Privacy Policy & KVKK Notice

Last updated: 24 September 2026. This notice is provided under the Turkish Personal Data Protection Law No. 6698 (“KVKK”), Article 10, and, for participants in the European Economic Area, the EU General Data Protection Regulation (“GDPR”).

1. Data controller

The data controllers are the Organiser, Türkiye Hava Trafik Kontrolörleri Derneği (TATCA), and — for registrations, payments, accommodation and invoicing — the Seller, Harikalar Kumpanyası Organizasyon (together “we”).

• E-mail: ifatca66@tatca.org

• Address: Yeni Mah. Radar Cad. Samet Sok. No: 3 B1 Blok D: 7, İzmit / Kocaeli
• Telephone: +90 532 369 32 76
• E-mail: merhaba@harikalarkumpanyasi.com

For any privacy question or request, please write to ifatca66@tatca.org.

2. Personal data we process

• Identity: name, badge name, date of birth and nationality; name as in passport and passport number, only when needed for a visa invitation letter.
• Contact: e-mail address, telephone number and country.
• Professional: Member Association, organisation and participant status.
• Participation and travel: registration details, accompanying persons, hotel booking, arrival and departure information, notes you send us.
• Dietary requirements (optional): these may reveal information about your health or religious beliefs, which is special-category data. It is used only to arrange catering and only with your explicit consent, which you give by entering it; you can remove it at any time.
• Payment: amounts, payment status, card brand and the last four digits of the card. We never receive or store full card numbers or security codes.
• Technical and security: IP address, browser type, login times and security logs.
• Communications: messages sent through the contact form and e-mails we send you.
• Images: photographs and video recorded at the Conference.

3. Purposes and legal bases

• Creating and managing your account, registration, badge, hotel booking and payment, and communicating with you about the Conference — necessary for the performance of the contract (KVKK Art. 5(2)(c); GDPR Art. 6(1)(b)).
• Issuing visa invitation letters at your request — performance of the contract.
• Keeping accounting and tax records and answering requests from public authorities — legal obligation (KVKK Art. 5(2)(ç); GDPR Art. 6(1)(c)).
• Protecting the Website against misuse and fraud, verifying participant categories and handling disputes — our legitimate interests and the establishment or defence of rights (KVKK Art. 5(2)(e) and (f); GDPR Art. 6(1)(f)).
• Catering based on dietary requirements — explicit consent (KVKK Art. 6; GDPR Art. 9(2)(a)).
• Publishing Conference photographs — our legitimate interest in documenting the event; you can object at any time.

We do not sell personal data, use it for advertising, or make decisions about you by automated means.

4. Who receives your data

• Our licensed payment institution and banks, to process card payments and refunds.
• The partner hotels, for accommodation you book (name, dates, room type).
• IFATCA, where needed to accredit Member Association delegates and for the official records of the Conference.
• Service providers acting on our instructions: website hosting (DigitalOcean, data centre in Frankfurt, Germany) and e-mail delivery (Twilio SendGrid, USA).
• Public authorities, where the law requires it.

5. Transfers outside Türkiye

Some of the recipients above are located abroad (Germany, the United States and, for IFATCA, Canada). We transfer data abroad in accordance with KVKK Article 9 and the GDPR — on the basis of appropriate safeguards such as standard contractual clauses or, for occasional transfers, where the transfer is necessary to perform the contract with you.

6. How long we keep data

• Account, registration and communication data: for the duration of the Conference and up to two years afterwards, so that we can answer questions and prepare official records.
• Passport details and dietary requirements: deleted or anonymised at the latest twelve months after the Conference.
• Payment and accounting records: for the periods required by Turkish commercial and tax law (generally ten years).
• Security logs: up to two years.

After these periods, data is deleted, destroyed or anonymised.

7. Cookies

The Website uses only one strictly necessary cookie, which keeps you signed in to your account. We do not use analytics, advertising or tracking cookies, so no consent banner is needed.

8. Security

All pages are served over encrypted HTTPS connections. Passwords are stored only as salted one-way hashes, payment-provider credentials are encrypted, access to participant data is limited to authorised members of the Organising Committee, and card payments are protected by 3-D Secure.

9. Your rights

Under KVKK Article 11 you have the right to learn whether your personal data is processed and to request information about it; to learn the purpose of processing and whether it is used accordingly; to know the recipients in Türkiye and abroad; to request correction of incomplete or inaccurate data; to request deletion or destruction of data under the conditions of Article 7; to request that recipients be notified of such correction or deletion; to object to a result against you arising exclusively from automated analysis; and to claim compensation for damage caused by unlawful processing. Under the GDPR you also have the rights to restriction of processing and to data portability, and you can withdraw your consent at any time.

Please send your request by e-mail from the address registered in your account to ifatca66@tatca.org, or in writing to the address above. We answer free of charge within 30 days. You may also lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, if you live in the EEA, with your local data-protection authority.

10. Minors

The Website is intended for adults. Data of minors (for example accompanying children) may only be provided by their parent or legal guardian.

11. Changes

We may update this notice; the current version is always published on this page.