The protection of personal data is an important issue for "Airospot". As the data controller, Airospot adopts the principles set forth by the law, fulfilling its obligations regarding the processing, deletion, destruction, anonymization, transfer, informing the data subject, and ensuring data security. The Privacy and Personal Data Protection Policy prepared in this context is made available to individuals whose personal data is processed.
1. Scope and Purpose of the Privacy and Personal Data Protection Policy
This Privacy and Personal Data Protection Policy;
a. Methods and legal reasons for collecting personal data,
b. Which groups of individuals have their personal data processed (Categorization of Data Subject Groups),
c. The categories of personal data processed regarding these groups (Data Categories) and example data types,
d. In which business processes and for what purposes these personal data are used,
e. Technical and administrative measures taken to ensure the security of personal data,
f. To whom and for what purposes personal data can be transferred,
g. The retention periods of personal data,
h. Profiling and Segmentation,
i. What rights Data Subjects have over their personal data and how they can exercise these rights,
j. How Data Subjects can change their preferences regarding receiving commercial electronic communications,
k. Sharing personal data with official authorities,
l. Use and Management of Cookies.
a. Methods and Legal Reasons for Collecting Personal Data
Airospot collects personal data through websites, mobile applications, social media accounts, cookies, call centers, and other communication channels based on the following legal reasons specified in the laws:
• Explicitly provided for in the laws,
• Necessary for the establishment or performance of a contract directly related to the parties' personal data,
• Made public by the data subject,
• Necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject,
• Necessary for the establishment, use, or protection of a right.
b. Categorization of Data Subject Groups
Airospot categorizes the groups of individuals whose personal data is processed in its personal data processing processes and related activities as follows. Additionally, personal data of other groups (consultants, educators, bloggers) may also be processed in accordance with the conditions specified in the laws and the legal reasons stated in this Privacy/Personal Data Protection Policy.
c. Data Categories and Example Data Types
1. a) Member Customer
• Identity Information: Name, surname, date of birth, gender, ID number, passport number,
• Location Information: City of residence, district (delivery address and billing address for purchases made through Airospot websites),
• Contact Information: mobile phone, email address, address, postal code, landline,
• Financial Information: Tax office, invoice information,
• Customer/Member Information: Membership information, membership number,
• Customer/Member Transaction Information: Purchased product(s), purchase amount, purchase date, call center conversation records, commercial communication consent, utilized campaigns/competitions, used coupons, information related to the order,
• Risk Management Information: IP address,
• Transaction Security Information: Password, password information,
• Marketing Information: Cookie records, targeting information, evaluations showing habits and preferences,
• Auditory Data: Call center conversation records,
• Legal Transaction and Compliance Information: Start and end time of the service provided, type of service utilized, amount of data transferred, consent for commercial electronic communication given by the Data Subject in electronic form, membership agreement, corporate membership agreement, and other legal texts and contracts that enable the use of services provided by Airospot.
• Marketing Information: Marketing SMS, email messages, or calls made by the call center sent based on the commercial electronic communication consent given by the Data Subject.
• Request/Complaint Management/Reputation Management Information: Records related to complaints and/or requests made by the Data Subject regarding the product or service purchased through the website, mobile application, social media accounts, or call center, and the processes of evaluating or managing these requests.
1. b) Guest Users (users shopping without membership)
• Identity Information: Name, surname, date of birth, gender, ID number, passport number,
• Location Information: City of residence, district (delivery address for purchases made through Airospot websites),
• Contact Information: mobile phone, email address, address, postal code, landline,
• Financial Information: Tax office, invoice information,
• Guest Customer Transaction Information: Purchased product(s), purchase amount, purchase date, call center conversation records, commercial communication consent, utilized campaigns, information related to the order,
• Risk Management Information: IP address,
• Transaction Security Information: Password, password information,
• Marketing Information: Cookie records, targeting information, evaluations showing habits and preferences,
• Auditory Data: Call center conversation records,
• Legal Transaction and Compliance Information: Start and end time of the service provided, type of service utilized, amount of data transferred, consent for commercial electronic communication given by the Data Subject in electronic form, and other legal texts and contracts that enable the use of services provided by Airospot.
• Marketing Information: Marketing SMS, email messages, or calls made by the call center sent based on the commercial electronic communication consent given by the Data Subject.
• Request/Complaint Management/Reputation Management Information: Records related to complaints and/or requests made by the Data Subject regarding the product or service purchased through the website, mobile application, social media accounts, or call center, and the processes of evaluating or managing these requests.
2. Online Visitor
• Transaction Security Information: Password, mobile phone, password information,
• Legal Transaction Information/Risk Management Information: IP address,
• Legal Transaction and Compliance Information: Start and end time of the service provided, type of service utilized, amount of data transferred.
