Privacy Policy

1. Personal Information We Collect

The personal information we collect depends on how you interact with us. We collect personal information in three ways: directly from you, automatically when you use the Site, and from third-party sources.

1.1 Information You Provide Directly

• Contact and identity information, such as your name, email address, phone number, mailing address, job title, employer or organization, and country of residence or citizenship where relevant to export control screening.
• Communications, including the contents of messages you send us through contact forms, email, or other channels, and any information you choose to include.
• Business relationship information, such as information provided when you request a briefing or demonstration, register for an event, execute a non-disclosure agreement, respond to a request for proposal, or engage with us as a supplier, partner, or customer representative.
• Recruiting information, such as your résumé or CV, cover letter, employment history, education, certifications, security clearance status or eligibility, work authorization and citizenship status (where permitted or required by law, including for positions subject to U.S. export control laws), references, and any other information you provide during the application process.
• Event information, such as registration details, dietary restrictions, and badge or credentialing information for facility visits, which may include government-issued identification details where required for site access.

1.2 Information Collected Automatically

When you visit the Site, we and our service providers automatically collect certain technical information, including:

• Device and browser information, such as IP address, browser type and version, operating system, device type, screen resolution, and language preferences.
• Usage information, such as the pages you view, the links you click, the date and time of your visit, time spent on pages, referring and exit URLs, and general interaction patterns.
• Approximate location information derived from your IP address (city or region level; we do not collect precise geolocation from the Site).
• Cookie and tracking data, as described in Section 4 below.

1.3 Information from Third Parties

We may receive personal information about you from third parties, including:

• Recruiting sources, such as recruiting platforms, professional networking sites (e.g., LinkedIn), staffing agencies, references, and background check providers (where permitted by law and with any required consent).
• Business partners and customers, such as when a partner, prime contractor, or government customer identifies you as a point of contact.
• Publicly available sources, such as public government records, professional directories, corporate websites, and press coverage.
• Service providers, such as analytics providers, event organizers, and lead-generation or sales-intelligence services.

We may combine information collected from different sources for the purposes described in this Privacy Policy.

2. How We Use Personal Information

We use personal information for the following purposes:

• Business communications. To respond to inquiries; provide information about our products, capabilities, and programs; schedule and conduct briefings and demonstrations; and manage relationships with customers, suppliers, partners, and prospective partners.
• Site operations. To operate, maintain, secure, and improve the Site; diagnose technical issues; and ensure the Site functions properly across devices and browsers.
• Analytics and improvement. To understand how visitors use the Site, measure the effectiveness of our content, and improve our communications and Services.
• Recruiting and hiring. To evaluate candidates, verify qualifications and eligibility (including work authorization, citizenship, and clearance eligibility where legally relevant to the position), conduct interviews and assessments, perform background checks where permitted by law, and communicate about opportunities.
• Events and facility access. To register attendees, manage event logistics, and credential visitors to our facilities, including compliance with physical security and visitor-control requirements.
• Security and integrity. To protect the security and integrity of our Site, systems, facilities, personnel, and information; to detect, investigate, and prevent fraud, unauthorized access, and other malicious, deceptive, or illegal activity; and to conduct insider-risk and counterintelligence-related screening where permitted or required by law and applicable government requirements.
• Legal and regulatory compliance. To comply with applicable laws, regulations, and legal processes, including U.S. export control laws (the International Traffic in Arms Regulations, 22 C.F.R. Parts 120–130 ("ITAR"), and the Export Administration Regulations, 15 C.F.R. Parts 730–774 ("EAR")), economic sanctions administered by the U.S. Department of the Treasury's Office of Foreign Assets Control ("OFAC"), government contracting requirements, national security requirements, anti-corruption laws, and tax and accounting obligations. This may include screening individuals against restricted-party and sanctions lists and verifying nationality or citizenship where required to determine export licensing obligations.
• Corporate transactions. In connection with an actual or contemplated merger, acquisition, financing, reorganization, or sale of all or a portion of our business or assets.
• Enforcement of rights. To enforce our agreements and terms, and to establish, exercise, or defend legal claims.

We do not use personal information collected through the Site for automated decision-making that produces legal or similarly significant effects about you.

