This Privacy Notice describes the data that Hopper collects about you when you use the Hopper apps, websites, and services (the “Services”), and how Hopper uses and discloses that data. This Notice also explains your rights, including your rights to request information about Hopper’s data processing, and/or deletion of your data.

First, we want you to know that Hopper is committed to protecting your privacy and your personal data and information. Hopper uses and discloses your data only to provide the Services to you, for example to book your next trip or notify you when we see a deal that you won’t want to miss, as explained in this Notice. If you have any questions about your data, you can always reach our Privacy team by emailing us at [email protected].

1. The Information Hopper Collects.

A. Information You Provide. When you create a Hopper account, you may be required to provide and verify your mobile phone number. To make travel bookings using the Hopper Services or to communicate to Hopper for other purposes, you may be required to provide additional personal information including, for example, your name, address, email, government identification or third-party rewards numbers, date of birth, gender, and payment information. You may also be required to provide this personal information for any individual(s) on whose behalf you make travel booking(s).

B. Your Device. When you use or access Hopper Services, Hopper receives information about the computers, phones, or other web-connected devices and browsers that you use. The device information Hopper receives includes attributes such as the device or browser type, operating system, hardware and software versions, display settings, language, region, location, currency, and time zone settings, mobile carrier, your IP address, and any device, operating system or advertising identifiers.

C. Your Usage and Transactions. Hopper collects information about how you use the Services, such as the flights or hotels you watch and the content you view or engage with. Hopper also retains records of the travel bookings or other product/service purchases that you make using the Services, and any interactions with Hopper’s support team.

D. Geolocation Data. Hopper receives geolocation data from your device solely for the purpose of populating search fields, such as the “origin airport” field within the flight search section of the app, or to allow you to search for nearby pickup locations within the cars search section of the app. Hopper does not retain your geolocation data. You can decline to provide geolocation data using your app settings.

E. Cookie Data: When you visit Hopper websites, Hopper uses “cookies” and/or similar identifying technology on your device(s) to collect data, including cookie IDs, settings, and usage data. Please refer to Hopper’s Cookie Statement, as part of Hopper’s Supplemental; Privacy Notice attached to this Notice, for more information.

2. How Hopper Uses Your Information.

A. To Provide, Improve and Personalize the Services. Hopper stores and uses the data it collects for the following purposes: (i) to provide and support the Services for you, including by making bookings, supporting your bookings, and notifying you about deals; (ii) to personalize the Services for you, such as by watching or suggesting trips or other products, deciding which products to offer, and administering Hopper rewards programs, discounts, and offers; (iii) to analyze and improve the Services and products, such as by marketing to you and measuring the effectiveness of our marketing; (iv) to improve products and develop new products (based on usage trends); (v) to ensure the security of the Services and prevent fraud or other illegal activity, such as by verifying the validity of an attempted booking or payment, which may also include the use of automated decision-making, for example, in relation to assessing fraudulent transactions or suspicious activity; (vi) to comply with applicable accounting, legal and regulatory requirements; and (viii) as otherwise explained to you at the time of the collection of data.

B. To Communicate with You. Hopper also uses the data you provide to communicate with you about your travel bookings, about deals on travel that you are watching or may be interested in, and/or about other Hopper products and services that we think you may be interested in. Hopper may communicate with you via in-app push notifications, email, phone, SMS, or other messaging means based on contact information that you provide. You will have the opportunity to decline to receive any marketing communications from Hopper unrelated to any booking, purchase, or support request that you make.

3. When Hopper Shares Your Information.

A. To Make Travel Bookings. When you request to make a travel booking, Hopper may share your data to third-party travel service suppliers (such as airlines, hotels, rental car providers, or insurance providers) and their data-processing partners, and/or to Hopper’s third-party travel booking partners (such as a Global Distribution System provider) only as necessary to complete your booking. Hopper’s third-party travel-booking partners (other than travel service providers) are required by Hopper to use and disclose your data only as necessary to complete your Hopper travel booking. Third-party travel service suppliers (such as airlines, hotels, rental car providers) that you select are not controlled by Hopper, and any data disclosed to them will be subject to that supplier's privacy policy and security practices. Therefore, we encourage you to review the privacy policies of any travel supplier whose products you purchase through Hopper.

