Personal Data Storage, Deletion, Destruction and Transfer Policy
PURPOSE OF THE POLICY
This Personal Data Retention and Destruction Policy (''Policy'') has been prepared in order to fulfil our obligations in accordance with the Personal Data Protection Law No. 6698 (''KVKK'' or ''Law'') and the Regulation on Deletion, Destruction or Anonymisation of Personal Data (''Regulation'') and to determine the maximum retention and destruction periods required for the purpose for which personal data are processed.
ORGANISED RECORDING MEDIA
Personal data stored within the Company are sensitively stored in the following recording media in accordance with the nature of the relevant data and our legal obligations.
Electronic media
Ms Office Files
Our Servers
Our computers, which are sensitively protected with antivirus programmes and firewall
Our network devices
Shared/unshared disc drives used for data storage on the network
Mobile phones and all the storage space inside,
Printer,
Flash memories
Database
Physical environments;
Unit Cabinets
Unit Archive
Institution Archive
Archive
Accounting Unit
- DEFINITIONS AND EXPLANATIONS
Open Consent | Consent on a specific subject, based on information and expressed with free will. |
Anonymisation/Anonymisation | Making personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even by matching with other data. |
Employee | BETRA KİMYA çalışanları. |
Destruction | Deletion, destruction or anonymisation of personal data. |
Recording Media | Any medium containing personal data that is fully or partially automated or processed non-automatically, provided that it is part of any data recording system, |
Personal Data | Any information relating to an identified or identifiable natural person. |
Personal Data Owner/Related Person | The natural person whose personal data is processed. |
Processing of Personal Data | Any operation performed on personal data such as obtaining, recording, storing, retaining, modifying, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic means or by non-automatic means provided that it is part of any data recording system. |
Board | Personal Data Protection Board. |
Institution | Personal Data Protection Authority |
KVKK, Law | Law No. 6698 on the Protection of Personal Data |
Sensitive Personal Data | data relating to health, sexual life, criminal convictions and security measures, and biometric and genetic data. |
Periodic Disposal | If all of the conditions for processing personal data specified in the Law are no longer applicable in the event of a recurring event specified in the personal data retention and destruction policy erasure, destruction or anonymisation to be carried out ex officio at intervals. |
Policy | BETRA KİMYA Personal Data Storage and Destruction Policy |
Deletion | Making personal data inaccessible and non-reusable for the users concerned. |
Supplier | Defines the parties with whom the Data Owner has established a business partnership for the purposes of obtaining all kinds of services and carrying out the operational process on behalf of the companies in which the Data Owner participates in its capital or in the management of which it participates in its capital personally or through its shareholders or managers while carrying out its commercial activities |
Legally Authorised Public Institutions and Organisations | Public institutions and organisations authorised to receive information and documents from the company in accordance with the provisions of the relevant legislation |
Company | Betra Kimya İth. İhr. San. ve Tic. Ltd. Şti. |
Data Processor | A natural or legal person who processes personal data on behalf of the data controller based on the authorisation granted by the data controller. |
Data Recording System | A recording system in which personal data are structured and processed according to certain criteria, directory. |
Data Controller | The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system. |
Destruction | It is the making of personal data inaccessible, irretrievable and non-reusable by anyone in any way. |
Regulation | Regulation on Deletion, Destruction or Anonymisation of Personal Data published in the Official Gazette on 28 October 2017 |
- Regulation on Deletion, Destruction or Anonymisation of Personal Data published in the Official Gazette on 28 October 2017
Personal data within the Company are stored securely and sensitively in electronic or physical media specified in this Policy for the following data processing reasons in order to provide our Company's services, to continue its commercial activities without interruption, to fulfil its legal obligations, to carry out customer relations, to plan and fulfil employee rights; and are destroyed ex officio or upon the request of the person concerned in the event that these reasons disappear.
- The presence of explicit consent,
- The existence of a provision of law,
- Failure to obtain explicit consent due to actual impossibility,
- It is necessary to process the personal data of the parties to the contract, provided that it is directly related to the establishment or performance of the contract,
- It is mandatory for the data controller to fulfill its legal obligation,
- The personal data of the data subject has been made public by him/herself,
- Data processing is mandatory for the establishment, use or protection of a right,
- Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
- PROTECTION OF SPECIAL CATEGORIES OF PERSONAL DATA
Our Company does not process the personal data specified as special quality that carries the risk of creating discrimination when they are processed unlawfully, but takes measures in accordance with the data processing conditions set forth in Article 6 of the KVK Law in case of processing of special quality personal data with the explicit consent of the data owner or when required by the law.
