Privacy Policy

Personal data we collect

Award entry form: Contact name, email address, company name, website, country, company type, selected categories, application text, supporting files. Files may include screenshots or documents that contain personal data.
Contact form: Name, email address, company (optional), message. Includes any details you choose to write in the message.
Email and other correspondence: Name, email address, signature details, message content.
Jury members: Name, photo, company, job title, short profile, evaluation notes and scores. Name, photo, company and title are published on the website.
Website use: IP address, browser and device type, operating system, pages visited, date and time of access, referring page. Collected through server and security logs.
Cookies and similar technologies: Session identifiers, security tokens, consent choices. See our Cookie Policy.
Award badge verification: Technical data of visitors who click a winner's badge on a third-party site. Logged like any other page visit.

The entry form asks for business information. Most of it relates to companies, not individuals. It becomes personal data when it identifies a person, such as a contact name, a work email, a sole trader's business or an independent blogger's website.

We do not ask for special categories of personal data (such as health, religion or biometric data). Please do not include them in entries or messages. Before uploading evidence, please remove or blur the personal data of your customers and staff unless it is essential to the entry and you have a lawful basis to share it with us.

Why we use your data and our legal basis

For each purpose below, we name the legal basis that allows the processing under the GDPR and under KVKK.

Receiving, checking and evaluating award entries, including sharing them with the jury. Under the GDPR, this is allowed because it is processing that is necessary to perform a contract with you, or to take steps you request before entering into one. Under KVKK, this is allowed for the same reason: it is processing that is directly related to and necessary for the establishment or performance of a contract.
Publishing nominees, shortlists, finalists and winners (company name, logo, website, category and year). Under the GDPR, this is allowed because it is processing that is necessary to perform a contract with you, or to take steps you request before entering into one, and because it is also processing that is necessary for our legitimate interests, provided your rights and interests do not override them. Under KVKK, this is allowed for the same reason: it is processing that is directly related to and necessary for the establishment or performance of a contract, and because it is also processing that is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms. Our legitimate interest is running a transparent awards programme.
Operating the badge verification pages for winners. Under the GDPR, this is allowed because it is processing that is necessary for our legitimate interests, provided your rights and interests do not override them. Under KVKK, this is allowed for the same reason: it is processing that is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms. Our legitimate interest is letting anyone check that an award is genuine.
Answering enquiries sent through the contact form or by email. Under the GDPR, this is allowed because it is processing that is necessary for our legitimate interests, provided your rights and interests do not override them, and because it is also processing that is necessary to perform a contract with you, or to take steps you request before entering into one. Under KVKK, this is allowed for the same reason: it is processing that is directly related to and necessary for the establishment or performance of a contract, and because it is also processing that is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms.
Sending entrants programme updates, such as deadlines and results. Under the GDPR, this is allowed because it is processing that is necessary to perform a contract with you, or to take steps you request before entering into one, and because it is also processing that is necessary for our legitimate interests, provided your rights and interests do not override them. Under KVKK, this is allowed for the same reason: it is processing that is directly related to and necessary for the establishment or performance of a contract, and because it is also processing that is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms.
Sending marketing emails about future editions. Under the GDPR, this is allowed because it is processing based on your consent. Under KVKK, this is allowed for the same reason: it is processing with your explicit consent. You can withdraw your consent at any time.
Publishing jury profiles. Under the GDPR, this is allowed because it is processing based on your consent. Under KVKK, this is allowed for the same reason: it is processing with your explicit consent. Jury members can withdraw their consent at any time.
Keeping the website secure, stopping spam and fraud, and fixing faults. Under the GDPR, this is allowed because it is processing that is necessary for our legitimate interests, provided your rights and interests do not override them. Under KVKK, this is allowed for the same reason: it is processing that is necessary for our legitimate interests, provided it does not harm your fundamental rights and freedoms.
Meeting legal duties and establishing, exercising or defending legal claims. Under the GDPR, this is allowed because it is processing that is necessary to comply with a legal obligation, and because it is also processing that is necessary for our legitimate interests, provided your rights and interests do not override them. Under KVKK, this is allowed for the same reason: it is processing that is necessary for us to comply with a legal obligation, and because it is also processing that is necessary to establish, exercise or protect a right.

We do not make decisions about entries by automated means alone, so the GDPR and KVKK rules on automated decision-making do not apply. Every eligible entry is reviewed by people.

If you do not provide the data marked as required on the entry form, we cannot accept or evaluate your entry.