B. To Vendors that Help Hopper Provide the Services. Hopper works with a number of third-party data processing partners who help us provide and improve the Services. These partners include cloud-hosting services, data analytics and processing services, communication management (support) services, technology integration partners, survey partners, and payment and fraud-prevention service providers. These third-party processing partners have access to your data only as necessary to perform their functions for Hopper, and they are not permitted to share or use your data for any other purpose. They are also required to follow the same data security practices that Hopper employs.

C. As Required by Law. Hopper may share information with law enforcement and governmental entities, or in response to legal requests, only when necessary as required by law, or in the good-faith belief that such action is required by law, such as in response to a facially valid judicial, or other governmental entity, order, subpoena or warrant. Hopper may also share information with law enforcement if we have a good-faith belief that such disclosure is necessary to detect, prevent and address fraud, unauthorized use of the Services, violations of our terms or policies, or other harmful or illegal activity.

D. For Marketing and Analytics Purposes. When you use the Hopper Services, Hopper may share your device advertising identifier (e.g., IDFA on iOS and AdID on Android) or cookie information, and information about actions you take in the app, if you have enabled these features in your device settings, with third parties for the purpose of analyzing the effectiveness of Hopper marketing activities and/or future marketing activities. You can disable, opt-out, and prevent the sharing of this information in your device or browser settings without impacting your ability to use the Services. Hopper will accept your decision to disable sharing of your device advertising identifier as your signal of an election to opt-out of sharing and limit the use and processing of your personal data, and will abide by that decision in a frictionless manner. If you permit the sharing of such information, Hopper’s third-party partners may combine information they receive from Hopper with information about you obtained from other sources.

4. Your Rights to Your Personal Information, to Opt-Out of Sharing and to Limit Processing. Hopper provides all Users, regardless of your country of residency, with rights to access (receive a copy of), rectify, and/or delete your personal information. You may also object, or withdraw consent, to future sharing or processing of your data by Hopper. You may make any such requests to Hopper by utilizing this interactive opt-out form within the Hopper mobile app, or by emailing us at [email protected] and subsequently verifying your identity as requested by Hopper. Please note that the linked opt-out form will not be effective if accessed from a web browser outside the Hopper App. Absent exceptional circumstances, there is no fee for such requests and Hopper will respond within thirty (30) days, or otherwise as required by law. Please note that certain Services that require data processing may no longer be available to you following a request for data deletion or cessation of processing, and a withdrawal of consent to processing will not prevent Hopper from continuing to process data where Hopper relies on a legal basis other than consent. If you are a resident of Canada, California (United States), the United Kingdom, or the European Union, you may have additional rights under the Personal Information Protection and Electronic Documents Act (PIPEDA), California Consumer Privacy Act of 2018 (CCPA), the UK General Data Protection Regulation (UK GDPR), and the EU General Data Protection Regulation (EU GDPR), respectively. These rights are explained in our Supplemental Privacy Notice following this notice.

5. International Data Transfer. Hopper shares information globally within the Hopper Companies (as defined in our Terms of Service), including its global subsidiaries, and to the external processing partners and third-party suppliers mentioned above. Your information may, for example, be transferred or transmitted to, or stored and processed by, Hopper group entities and/or third-party data processors located in the United States, Canada, or other countries outside of where you live, as necessary for the purposes as described in this Notice and to provide the Services to you. The laws in the countries in which your data is processed may differ from the laws in your home country. In order to protect your data during processing in any country, Hopper utilizes standard contract clauses, relies on the European Commission's adequacy decisions about certain countries, as applicable, and obtains your consent for these data transfers to the United States and other countries. By using the Services, you consent to these international data transfers.