➢ Training is provided to the personnel involved in the processing of special quality personal data.
➢ Authorization restriction is provided, which prevents access to the relevant data.
➢ The physical and electronic environments where the data is collected are protected by encryption technique.
➢ Access records related to this data, system and employee are periodically audited.
- TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN FOR THE SECURE STORAGE OF PERSONAL DATA AND THE PREVENTION OF UNLAWFUL PROCESSING AND ACCESS TO IT
Our Company takes the following technical and administrative measures in order to ensure that personal data is stored securely and processed in accordance with the law and to prevent unlawful access to personal data:
- Network security and application security are ensured.
- Security measures are taken within the scope of information technology systems supply, development and maintenance.
- Disciplinary regulations with data security provisions are in place for employees.
- Training and awareness activities are carried out for employees on data security at regular intervals.
- An authorization matrix has been created for employees.
- Institutional policies on access, information security, use, storage and destruction have been prepared and started to be implemented.
- The authorizations of employees who have a change of duty or who have left their jobs in this field are removed.
- Up-to-date anti-virus systems are used.
- Firewalls are used.
- The signed contracts contain data protection provisions.
- Extra security measures are taken for personal data transferred via paper and the relevant documents are sent in confidential document format.
- Personal data security policies and procedures have been determined.
- Personal data security issues are reported quickly.
- Personal data security is monitored.
- Necessary security measures are taken regarding the entrances and exits to physical environments containing personal data.
- The security of physical environments containing personal data against external risks (fire, flood, etc.) is ensured.
- The security of environments containing personal data is ensured.
- Personal data is reduced as much as possible.
- Personal data is backed up and the security of the backed up personal data is also ensured.
- User account management and authorization control system are implemented and these are also monitored.
- In-house periodic and/or random audits are carried out and carried out.
- Log records are kept in such a way that there is no user intervention.
- Existing risks and threats have been identified.
- Protocols and procedures for the security of personal data of special nature have been determined and implemented.
- If personal data of special nature is to be sent via electronic mail, it is sent in encrypted form and using KEP or corporate mail account.
- Within the scope of Article 9 of KVKK; Personal data and information belonging to real/private law legal entities included in the commercial registry in accordance with the TCC publicity principle due to the effective use of international applications using cloud technology (Whatsapp, Google data-based applications, Yandex data-based applications, Amazon data-based applications, Microsoft data-based applications) in commercial life -until the safe country list is published by the Authority and the re-evaluation process begins- explicit consent are received.
- Within 3 working days following the publication of the adequate protection list, the compliance process will be carried out and the classification of the works to be carried out without explicit consent and consent due to the nature of the work will be carried out.
- If deemed necessary, the Binding Corporate Rules Application process can be started and the procedure in which the presence of explicit consent is not sought in inter-company coordination and effective work can be started.
- Cyber security measures have been taken and their implementation is constantly monitored.
- Encryption is performed.
- The data of special quality persons transferred on portable memory, CD, DVD media are encrypted and transferred.
- Service providers that process data are periodically audited for data security.
- Service providers that process data are made aware of data security.
- TECHNICAL AND ADMINISTRATIVE MEASURES TAKEN FOR THE DESTRUCTION OF PERSONAL DATA IN ACCORDANCE WITH THE LAW
The practices within the Company for the destruction (deletion, destruction and anonymization) of personal data are as follows:
DELETION OF PERSONAL DATA
- The data in the cloud system is deleted by giving the delete command.
- Personal data in paper environment; it is erased using the dimming method (by scratching/painting/erasing). The blackout process is carried out in the form of cutting the personal data on the relevant document where possible, and in cases where it is not possible, making it invisible to the relevant users by using fixed ink in a way that cannot be reversed and read with technological solutions.
- Office files located on the central server are deleted by deleting the file with the delete command in the operating system or by removing the access rights of the relevant user on the file or the directory where the file is located.
- Personal data on portable media (for example, data on flash-based storage media) must be stored encrypted and deleted using software appropriate to these media.
- The personal data in the databases are deleted by the database commands (DELETE, etc.) of the relevant rows/columns or the cells in the table.
