Privacy

1. Controller and contact

NorthFLY Flight Academy (data controller). Address: Samsun International Carsamba Airport, Türkiye. Email: info@northfly.aero · Phone: +90 850 532 1919 · Web: https://northfly.aero

Submit requests via the Data Subject Request form, by email to info@northfly.aero, or in writing to the address above. We may ask for proportionate identity verification.

2. Who is covered?

Website visitors, training candidates and parents, limited digital contact with students, job applicants, partners and anyone who submits our forms.

Flight-training contracts and DGCA processes are covered by separate notices; this policy focuses on the website and general communications.

3. Categories of personal data

We may process:

• Identity: name; optional partial national ID for verification
• Contact: phone, email, preferred channel
• Application content: messages, topics, CVs and attachments
• Security: IP address, browser/device data, logs
• Cookies: necessary cookies; analytics/marketing with consent
• Marketing preferences where consent is given

4. How we collect data

Directly from you (forms, email, phone, WhatsApp, career applications) or automatically (site use, cookies, server logs). If we receive data from third parties we comply with applicable notice duties.

5. Purposes

We process data to:

• Inform about training programmes, intakes and campuses
• Answer contact and callback requests
• Run recruitment processes
• Secure the site and prevent abuse
• Meet legal obligations
• Run analytics/marketing only with consent
• Handle and evidence data-subject requests

6. Legal bases (KVKK and GDPR)

Under KVKK we rely on explicit consent or Art. 5/2 grounds (contract, legal obligation, legitimate interests, etc.). We do not request special-category data via ordinary web forms.

Under the GDPR we rely on Art. 6(1)(a) consent, (b) contract, (c) legal obligation and (f) legitimate interests, with a balancing test and your right to object.

7. Retention

We keep data only as long as needed for the purpose and legal limitation periods, then delete, destroy or anonymise it.

• Contact forms: up to 2 years after closure
• Career applications: up to 1 year after the process ends (unless longer consent)
• Data-subject requests: up to 3 years for accountability
• Security logs: up to 1 year unless an incident requires longer
• Cookie consent: up to 12 months
• Contracts/invoices: as required by tax and commercial law

8. Recipients and transfers

Hosting, email, optional analytics/ads (with consent), public authorities, advisors and contracted partners may receive data for the stated purposes.

International transfers follow KVKK cross-border rules and GDPR Chapter V (adequacy, SCCs, etc.).

9. Security

We apply appropriate technical and organisational measures (access control, HTTPS, updates, incident handling). No system is perfectly secure—contact us if you suspect misuse.

10. Your rights

Under KVKK Art. 11 and GDPR Arts. 12–22 you may request access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Use the Data Subject Request page.

• Learn whether your data is processed and obtain information
• Learn the purpose and whether it is used accordingly
• Know recipients in Türkiye or abroad
• Request correction of incomplete or inaccurate data
• Request erasure under KVKK Art. 7 / GDPR Art. 17
• Ask that corrections/erasures are notified to recipients
• Request restriction of processing
• Data portability (GDPR Art. 20)
• Object to legitimate interests or direct marketing
• Withdraw consent at any time
• Seek compensation for unlawful processing where applicable

11. Response times

KVKK: within 30 days. GDPR: within one month, extendable by up to two further months for complex requests with notice. Requests are free of charge unless manifestly unfounded or excessive.

12. Children

The site is general information. Forms completed for minors should be overseen by a legal guardian. We do not knowingly collect marketing consent from children.

13. Changes

We may update this policy. The latest version is published on the site with a revised “Last updated” date.

14. Complaints

You may lodge a complaint with Türkiye’s Personal Data Protection Authority (https://www.kvkk.gov.tr) or your EU/EEA supervisory authority (see https://edpb.europa.eu).