KVKK Privacy Notice

Template text notice

The text below is a draft prepared to complete the structure of this site. Before publication it must be reviewed by your legal counsel against the company's actual data processing operations.

1. Data controller

This notice has been prepared by Gazali Aviation, in its capacity as data controller, pursuant to the disclosure obligation set out in Article 10 of Turkish Personal Data Protection Law No. 6698 (KVKK) and within the scope of the European Union General Data Protection Regulation (GDPR).

The company operates through legal entities registered in two countries:

Türkiye: Canberk Gazali Aviation Brokerage Havacılık Ltd. Şti. — Esentepe Mah. Harman 1. Sok. Nida Kule No: 7-9, Office No: 38 — Şişli / Istanbul.
United Arab Emirates: Canberk Gazali Aviation DWC-LLC — Business Centre, Floor 3, Building A3, Business Park, Dubai South — United Arab Emirates.

Contact: [email protected] · +90 553 212 51 20 · +971 58 587 51 20

2. Personal data processed

The following data may be processed through the forms you submit via our website and through the contact you establish with us:

Identity and contact data: name and surname, e-mail address, telephone number, company name.
Request data: the service you are interested in, charter type, flight route (departure and arrival point), date, number of passengers, purpose of travel, baggage or cargo information, preferred aircraft class, message content and notes (e.g. cabin layout and catering preferences).
Aircraft sales and engine/APU request data: whether you are buying or selling, aircraft category, model, year of manufacture or budget; engine/APU unit, request type, urgency (AOG), part number, required condition, quantity and aircraft registration or serial number (MSN).
Parts and technical request data: the numbers and descriptions of the parts you add to your parts request basket, aircraft type, urgency status, and the notes and technical descriptions you add to your request.
Technical data: IP address, browser and device information, request time, the site language in which you submit a form, site usage records, server security logs, and data obtained through cookies and the measurement tools enabled on the site.

No special categories of personal data are requested in our forms. We recommend that you do not write information of this nature in free-text fields.

3. Purposes of processing

Evaluating and responding to your requests and quotations.
Carrying out brokerage and advisory services.
Conducting pre-contractual negotiations and fulfilling contractual obligations.
Fulfilling legal obligations and establishing evidence in the event of a dispute.
Ensuring the security of the website and preventing automated and malicious form submissions.
Improving service quality.

Your data is not used for sending commercial electronic messages or for marketing purposes unless you have given your explicit consent. The cookieless measurement requests that Google tags, where enabled on the site, send even without consent are explained in the Cookie Policy.

4. Legal grounds

Your personal data is processed, in accordance with Article 5/2 of the KVKK, on the legal grounds of being directly related to the conclusion or performance of a contract, the fulfillment of the data controller's legal obligation, being mandatory for the establishment, exercise or protection of a right, and the legitimate interest of the data controller; in cases other than these, it is processed on the basis of your explicit consent.

In terms of the GDPR, the corresponding legal bases are performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interest (Art. 6(1)(f)) and explicit consent (Art. 6(1)(a)).

5. Method of collecting personal data

Your personal data is collected by partly automated and non-automated means, through the contact form, the aircraft charter quotation form, the aircraft sales and engine/APU request forms and the parts request basket on our website, e-mail and telephone conversations, in-person or online meetings, and the records kept by our server, cookies and the measurement tools enabled on the site during your visit. Requests you submit through the site forms are written to our database and are forwarded as a notification to our company e-mail address. When your request reaches us through an operator, broker or supplier, only the contact information required in order to evaluate that request is obtained from the party concerned.

6. Transfer

As required by your request, your data may be shared only with the relevant operator, broker, maintenance organization, parts supplier, insurance or logistics partners — and only to the minimum extent necessary. In addition, data may be transferred to parties from which support services are received, such as server and e-mail infrastructure and accounting and legal advisory services, to be processed on our instructions and under a contractual confidentiality obligation. Where enabled on the site, the technical data required for the measurement, advertising and form security tools to work (IP address, device and browser information, the page visited and, if you have given consent, cookie identifiers) is passed to their providers Google, Meta and Cloudflare; details are set out in the Cookie Policy. Where there is an obligation arising from legislation or a duly made request, data is shared with the authorized public institutions and organizations.

Your personal data is not sold or rented, and the request and contact information you submit through our forms is not made available to third parties for advertising purposes.

7. Transfer abroad

Our company operates in Türkiye and the United Arab Emirates and works with an international network of operators, brokers and suppliers. Where the nature of your request so requires, your data may be transferred to a party abroad. Technical data passed to the measurement, advertising and security tools enabled on the site may also be processed by the providers of those tools on servers located abroad. Where a transfer abroad is involved, the provisions of the KVKK on transfer and the relevant safeguards of the GDPR — an adequacy decision, standard contractual clauses or the other cases provided for by law — are complied with, and the transfer is kept limited to the scope required by the request.

8. Retention period

Your personal data is retained for as long as the purpose of processing requires and until the limitation periods provided for in the relevant legislation expire; once the period has elapsed, it is deleted, destroyed or anonymized. A request correspondence that does not result in a conclusion, a relationship that turns into a contract, and records that must be kept for a certain period under legislation are subject to different periods.

9. Rights of the data subject

Under Article 11 of the KVKK and Articles 15-22 of the GDPR, you have the following rights:

To learn whether your personal data is processed and to request information in this regard.
To learn the purpose of processing and whether the data is used in accordance with that purpose.
To know the third parties to whom the data is transferred, in the country or abroad.
To request the correction of data that has been processed incompletely or incorrectly.
To request the deletion or destruction of the data within the framework of the conditions provided for in Article 7 of the KVKK.
To request that correction, deletion and destruction operations be notified to the third parties to whom the data has been transferred.
To object to an outcome that arises to your detriment through analysis carried out exclusively by automated systems.
To object to processing, and to request the restriction of processing and the portability of the data.
To withdraw your consent at any time in processing based on explicit consent; withdrawal does not affect the lawfulness of the processing carried out up to that point.
To request that the damage be remedied in the event that you suffer damage due to unlawful processing.

10. Application procedure

You may submit your requests concerning the above rights by e-mail to [email protected] or in writing to our Istanbul or Dubai office. Your application must include:

Name, surname and, if the application is in writing, signature,
Contact information sufficient for us to identify you (e-mail, telephone or address),
The subject of your request and, if any, the information and documents on which your request is based

Where we cannot be reasonably certain of your identity, we may request additional verification in order to protect your data. Applications are concluded as soon as possible according to the nature of the request and in any event within 30 days at the latest; if the operation additionally entails a cost, the fee in the tariff determined by the Board may be charged.

In the event that your application is rejected, that you find the response we give insufficient or that you do not receive a response within the prescribed period, your right to lodge a complaint with the Personal Data Protection Board is reserved. If you are within the scope of the GDPR, you may apply to the data protection authority of the country in which you are located.

11. Notice regarding the scope of services

Gazali Aviation provides aviation brokerage and advisory services only. It does not carry out aircraft operation, does not hold an AOC (Air Operator Certificate) and assumes no operational, safety or technical responsibility. All flights are performed under the AOC of the relevant operator. For this reason, the data controller for personal data processed by the operator in its own capacity during the performance of the flight is that operator.

12. Changes

This notice may be updated where necessary. The current version is always published on this page, and the date at the end of the page indicates the date of the last update.

Last updated: 28 September 2026