Customer Privacy Notice

1. Data controller and scope of this notice

This privacy notice has been prepared by Gazali Aviation in its capacity as data controller, within the scope of Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR).

• Türkiye: Canberk Gazali Aviation Brokerage Havacılık Ltd. Şti. — Esentepe Mah. Harman 1. Sok. Nida Kule No: 7-9, Office No: 38 — Şişli / Istanbul.
• United Arab Emirates: Canberk Gazali Aviation DWC-LLC — Business Centre, Floor 3, Building A3, Business Park, Dubai South — United Arab Emirates.

This notice covers natural persons whose data is processed in the capacity of customer, customer officer, agent or contact person in the course of aircraft and helicopter sale and purchase, leasing and charter, spare parts and engine and APU supply and aviation consultancy processes. Where we work with a corporate customer, the data of the employees and officers notified to us by that organization also falls within the scope of this notice.

Contact: [email protected] · +90 553 212 51 20 · +971 58 587 51 20

2. Personal data processed

• Identity and contact data: full name, title, company represented, e-mail address, telephone number; at the contract stage, the identity and authorization document information required to establish signing authority.
• Flight request data: charter type (private jet, passenger aircraft, cargo aircraft, long-term / ACMI), trip type, departure and arrival point (for long-term charter, the home base and main route), outbound and return or start date, number of passengers, purpose of travel, baggage or cargo information, preferred aircraft class and the notes you add to your request (e.g. cabin layout and catering preferences).
• Aircraft, engine/APU and parts request data: whether you are buying or selling, the aircraft category, type and configuration of interest, year of manufacture, budget range and the listing you are interested in; the engine/APU unit, request type (purchase, exchange, overhaul), quantity and aircraft registration or serial number (MSN); part number and condition, urgency (AOG) information, delivery location and technical notes.
• Contract and transaction data: quotation and contract correspondence, letters of intent, non-disclosure agreements, delivery and acceptance records, dispute and claim records.
• Payment and financial process data: invoice information, tax number, bank account and wire/EFT references, payment status. No payment is collected through our website; card information is not collected through the site at any stage.
• Compliance and screening data: the documents requested within the scope of know your customer (KYC), information on the ultimate beneficial owner and on the authority to represent, sanctions and export control screening results.
• Communication records: e-mail correspondence, meeting notes and request history.

If you need to provide passenger information for a flight request, that information is kept limited to the minimum scope required to convey the request to the operator. Passports, visas and similar travel documents are not routinely requested by our company; where the operation requires it, such documents are shared directly with the relevant operator.

3. Method of collecting the data

Your personal data is collected by partly automated and non-automated means, through the contact form, the aircraft charter quotation form, the aircraft sales and engine/APU request forms and the parts request basket on our website, e-mail and telephone conversations, face-to-face or online meetings, and the contracts and documents signed. Requests you submit through the site forms are written, together with the site language in which you submitted the form, your IP address and browser information, to our database, and are forwarded as a notification to our company e-mail address.

Your data may also be obtained from the broker, operator, owner or supplier conveying the request, from the organization you represent, and, within the scope of compliance checks, from publicly available sources and sanctions lists.

4. Purposes of processing

• Receiving your request, researching a suitable aircraft, operator, part or supplier and preparing a quotation.
• Carrying out the brokerage and consultancy service; coordinating the negotiations, the contract process and the delivery stage.
• Planning the flight, supply or delivery organization together with the relevant operator, supplier and logistics party.
• Issuing invoices, following up collections and keeping accounting records.
• Fulfilling the obligations arising from aviation, commercial, tax, export control and anti-financial-crime legislation; carrying out know your customer and sanctions screening checks.
• Establishing evidence in the event of a dispute and pursuing legal claims.
• Improving service quality and auditing internal processes.

Commercial electronic messages are not sent without your explicit consent; notifications within the scope of an existing commercial relationship are outside this, and you may opt out of those messages at any time.

5. Legal grounds

Your personal data is processed pursuant to Article 5/2 of the KVKK on the legal grounds that it is directly related to the conclusion or performance of a contract, that the data controller is fulfilling a legal obligation, that it is mandatory for the establishment, exercise or protection of a right, and that it serves the legitimate interest of the data controller; in cases other than these, it is processed on the basis of your explicit consent. Under the GDPR, the grounds are performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interest (Art. 6(1)(f)) and explicit consent (Art. 6(1)(a)).

6. Know your customer (KYC) and sanctions screening

In the aviation sector, sale and purchase, leasing and parts supply transactions are subject to international sanctions regimes, export control rules and anti-financial-crime legislation. For this reason, depending on the nature of the transaction, identity and authorization documents, trade registry records, an ultimate beneficial owner (UBO) declaration and information on the source of funds may be requested from you or from the organization you represent; the parties may be screened against national and international sanctions lists and export restriction records.

