01Data Controller
The data controller responsible for the processing of personal data described in this Policy is Tafaen Aerospace, a joint-stock company organized under the laws of the Republic of Türkiye, with its registered office in İstanbul.
| Entity | Tafaen Aerospace A.Ş. |
|---|---|
| Country | Republic of Türkiye |
| Privacy Contact | [email protected] |
| General Contact | [email protected] |
02Personal Data We Collect
We collect only the personal data necessary for the operation of our Website and the evaluation of legitimate inquiries. Specifically:
- Identity data: first name, last name.
- Contact data: e-mail address, organization name, organizational role.
- Inquiry content: the substance of the message you submit.
- Technical data: IP address, browser type, device type, referrer, pages visited, timestamps, and similar log information collected automatically.
- Cookies / preferences: as described in Section 8.
We do not intentionally collect special-category data (health, biometrics, religious belief, political opinion, criminal record, etc.). If you submit such data voluntarily through an inquiry, we will treat it under the stricter regime of Article 6 of KVKK.
03Purposes of Processing
We process personal data for the following purposes:
- To respond to inquiries submitted through the Website;
- To evaluate qualifications of potential partners, customers, and investors;
- To execute pre-contractual vetting, due diligence, and export-control checks;
- To maintain the security, performance, and integrity of the Website;
- To comply with our legal obligations under Turkish law, including those imposed by defense industry regulators;
- To pursue our legitimate corporate interests in a measured and proportionate way.
04Legal Basis for Processing
Under KVKK Articles 5 and 6, the legal bases for processing your personal data include:
- The processing is necessary for the establishment or performance of a contract (Art. 5/2-c);
- The processing is necessary for compliance with a legal obligation (Art. 5/2-ç);
- The processing is necessary for the legitimate interests of the data controller, balanced against fundamental rights (Art. 5/2-f);
- Where neither of the above applies, your explicit consent (Art. 5/1).
05Sharing with Third Parties
We do not sell personal data. We share personal data only with:
- Service providers bound by data-processing agreements (hosting, e-mail, analytics, security);
- Professional advisors (legal counsel, auditors) under duties of confidentiality;
- Competent public authorities where compelled by law or where required for export-control or defense industry vetting;
- Successor entities in the context of a corporate restructuring, with continued protection of your rights.
06International Transfers
Personal data is primarily processed within Türkiye. Where transfer outside Türkiye is necessary — for example, when using a hosting or e-mail provider with infrastructure abroad — such transfer is carried out in compliance with KVKK Article 9 and any applicable adequacy or binding-rules framework. We apply contractual safeguards equivalent in substance to GDPR Standard Contractual Clauses.
07Retention Periods
| Inquiry Records | Up to 3 years from last contact, unless a longer period is required by law or by an ongoing relationship. |
|---|---|
| Server / Access Logs | Up to 12 months for security and forensic purposes. |
| Contractual & Procurement Records | 10 years, in accordance with Turkish Tax Procedure Law and Turkish Commercial Code. |
| Cookies / Preferences | Until expiration as defined per cookie, or until you withdraw consent. |
08Cookies and Similar Technologies
The Website uses a minimal set of cookies. Strictly necessary cookies are required for technical operation and do not need consent. Performance / analytics cookies are used only where you have given consent, and may be withdrawn at any time through your browser settings.
09Your Rights as a Data Subject
Under KVKK Article 11, you have the right to:
- Learn whether your personal data is being processed;
- Request information about the processing;
- Learn the purposes of the processing and whether the data is used consistently with those purposes;
- Know third parties to whom your data has been transferred, domestically or abroad;
- Request rectification of inaccurate or incomplete data;
- Request erasure or destruction within the scope of the conditions in KVKK Article 7;
- Request notification of the foregoing operations to third parties to whom the data has been transferred;
- Object to outcomes produced by automated processing if they cause harm;
- Claim compensation for damage arising from unlawful processing.
To exercise these rights, please follow the application procedure described in our KVKK Notice.
10Security Measures
We apply administrative and technical security measures appropriate to the risk, including access control, encryption in transit, secure backups, network segmentation, audit logging, vendor due diligence, staff training, and incident response procedures. We treat personal data with the same seriousness with which we treat operational and design information.
11Children's Privacy
The Website is not directed at children under 18. We do not knowingly collect personal data from minors. If you become aware that a minor has provided personal data, please contact us and we will take appropriate action to delete the data.
12Updates to this Policy
We may update this Policy from time to time. The "Effective" date above identifies the latest revision. Material changes will be communicated through the Website and, where appropriate, by direct notice.
13Contact
For any question concerning this Policy or to exercise your rights, contact us at [email protected].