Privacy Policy

This draft describes personal-data handling in the current IDAJET Aviation website inquiry flow at https://www.idajet.com. Data controller: GÖKADA HAVACILIK TİCARET A.Ş. IDAJET Aviation is the public brand.

Confirmed by the owner: the registered office is the company's official registered address (address to be supplied). Confirmation required: the address itself, designated privacy contact and formal request procedure. The public sales contact below is available for questions but is not yet confirmed as the statutory privacy-request channel.

Flight inquiries collect name, email, telephone, departure, destination, departure date, trip type, passenger count and, for return trips, return date. The expanded form permits optional notes; the compact form has no visible notes field. Valid inquiries are stored with operational record identifiers, creation information and request status.

Please do not include unnecessary health information, passport/identity documents or payment-card data in notes. Confirmation required: any separate process and legal conditions for patient or other sensitive information and any data later required to arrange a service.

The current flow stores and presents inquiries to authorized staff and sends a sales notification to support follow-up about the requested flight. Validation, a hidden anti-bot field and submission limits help prevent invalid or abusive requests.

Submitting an inquiry does not establish a marketing subscription or blanket consent. Confirmation required: applicable lawful grounds for inquiry handling, contracting, abuse prevention and any statutory retention, including the relevant KVKK provisions and GDPR only where applicable.

The current implementation uses Lovable Cloud for inquiry storage and restricted staff access. After a valid inquiry is saved, a notification containing contact details, flight details and any notes is sent through the connected Resend service from noreply@notify.idajet.com to sales@idajet.com. The customer’s validated email is used as Reply-To. If sending fails, the saved inquiry is retained and the submission is not reported as failed solely for that reason.

Confirmation required: provider legal entities, processor agreements, authorized staff/recipient scope, mailbox processing and any aircraft or service partners that receive personal data. The current notification is not a customer marketing email.

The processing locations and transfer safeguards for hosting, storage, the email connection, email delivery, the sales mailbox and content delivery must be established before the final policy is approved. Verification of a sending domain in Resend’s Ireland region does not establish that all processing remains in Ireland or the EU.

Confirmation required: actual locations, subprocessors, applicable transfer mechanisms and information on obtaining relevant safeguards. This draft makes no data-localization guarantee.

Confirmation required: retention periods or objective criteria for inquiry records, mailbox copies, delivery records, abuse/security logs, staff accounts and backups; deletion responsibility and process; and any legal preservation exceptions. The current inquiry flow does not establish a verified automated deletion schedule. No retention period is invented here.

Staff sign-in uses browser session storage through the authentication service; the production client is configured to persist sessions in local storage. Website source references Google Fonts and externally delivered images/video. Telephone, email and WhatsApp links open the selected contact service, whose own practices may apply.

A complete production cookie/storage and service inventory remains necessary, including provider/hosting logs, telemetry, request/device data and any tracking added outside application source. No general analytics tag, embedded map or cookie-consent mechanism was identified in the inspected source; that does not prove their absence in production. Confirmation required: final inventory, purposes, durations, lawful grounds and any required consent/choice mechanism.

The inquiry implementation validates submissions and restricts staff reads and status updates. These measures do not guarantee absolute security. Confirmation required: organizational safeguards, provider commitments, access reviews and incident-response procedures for the complete processing chain. Do not send highly sensitive documents through general notes or ordinary contact links.

Applicable rights may include information about processing, access, correction, deletion, restriction, objection and portability, depending on the governing law and circumstances. Where processing relies on consent, withdrawal must be addressed without treating an inquiry as blanket consent.

Confirmation required: the exact applicable KVKK/GDPR rights, identity-verification method, authorized application channels, statutory response periods and complaint authority/procedure. Questions can be directed to the verified public contact below while the formal process is confirmed; this draft does not designate a statutory controller representative.

Confirmation required: effective date, approving entity and process for communicating material changes. Turkish, English, Russian and Arabic versions require equivalent company-approved and legally reviewed content before release. This draft is not a final compliance determination.