These checks are mandatory for us to be able to carry out the transaction lawfully, and they are not an assessment targeting you but a compliance check arising from legislation. Should the checks not be completed or result unfavorably, we reserve the right not to proceed with the transaction. Screening records are retained for the period prescribed by legislation.

7. Transfer

As required by your request and by the contract, your data may be shared, only to the minimum extent necessary, with the following parties:

• Operators and owners: the AOC-holding operator that will perform the flight, and the owner or operator of the aircraft.
• Broker and agent network: the brokers and agencies representing the counterparty.
• Suppliers and technical parties: parts suppliers, approved maintenance organizations, inspection and appraisal experts.
• Logistics and customs parties: organizations providing transport, warehousing and customs brokerage services.
• Insurance and finance parties: insurance companies and brokers, banks and payment institutions and, where necessary, escrow service providers.
• Advisors: our legal, accounting and tax advisors and our server and e-mail infrastructure providers; these parties process the data only on our instructions and under a contractual confidentiality obligation.
• Competent authorities: public institutions and organizations and judicial authorities, where there is an obligation arising from legislation or a duly made request.

Your personal data is not sold, rented out or made available to third parties for advertising purposes. At your request, discussions are conducted under a signed non-disclosure agreement.

8. Transfer abroad

Our activity is international by nature: our company has offices in İstanbul and Dubai and the counterparty is most often resident in another country. For this reason, while your request is being assessed and the transaction is being carried out, it may be necessary to transfer your data to operators, brokers, suppliers, insurers or advisors located abroad.

Transfers abroad are made in accordance with the provisions of the KVKK on transfer and with the appropriate safeguards of the GDPR — an adequacy decision, standard contractual clauses or the other cases provided for by law — and only to the extent limited to what the transaction requires.

9. Retention period

Your personal data is retained for as long as the purpose of processing requires and until the limitation and retention periods prescribed by the relevant legislation expire; once the period has elapsed, it is deleted, destroyed or anonymized. Quotation correspondence that does not turn into a contract, a signed contract, financial records and compliance check documents are subject to different periods. You can learn the retention period of a specific record by writing to [email protected].

10. If you provide data belonging to another person

If you provide us with the data of a passenger, of an employee of yours or of another third party, it is your responsibility to inform those persons that their data has been shared with us and will be processed within the scope explained in this notice, and to provide the necessary legal basis. We ask you to forward this notice to the persons concerned and to share with us only the minimum information the request requires.

11. Your rights

Under Article 11 of the KVKK and Articles 15-22 of the GDPR, you have the following rights:

• To learn whether your personal data is processed and to request information in this regard.
• To learn the purpose of processing and whether the data is used in accordance with that purpose.
• To know the third parties to whom the data is transferred domestically or abroad.
• To request the correction of data processed incompletely or inaccurately.
• To request the deletion or destruction of the data and the notification of this action to the third parties to whom it was transferred.
• To object to processing and to request the restriction of processing and the portability of the data.
• To withdraw your consent where processing is based on explicit consent; withdrawal does not affect the lawfulness of the processing carried out up to that point.
• To claim compensation for the damage if you suffer damage due to unlawful processing.

In respect of records covered by the retention and compliance obligations arising from legislation, deletion requests may be met only to the extent limited by the obligation; in such a case the reason is notified to you in writing.

12. Application procedure

You may submit your requests by e-mail to [email protected] or in writing to our İstanbul or Dubai office. In your application, state clearly the information sufficient for us to verify your identity and the subject of your request. Applications are concluded within 30 days at the latest. If you find the response inadequate or do not receive a response within the time limit, you reserve the right to apply to the Turkish Personal Data Protection Board or, if you fall within the scope of the GDPR, to the data protection authority of the country in which you are located.

13. Notice on the scope of service

Gazali Aviation provides aviation brokerage and consultancy services only. It does not carry out aircraft operation, does not hold an AOC (Air Operator Certificate) and assumes no operational, safety or technical responsibility. All flights are performed under the AOC of the relevant operator.

The consequence of this in terms of data protection is as follows: in respect of the data processed by the operator under its own obligations during the performance of the flight (passenger manifest, travel documents, safety and security records), the data controller is the relevant operator. You may request information about the processing of that data directly from the operator. The commercial and legal consequences of the scope of service are explained in detail in the Terms of Use.

14. Changes

This notice may be updated when necessary. The current version is always published on this page and the date at the end of the page shows the date of the last update.

Last updated: 28 September 2026