Privacy Policy & KVKK Notice
Clarification notice on the processing of personal data, recruitment submissions, telemetry, and data subject rights.
1. Data Controller & Scope
This Privacy Policy and Clarification Notice is published by the Flanker UAV student engineering crew at Yıldız Technical University (YTU), located in Istanbul, Turkey (referred to as 'Flanker UAV', 'we', 'our', or 'the team').
In compliance with Turkish Personal Data Protection Law No. 6698 (KVKK) and applicable international privacy standards including the General Data Protection Regulation (GDPR), this document informs visitors, team applicants, and users regarding how we collect, store, process, and protect your personal information.
For any questions or requests regarding your data, you can contact our privacy point of contact directly at info@flankers.club.
2. Personal Data We Collect
We collect personal information through direct user interactions, recruitment submissions, contact forms, and security telemetry. The categories of data include:
Recruitment & Application Data: When applying to join Flanker UAV via our Join Us portal (/join-us), we collect your full name, email address, university, academic department, year of study, motivation statement, portfolio or GitHub URL, uploaded CV or resume files (which may contain contact details, academic history, and work experience), and optional supplementary portfolios.
Authentication Data: Single-use email authentication codes (OTP) used to authenticate team applicants and verify account access.
Contact Form Data: When contacting us via /contact-us, we collect your first name, surname, email address, message category, and the contents of your inquiry.
Technical & Anti-Bot Telemetry: To protect our services against malicious automated traffic, we collect client IP addresses, browser headers, and verification tokens via Cloudflare Turnstile.
Local Browser Storage: To provide a seamless experience, we store non-tracking local preferences in your browser, including theme selection (dark/light), application session draft recovery data (flanker_apply_draft), and dismissed announcement notices.
3. Purposes and Legal Grounds of Processing
Your personal data is processed strictly for legitimate, explicit, and transparent purposes:
Evaluation of Applications: Processing candidate credentials, academic records, and CV files to evaluate recruitment qualifications for autonomous UAV subteams during the active competition cycle.
Communication & Notification: Replying to contact requests, scheduling technical interviews, and transmitting recruitment milestone notifications.
Infrastructure & Abuse Security: Enforcing persistent server-side rate limits, preventing spam submissions, and defending public forms against automated attacks.
Compliance with Legal Standards: Fulfilling data controller obligations under KVKK Article 5 and Article 6, relying on explicit consent provided upon application submission and the legitimate interest of maintaining team operations.
4. Third-Party Processors & Cloud Infrastructure
Flanker UAV relies on trusted third-party technology providers to manage data securely. These providers operate under rigorous security controls:
Google Cloud & Firebase: Firestore databases store application records, contact messages, and rate-limit metadata. Firebase Storage securely hosts uploaded applicant CV documents. Firebase Authentication handles email verification tokens.
Resend: A transactional email routing provider used to dispatch recruitment alerts and confirmation notifications to team leaders.
Cloudflare: Provides Turnstile bot-detection challenges that analyze privacy-friendly device signals without using cross-site tracking cookies.
Vercel Analytics: First-party, privacy-preserving aggregate page telemetry that records anonymous visitor metrics without advertising cookies or cross-domain tracking.
5. Data Retention & Storage Security
Recruitment applications and CV files are retained only for the duration of the relevant competition cycle and evaluation season. Once candidate selections conclude, files of unselected applicants are safely expunged or archived in accordance with team governance.
Contact form messages are retained solely for the period required to resolve the inquiry.
All stored documents and database records are shielded by server-side authentication, restricted service-account permissions, and database security rules to prevent unauthorized access or disclosure.
6. Your Rights Under KVKK and GDPR
Under Article 11 of the Turkish Personal Data Protection Law (KVKK) and relevant articles of the GDPR, data subjects have the right to:
Learn whether your personal data is being processed, and request information if it has been processed.
Learn the purpose of the processing and whether the data is used in accordance with that purpose.
Know the third parties to whom personal data is transferred domestically or abroad.
Request rectification of incomplete or inaccurate data.
Request erasure or destruction of personal data when the processing purposes no longer exist.
Object to negative outcomes resulting from automated data processing.
To exercise any of these rights, please email info@flankers.club with your request. We will review and respond to legitimate requests without undue delay.
Questions about your personal data or need to exercise your rights?
Looking for software and platform terms? View Terms of Use & Disclaimers