3. Legal Bases for Processing (EEA, UK, and Similar Jurisdictions)

Where the EU General Data Protection Regulation ("GDPR"), the UK GDPR, or similar laws apply, we process personal information on the following legal bases:

• Legitimate interests (Art. 6(1)(f)): operating and securing the Site; communicating with business contacts; marketing our capabilities to organizations; protecting our personnel, facilities, and information; and improving our Services, in each case where our interests are not overridden by your rights and freedoms.
• Performance of a contract or pre-contractual steps (Art. 6(1)(b)): processing applications for employment, managing supplier and partner relationships, and responding to your requests.
• Legal obligation (Art. 6(1)(c)): compliance with export control, sanctions, government contracting, employment, tax, and other applicable legal requirements.
• Consent (Art. 6(1)(a)): where required, such as for certain cookies or direct marketing; you may withdraw consent at any time without affecting the lawfulness of prior processing.

Where we process special categories of personal data or data relating to nationality or citizenship for export control or security purposes, we do so only where permitted by applicable law, including where processing is necessary for reasons of substantial public interest under applicable member state or UK law.

4. Cookies and Similar Technologies

We and our service providers use cookies, pixels, local storage, and similar technologies on the Site to:

• Enable essential functionality, such as security, load balancing, and remembering your preferences (strictly necessary cookies);
• Measure and analyze usage, such as through analytics services that help us understand aggregate visitor behavior (analytics cookies); and
• Improve performance, such as content delivery and caching (performance cookies).

The Site does not use third-party advertising cookies, and we do not serve targeted advertising.

You can control cookies through your browser settings, including by blocking or deleting cookies. Where required by law, we will request your consent before setting non-essential cookies and provide a mechanism to manage your preferences. Disabling cookies may affect certain features of the Site.

Do Not Track. Some browsers transmit "Do Not Track" (DNT) signals. Because there is no common standard for interpreting DNT signals, the Site does not currently respond to them. Where legally required, we treat recognized opt-out preference signals (such as the Global Privacy Control) as a valid request to opt out of any applicable sharing.

5. How We Disclose Personal Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We may disclose personal information in the following circumstances:

• Service providers. We share personal information with vendors and service providers that perform services on our behalf, such as website hosting, cloud infrastructure, analytics, communications, event management, applicant tracking, background screening, and IT and security services. These providers are contractually required to protect personal information and use it only for the purposes for which it was disclosed.
• Affiliates. We may share personal information with our subsidiaries and affiliated entities for purposes consistent with this Privacy Policy.
• Government authorities and legal process. We may disclose personal information to government authorities, regulators, courts, or other parties where required by law, regulation, subpoena, court order, or other legal process; to comply with national security or law enforcement requirements; or in connection with export control, sanctions, or government contracting compliance obligations.
• Customers and partners. In the ordinary course of business, we may disclose business contact information to customers, prime contractors, subcontractors, or teaming partners, for example, identifying program points of contact.
• Professional advisors. We may disclose personal information to lawyers, auditors, accountants, insurers, and other professional advisors in connection with the services they provide to us.
• Protection of rights and safety. We may disclose personal information where we believe it is necessary to protect the rights, property, or safety of Astreia, our personnel, our customers, or others, including to detect and prevent fraud or security threats.
• Corporate transactions. We may disclose or transfer personal information in connection with a merger, acquisition, financing, due diligence, reorganization, bankruptcy, or sale of all or a portion of our business or assets. Any successor will be bound by obligations consistent with this Privacy Policy.

6. International Data Transfers

Astreia is headquartered in the United States, and personal information we collect is processed and stored in the United States and in other countries where we or our service providers operate. These countries may have data protection laws that differ from those of your jurisdiction.

Where we transfer personal information from the European Economic Area, the United Kingdom, Switzerland, Brazil, or other jurisdictions with data transfer restrictions, we implement appropriate safeguards as required by applicable law, such as the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), together with supplementary measures where appropriate. You may contact us as described in Section 13 for more information about the safeguards we use.

7. Data Retention

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. In determining retention periods, we consider:

• the nature and sensitivity of the information;
• the purposes for which it was collected and whether those purposes can be achieved by other means;
• legal, regulatory, contractual, and government-contracting record-keeping requirements, including export control and audit obligations, which may require extended retention; and
• applicable statutes of limitations and the need to preserve information for actual or anticipated legal proceedings.

When personal information is no longer needed, we delete it, de-identify it, or securely archive it in accordance with our retention schedules and applicable law.

8. Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures are informed by the sensitivity of the information and the security requirements applicable to our industry, and include access controls, encryption in transit, network monitoring, personnel security practices, and vendor security requirements.

However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the confidentiality of any credentials associated with your interactions with us and for using appropriate care when transmitting information to us.

