compensation, leaves of absences, and unemployment claims);

Conducting performance reviews and determining performance requirements;

Establishing a point of contact in the event of an emergency (such as next of kin);

Complying with applicable labor or employment laws; 3

Compiling directories;

Providing employment and wage verification; and

Other purposes as are reasonably necessary to comply with Swissport legal and contractual obligations.

Swissport may use Employee Personal Information for any additional purpose for which the employee has been notified, to the extent required by law, and/or where Swissport has obtained an employee’s consent to use or disclose his or her personal information. Swissport may also use an employee’s information in accordance with a written request from that employee or an authorized representative of the employee. When does Swissport share or disclose Employee Personal Information? Swissport does not sell or share Employee Personal Information with third parties for marketing or any other non-Swissport business purposes. Swissport HR has shared and will continue to share Employee Personal Information within Swissport, to include Operations, Legal, and Information Technology (IT) personnel, as necessary. Swissport may share Employee Personal Information with other Swissport entities, employees, contractors, consultants, and other parties to the extent necessary to assist Swissport with establishing and managing Swissport’s employment relationships. Swissport may also share Employee Personal Information to the extent necessary to establish Swissport qualifications and eligibility for contracting, billing, performance assessments, and other Swissport business activities. A list of the types of third parties with whom Swissport may share Employee Personal Information and the purposes for such is included as an addendum to this Employee Privacy Policy. Employee Personal Information may also be disclosed in various other situations, including without limitation (i) as permitted or required by applicable law; (ii) to comply with valid legal processes such as search warrants, subpoenas, or court orders; (iii) as part of Swissport’s regular reporting activities to others within Swissport or its affiliates, parents, and subsidiaries; (iv) to protect Swissport’s rights and property; (v) during emergency situations; or

(vi) with an employee’s consent where such consent is required by law. Swissport may share Employee Personal Information within Swissport, with Swissport affiliates, parents, and subsidiaries, and with third parties for the purposes described in this Employee Privacy Policy. As a result, Employee Personal Information may be collected, used, processed, stored, or disclosed in the United States, and in some cases, in other countries. Swissport will transfer Employee Personal Information to another country only to the extent required or permitted under applicable laws and only subject to agreements that provide assurances that the transfers will be secure and will maintain at least the same level of data protection that is provided by Swissport.

When Swissport shares Employee Personal Information with third parties, it strives to do so in conjunction with a written agreement that requires the third party to, among other things, protect the personal information and use it only to the extent necessary to accomplish the purposes for which Swissport is sharing it.

4

How does Swissport protect Employee Personal Information? Swissport incorporates the physical, technical, and procedural safeguards developed, implemented, and maintained by the Swissport IT Department to protect Swissport non-public information, including Employee Personal Information, against loss and unauthorized access, copying, use, modification, disclosure, retention, and disposal. Swissport also complies with an incident response process as outlined in the Corporate IT Standard document on Information Security.

In addition, Swissport HR maintains HR-specific physical and other access controls to limit direct access to Employee Personal Information to HR staff and to other authorized individuals, including by

Applying role-based, need-to-know, least-privilege access controls;

Working with and sharing Employee Personal Information in aggregated, excerpted, deidentified, or otherwise anonymized personal information to the extent possible; and

Treating all Swissport materials that include or incorporate Employee Personal Information as Employee Personal Information.

Swissport HR maintains processes for providing those outside of the department with access to Employee Personal Information. These processes enable HR to verify that the access is lawful, for an authorized Swissport business purpose, and compliant with Swissport policies and procedures, including that the request is limited in scope to the least amount of personal information necessary to accomplish the specified business purpose(s), and that the personal information is aggregated, excerpted, deidentified, or otherwise anonymized to the extent feasible.

HIPAA-Protected Data

Employee Personal Information relating to coverage under Swissport group health plans is subject to specific privacy and data security requirements imposed by the Health Insurance Portability and Accountability Act (HIPAA). Swissport HR implements HIPAA-compliant internal controls to safeguard HIPAA-protected personal information when accessing or using such information.

How long does Swissport retain Employee Personal Information? Swissport retains Employee Personal Information for the period necessary to fulfill the purposes for which the personal information was collected and to comply with Swissport legal and business obligations.

Once the purposes for which the Employee Personal Information have been achieved, and there is no legal or business need to retain it, Swissport strives to destroy, delete, anonymize, and/or remove the Employee Personal Information from its systems. 5

What rights do prospective, current, and former employees have regarding Swissport HR’s collection and use of Employee Personal Information? A. Right to Know What Information is Collected

To the extent practicable and in compliance with applicable laws, Swissport HR shall provide information to individuals about how it collects, processes, protects, shares, discloses, and disposes of their Employee Personal Information. This Swissport Employee Privacy Policy constitutes Swissport HR’s notice regarding Employee Personal Information. This Privacy Policy is provided to employees when they join the Company, and periodically when updated. B. Right of Access

Upon receiving a request from a prospective, current, or former employee or their authorized representative, together with sufficient information to validate the identity of the individual making the request, Swissport shall determine whether Swissport holds Employee Personal Information about the requester and will, unless prohibited by law or contractual obligation:

inform that individual whether Swissport collects, stores, or uses Employee Personal Information about him or her;

describe the Employee Personal Information that Swissport holds, the reason for holding that Employee Personal Information, and, where required by law, the categories of third parties or specific third parties to whom it may disclose that Employee Personal Information (e.g., service providers); and

provide the individual with copies of the Employee Personal Information held about him or her, together with an indication of the source(s) of the data, if known.