6. Information About Minors. The Hopper Services are not intended for or directed to persons under the age of 16, and we do not knowingly collect personal information from persons under the age of 16 without obtaining parental consent. An adult making a booking on behalf of a person under the age of 16 consents to the collection and use of data about such person. If we learn that personal information has been collected on the Services from persons under 16 years of age and without verifiable consent, then we will take the appropriate steps to delete this information.

7. How Hopper Protects Your Information. Hopper employs industry standard procedures and other accepted best practices to protect the information that we collect, both during transmission and once we receive it. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. Hopper therefore cannot ensure or warrant the security of any information you transmit to us, and you do so at your own risk. If you believe your personal information has been compromised, please contact us as set forth in the "Contact Us" section below.

8. Non-Covered Privacy Practices. Please note that this Notice does not cover the privacy practices relating to the personal information of job applicants, employees and other Hopper personnel. Please refer to those separate websites for applicable privacy policies.

9. Changes to this Policy. Before we make changes to the way we collect, use, and disclose your information, we will make available a revised version of this Notice via the Services. If possible, or where required by law, we will notify you of the change and give you the opportunity to review the revised Notice before you choose to continue using the Services. By continuing to use the Services following publication of any update, you consent to the updated Notice.

10. Contact Us. If you have any questions or comments about this Notice or your personal data, or to make an access, deletion, or correction request, or to exercise any other applicable rights, you can email us at [email protected], or by mail to: Hopper, Inc., 5795 Avenue de Gaspe, Montreal, Quebec, H2S 2X3, Canada.

Supplemental Privacy Notice for Residents of Canada, California (U.S.), and the European Union

This Supplemental Privacy Notice (“Notice”) supplements Hopper’s Privacy Notice and explains: (1) how Hopper collects and uses Personal Information with specific reference to the requirements of the Personal Information Protection and Electronic Documents Act (PIPEDA), California Consumer Privacy Act of 2018 (CCPA), UK General Data Protection Regulation (UK GDPR), and EU General Data Protection Regulation (EU GDPR); and; (2) your rights under each of these laws and regulations.

1. Definition of "Personal Information" Hopper uses the Personal Information that it collects from you in accordance with our Privacy Notice, and otherwise in accordance with PIPEDA, CCPA, UK GDPR and EU GDPR. Hopper does not sell your Personal Information. The term “Personal Information,” for purposes of each of the above-referenced Laws, means:

2. Data Controllers The following Hopper group entities act as the Controller for data collected from you in each of the following jurisdictions:

3. Categories of Information Collected, Used, Shared. The table below summarizes the categories of Personal Information Hopper may have collected about you over the past 12 months, depending on how you use our Services, as well as how we use it and with whom we may have shared it:

4. Sources of Information Hopper receives Personal Information from you, including information that you provide or from your usage of the Services, and from your device(s). This collection of data is explained in our Privacy Notice. The categories of sources from which we’ve collected or received Personal Information include:

5. Lawful Bases for Processing Hopper collects, uses, processes and discloses personal information based on: (i) the need to process data to carry out Hopper’s contractual obligations to you and/or Hopper’s legal obligations; (ii) your consent, for the uses and purposes set forth in Hopper’s Privacy Notice and/or as explained at the time of the data collection; and/or (iii) based on Hopper’s legitimate interest in delivering, improving, and providing the Services, consistent with the purposes for which you provided the data to Hopper, where such interest is not overridden by your rights. Hopper will store personal information for an indefinite period of time as necessary to continue to provide the Services to you.

If Hopper collects and uses your personal information in reliance on its legitimate interests (or the legitimate interests of any third-party), this interest will typically be to operate or improve the Hopper platform and communicate with you as necessary to provide services to you, for security verification purposes when you contact Hopper, to respond to your queries, undertaking marketing, or for the purposes of potentially detecting or preventing illegal activities.

Hopper may in some cases use automated decision-making, for example, in relation to assessing fraudulent transactions or suspicious activity in the Hopper app or on the Hopper site. As part of this processing, automated decisions may be made by putting your personal information into a system and the decision is calculated using automatic processes. If you pose a fraud risk, this may affect your ability to book on Hopper. You may have rights in relation to automated decision making, including the ability to request a manual decision-making process instead or contest a decision based solely on automated processing. If you want to know more about your data protection rights, please contact Hopper by emailing [email protected].

