Privacy Policy (PDPA)
Personal Data Retention and Destruction Policy
Table of Contents
- Legal Basis, Purpose and Scope
- Terms and Definitions
- Deletion, Destruction or Anonymization of Personal Data
- General Provisions
- Policy Annexes and Risk Analysis Reports
- Updates
- Entry into Force and Repeal
1. Legal Basis, Purpose and Scope
Legal Basis
This Policy, prepared by the DATA CONTROLLER, is based on Article 7(3) and Article 22(1)(e) of Law No. 6698 on the Protection of Personal Data and the provisions of the Regulation on the Deletion, Destruction or Anonymization of Personal Data, which was published by the Personal Data Protection Board in Official Gazette No. 30224 dated 28 October 2017 and entered into force on that date.
Purpose
The purpose of this Personal Data Retention and Destruction Policy is to:
- The Personal Data Protection Policy,
- The Personal Data Protection Law,
- National and international legal regulations
establish the processes to be followed by the DATA CONTROLLER, acting as both data processor and data controller, for the destruction of personal data belonging to data subjects after such data has been processed, within the framework of the foregoing.
In this context, the Policy governs the procedures and principles applicable to:
- Deletion,
- Destruction,
- Anonymization
activities.
This Policy also defines the obligations and responsibilities of all parties that:
- Communicate or interact with the DATA CONTROLLER,
- Enter into legal, commercial or financial relationships,
- Are public or private institutions,
- Are natural or legal persons.
The obligations and responsibilities of all such parties are governed by this Policy.
Scope
This Policy applies within the framework of:
- Law No. 6698 on the Protection of Personal Data,
- National and international legislation,
- Regulations,
- Circulars,
- Decisions of regulatory authorities,
- Directives,
- International agreements.
It is implemented in accordance with the foregoing.
The Policy covers all natural persons whose personal data is processed, including in particular:
- Business partners,
- Solution partners,
- Suppliers,
- Employees,
- Customers,
- Shareholders.
It applies to all natural persons whose personal data is processed, including but not limited to the foregoing.
2. Terms and Definitions
Certain key terms used in this Policy are explained below.
Key Definitions
Explicit Consent
Freely given, specific and informed consent relating to a particular matter.
Recipient Group
The category of natural or legal persons to whom the DATA CONTROLLER transfers personal data.
Anonymization
Rendering personal data incapable of being associated with an identified or identifiable person under any circumstances, even when matched with other data.
Data Subject
The natural person whose personal data is processed.
Destruction
The collective term for the following operations performed on personal data:
- Deletion,
- Destruction,
- Anonymization.
It encompasses all of the foregoing operations.
Personal Data
Any information relating to an identified or identifiable natural person.
Processing of Personal Data
Any operation performed on personal data, including:
- Collection,
- Recording,
- Storage,
- Alteration,
- Transfer,
- Classification,
- Restriction of use.
It includes all operations of this nature.
Personal Data Protection Authority
The Turkish Personal Data Protection Authority (KVKK).
Personal Data Protection Law
Law No. 6698 on the Protection of Personal Data, published in Official Gazette No. 29677 dated 7 April 2016.
Data Processor
A natural or legal person who processes personal data on behalf of the data controller under the authority granted by the data controller.
Data Controller
The natural or legal person who determines the purposes and means of processing personal data.
VERBİS
The Data Controllers Registry Information System.
Deletion
Rendering personal data inaccessible and unusable by relevant users.
Destruction of Personal Data
Rendering personal data inaccessible, irretrievable and unusable by anyone.
3. Deletion, Destruction or Anonymization of Personal Data
General
Personal data processed by the DATA CONTROLLER for which the processing conditions have ceased to exist shall be disposed of using the appropriate method of:
- Deletion,
- Destruction,
- Anonymization.
The method appropriate to the circumstances shall be applied.
All operations shall be carried out in accordance with the applicable legislation and this Policy.
