Privacy Policy | Gazali Aviation

Template text notice

The text below is a draft prepared to complete the structure of this site. Before publication it must be reviewed by your legal counsel against the company's actual data processing operations.

1. Scope of this policy

This Privacy Policy explains the extent to which Gazali Aviation collects your personal data through its website at gazaliaviation.com and during communication established via this site, the purposes for which it processes that data, with whom it shares it, how long it retains it, and your rights over that data.

The policy covers everyone who visits the site, persons who fill in the contact and request forms, operator and supplier representatives who submit parts requests, and company users with access to the administration panel. Separate disclosure notices prepared for specific processes supplement this policy; in the event of a conflict, the notice specific to the relevant process applies:

KVKK Disclosure Notice — general disclosure under Article 10 of Law No. 6698.
Customer Disclosure Notice — aircraft sale and purchase, leasing, and engine/APU and parts supply processes.
Cookie Policy — cookies and browser local storage.

2. Data controller and contact

This policy has been prepared by Gazali Aviation in its capacity as data controller under Turkish Personal Data Protection Law No. 6698 (KVKK) and the European Union General Data Protection Regulation (GDPR). The company operates through legal entities registered in two countries:

Türkiye: Canberk Gazali Aviation Brokerage Havacılık Ltd. Şti. — Esentepe Mah. Harman 1. Sok. Nida Kule No: 7-9, Office No: 38 — Şişli / Istanbul.
United Arab Emirates: Canberk Gazali Aviation DWC-LLC — Business Centre, Floor 3, Building A3, Business Park, Dubai South — United Arab Emirates.

Contact: [email protected] · +90 553 212 51 20 · +971 58 587 51 20

3. Personal data processed

The following data may be processed through the site and in the course of the communication you establish with us:

Identity and contact data: full name, e-mail address, telephone number, company name.
Request data: the service you are interested in, charter type, trip type (one way or round trip), departure and arrival point (the code, name, city and country of the airport you select from the list, or the place name you type yourself), outbound and return date, number of passengers, purpose of travel, baggage or cargo information, preferred aircraft class, and the message and notes you write as free text (e.g. cabin layout and catering preferences).
Aircraft sales and engine/APU request data: whether you are buying or selling, aircraft category, model, year of manufacture or budget, and the listing you are interested in; for engine/APU requests, the unit type, request type (purchase, exchange, overhaul), urgency (AOG), model, part number (P/N), required condition, quantity and aircraft registration or serial number (MSN).
Parts and technical request data: the numbers and descriptions of the parts you add to your parts request basket, the aircraft type you are interested in, urgency status, and the notes and technical descriptions you add to your request.
Technical data: IP address, browser and device information, request time, the site language in which you submit a form, server and security logs, site usage records, and data obtained through the cookies and measurement tools described in Section 7.
Account data: for company users with access to the administration panel only, full name, e-mail address, telephone number and profile photo where provided, authorization level, and session, sign-in attempt (with IP address and browser information) and transaction records.

Our forms do not request special categories of personal data (health, biometrics, religion, membership and similar). We recommend that you do not write information of this nature into free text fields; if you do, such data is processed solely in order to meet the requirements of your request.

4. Method of collection

Directly from you: the contact form, the aircraft charter quotation form, the aircraft sales request form, the engine and APU request form, the parts request basket, e-mail and telephone conversations, face-to-face or online meetings.
Automatically: the access and security records kept by our server when you visit the site, the strictly necessary cookies, and the measurement, advertising and security tools described in Section 7.
From business partners: where your request reaches us through an operator, broker or supplier, only the contact details required in order to assess that request.

Requests you submit through the site forms are written, together with the site language in which you submitted the form, your IP address and browser information, to our database, and are also forwarded as a notification to our company e-mail address. The text you type into the parts and airport search boxes is used only to retrieve results and suggestions; it is not recorded separately for this purpose.

5. Purposes of processing

Assessing and responding to your requests and quotation enquiries.
Carrying out aircraft sale and purchase, leasing and charter, parts and engine/APU supply and aviation consultancy services.
Conducting pre-contractual negotiations and performing contractual obligations.
Complying with legal obligations and establishing evidence in the event of a dispute.
Ensuring the security of the site and the administration panel and preventing misuse and automated form submissions.
Improving service quality and auditing internal processes.

Your data is not used for marketing purposes unless you have given your explicit consent; the cookieless measurement requests that Google tags, where enabled on the site, send even without consent are explained in Section 7. No profiling or decision mechanism based solely on automated processing and producing legal effects concerning you is applied.

6. Legal grounds

Your personal data is processed on the legal grounds set out in Article 5/2 of the KVKK — being directly related to the conclusion or performance of a contract, compliance with a legal obligation of the data controller, the establishment and protection of a right, and the legitimate interest of the data controller — and, in cases falling outside these, on the basis of your explicit consent. Under the GDPR, the corresponding legal bases are performance of a contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)), legitimate interest (Art. 6(1)(f)) and explicit consent (Art. 6(1)(a)).

7. Cookies and browser local storage

Our site uses three first-party cookies that are strictly necessary for it to work: gaSID, to maintain the session (for administration panel users, also the panel session) and the form security token; OtrmID, written only when "Keep me signed in" is selected at the administration panel sign-in, to remember that device; and ga_cerez, to record your cookie preference. Analytics and marketing cookies are used only if you allow the relevant category in the cookie notice or in the cookie settings; you can change or withdraw your preference at any time.