Who we share data with

We do not sell personal data. We share it only as follows:

Jury members, who see the entries in their categories and are bound by confidentiality and conflict-of-interest rules.
Professional advisers, such as lawyers, accountants and auditors, under confidentiality duties.
Public authorities and courts, when the law requires it or to protect our rights.
A successor organisation, if the Flyoneers programme is reorganised, merged or transferred. This Policy will continue to apply.

International transfers

Flyoneers is an international programme. Our jury members, service providers and entrants are located in several countries. Your data may therefore be transferred outside Türkiye, the European Economic Area or the United Kingdom.

Under data protection law, data can be transferred to a country that has been found to offer adequate protection. Where there is no such decision, we use the safeguards these laws allow.

For transfers from the EU, we use the European Commission's Standard Contractual Clauses, as permitted under the GDPR. For transfers from Türkiye, we use the standard contract templates approved under KVKK, and notify the Personal Data Protection Authority within five business days of signing them.

You can request a copy of the relevant safeguards at [email protected].

How long we keep data

Entries and supporting files that did not win: Until the end of the programme year plus 24 months, then deleted or anonymised.
Winner records (company name, category, year, badge): For as long as the programme and its verification pages operate.
Supporting files of winners and finalists: Until the end of the programme year plus 24 months.
Contact form messages and correspondence: 24 months after our last exchange.
Server and security logs: Up to 90 days, unless needed to investigate an incident.
Jury profiles: Until you ask us to remove them or leave the jury.
Records needed for legal claims or tax duties: For the statutory limitation or retention periods that apply.

When a period ends, we delete, destroy or anonymise the data in line with our retention and destruction policy.

Your rights

You have the following rights over your personal data, under the GDPR and under KVKK, Türkiye's data protection law.

Right to know and access your data. You can learn whether we process your personal data, get information about that processing, and receive a copy of your data.
Right to know the purpose. You can learn why we process your data and whether we actually use it for that purpose.
Right to know who receives your data. You can learn the third parties, in Türkiye or abroad, to whom your data is transferred.
Right to correction. You can have incomplete or inaccurate data corrected.
Right to deletion. You can have your data deleted or destroyed once the reasons for processing it no longer apply.
Right to have third parties informed. You can ask us to tell the third parties who received your data about any correction or deletion.
Right to restriction. You can ask us to limit how we use your data in certain cases, for example while we check whether it is accurate.
Right to data portability. Where we process your data by automated means based on your consent or a contract, you can receive the data you gave us in a structured, machine-readable format.
Right to object. You can object to processing based on our legitimate interests, and object to direct marketing at any time.
Right to withdraw consent. You can withdraw your consent at any time. This does not affect processing carried out before you withdrew it.

To use these rights, email [email protected] or send a written request to the address above. We may ask you to confirm your identity.

We will reply within 30 days, free of charge, unless the request involves significant extra cost, in which case we may charge the fee set by the Personal Data Protection Board.

If you withdraw an entry or ask us to delete entry data before judging ends, your entry can no longer be evaluated.

In Türkiye, you can complain to the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu) if we reject your request, our reply is insufficient, or we do not reply in time. The complaint must be made within 30 days of our reply, and in any case within 60 days of your original request.

In the EU, you can complain to the data protection authority in the country where you live or work. In the UK, you can complain to the Information Commissioner's Office. We would appreciate the chance to resolve your concern first.

How we protect data

We use HTTPS encryption, Cloudflare security services, protection against cross-site request forgery and spam, file type and size limits on uploads, and access controls that limit entries to the staff and jury members who need them.

No method of transmission or storage is completely secure. If a personal data breach occurs, we will notify the competent authority and, where required, the people affected. The law requires this within 72 hours, and The law requires notice to the Personal Data Protection Board and to affected people as soon as possible.

Children

The website and the awards are intended for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, contact us and we will delete it.

Links to other websites

Our pages link to nominee, winner and jury websites. We are not responsible for the privacy practices of those sites. Please read their policies.

Changes to this Policy

We may update this Policy when our programme, services or legal duties change. The date at the top shows the latest version. We will notify entrants by email of significant changes that affect them.

Contact

The data controller for the processing described in this Policy is Flyoneers. Flyoneers does not yet publish a registered company name or address on its website, so this Policy identifies the controller by the Flyoneers name and the contact details below. We will update this section once Flyoneers registers a legal entity.

For any privacy question or request, email [email protected].

Last updated: 19 October 2026