Privacy Notice on the Processing of Personal Data of Persons Receiving Products/Services

Within the scope of the purposes explained below, we may process, record, store, classify, update your personal data in compliance with the law and the rules of good faith, and — where permitted by legislation and/or limited to the purpose for which they are processed — disclose/transfer them to third parties.

a. Data Controller and Representative

Pursuant to the Law, “Bonair Havacılık Ticaret ve Sanayi A.Ş.” (hereinafter referred to as “Bonair Havacılık”), operating at the address “Şenlikköy Mah. Orman Sk. No:10, 34153 Bakırköy / İstanbul”, is the Data Controller.

b. Personal Data Processed by Our Company as Data Controller

Within the scope of the aviation, flight operations, training, maintenance coordination, customer services and commercial activities provided by us, the following categories of personal data may be processed:

• Your Identity Information (identity data by which we can identify you, such as your name, surname, ID number, place of birth, date of birth, nationality, passport information),
• Your Contact Information (your address, mobile phone, e-mail address and other contact data),
• Your Financial Data (bank account information, IBAN information, payment and collection information, invoice and accounting records),
• Customer Transaction (request and complaint records, reservation information, contract records, quote and order information, customer representative call records),
• Transaction Security (website browsing information, IP address, website entry/exit information, password and credential information, etc.),
• Health Data (such as discharge (epicrisis) information, initial examination findings and medical reports requested within the scope of the air ambulance service),
• Flight and Operation Information (flight planning information, operation records, passenger and crew coordination information, records required within the scope of carrying out aviation activities),
• Visual and Audio Data (security camera recordings, recordings of customer interviews),
• Other personal data you personally provide within the scope of your requests, suggestions and complaints.

c. Purposes for Which Personal Data May Be Processed

The personal data of our direct product or service recipient, or of the employees of our product or service recipient, or of persons authorised to represent and bind them, is processed by our Company for the following purposes:

• Carrying out flight operations,
• Planning and providing aviation services,
• Managing reservation, sales and customer relations processes,
• Carrying out quote, contract and service processes,
• Performing invoicing and accounting transactions,
• Carrying out customer satisfaction activities,
• Evaluating requests, suggestions and complaints,
• Carrying out information security processes,
• Ensuring risk management and operational security,
• Fulfilling legal obligations,
• Ensuring compliance with the regulations of the DGCA (SHGM) and other competent authorities,
• Carrying out audit and reporting activities,
• Following up legal processes,
• Performing storage and archiving activities,
• Providing information to authorised persons, institutions and organisations,
• Carrying out strategic planning activities,
• Carrying out activities in compliance with legislation,
• Creating visitor records.

d. Method and Legal Basis of Data Processing

Method of Processing: Your personal data may be processed by automated or non-automated methods through any verbal, written or electronic means.

Legal Basis of Processing: Your data is processed primarily within the scope of the SHY-PASSENGER Regulation, the SHY-6A Commercial Air Transport Operators Regulation, national and international civil aviation regulations (ICAO and IATA rules), Law No. 2559 and related security legislation; for the purposes of and on the legal grounds of providing the flight service, performing reservation and ticketing operations, ensuring flight safety and fulfilling legal obligations. Your personal data will be processed in line with the data-processing purposes set out in this Privacy Notice based on the following legal grounds:

• It is necessary to fulfil the obligations arising from the relevant commercial contract between the customer and the Company (KVKK Art. 5/2/(c)),
• Data processing is necessary for the establishment, exercise or protection of a right (KVKK Art. 5/2/e),
• Data processing is necessary for our Company to fulfil a legal obligation (KVKK Art. 5/2/(ç)),
• Data processing is necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of data subjects (KVKK Art. 5/2/e),
• It is necessary for persons under an obligation of secrecy or authorised institutions and organisations, for the purposes of protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning, management and financing of healthcare services (KVKK Art. 6/3/e).

e. Transfer of Processed Personal Data

Within the scope of fulfilling the purposes specified above, your personal data may be transferred to the following recipient groups in line with the personal-data-processing conditions set out in Articles 8 and 9 of Law No. 6698 and the purposes specified above:

• Authorised Public Institutions and Organisations: Directorate General of Civil Aviation (SHGM), DHMİ, the relevant airport authority, judicial authorities, law enforcement, courts, enforcement offices and other competent public institutions.
• Service Providers and Suppliers: Information technology service providers, cloud service providers, accounting and financial advisory services, legal advisors, dispatch, operation and maintenance service providers.
• Business Partners and Contracted Organisations: Aviation organisations, maintenance organisations, training organisations and service providers cooperated with in order to carry out operational activities.
• Financial Institutions: Banks, payment institutions and other financial institutions required for carrying out financial transactions.

f. Your Rights as a Data Subject

Regarding the processing of your personal data by our Company, pursuant to Article 11 of the KVKK, you have the right to:

• Learn whether your personal data is processed,
• Request information if your personal data has been processed,
• Learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• Know the third parties to whom your personal data is transferred at home or abroad,
• Request the correction of your personal data if it has been processed incompletely or inaccurately,
• Request the erasure or destruction of your personal data if the reasons requiring its processing no longer exist, and request that correction or erasure operations be notified to the third parties to whom your personal data has been transferred,
• Object to a result against you arising from the analysis of the processed data exclusively through automated systems,
• Request compensation if you suffer damage due to the unlawful processing of your personal data.

Pursuant to Article 4 of the Law on the Protection of Personal Data No. 6698, the personal data we collect and process must be accurate and, where necessary, up to date. Therefore, in the event of any change in your personal data, you may notify us of your current and accurate personal information by the methods specified below.

g. If You Wish to Contact Us for Your Requests

For written requests; you may deliver a wet-signed copy of the “KVKK Application Form” available on our website (https://bonair.com.tr/) in person together with an identity document, or by proxy with a notarised power of attorney showing that you are authorised to apply regarding the rights listed under Article 11, or send it via notary to the address “Şenlikköy Mah. Orman Sk. No:10, 34153 Bakırköy / İstanbul”.

For electronic requests; you may submit the KVKK Application Form by signing it with an electronic or mobile signature holding a “secure electronic signature” certificate as defined in the Electronic Signature Law No. 5070, to our Company’s Registered Electronic Mail (KEP) address bonair@hs02.kep.tr, or to kvkk@bonair.com.tr using the e-mail address you have previously notified to our Company and which is registered in our systems.

Your requests submitted to our Company will be answered in writing or electronically as soon as possible and within thirty days at the latest, depending on the nature of your request. (We may request additional verification (such as sending a message to your registered e-mail address or calling you) in order to confirm that the application belongs to you and to protect your rights. If the application is made by third parties on behalf of the data subjects, the applicant must provide a special power of attorney issued before a notary by the data subject.)

Data Controller Contact Details

Bonair Havacılık Ticaret ve Sanayi A.Ş.

Address: Şenlikköy Mah. Orman Sk. No:10, 34153 Bakırköy / İstanbul

Phone: +90 212 400 00 04

E-mail: kvkk@bonair.com.tr