Personal Data Storage, Deletion, Destruction and Transfer Policy

PURPOSE OF THE POLICY

This Personal Data Retention and Destruction Policy (''Policy'') has been prepared in order to fulfil our obligations in accordance with the Personal Data Protection Law No. 6698 (''KVKK'' or ''Law'') and the Regulation on Deletion, Destruction or Anonymisation of Personal Data (''Regulation'') and to determine the maximum retention and destruction periods required for the purpose for which personal data are processed.

ORGANISED RECORDING MEDIA

Personal data stored within the Company are sensitively stored in the following recording media in accordance with the nature of the relevant data and our legal obligations.

Electronic media

Ms Office Files
Our Servers
Our computers, which are sensitively protected with antivirus programmes and firewall
Our network devices
Shared/unshared disc drives used for data storage on the network
Mobile phones and all the storage space inside,
Printer,
Flash memories
Database

Physical environments;

Unit Cabinets
Unit Archive
Institution Archive
Archive
Accounting Unit

1. DEFINITIONS AND EXPLANATIONS

1. Regulation on Deletion, Destruction or Anonymisation of Personal Data published in the Official Gazette on 28 October 2017

Personal data within the Company are stored securely and sensitively in electronic or physical media specified in this Policy for the following data processing reasons in order to provide our Company's services, to continue its commercial activities without interruption, to fulfil its legal obligations, to carry out customer relations, to plan and fulfil employee rights; and are destroyed ex officio or upon the request of the person concerned in the event that these reasons disappear.

• The presence of explicit consent,
• The existence of a provision of law,
• Failure to obtain explicit consent due to actual impossibility,
• It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of the contract,
• It is mandatory for the data controller to fulfill its legal obligation,
• The personal data of the data subject has been made public by him/herself,
• Data processing is mandatory for the establishment, use or protection of a right,
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

1. PROTECTION OF SPECIAL CATEGORIES OF PERSONAL DATA

Our Company does not process the personal data specified as special quality that carries the risk of creating discrimination when they are processed unlawfully, but takes measures in accordance with the data processing conditions set forth in Article 6 of the KVK Law in case of processing of special quality personal data with the explicit consent of the data owner or when required by the law.

➢ Training is provided to the personnel involved in the processing of special quality personal data. 

➢ Authorization restriction is provided, which prevents access to the relevant data. 

➢ The physical and electronic environments where the data is collected are protected by encryption technique. 

➢ Access records related to this data, system and employee are periodically audited.

1. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN FOR THE SECURE STORAGE OF PERSONAL DATA AND THE PREVENTION OF UNLAWFUL PROCESSING AND ACCESS TO IT

Our Company takes the following technical and administrative measures in order to ensure that personal data is stored securely and processed in accordance with the law and to prevent unlawful access to personal data:

• Network security and application security are ensured.
• Security measures are taken within the scope of information technology systems supply, development and maintenance.
• Disciplinary regulations with data security provisions are in place for employees.
• Training and awareness activities are carried out for employees on data security at regular intervals.
• An authorization matrix has been created for employees.
• Institutional policies on access, information security, use, storage and destruction have been prepared and started to be implemented.
• The authorizations of employees who have a change of duty or who have left their jobs in this field are removed.
• Up-to-date anti-virus systems are used.
• Firewalls are used.
• The signed contracts contain data protection provisions.
• Extra security measures are taken for personal data transferred via paper and the relevant documents are sent in confidential document format.
• Personal data security policies and procedures have been determined.
• Personal data security issues are reported quickly.
• Personal data security is monitored.
• Necessary security measures are taken regarding the entrances and exits to physical environments containing personal data.
• The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
• The security of environments containing personal data is ensured.
• Personal data is reduced as much as possible.
• Personal data is backed up and the security of the backed up personal data is also ensured.
• User account management and authorization control system are implemented and these are also monitored.
• In-house periodic and/or random audits are carried out and carried out.
• Log records are kept in such a way that there is no user intervention.
• Existing risks and threats have been identified.
• Protocols and procedures for the security of personal data of special nature have been determined and implemented.
• If personal data of special nature is to be sent via electronic mail, it is sent in encrypted form and using KEP or corporate mail account.
• Within the scope of Article 9 of KVKK; Personal data and information belonging to real/private law legal entities included in the commercial registry in accordance with the TCC publicity principle due to the effective use of international applications using cloud technology (Whatsapp, Google data-based applications, Yandex data-based applications, Amazon data-based applications, Microsoft data-based applications) in commercial life -until the safe country list is published by the Authority and the re-evaluation process begins- explicit consent  are received.
• Within 3 working days following the publication of the adequate protection list, the compliance process will be carried out and the classification of the works to be carried out without explicit consent and consent due to the nature of the work will be carried out.
• If deemed necessary, the Binding Corporate Rules Application process can be started and the procedure in which the presence of explicit consent is not sought in inter-company coordination and effective work can be started.
• Cyber security measures have been taken and their implementation is constantly monitored.
• Encryption is performed.
• The data of special quality persons transferred on portable memory, CD, DVD media are encrypted and transferred.
• Service providers that process data are periodically audited for data security.
• Service providers that process data are made aware of data security.

1. TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN FOR THE DESTRUCTION OF PERSONAL DATA IN ACCORDANCE WITH THE LAW

The practices within the Company for the destruction (deletion, destruction and anonymization) of personal data are as follows:

DELETION OF PERSONAL DATA

• The data in the cloud system is deleted by giving the delete command.
• Personal data in paper environment; it is erased using the dimming method (by scratching/painting/erasing). The blackout process is carried out in the form of cutting the personal data on the relevant document where possible, and in cases where it is not possible, making it invisible to the relevant users by using fixed ink in a way that cannot be reversed and read with technological solutions.
• Office files located on the central server are deleted by deleting the file with the delete command in the operating system or by removing the access rights of the relevant user on the file or the directory where the file is located.
• Personal data on portable media (for example, data on flash-based storage media) must be stored encrypted and deleted using software appropriate to these media.
• The personal data in the databases are deleted by the database commands (DELETE, etc.) of the relevant rows/columns or the cells in the table.

DESTRUCTION OF PERSONAL DATA

• Destruction of personal data on local systems; It is destroyed by de-magnetization (exposure of the media to a magnetic field at a high value by passing it through a special device), physical destruction (melting, burning, using grinders of media and magnetic media) and overwriting.
• Destruction of personal data on peripheral systems; Network devices (switches, routers, etc.), Flash-based media/hard disks (ATA "SATA, PATA etc.", SCSI "SCSI Express etc."), Magnetic tape, Units such as magnetic disk, Mobile phones (Sim card and fixed memory areas), Printer with removable or fixed data recording media, Environmental recording systems that we can specify as optical discs are supported as a product feature if digital media is to use the destroy command,      If digital media is not supported as a product feature, it is necessary to use the manufacturer's recommended destruction method or to use one or more of the appropriate methods specified as "de-magnetize, physical destroy, overwrite", and finally to destroy by using one or more of the appropriate methods of "de-magnetize, physical destruction, overwrite" if it is not digital media.
• Since the personal data in paper and micro office environments are permanently and physically written on the environment, the destruction process is carried out by destroying the main environment where these data are located.
• Personal data in the cloud environment is encrypted and stored and the destruction command is applied when the destruction time comes.

ANONYMIZATION OF PERSONAL DATA

• With the masking method, anonymization is carried out by extracting the basic identifying information (e.g. name, surname, TCKN) that enables the identification of the data owner.
• With the aggregation method, anonymization is carried out by extracting personal data in a way that cannot be associated with any person (e.g. more job applications from people between the ages of 25 and 30).
• With the Data Derivation method, anonymization is carried out by creating a more general content than the content of personal data and in such a way that the personal data cannot be associated with a person in any way (e.g. writing age instead of birth dates).

(Below are definitions and explanations of the anonymization methods used in practice. if one or more of these methods are used within the Company, it is necessary to select/specify the relevant methods)

1. A) ANONYMISATION METHODS THAT DO NOT PROVIDE VALUE IRREGULARITY

The practices within the Company for the destruction (deletion, destruction and anonymization) of personal data are as follows:

DELETION OF PERSONAL DATA

• The data in the cloud system is deleted by giving the delete command.
• Personal data in paper environment; it is erased using the dimming method (by scratching/painting/erasing). The blackout process is carried out in the form of cutting the personal data on the relevant document where possible, and in cases where it is not possible, making it invisible to the relevant users by using fixed ink in a way that cannot be reversed and read with technological solutions.
• Office files located on the central server are deleted by deleting the file with the delete command in the operating system or by removing the access rights of the relevant user on the file or the directory where the file is located.
• Personal data on portable media (for example, data on flash-based storage media) must be stored encrypted and deleted using software appropriate to these media.
• The personal data in the databases are deleted by the database commands (DELETE, etc.) of the relevant rows/columns or the cells in the table.