DESTRUCTION OF PERSONAL DATA
- Destruction of personal data on local systems; It is destroyed by de-magnetization (exposure of the media to a magnetic field at a high value by passing it through a special device), physical destruction (melting, burning, using grinders of media and magnetic media) and overwriting.
- Destruction of personal data on peripheral systems; Network devices (switches, routers, etc.), Flash-based media/hard disks (ATA "SATA, PATA etc.", SCSI "SCSI Express etc."), Magnetic tape, Units such as magnetic disk, Mobile phones (Sim card and fixed memory areas), Printer with removable or fixed data recording media, Environmental recording systems that we can specify as optical discs are supported as a product feature if digital media is to use the destroy command, If digital media is not supported as a product feature, it is necessary to use the manufacturer's recommended destruction method or to use one or more of the appropriate methods specified as "de-magnetize, physical destroy, overwrite", and finally to destroy by using one or more of the appropriate methods of "de-magnetize, physical destruction, overwrite" if it is not digital media.
- Since the personal data in paper and micro office environments are permanently and physically written on the environment, the destruction process is carried out by destroying the main environment where these data are located.
- Personal data in the cloud environment is encrypted and stored and the destruction command is applied when the destruction time comes.
ANONYMIZATION OF PERSONAL DATA
- With the masking method, anonymization is carried out by extracting the basic identifying information (e.g. name, surname, TCKN) that enables the identification of the data owner.
- With the aggregation method, anonymization is carried out by extracting personal data in a way that cannot be associated with any person (e.g. more job applications from people between the ages of 25 and 30).
- With the Data Derivation method, anonymization is carried out by creating a more general content than the content of personal data and in such a way that the personal data cannot be associated with a person in any way (e.g. writing age instead of birth dates).
(Below are definitions and explanations of the anonymization methods used in practice. if one or more of these methods are used within the Company, it is necessary to select/specify the relevant methods)
- A) ANONYMISATION METHODS THAT DO NOT PROVIDE VALUE IRREGULARITY
The practices within the Company for the destruction (deletion, destruction and anonymization) of personal data are as follows:
DELETION OF PERSONAL DATA
- The data in the cloud system is deleted by giving the delete command.
- Personal data in paper environment; it is erased using the dimming method (by scratching/painting/erasing). The blackout process is carried out in the form of cutting the personal data on the relevant document where possible, and in cases where it is not possible, making it invisible to the relevant users by using fixed ink in a way that cannot be reversed and read with technological solutions.
- Office files located on the central server are deleted by deleting the file with the delete command in the operating system or by removing the access rights of the relevant user on the file or the directory where the file is located.
- Personal data on portable media (for example, data on flash-based storage media) must be stored encrypted and deleted using software appropriate to these media.
- The personal data in the databases are deleted by the database commands (DELETE, etc.) of the relevant rows/columns or the cells in the table.
DESTRUCTION OF PERSONAL DATA
- Destruction of personal data on local systems; It is destroyed by de-magnetization (exposure of the media to a magnetic field at a high value by passing it through a special device), physical destruction (melting, burning, using grinders of media and magnetic media) and overwriting.
- Destruction of personal data on peripheral systems; Network devices (switches, routers, etc.), Flash-based media/hard disks (ATA "SATA, PATA etc.", SCSI "SCSI Express etc."), Magnetic tape, Units such as magnetic disk, Mobile phones (Sim card and fixed memory areas), Printer with removable or fixed data recording media, Environmental recording systems that we can specify as optical discs are supported as a product feature if digital media is to use the destroy command, If digital media is not supported as a product feature, it is necessary to use the manufacturer's recommended destruction method or to use one or more of the appropriate methods specified as "de-magnetize, physical destroy, overwrite", and finally to destroy by using one or more of the appropriate methods of "de-magnetize, physical destruction, overwrite" if it is not digital media.
- Since the personal data in paper and micro office environments are permanently and physically written on the environment, the destruction process is carried out by destroying the main environment where these data are located.
- Personal data in the cloud environment is encrypted and stored and the destruction command is applied when the destruction time comes.
ANONYMIZATION OF PERSONAL DATA
- With the masking method, anonymization is carried out by extracting the basic identifying information (e.g. name, surname, TCKN) that enables the identification of the data owner.
- With the aggregation method, anonymization is carried out by extracting personal data in a way that cannot be associated with any person (e.g. more job applications from people between the ages of 25 and 30).