6. Consumer Rights - California Residents If you are a California Resident, you have the following rights under the CCPA:

• Right to Access: You have the right to request that Hopper disclose to you the Personal Information that we collect, use, or disclose, and information about our data practices;

• Right to Request Deletion: You have the right to request that Hopper delete your Personal Information that we have collected from you; and

• Right to Non-Discrimination: Hopper will not discriminate against you for exercising any of these rights by either: (a) denying goods or services; (b) charging different prices or rates for goods or services, including through discounts; or (c) providing a different level or quality of goods or services. Please note that deletion of data necessary to the Services (such as bookings and transactions) will make these Services unavailable to you.

• Right to Opt-Out of Data Sharing. Hopper’s collection and use of data for some marketing purposes, as described in the Privacy Notice and this Supplement, may be considered by the California Attorney General and/or California Privacy Protection Agency to be the “sharing” or “sale” of data, as those terms are used in the CCPA, CPRA, and implementing regulations. You have the right to opt-out of such use of data by Hopper by: (i) disabling your device advertising identifier (IDFA for iOS or AdID for Android), which Hopper will accept and implement in a frictionless manner as a signal of your intent to opt-out; (ii) by utilizing this Interactive Form from within the Hopper mobile app; and/or (iii) emailing Hopper at [email protected].

7. Consumer Rights - Canada Residents If you are a resident of Canada, you have the right under PIPEDA to request from Hopper:

• information about the existence, use, and disclosure of your personal information;

• a copy of such information; and

• an account of the use that has been made or is being made of this information and an account of the third parties to which it has been disclosed.

8. Consumer Rights - United Kingdom and European Union Residents If you are a resident of the United Kingdom or European Union, you have the following rights under UK GDPR or EU GDPR:

• Right to Access: You have the right to request that Hopper disclose to you the Personal Information that we collect, use, or disclose, and information about our data practices;

• Right to Request Deletion: You have the right to request that Hopper delete your Personal Information that we have collected from you;

• Right to Rectify: You have the right to request that Hopper correct any of your Personal Information used or stored by Hopper;

• Right to Data Portability: You have the right to request the export of electronic data in a reasonable usable form;

• Right to Withdraw Consent, and/or Object to or Restrict Processing: You have the right to request that Hopper cease or restrict its processing of your personal information, in certain circumstances, including where Hopper’s processing is based on its legitimate interests rather than your consent.

You also have the right to lodge a complaint about Hopper’s data practices with a supervisory authority. For more information, you can visit the European Commission's page on Data Protection.

9. Exercising Consumer Rights You may exercise your rights and make requests for information or deletion by emailing us as [email protected]. Please note that to protect your information and the integrity of our Products, we may need to verify your identity before processing your request. In some cases we may need to collect additional information to verify your identity, such as a government issued ID.

10. Cookie Statement “Cookies” are small pieces of text sent as files to your computer or mobile device when you visit most websites. When you use the Services, cookies may be delivered by Hopper (“first-party” cookies) or delivered by a third-party provider (“third-party” cookies). Cookies are either session cookies or persistent cookies. Session cookies enable Hopper to recognize and link the actions you take during a single browsing session. Persistent cookies enable Hopper to recognize you as an existing user, and these cookies are stored on your system or device until they expire, or until you delete them. Hopper also may use other technologies similar to Cookies, including (and all are referred to as “Cookies”):

• Pixels are small objects embedded into a web page that are not visible to the user. We use pixels to deliver cookies to your computer, facilitate the log-in process, monitor the activity on our sites, and deliver online advertising.

• Tags are small pieces of HTML code that tell your browser to request certain content generated by an ad server. We use tags to show you relevant advertising and promotions.

• Scripts are pieces of JavaScript code that launch automatically when certain webpages load, to determine whether users view associated advertisements.