C. Right of Correction

An individual may request that Swissport correct the Employee Personal Information it holds about him or her. Swissport will either correct the information or, if Swissport disagrees, it will record in the relevant file(s) the fact that the individual considers the Employee Personal Information to be incorrect.

D. Right to Object to Marketing

Swissport does not currently share Employee Personal Information for third-party marketing purposes and does not permit service providers or others acting on Swissport’s behalf to use Employee Personal Information for any purposes other than authorized Swissport business purposes. However, in the unlikely event that Swissport changes its practices in the future to permit marketing, Swissport will honor a request from a prospective, current, or former employee not to use his or her Employee Personal Information for marketing purposes, shall do 6

so free of charge to the individual, shall maintain a list of individuals who have submitted “no marketing” requests, and shall provide that list to all contractors and data processors who engage in marketing on its behalf.

E. Right to Withdraw Consent Previously Given

Employee consent is generally not required under applicable law for Swissport to collect, use, or disclose Employee Personal Information for the purposes of establishing, maintaining, or terminating an employment relationship. However, to the extent, if any, that Swissport is collecting and using Employee Personal Information based solely on an employee’s consent, Swissport shall permit that individual to withdraw consent at any time, to the extent consistent with Swissport legal and contractual obligations. Swissport will, within a reasonable period of receiving a withdrawal of consent, cease processing that individual’s Employee Personal Information to the extent practicable and consistent with Swissport legal and contractual obligations and shall also notify all vendors and data processors acting on Swissport’s behalf to cease relying on that consent to process the individual’s Employee Personal Information. F. Non-Discriminatory Treatment

Swissport will not discriminate against a prospective, current, or former employee for exercising any of these rights.

G. Other Rights Under Applicable Privacy Laws

An individual may have additional rights under other applicable federal, state, and international privacy laws.

How do California Residents exercise their rights under the CCPA/CPRA? If you are a California resident, you have the right to request that Swissport: 1. Disclose to you the following information covering the 12-month period prior to your request (“Access Request”):

The categories of Employee Personal Information we collected about you and the categories of sources from which we collected the Employee Personal Information;

The business or commercial purpose for collecting Employee Personal Information about you;

The categories of third parties to whom we disclosed Employee Personal Information about you, and the categories of Employee Personal Information disclosed;

The specific pieces of Employee Personal Information we collected about you; and

2. Delete Employee Personal Information we collected from you (“Deletion Request”).

7

You can make an Access Request or a Deletion Request by calling or emailing Swissport: Toll Free Number: 888-***-****

Email Address: adxqux@r.postjobfree.com

We will ask you to provide the following information to identify yourself:

Name, contact information, social security number, date of birth; and

A copy of government-issued photo ID, such as a driver’s license. When you make a request, we will attempt to verify that you are who you say you are. For example, we will attempt to match information that you provide in making your request with other sources of similar information to reasonably verify your identity. Response Timing and Format

Swissport endeavors to respond to a verifiable request within 45 days of receipt. If we require more time (up to 90 days), we will notify you in writing and explain why. For data portability requests, Swissport will select a format to provide your personal information that is readily useable and transmittable.

Swissport does not charge a fee to process or respond to a verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that your request warrants a fee, we will explain why and provide a cost estimate before completing your request. If Swissport cannot comply with a verifiable request, we will explain why. For example, we will not provide certain Employee Personal Information if disclosure would reveal private information about entities and individuals other than you, if disclosure would violate Swissport legal or contractual obligations, or if the information requested is exempt from the CCPA/CPRA, including information subject to certain federal privacy laws such as HIPAA. Furthermore, we will not delete certain Employment Related Information when it is necessary to maintain that Employment Related Information to comply with a legal obligation. How do prospective, current, and former employees get more information about Swissport’s practices regarding Employee Personal Information? Any questions about how Swissport collects, uses, and discloses Employee Personal Information, assertions of rights, or this Employee Privacy Policy should be addressed to adxqux@r.postjobfree.com.

8

Swissport North America Holdings, Inc., and U.S. Affiliates Employee Privacy Policy

Addendum: Third Parties with which Swissport May Share Employee Personal Information Swissport may share Employee Personal Information with the following types of third parties:

Benefits administration provider, to facilitate administration and management of benefit eligibility and enrollment in insurance programs, including for medical, dental, vision, life and disability, and personal accident and critical illness coverage.

Retirement products and services provider, to facilitate management of Swissport’s 401(k) program.

Third party service providers, to facilitate Swissport HR, Tax, and Operational processes, employee recognition and rewards programs, and discount programs to benefit employees.

9

Swissport North America Holdings, Inc., and U.S. Affiliates Employee Privacy Policy

Employee Acknowledgement Form

I, the undersigned, acknowledge that I have reviewed the Swissport North America Holdings, Inc. and its U.S. affiliates Employee Privacy Policy and understand it. Employee Signature:

Employee Name (please print):

Date:

Contact this candidate