Google Tag Manager, Google Analytics 4, Google Ads and Meta Pixel run when their IDs are configured on the site. Google tags are used in the advanced mode of Google Consent Mode (v2): they are loaded on the page regardless of your cookie preference; if you do not give consent or refuse it, they do not write cookies, but cookieless measurement requests containing the address of the page you visit, your IP address and your device and browser information are sent to Google. If you give consent, measurement is carried out with cookies. Unless you allow marketing cookies, Meta Pixel is initialized in consent-revoked mode, in which it writes no cookies and sends no measurement events; however, your browser connects to Meta's servers while its script loads. Where enabled, Cloudflare Turnstile is used on the forms to distinguish automated submissions, and when a form is submitted the verification result is passed to Cloudflare together with your IP address.

Your parts quotation basket, your view preference in the parts catalog and the primary record of your cookie preference are not cookies but data held in your browser's local storage (localStorage); some short-lived markers are kept in session storage (sessionStorage) and are deleted when the tab is closed. This data is not sent to the server automatically with requests; the contents of your basket are transmitted to us as part of your request when you submit your parts request.

For the detailed table, retention periods and the steps for deleting them from your browser, see the Cookie Policy.

8. Sharing and disclosure

We do not sell or rent your personal data, and we do not make the request and contact information you submit through our forms available to third parties for advertising purposes. Your data may be shared, only to the minimum extent necessary, with the following parties:

Business partners that are party to the service: as required by your request, the operator that will perform the flight, the counterparty broker, the maintenance organization, the parts supplier, the insurance and logistics partners.
Service providers: parties from which support services are received, such as server and e-mail infrastructure and accounting and legal consultancy; these parties process the data only on our instructions and under a contractual confidentiality obligation.
Providers of measurement, advertising and security tools: where enabled on the site, Google (Google Tag Manager, Google Analytics 4, Google Ads), Meta (Meta Pixel) and, for form security, Cloudflare (Turnstile); the data passed to these providers and the effect of your consent are explained in Section 7.
Competent authorities and institutions: the relevant public authorities and judicial bodies where there is an obligation arising from legislation or a duly made request.

9. Transfer abroad

Gazali Aviation operates in Türkiye and the United Arab Emirates and works with an international network of operators, brokers and suppliers. For this reason, depending on the nature of your request, it may be necessary to transfer your data to a party abroad. Technical data passed to the measurement, advertising and security tools enabled on the site may also be processed by the providers of those tools on servers located abroad. Where such a transfer takes place, the provisions of the KVKK on transfer abroad and the appropriate safeguards of the GDPR (adequacy decision, standard contractual clauses or the other cases provided for by law) are complied with, and the transfer is kept limited to the scope required by the request.

10. Retention period

Your personal data is retained for as long as the purpose of processing requires and until the limitation and retention periods laid down in the relevant legislation expire; once the period has expired, it is deleted, destroyed or anonymized. Correspondence on a request that does not result in a transaction, a relationship that turns into a contract and records that must be kept for a certain period under legislation are subject to different periods. You can find out the exact retention period of a particular item of data by writing to [email protected].

11. Data security

We apply technical and administrative measures to protect your data against unauthorized access, loss and unlawful processing. Connections to the site are encrypted over HTTPS; session cookies are written with the Secure and HttpOnly flags and cannot be read by scripts; forms are protected against cross-site request forgery by a security token bound to the session, and excessive submissions from the same connection within a short time are limited; administration panel passwords are stored as irreversible hashes and are not kept anywhere in plain text. The submission limit is calculated from the IP address written to our database together with your request: the limit counts only the requests recorded from the same IP address within the last hour; no separate record is kept for this purpose. Panel access is granted according to authorization levels limited to what the role requires.

We wish to point out that no technical measure provides absolute security. If you have any doubt concerning the security of your data, please contact us.

12. Your rights

Under Article 11 of the KVKK and Articles 15-22 of the GDPR, you have the following rights:

To learn whether your personal data is processed and to request information in this regard.
To learn the purpose of processing and whether the data is used in accordance with that purpose.
To know the third parties to whom the data is transferred domestically or abroad.
To request the correction of data processed incompletely or incorrectly.
To request the erasure or destruction of the data.
To request that correction, erasure and destruction operations be notified to the third parties to whom the data has been transferred.
To object to processing and to request the restriction of processing and the portability of the data.
To withdraw your consent at any time in processing based on explicit consent; withdrawal does not affect the lawfulness of the processing carried out up to that point.
To request compensation where you suffer damage as a result of unlawful processing.

You can submit your requests to [email protected]. In your application, clearly state information sufficient for us to establish your identity and the subject of your request. Applications are concluded within 30 days at the latest. If you are not satisfied with the outcome, you retain the right to lodge a complaint with the Turkish Personal Data Protection Board or, if you fall within the scope of the GDPR, with the data protection authority of the country in which you are located.

13. Data relating to children

Our site and our services are directed at corporate counterparties and adults; we do not knowingly collect personal data from children. If you notice that data belonging to a child has been submitted to us without consent, inform us; the data is deleted without delay.

14. Notice on the scope of services

Gazali Aviation provides aviation brokerage and consultancy services only. It does not operate aircraft, does not hold an AOC (Air Operator Certificate) and assumes no operational, safety or technical responsibility. All flights are performed under the AOC of the relevant operator. The consequences of this distinction for the content and the requests on the site are explained in detail in the Terms of Use.

15. Changes

This text may be updated where necessary. The current version is always published on this page and the date at the end of the page shows the date of the last update. In the event of a material change, a separate notice is also given on the site.

Last updated: 9 October 2026