DESTRUCTION OF PERSONAL DATA

• Destruction of personal data on local systems; It is destroyed by de-magnetization (exposure of the media to a magnetic field at a high value by passing it through a special device), physical destruction (melting, burning, using grinders of media and magnetic media) and overwriting.
• Destruction of personal data on peripheral systems; Network devices (switches, routers, etc.), Flash-based media/hard disks (ATA "SATA, PATA etc.", SCSI "SCSI Express etc."), Magnetic tape, Units such as magnetic disk, Mobile phones (Sim card and fixed memory areas), Printer with removable or fixed data recording media, Environmental recording systems that we can specify as optical discs are supported as a product feature if digital media is to use the destroy command,      If digital media is not supported as a product feature, it is necessary to use the manufacturer's recommended destruction method or to use one or more of the appropriate methods specified as "de-magnetize, physical destroy, overwrite", and finally to destroy by using one or more of the appropriate methods of "de-magnetize, physical destruction, overwrite" if it is not digital media.
• Since the personal data in paper and micro office environments are permanently and physically written on the environment, the destruction process is carried out by destroying the main environment where these data are located.
• Personal data in the cloud environment is encrypted and stored and the destruction command is applied when the destruction time comes.

ANONYMIZATION OF PERSONAL DATA

• With the masking method, anonymization is carried out by extracting the basic identifying information (e.g. name, surname, TCKN) that enables the identification of the data owner.
• With the aggregation method, anonymization is carried out by extracting personal data in a way that cannot be associated with any person (e.g. more job applications from people between the ages of 25 and 30).
• With the Data Derivation method, anonymization is carried out by creating a more general content than the content of personal data and in such a way that the personal data cannot be associated with a person in any way (e.g. writing age instead of birth dates).

(Below are definitions and explanations of the anonymization methods used in practice. if one or more of these methods are used within the Company, it is necessary to select/specify the relevant methods)

1. B) ANONYMISATION METHODS PROVIDING VALUE IRREGULARITY

Existing values are anonymized, creating distortion of the data set's values by modifying them. Even if the values in the dataset change, the aggregate statistics can still be distorted and the data can still benefit from it.

• Microjoin: All the records in the dataset are first arranged in a meaningful order, and then the whole set is divided into a certain number of subsets. Then, the value of each subset of the specified variable is averaged and the value of that variable of the subset is replaced by the average value. This will also keep the average value of that variable that applies to the entire data set unchanged.
• Data Exchange: Record changes obtained by exchanging values from a variable subset between pairs selected from within records. This method is mainly used for variables that can be categorized, and the main idea is to anonymize the database by changing the values of the variables between records belonging to individuals.
• Adding Noise: It is anonymized by adding and subtracting to provide distortions to a specified extent in a selected variable. This method is mostly applied to datasets that contain numeric values. Distortion applies equally to each value.

1. C) STATISTICAL METHODS TO ENHANCE ANONYMISATION

In anonymized datasets, the combination of some values in records with singular scenarios may result in the possibility of identifying the people in the records or deriving assumptions about their personal data. For this reason, anonymity can be strengthened by minimizing the singularity of the records in the dataset by using various statistical methods in anonymized datasets. The main purpose of these methods is to minimize the risk of deterioration of anonymity while keeping the benefit to be obtained from the data set at a certain level.

• K-Anonymity: It is an anonymization statistical method developed to prevent the disclosure of information specific to individuals who show singular characteristics in certain combinations by enabling the identification of more than one person with certain fields.
• L-Diversity: It was formed by studies carried out on the deficiencies of K-Anonymity. In this method, the diversity of sensitive variables corresponding to the same combinations of variables is taken into account. For example, although K-anonymity has been applied by anonymizing the name, surname or identity number of the persons, there is a possibility that it can be determined because the postal code, age and ethnicity information have been shared. By anonymizing this information with the masking method, it has reduced the guessing power of the user with external information.
• T-Proximity: Although the L-diversity method provides diversity in personal data, there are cases where this method does not provide adequate protection because it does not deal with the content and sensitivity of personal data. In this case, the process of calculating the degree of proximity of personal data and values to each other and anonymizing the data set by dividing it into subclasses according to these proximity degrees is called the T-proximity method.
• In this context, the decisions of the institutions to anonymize as a result of their own discretion should be investigated and processed accordingly by investigating whether there is a risk that the anonymized personal data will be reversed by various interventions and that the anonymized data will become identifiable and distinguishing real persons.

1. TITLES, UNITS AND JOB DESCRIPTIONS OF THOSE INVOLVED IN THE STORAGE AND DESTRUCTION OF PERSONAL DATA