Privacy Policy

(LAST UPDATED JANUARY 7, 2020)

Your Privacy is Important to Cirrus Aircraft.

Cirrus Design Corporation d/b/a Cirrus Aircraft is committed to maintaining a high standard of data privacy in accordance with your data protection rights under applicable law. The personal information you provide to Cirrus Aircraft helps us better serve you and enhances the Cirrus Life experience. The protection and proper use of the personal information you entrust to us is a responsibility we take seriously. Cirrus Aircraft uses a variety of security measures, including firewalls, threat detection, encryption, and authentication tools, to help protect and maintain security, integrity and availability of your personal information.

This Privacy Policy explains what personal information we may collect from you, when we may collect it, how we may use it, and the choices you have regarding our use of it, and whether we disclose it to anyone.

What Categories of Personal Information Do We Collect, and How Do We Obtain the Personal Information?

We may collect certain information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer or household (“Personal Information”). Personal information does not include de-identified or aggregated consumer information. The following types of personal information may be collected:

• Identifiers – We may collect your name, aircraft identification numbers, postal address, phone numbers, and email addresses. We obtain this information from you when you: (1) purchase an aircraft, product or service; (2) register on our website, portals, or applications; (3) sign in to the Cirrus Learning, Cirrus VPO, Cirrus Connection, Cirrus Direct, and Cirrus Supplier portals and the Cirrus Aircraft Application; (4) interact with Cirrus Aircraft’s support team and field service network; (5) apply for insurance through Cirrus Insurance™ and submit requested information to us; and (6) apply for financing through Cirrus Finance™ and submit the requested information to us.
• Internet or other similar network activity – We may collect your activity on our websites, portals, and applications, as well as your interaction with our advertising and other communications.
• Commercial information – We may collect information from you relating to your purchases and services, including:
  • your purchasing or consuming histories or tendencies, information about your flight training history and records,
  • your pilot’s training information,
  • information about your aircraft’s maintenance history and warranty, and
  • other information relating to your aircraft collected by the Cirrus Aircraft Application, such as flight plans and fluid levels.
• Geolocation data – We may collect information regarding the physical location or movement of your aircraft if your aircraft is equipped with the connectivity hardware.
• Financial information – We may collect your bank account number, credit card number or other financial information when you purchase an aircraft or other products or services from us.

What is Our Business or Commercial Purpose for Collecting Your Personal Information, and With Whom Do We Share Your Personal Information?

Cirrus Aircraft may use or share your Personal Information as follows:

• Identifiers – We may use your identifiers to: (1) process and fulfill your purchases; (2) maintain and service your aircraft; (3) send you information by email, postal mail, or telephone, about our products, services, and promotions; (4) provide you with flight training; (5) access Cirrus portals and applications; and (6) process your requests through Cirrus Insurance™ and Cirrus Finance™. We share your identifiers with authorized sales, flight training and maintenance providers that provide services to you.
• Internet or similar network activity: We use your network activity to personalize and enhance your experiences when you interact with Cirrus Aircraft’s websites, and to help us manage and improve our websites. We do not share this information with third parties.
• Commercial information: We may use commercial information to: (1) maintain and service your aircraft; (2) provide you with flight training; and (3) provide you with other information about the status of your aircraft. We may share this information with authorized sales, flight training, and maintenance providers who provide services to you.
• Geolocation data: We use your aircraft geolocation to provide you with preflight planning information through the Cirrus Aircraft Mobile Application. We may use this information for internal research and development purposes.
• Financial information: We use financial information you provide to us to process and fulfill your purchases. We share this information with a third-party vendor who processes your payment information.

We take reasonable steps to ensure that the companies to whom we share your Personal Information are contractually obligated to keep the personal information that we provide to them confidential and to use such information only as we permit.

In addition, where consistent with the laws and regulations of the relevant jurisdiction, Cirrus Aircraft may disclose Personal Information if such disclosure:

• is necessary to prepare, negotiate, or perform a contract with you;
• is needed to respond to subpoenas, court orders, or other legal process or otherwise required by law or the competent governmental or judicial authorities;
• is needed to cooperate with law enforcement, government or regulatory entities, and safety or investigation authorities;
• is necessary to establish or preserve a legal claim or defense;
• is part of a corporate restructuring, sale of assets, merger or divestiture; or
• is necessary to prevent fraud or other illegal activities, such as willful attacks on Cirrus Aircraft’s information technology systems.

No Sale of Personal Information

In the preceding 12 months, we have not sold and will not sell any Personal Information to non-affiliated third parties without your consent. We also have not and will not sell the Personal Information of minors under 16 years of age to non-affiliated third parties without affirmative consent.

Retention of Personal Information

Cirrus Aircraft will retain your Personal Information for as long as it is necessary for the purpose(s) for which we obtained the information or where claims are contemplated. Also, please see below regarding an EU resident’s right to erasure under the GDPR.