- With the Data Derivation method, anonymization is carried out by creating a more general content than the content of personal data and in such a way that the personal data cannot be associated with a person in any way (e.g. writing age instead of birth dates).
(Below are definitions and explanations of the anonymization methods used in practice. if one or more of these methods are used within the Company, it is necessary to select/specify the relevant methods)
- B) ANONYMISATION METHODS PROVIDING VALUE IRREGULARITY
Existing values are anonymized, creating distortion of the data set's values by modifying them. Even if the values in the dataset change, the aggregate statistics can still be distorted and the data can still benefit from it.
- Microjoin: All the records in the dataset are first arranged in a meaningful order, and then the whole set is divided into a certain number of subsets. Then, the value of each subset of the specified variable is averaged and the value of that variable of the subset is replaced by the average value. This will also keep the average value of that variable that applies to the entire data set unchanged.
- Data Exchange: Record changes obtained by exchanging values from a variable subset between pairs selected from within records. This method is mainly used for variables that can be categorized, and the main idea is to anonymize the database by changing the values of the variables between records belonging to individuals.
- Adding Noise: It is anonymized by adding and subtracting to provide distortions to a specified extent in a selected variable. This method is mostly applied to datasets that contain numeric values. Distortion applies equally to each value.
- C) STATISTICAL METHODS TO ENHANCE ANONYMISATION
In anonymized datasets, the combination of some values in records with singular scenarios may result in the possibility of identifying the people in the records or deriving assumptions about their personal data. For this reason, anonymity can be strengthened by minimizing the singularity of the records in the dataset by using various statistical methods in anonymized datasets. The main purpose of these methods is to minimize the risk of deterioration of anonymity while keeping the benefit to be obtained from the data set at a certain level.
- K-Anonymity: It is an anonymization statistical method developed to prevent the disclosure of information specific to individuals who show singular characteristics in certain combinations by enabling the identification of more than one person with certain fields.
- L-Diversity: It was formed by studies carried out on the deficiencies of K-Anonymity. In this method, the diversity of sensitive variables corresponding to the same combinations of variables is taken into account. For example, although K-anonymity has been applied by anonymizing the name, surname or identity number of the persons, there is a possibility that it can be determined because the postal code, age and ethnicity information have been shared. By anonymizing this information with the masking method, it has reduced the guessing power of the user with external information.
- T-Proximity: Although the L-diversity method provides diversity in personal data, there are cases where this method does not provide adequate protection because it does not deal with the content and sensitivity of personal data. In this case, the process of calculating the degree of proximity of personal data and values to each other and anonymizing the data set by dividing it into subclasses according to these proximity degrees is called the T-proximity method.
- In this context, the decisions of the institutions to anonymize as a result of their own discretion should be investigated and processed accordingly by investigating whether there is a risk that the anonymized personal data will be reversed by various interventions and that the anonymized data will become identifiable and distinguishing real persons.
- TITLES, UNITS AND JOB DESCRIPTIONS OF THOSE INVOLVED IN THE STORAGE AND DESTRUCTION OF PERSONAL DATA
PERSONNEL | UNIT | JOB DESCRIPTION |
Archivist | Archivist | Destruction of personal data. |
Lawyer | Law | Receiving the requests of the relevant persons, checking their compliance and answering the request. |
Accounting/Human Resources Staff | Accounting/Human Resources | Ensuring that the processes within its duty comply with the retention period, managing the periodic destruction process, performing the necessary audits and controls to respond to the requests of the relevant persons. |
Accounting/Finance Staff | Accounting/Finance | Ensuring that the processes within its duty comply with the retention period, managing the periodic destruction process, performing the necessary audits and controls to respond to the requests of the relevant persons. |
Call Center Staff | Call Center | Ensuring that the processes within its duty comply with the retention period and managing the personal data destruction process in accordance with the periodic destruction period. |
Sales-Marketing Staff | Sales-Marketing | Ensuring that the processes within its duty comply with the retention period and managing the personal data destruction process in accordance with the periodic destruction period. |
Consultant/Dietitian | Consultant/Dietitian | Ensuring that the processes within its duty comply with the retention period and managing the personal data destruction process in accordance with the periodic destruction period. |
Production Personnel | Production | No personal data is processed due to production activities within the scope of its duty. |