01Data Controller
The data controller responsible for the processing of personal data described in this Policy is Tafaen Aerospace, a joint-stock company organized under the laws of the Republic of Türkiye, with its registered office in İstanbul. The GÖKKIRAN program webpage is operated as a digital property of Tafaen Aerospace.
| Entity | Tafaen Aerospace A.Ş. |
|---|---|
| Country | Republic of Türkiye |
| Privacy Contact | [email protected] |
| Procurement Contact | [email protected] |
02Personal Data We Collect
The GÖKKIRAN webpage collects only the minimum personal data necessary to evaluate briefing requests:
- Identity data: first name, last name.
- Contact data: e-mail address, organization, organizational role.
- Inquiry content: the substance of your briefing request.
- Vetting data: information provided in support of a briefing or procurement evaluation, including end-user / end-use declarations.
- Technical data: IP address, browser, device, timestamps, referrer.
Special-category data (health, biometrics, etc.) is not actively requested. If submitted voluntarily, it is processed under the stricter regime of KVKK Article 6.
03Purposes of Processing
- To evaluate and respond to briefing and procurement inquiries;
- To conduct pre-engagement vetting, end-use verification, and export-control screening;
- To maintain the security and integrity of the Site;
- To meet legal obligations under Turkish defense industry, commercial, and tax law;
- To pursue legitimate corporate interests in a measured and proportionate way.
04Legal Basis for Processing
Under KVKK Articles 5 and 6, processing relies on the following legal bases:
- Art. 5/2-c: necessity for the establishment or performance of a contract;
- Art. 5/2-ç: compliance with a legal obligation;
- Art. 5/2-e: establishment, exercise, or protection of a right;
- Art. 5/2-f: legitimate interests of the controller, balanced against fundamental rights;
- Art. 5/1: explicit consent, where no other basis applies.
05Sharing with Third Parties
We do not sell personal data. We share personal data only with:
- Service providers under data-processing agreements (hosting, e-mail, security);
- Professional advisors (legal, audit) under confidentiality duties;
- Competent public authorities where compelled by law, including defense industry regulators and export-control authorities;
- Successor entities in the context of corporate restructuring.
06International Transfers
Personal data is primarily processed within Türkiye. Where transfer outside Türkiye is necessary — for example, if a hosting or e-mail provider has infrastructure abroad — such transfer is conducted in compliance with KVKK Article 9 and applicable safeguards equivalent in substance to GDPR Standard Contractual Clauses.
07Retention Periods
| Briefing / Inquiry Records | Up to 3 years from last contact, longer where mandated by law or by an ongoing engagement. |
|---|---|
| Vetting & End-Use Documentation | For the duration required by Turkish defense export procedures and applicable allied regimes — typically 10 years. |
| Server / Access Logs | Up to 12 months. |
| Cookies / Preferences | Per cookie type, or until withdrawal of consent. |
08Cookies and Similar Technologies
The Site uses a minimal set of cookies. Strictly necessary cookies are essential to operation and do not require consent. Performance / analytics cookies are loaded only with consent and can be withdrawn at any time via your browser settings.
09Your Rights as a Data Subject
Under KVKK Article 11, you have the right to:
- Learn whether your personal data is being processed;
- Request information about the processing;
- Learn the purposes and whether the data is used consistently with those purposes;
- Know third-party recipients, domestic or international;
- Request rectification of inaccurate or incomplete data;
- Request erasure or destruction within the conditions of KVKK Article 7;
- Request that rectification, erasure, or destruction be notified to recipients;
- Object to outcomes produced by automated processing that cause harm;
- Claim compensation for damage from unlawful processing.
For application procedure, see our KVKK Notice.
10Security Measures
We apply administrative and technical safeguards proportionate to the risk, including access control, encryption in transit, secure backups, network segmentation, audit logging, vendor due diligence, staff training, and incident response. Personal data submitted through the GÖKKIRAN webpage is handled with the same operational discipline applied to design and engineering data.
11Children's Privacy
The Site is not directed at minors. We do not knowingly collect personal data from individuals under 18. Inquiries received from minors are not processed.
12Updates
This Policy may be updated. The "Effective" date above reflects the latest revision. Material changes are communicated on the Site and, where appropriate, by direct notice.
13Contact
For any privacy question or to exercise your rights: [email protected].