Rights and Choices of California Customers

We provide our California customers with specific rights regarding their Personal Information. The section describes the rights that you have under California law and explains how to exercise those rights.

Right to Know About Personal Information Collected, Used, or Disclosed

You have the right to request that we disclose certain information to you about our collection, use and disclosure of your Personal Information over the past 12 months. Once we receive your request and verify your identity, we will disclose to you: (1) the categories of Personal Information we collected about you; (2) the categories of sources for the Personal Information; (3) our business or commercial purpose for collecting or disclosing that Personal Information; (4) the categories of third parties with whom we shared that Personal Information; and (5) the specific pieces of Personal Information we collected about you in the preceding 12 months.

Right to Delete Personal Information Collected or Maintained

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your request and verify your identity, we will permanently delete (and direct our service providers to delete) your Personal Information from our records, unless a legal exception to deletion applies. In our response to your request to delete, we will specify the manner in which we have deleted your Personal Information or, if we must deny your deletion request, the basis for this refusal.

Right to Non-Discrimination for Exercise of Privacy Rights

We will not discriminate against you for exercising any of your rights by: (1) denying you goods or services; (2) charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (3) providing you a different level or quality of goods or services; or (4) suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 1-800-279-4322 and asking to be directed to the Legal Department
• Emailing us at privacy@cirrusaircraft.com

Authorizing an Agent

You may designate an authorized agent to submit your consumer request on your behalf, so long the authorized agent has your written permission to do so and you have taken steps to verify your identity directly with us.

Verifying Your Request

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify your identity or authority to make the request. You may only make a verifiable consumer request for access or data portability twice within a 12-month period.

To verify your identity, we ask that you to provide us with the following information when you submit your request: (1) first name; (2) last name; and (3) phone number or email. We will use the above information to verify your identity. Depending on your type of request or the information requested by you, we may require additional information to verify your identity and fulfill your request.

Rights and Choices of EU Data Subjects

Under the GDPR, the use of personal information set forth above is permitted on the basis of the following legal grounds: (1) where you have provided your consent; (2) when necessary to perform our contractual obligations to you; (3) when needed to either comply with our legal obligations or defend any legal claims; (4) when necessary to achieve a legitimate interest, which outweighs any prejudice to your data protection rights; and (5) when necessary protect the vital interests of you or another person. For individuals residing in the EU, it is Cirrus Aircraft’s policy to obtain your consent and permission to share your personal information with our authorized sales, flight training, and maintenance providers for the purposes for which the data was initially collected.

If you reside in the EU, you have the right under the GDPR to: (1) access your personal information; (2) transfer your personal information; (3) request the erasure of your personal information; (4) object to the processing of your personal information; and (5) change your privacy preferences. Please contact privacy@cirrusaircraft.com to exercise any of these rights under the GDPR or if you have any questions regarding this Privacy Policy.

Third Party Websites and Applications

Cirrus Aircraft’s website, portals, and applications may contain links to websites or applications hosted by third parties. This Privacy Policy only applies to websites, portals, and applications within Cirrus Aircraft’s control and does not apply to any third party sources. Any data collected through third party websites or applications shall be subject to the privacy practices of the third party, and you should review the privacy policies of these third parties prior to sharing any personal information.

Cross-Border Data Transfers

We process information both inside and outside the United States. It is important to know that data protection laws in the United States may not be as strong as those in your country. Where we transfer your personal information from the European Economic Area (“EEA”) to a location outside the EEA, we

will only transfer your information if an appropriate level of protection for your personal information is guaranteed, such as where we have contractual obligations to protect or transfer data with certain safeguards in place. To ensure the continued protection of your personal information while in our care, we take appropriate organizational and technical measures. In addition, we may transfer your personal information if one of the legal exceptions for such transfer can be invoked, such as with your consent or in execution of an agreement you have with us.

Children Under the Age of 16

We do not knowingly collect personal information from individuals under the age of 16, unless the personal information is submitted with verifiable parental consent. Our website, portals, and applications are not intended for anyone under the age of 16, and no one under the age of 16 may provide information on the website, portals, or applications.

Updates to the Privacy Policy

Cirrus Aircraft may update this Privacy Policy periodically as we offer new products and services, and as our business, technology, and laws change. You can determine when this Privacy Policy was last revised by referring to the “Last updated” reference above. Any changes will become effective upon posting of the revised Privacy Policy.

In addition, Cirrus Aircraft will provide notice to you if these changes are material and, where required by applicable law, we will obtain your consent. This notice will be provided by email or by posting notice of the changes on our websites and portals that link to this Privacy Policy.

Contact Us

Cirrus Design Corporation
4515 Taylor Circle
Duluth, MN 55811
Toll-Free Telephone: 1-800-279-4322
Email: privacy@cirrusaircraft.com