• Local Storage Objects, such as HTML 5, are used to store content and preferences. Third-parties with whom we partner to provide certain features on our site to display advertising based upon your web browsing activity use Local Storage Objects to collect and store information.

Types of Information Collected Using Cookies. As explained in Hopper’s Privacy Notice, the types of information that we collect through cookies include: IP address; Device ID; Viewed pages; Browser type; Browsing information; Operating system; Internet Service Provider; Whether you have responded to, or interacted with, an advertisement; Referring or referred links or URLs; and Features used and activities engaged in on our sites and in our apps.

How we use Data Collected Using Cookies. Hopper uses Cookies on the Hopper website for a number of reasons, including to: (i) Help us improve your experience when visiting our sites; (ii) Fulfill transactions and ensure our sites perform as intended; (iii) Remember your preferences, such as language, region, or currency; (iv) Provide you with relevant advertising and analyze performance of the ads; (v) Enable you to return to previous travel searches; (vi) Identify errors on our sites; (vii) Help with data protection and potentially detect and investigate malicious or fraudulent activity; (viii) Help us understand traffic to our site, including time and date of the visit, time and date of the last visit, and other information; and (ix) Analyze how well our sites are performing.

Types and Functions of Cookies.

Essential Cookies. Certain cookies are required or “essential” for our sites to function as intended. Essential cookies are necessary for you to navigate our site and use certain features like logging in to your account and managing your bookings. These cookies are also used to remember security settings that allow access to particular content. Lastly, we use essential cookies to collect information on which web pages visitors go to most, so we can improve our online services. You are not able to opt out of essential cookies.

Functional Cookies. We want to make sure when you visit our site, your preferences (such as your preferred language), settings, and previous searches are remembered. Functional cookies enhance your experience on any Hopper site.

Analytics Cookies. We use analytics cookies to understand our site’s performance and how it is used, including the number of visitors, how long you stay on the site, and which parts of the site you visit. We can see details about how visitors interact with the sites, like the number of clicks visitors made on a given page, their mouse movements and scrolling activity, the search words visitors used, and the text visitors enter into various fields. We also use Analytics Cookies to test different designs and features for our site, determine effectiveness of our advertising, and to improve our services, including your experience on our site., For analytics, our third-party service providers may use cookies to perform their services and may combine the information that they collect about you on our sites with other information that they have collected. This Cookie Statement does not cover such third-parties’ use of your information.

Advertising Cookies. Hopper and our third-party advertising partners may use advertising cookies to show you advertisements both on and off our sites that are based on your interests. We may allow third-parties to collect information about your online activities through cookies to perform their services and may combine the information that they collect about you on our sites with other information that they have collected. These third-parties include business partners who collect information when you view or interact with one of (1) their advertisements on our sites or (2) our advertising or booking information on their sites and advertising networks, which collect information about your interests when you view or interact with one of the advertisements or tracking mechanisms they place on many different sites on the Internet. Our partners may make assumptions about your interests, characteristics, or preferences and add you to groups based on those assumptions in order to show you tailored advertisements. Hopper does not have access to the cookies these third-parties may use to collect information about your interests, and the information practices of these third-parties are not covered by this Cookie Statement or our above Privacy Notice.

Manage your Cookies. You can set or amend your web browser controls to accept or refuse cookies whenever you like, but please remember if you do choose to reject cookies, your access to some of the functionality and areas of our site may be restricted.

Do-Not-Track Signals and Similar Mechanisms. Some web browsers may transmit "do-not-track" or Global Privacy Control (GPC) signals to sites with which the browser communicates. Because of differences in how web browsers incorporate and activate this feature, it is not always clear whether web users intend for these signals to be transmitted, or whether users are even aware of them. Hopper is evaluating the use of opt out signals received by its website. Hopper currently does take action to such signals within the Hopper mobile app by recognizing a user's decision to block the sharing of a device IDFA (iOS) and/or AdID (Android) as a signal of the user's intent to opt-out of the sharing of data for certain marketing purposes and to limit the processing of data as set forth above in this Privacy Notice.

Effective Date of this Notice: February 21, 2022 (Version 1.4)