Privacy Notice (GDPR)

1. Identity of the Data Controller

As the data controller operating the AviaCoach platform, we wish to inform you about the purposes and legal bases of processing your personal data, the parties to whom it is transferred, and your rights. For users in Türkiye, Law No. 6698 ("KVKK") applies; for users in the EU, the GDPR applies.

• Data controller: AviaCoach (Platform operator)
• Contact: kvkk@aviacoach.com
• Website: https://aviacoach.com

2. Personal Data Processed

• Identity: first name, last name, date of birth (18+ check), national ID or passport number (for KYC).
• Contact: email address, phone number.
• Account: password (hashed), session tokens, account creation date.
• Images: profile photo, passport image and selfie for KYC (foreign users).
• Training: questions answered, lesson progress, simulator hours, exam results.
• Social: AviaSOCIAL posts, comments, likes, follows.
• Payment: plan, subscription status, transaction ID. Card details are processed by Paddle (PCI-DSS) and are not stored on our Platform.
• Technical: IP address, browser type, device type, cookie data.

3. Purposes of Processing

• Membership creation, identity verification, session management.
• Provision of ATPL training services, performance tracking, AI-assisted guidance.
• Processing payments and issuing invoices.
• Content sharing on AviaSOCIAL, moderation and ensuring legal compliance (KYC + 18+).
• Improving service quality, error monitoring, preventing security breaches.
• Fulfilling legal obligations (tax, data protection, e-commerce legislation).
• Marketing communication with your explicit consent (email, push notification).

4. Legal Bases (GDPR Art. 6 / KVKK Art. 5)

• Performance of a contract — for membership and payment processes.
• Legal obligation — for tax, KYC and content moderation.
• Legitimate interest — for system security, fraud detection and service improvement.
• Consent — for marketing, cookies and transfers to third parties such as Sky Aviation via the Store.

5. Recipients of Data

• Paddle Inc. (international payment, US/EU): for subscriptions and PPP pricing.
• Google LLC: for the OAuth sign-in option.
• Sky Aviation Academy: to forward simulator/training orders placed via the Store.
• Sentry / hosting providers: for error monitoring and server infrastructure.
• Official authorities: upon lawful request.

Where data is transferred internationally, appropriate safeguards (e.g. standard contractual clauses) are applied.

6. Retention Periods

• Account data: while the account is active + 2 years (statutory limitation period).
• Payment/invoice records: 10 years (Tax Procedure Law).
• KYC identity documents: while the account is active + 1 year.
• Server logs: 90 days.
• After an account deletion request: all data, except that subject to a statutory retention obligation, is anonymised within 30 days.

7. Your Rights (GDPR Art. 15-22 / KVKK Art. 11)

As a data subject you have the following rights:

• To learn whether your personal data is processed.
• To request information if it has been processed.
• To learn the purpose of processing and whether it is used accordingly.
• To know the parties to whom it is transferred, domestically or abroad.
• To request rectification of incomplete or inaccurate data.
• To request erasure or destruction.
• To object to a result reached against you by automated analysis.
• To claim compensation for damage arising from unlawful processing.

You may submit requests to kvkk@aviacoach.comor via the "Delete Account" section in the panel. Requests are answered free of charge within 30 days at the latest.

8. Cookies

The Platform uses session and preference cookies. For details, please see our Privacy Policy page.

9. Changes

This notice may be updated to comply with legal regulations. You will be informed of material changes via your registered email address.