3. Person to Whom the Purchased Product Will Be Delivered
• Identity Information: Name, surname, date of birth, gender, ID number, passport number,
• Location Information: City of residence, district (delivery address for purchases made through Airospot websites),
• Contact Information: mobile phone, email address, address, postal code, landline,
• Financial Information: Tax office, invoice information.
d. In Which Business Processes and For What Purposes Personal Data Are Used
1. a) Member Personal Data
• To carry out membership transactions,
• To improve the services offered through the "airospot" websites operated by Airospot, to develop new services, and to inform about them,
• To fulfill the Membership Agreement established with the Member, regarding the analysis of the Member's preferences, likes, and needs, and to provide special promotions, opportunities, and benefits,
• To conduct remarketing, targeting, profiling, and analysis based on the Member's explicit consent, to promote and market applications, goods/products, and services in line with the Member's preferences and likes,
• To resolve Member issues and complaints,
• To improve the Member experience on both the web and mobile applications,
• To track accounting and purchasing transactions,
• To comply with legal processes and regulations,
• To respond to information requests from administrative and judicial authorities,
• To ensure information and transaction security and to prevent malicious use,
• To ensure that the processed data is up-to-date and accurate.
2. Online Visitor Personal Data
• Processing of online visitor data within the scope of the laws,
• Legal processes and compliance with regulations,
• Responding to information requests from administrative and judicial authorities,
• Ensuring information and transaction security and preventing malicious use,
• Fulfilling legal obligations.
3. Personal Data of the Person to Whom the Purchased Product Will Be Delivered
• Conducting product delivery processes,
• Tracking accounting and purchasing transactions,
• Legal processes and compliance with regulations,
• Responding to information requests from administrative and judicial authorities,
• Ensuring information and transaction security and preventing malicious use,
• Ensuring that the processed data is up-to-date and accurate,
• Fulfilling legal obligations.
e. Technical and Administrative Measures Taken to Ensure the Security of Personal Data
Airospot is committed to taking all necessary technical and administrative measures to ensure the confidentiality, integrity, and security of your personal data. Airospot takes necessary precautions to prevent unauthorized access, misuse, unlawful processing, disclosure, alteration, or destruction of personal data. Airospot uses widely accepted security technology standards such as firewalls and Secure Socket Layer (SSL) encryption when processing personal data. Additionally, when sending your personal data to Airospot via the website, mobile application, and mobile site, this data is transmitted using SSL.
Airospot takes necessary measures to prevent unlawful access to personal data, to prevent unlawful processing of this data, and to ensure the retention of personal data:
• All areas where personal data is collected on the website or mobile application are protected by SSL,
• Airospot creates and implements access authorization and control matrices for its employees to prevent unlawful processing of personal data collected from the website or mobile application.
In the event of damage to personal data or unauthorized access by third parties due to attacks on the platforms operated by Airospot or the Airospot system, Airospot will immediately notify you and the Personal Data Protection Authority and take necessary precautions.
f. To Whom and For What Purposes Personal Data Can Be Transferred
Airospot transfers personal data only to third parties in accordance with the purposes specified in this Privacy and Personal Data Protection Policy and in compliance with the laws. In this context, the data of Member/Guest Users and the information of the person to whom the purchased product will be delivered are shared with the seller and the cargo company, and these data can also be accessed by the call center when necessary. The information of the person to whom the invoice will be issued is shared with the cargo company for the purpose of sending the invoice to the relevant person.
The mobile phone number and/or email address of the Member/Guest User are shared with the commercial electronic communication service provider for the purpose of conducting promotions, advertisements, and providing benefits and opportunities based on the shopping preferences, likes, and habits of the relevant person.
Preferences for using the website or mobile application and browsing history are shared with domestic/international business partners from whom cookie (cookie) services are obtained for segmentation and to communicate with the Member/Guest User in line with their likes and preferences. The personal data transfers carried out in this context are made through secure environments and channels provided by the relevant third party. Depending on the content and scope of the services received from third parties; in all cases where there is no need to transfer the personal data of the Member/Guest User, pseudonymous data will be used for the transfer.
To increase Member/Guest User satisfaction and loyalty, the data of the Member/Guest User will be shared with companies conducting market research.
In the context of reporting and statistical studies, the data of the Member/Guest User will be shared with Airospot's solution partners.
Additionally, your personal data will be shared with our international business partners for the purposes of providing business development services, statistical and technical services, and managing customer relations.
The personal data subject to the domestic and international transfers mentioned above are legally protected by provisions in our contracts that comply with the laws, taking into account that the other party to the legal relationship is the data controller or data processor, in addition to the technical measures that will ensure their security.