9. Your Privacy Rights

Depending on your jurisdiction, you may have some or all of the following rights with respect to your personal information, subject to applicable legal limitations and exemptions:

• Access / to know: request confirmation of whether we process your personal information and a copy of it;
• Correction: request correction of inaccurate or incomplete personal information;
• Deletion: request deletion of your personal information;
• Restriction / objection: request that we restrict processing, or object to processing based on legitimate interests or for direct marketing;
• Portability: request a copy of certain personal information in a structured, commonly used, machine-readable format;
• Withdraw consent: where processing is based on consent, withdraw it at any time; and
• Non-discrimination: not receive discriminatory treatment for exercising your rights.

To exercise any of these rights, contact us as described in Section 13. We will verify your identity before responding, which may require you to provide additional information. You may designate an authorized agent to make a request on your behalf, in which case we may require proof of authorization and verification of your identity. If we decline a request, we will explain the basis for our decision, and you may have the right to appeal by contacting us again with the subject line "Privacy Request Appeal."

Please note that certain information may be exempt from these rights under applicable law, for example, where retention or processing is required by U.S. export control, national security, or government contracting requirements, or where the information is subject to legal privilege.

9.1 European Economic Area, United Kingdom, and Switzerland

If you are located in the EEA, UK, or Switzerland, you have the rights described above under the GDPR, UK GDPR, or Swiss FADP, as applicable. You also have the right to lodge a complaint with your local supervisory authority, in the EEA, the data protection authority of your member state; in the UK, the Information Commissioner's Office (ICO); and in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC). We would appreciate the opportunity to address your concerns before you approach a supervisory authority, so please contact us first.

9.2 California Residents

This section supplements this Privacy Policy for California residents and applies to the extent the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), applies to our processing.

In the preceding 12 months, we have collected the following categories of personal information as described in Section 1: identifiers (e.g., name, email, IP address); professional or employment-related information (e.g., employer, job title, application materials); internet or other electronic network activity information (e.g., browsing and usage data); geolocation data (approximate, IP-derived); sensory information (e.g., call or meeting recordings, where notice is given); inferences drawn from usage data; and, in limited recruiting and compliance contexts, characteristics of protected classifications (e.g., citizenship, where relevant to export control screening) and other sensitive personal information (e.g., government identifiers for facility access, clearance status). We collect these categories from the sources described in Section 1, use them for the purposes described in Section 2, and disclose them for business purposes to the categories of recipients described in Section 5.

We do not sell personal information and have not sold personal information in the preceding 12 months. We do not share personal information for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than those permitted under Cal. Civ. Code § 1798.121(a) and its implementing regulations (e.g., performing services, security, legal compliance), and therefore do not offer a right to limit.

California residents have the rights to know, access, correct, delete, and port their personal information, and the right to non-discrimination, each as described above. You may submit requests by emailing contact@astreia.space with the subject line "California Privacy Request."

9.3 Other Jurisdictions

Residents of other U.S. states (including Virginia, Colorado, Connecticut, Texas, and others with comprehensive privacy laws) and other countries may have similar rights under applicable law. We will honor rights requests as required by the law applicable to you.

10. Job Applicants

If you apply for a position with Astreia, we process your application information for recruiting purposes as described in Section 2. Please note:

• Many Astreia positions involve access to technical data controlled under ITAR or EAR. For such positions, we are required to determine whether an export license would be needed to employ you, which requires us to collect and verify information about your citizenship, nationality, and immigration status. This information is used solely for export compliance and, where applicable, security clearance processing, and is handled in accordance with applicable anti-discrimination laws.
• Where permitted by law and with any required notice or consent, we may conduct background checks and verify information you provide with references, prior employers, and educational institutions.
• We may retain application information for a reasonable period to consider you for future opportunities and to comply with legal record-keeping requirements, unless you request deletion and no legal basis requires retention.

11. Children's Privacy

The Site and our Services are intended for business audiences and are not directed to children under the age of 16 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will take steps to delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or business operations. The revised version will be posted on this page with an updated "Last updated" date, and, where required by law, we will provide additional notice or obtain consent. Your continued use of the Site after any changes become effective constitutes your acknowledgment of the updated policy. We encourage you to review this page periodically.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Astreia Space Corporation
Attn: Privacy
Email: contact@astreia.space

For requests relating to your privacy rights, please include your name, the nature of your request, and your jurisdiction so that we can respond appropriately.