Destruction of Data Processed Before the Personal Data Protection Law
Under Provisional Article 1(3) of the Personal Data Protection Law, personal data processed before the Law entered into force was brought into compliance with the applicable legislation within two years of its entry into force.
In this context:
- Explicit consent was obtained from data subjects where required.
- Data was destroyed where the relevant data subject could not be reached.
- Processing operations not requiring explicit consent continued in accordance with statutory requirements.
Destruction of Data Processed After the Personal Data Protection Law
The DATA CONTROLLER shall delete, destroy or anonymize personal data:
- When the processing conditions specified in Articles 5 and 6 of the Personal Data Protection Law cease to exist,
- Ex officio or upon the request of the data subject.
The relevant personal data shall be deleted, destroyed or anonymized accordingly.
Principles Observed During the Destruction Process
- Lawfulness and fairness
- Accuracy and being up to date
- Processing for specified, explicit and legitimate purposes
- Relevance, limitation and proportionality to the processing purpose
- Retention only for the period required
Personal Data Destruction Process
The following operations are performed during the destruction process:
- Identifying the personal data to be destroyed
- Identifying the relevant users
- Determining access authorizations
- Revoking access and recovery authorizations
Deletion of Personal Data
Definition
Rendering personal data inaccessible and unusable by relevant users.
Deletion Methods Used
Deletion of Data in Cloud Environments
For example, data stored in systems such as:
- Microsoft 365
- Google Drive
- OneDrive
is removed using deletion commands and the associated access authorizations are disabled.
Deletion of Data Stored on Paper
- Redaction is applied.
- Documents are destroyed using shredding machines.
Deletion of Files from a Central Server
- A deletion command is executed on the server.
- User access rights are revoked.
Deletion of Data from Portable Media
Data stored on portable media devices is irretrievably deleted using:
- Encrypted access systems,
- Specialized software.
These methods ensure that the data cannot be recovered.
Deletion of Database Records
Records contained in databases are removed using database commands such as:
- Delete,
- Remove.
The relevant records are removed using such database commands.
Destruction of Personal Data
Definition
Rendering personal data inaccessible, irretrievable and unusable by anyone.
Destruction Methods
Local Systems
One or more of the following methods is applied:
- Degaussing
- Physical destruction
- Overwriting
Peripheral Systems
Data stored on the following devices is destroyed:
- Network devices
- Portable storage devices
- SIM cards
- Printer memory
- Fingerprint systems
Paper Media
Documents are:
- Shredded,
- Destroyed,
- Rendered incapable of being reassembled.
Cloud Environments
The following are used in cloud systems:
- Cryptographic methods,
- Encryption keys.
The keys are destroyed when the service relationship ends.
Anonymization of Personal Data
Definition
Rendering personal data incapable of being associated with an identified or identifiable person, even when matched with other data.
Anonymization Methods Used
Methods That Do Not Introduce Value Distortion
- Variable suppression
- Record suppression
- Local suppression
- Generalization
- Global coding
- Sampling
Methods That Introduce Value Distortion
- Microaggregation
- Data swapping
- Noise addition
4. General Provisions
This Policy:
- Forms an integral part of the Personal Data Protection Policy.
- Tables,
- Diagrams,
- Agreements,
- Job descriptions,
- Undertakings
shall be considered together with all supplementary documents of this nature.
The DATA CONTROLLER reserves the right to publish summary versions in publicly accessible areas instead of the detailed Policy.
5. Policy Annexes and Risk Analysis Reports
The following documents are deemed annexes to this Policy:
- Personal Data Retention and Destruction Policy
- Explicit Consent Declarations
- Delivery records
- Job descriptions
- Data inventory
- Tables and diagrams
- Risk analysis reports
6. Updates
This Policy shall be reviewed and updated at least once a year.
Updates shall be monitored through the quality management system.
7. Entry into Force and Repeal
Entry into Force
This Policy shall enter into force on the date it is published on the DATA CONTROLLER’s website.
Repeal
This Policy may be repealed only upon the preparation and entry into force of a new written policy.