When sharing personal information with foreign countries as mentioned above, it is ensured that the data is transferred in accordance with this policy and in a manner permitted by the applicable law on data protection.
g. Retention Periods of Personal Data
Airospot retains the personal data it processes in accordance with the laws for the periods specified in the relevant legislation or required by the purpose of processing. The retention periods in our Personal Data Retention and Destruction Policy are approximately as follows:
Call Center voice recordings: 3 years,
Membership and order records: 10 years,
All records related to accounting and financial transactions: 10 years,
Cookies: Maximum 540 days,
Commercial electronic communication consent records: 1 year from the date the consent is withdrawn,
Traffic information related to online visitors: 2 years,
Information obtained due to job applications and/or CVs: 1 year,
Personal data of Member Customers/Guest Customers: 10 years after the legal relationship ends,
Personal data of suppliers: 10 years after the legal relationship ends,
Personal data obtained for usability testing research: 2 weeks.
h. Profiling and Segmentation
Airospot uses the personal data it processes regarding Member/Guest Users for:
• Profiling and segmentation to prepare content more suitable for the preferences and likes of Members/Guest Users who have given consent to receive commercial electronic communications, and to conduct advertising, promotions, and discounts.
• Profiling and segmentation will also be conducted for Members/Guest Users who have not given consent for commercial electronic communications;
a. To improve products (determining the best-selling or least-selling product categories),
b. To organize campaigns aimed at customer groups with the potential to purchase a specific product by analyzing shopping preferences and uploading them to the system,
c. To take actions aimed at increasing sales potential.
i. Rights of Data Subjects Over Their Personal Data and How They Can Exercise These Rights
The rights of the Data Subject regarding the personal data processed by Airospot are listed below:
• To learn whether personal data is being processed,
• To request information regarding personal data if it has been processed,
• To learn the purpose of processing personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom personal data is transferred, both domestically and internationally,
• To request the correction of personal data if it is incomplete or incorrectly processed,
• To request the deletion or destruction of personal data under the conditions stipulated in the laws,
• To request that the transactions carried out under (d) and (e) be notified to the third parties to whom personal data has been transferred,
• To object to the emergence of a result against the person by analyzing the processed data exclusively through automated systems,
• To request compensation for damages in case of damage due to unlawful processing of personal data.
To exercise your rights over your personal data; you can access your account through the "My Account" section in the Airospot website, mobile application, and mobile site and perform necessary changes, updates, and/or deletions. Additionally, you can submit your request through the "Contact" section on the website or mobile application operated by Airospot and exercise your rights.
j. Sharing Personal Data with Official Authorities
Airospot may share your personal data and browsing information, such as your navigation information related to your visit or membership to the electronic commerce platforms operated by Airospot, with public institutions and organizations authorized to request this information legally in order to fulfill Airospot's obligations under the law (in cases where there is a legal or administrative obligation to notify or provide information to Airospot, such as combating crime, threats to state and public security, etc.).
k. Use and Management of Cookies
In some cases, Airospot websites use "cookies". A cookie is a small file sent from the web server to your internet browser and stored on your computer. This allows you to be recognized when you visit Airospot again. Cookies are used to help recognize you, maintain your login status, and track the duration of your access to the service. Cookies and other technical procedures are used to enable certain processes, services, and transactions (for example, if you are using a virtual shopping cart in an online shopping center). Your browser settings can be changed to ensure that a warning appears before a cookie is saved or to prevent cookies from being placed. You are free to accept or reject the advantages of personal cookies. However, if you reject personal cookies, some services may not be available.
2. Conditions for Deletion, Destruction, and Anonymization of Personal Data
Airospot retains the personal data it processes through its website, mobile application, or mobile site for the periods stipulated by the relevant laws and/or the periods required by the purpose of processing. Upon the expiration of these periods, it will delete, destroy, or anonymize the data in accordance with the provisions of the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.
The deletion of personal data by Airospot refers to the process of making personal data inaccessible and unusable for the relevant users in any way. Airospot creates and implements an access authorization and control matrix at the user level for this purpose. It takes necessary precautions to carry out the deletion process in the database.
The destruction of personal data by Airospot refers to the process of making personal data inaccessible, irretrievable, and unusable by anyone in any way.
The anonymization of personal data by Airospot refers to the process of making personal data unidentifiable or untraceable to any identifiable or identifiable individual, even if matched with other data.
Airospot provides detailed explanations of the methods and technical and administrative measures it takes regarding deletion, destruction, and anonymization in its Personal Data Retention and Destruction Policy prepared in accordance with the Regulation on the Deletion, Destruction, or Anonymization of Personal Data. This Policy also specifies that the periodic destruction stipulated in the Regulation will be carried out every 6 months.
3. Changes to the Privacy/Personal Data Protection Policy
Airospot may change this Privacy/Personal Data Protection Policy at any time. These changes will take effect immediately upon the publication of the amended new Privacy/Personal Data Protection Policy. Necessary information will be provided to our members to keep them informed of changes in this Privacy/Personal Data Protection Policy.
