Article 2: Definitions and Principles

2.1. Definitions

Below are the definitions of the key terms used within the scope of the Policy:

2.2. Principles

The Company adheres to the following principles in the retention and disposal of personal data:

• The deletion, destruction, and anonymization of personal data are carried out in accordance with the Law, the provisions of the relevant legislation, the Board's decisions, and this Policy.
• All operations within this scope are recorded by the Company and, pursuant to the Regulation and without prejudice to other legal obligations, are retained for at least 3 (three) years.
• Unless otherwise decided by the Board, the appropriate one among the methods of deleting, destroying, or anonymizing personal data ex officio is selected by the Company; upon the request of the data subject, the rationale for the selected method is explained.
• In the event that all of the conditions for processing personal data set out in Articles 5 and 6 of the Law cease to exist, personal data are deleted, destroyed, or anonymized by the Company ex officio or upon the request of the data subject.
• In the event that the data subject applies to the Company:
  • Requests submitted are answered within 30 (thirty) days at the latest.
  • In the event that the data subject to the request has been transferred to third parties, this situation is notified to the relevant third parties and it is ensured that the necessary operations are carried out.

2.3. Recording Media

Personal data are stored by the Company in a lawful and secure manner in the electronic and non-electronic media listed below.

Article 3: Responsibility

The publication, keeping up to date, and monitoring of the implementation of this document is the responsibility of the consultancy department, which assumes the corporate compliance function. The document is reviewed at least on an annual basis.

The relevant department is authorized and responsible for the following matters:

• Making the necessary allocation of duties for the implementation of the policies and procedures and submitting it for management approval,
• Following up on the implementation of the technical and administrative measures taken pursuant to Article 12 of the Law and planning their auditing,
• Following up on the processes related to applications and requests made by personal data owners and ensuring the necessary coordination to resolve any issues that may arise,
• Identifying the matters that need to be carried out to ensure compliance with the KVK Law and the relevant legislation, and overseeing their implementation,
• Conducting relations with the Personal Data Protection Board.

Article 4: Procedures, Technical and Administrative Measures Regarding the Retention and Disposal of Personal Data

Personal data are processed lawfully where the processing of personal data is necessary for the Company to fulfill its obligations within the scope of employment, where data processing is mandatory for the establishment of a right, for benefiting from customer services, consumer rights, and other opportunities and for fulfilling the related commercial, financial, and legal responsibilities and obligations, for ensuring the security of the Company, or for the Company's legitimate purposes.

The main administrative and technical measures taken by the Company within the framework of the principles in Article 12 of the Law, for the purpose of securely storing your personal data, preventing their unlawful processing and access, and lawfully disposing of the data, are set out below.

4.1. Administrative Measures

• Disciplinary regulations containing data security provisions are in place for employees.
• Training and awareness activities on data security are carried out for employees at regular intervals.
• Corporate policies on access, information security, use, retention, and disposal have been prepared and put into practice.
• Confidentiality undertakings are signed.
• The relevant authorizations of employees who change roles or leave employment are revoked.
• The contracts signed contain data security provisions.
• Personal data security policies and procedures have been established.
• Personal data security is monitored.
• The necessary security measures are taken regarding entries to and exits from physical environments containing personal data.
• The security of environments containing personal data is ensured.
• Protocols and procedures for the security of special categories of personal data have been established and are implemented.

4.2. Technical Measures

• Network security and application security are ensured.
• Security measures within the scope of the procurement, development, and maintenance of information technology systems are taken.
• The security of personal data stored in the cloud is ensured.
• Up-to-date anti-virus systems are used.
• Encryption is applied.
• Awareness of data security is ensured among the service providers that process data.

Article 5: Explanations Regarding the Reasons Requiring Retention and Disposal

Personal data belonging to data owners are retained by the Company within the limits specified in the Law and the relevant legislation, in particular for (i) sustaining commercial activities, (ii) fulfilling legal obligations, and (iii) planning and performing employee rights and fringe benefits.

5.1. Reasons Requiring Retention

• Retention of personal data because they are directly related to the establishment and performance of contracts,
• Retention of personal data for the purpose of establishing, exercising, or protecting a right,
• The retention of personal data being mandatory for the legitimate interests of the Company, provided that it does not harm the fundamental rights and freedoms of individuals,
• Retention of personal data for the purpose of the Company fulfilling any of its legal obligations,
• Retention of personal data being expressly stipulated in the legislation,
• The existence of the explicit consent of the data subjects with respect to retention activities that require obtaining the explicit consent of the data owners.

5.2. Reasons Requiring Disposal

Pursuant to the Regulation, in the cases listed below, personal data belonging to data owners are deleted, destroyed, or anonymized by the Company ex officio or upon request:

• The amendment or repeal of the relevant legislative provisions that form the basis for the processing or retention of personal data,
• The disappearance of the purpose requiring the processing or retention of personal data,
• The disappearance of the conditions requiring the processing of personal data set out in Articles 5 and 6 of the Law,
• The data subject withdrawing their consent in cases where personal data are processed solely on the basis of the explicit consent requirement,
• The data controller accepting the deletion, destruction, or anonymization request made by the data subject within the framework of their rights under Article 11 of the Law,
• The Board upholding the complaint made to the Board upon the data controller rejecting the data subject's request or failing to respond within the time limit,
• The absence of any condition that would justify retaining the data for a longer period, despite the expiry of the maximum period requiring the retention of personal data.

Article 6: Retention and Disposal Periods

6.1. In General

The following criteria are taken into account by the Company in determining the retention and disposal periods for personal data obtained in accordance with the Law and the relevant legislation:

• If a period for retaining the relevant personal data is stipulated in the legislation, this period is complied with, and following the expiry of the period, a disposal decision is taken regarding the data.
• If no period is stipulated in the legislation;
  • Personal data are classified as personal data and special categories of personal data based on the definitions in Article 6 of the Law; a separate disposal assessment is also carried out for special categories of personal data.
  • The compliance of the data retention with the principles in Article 4 of the Law (for example, whether there is a legitimate purpose) is assessed; data that constitute a breach are deleted, destroyed, or anonymized.
  • Whether the retention of the data falls within the scope of the exceptions in Articles 5 and 6 of the Law is examined, and reasonable retention periods are determined accordingly.

6.2. Disposal Periods

A summary table regarding the retention, disposal, and periodic disposal periods determined by the Company is provided below:

Personal data whose retention period has expired are deleted, destroyed, or anonymized at 6 (six)-month periods in accordance with the procedures set out in this Policy. Records of these operations are retained for at least 3 (three) years. In cases where the Company's purpose for using the relevant personal data has not ended, where longer retention periods are stipulated in special legislation, or where the statute of limitations for litigation on the relevant matter is longer, these periods are taken as the basis.

Article 7: Entry into Force of the Policy, Breach Situations, and Sanctions

This Policy enters into force upon being announced to all employees and, from the date it enters into force, is binding on all business units, consultants, external service providers, and anyone who processes personal data.

Monitoring whether employees fulfill the requirements of the Policy is the responsibility of the relevant employees' supervisors. When behavior contrary to the Policy is detected, the matter is immediately reported by the relevant employee's supervisor to a higher-level supervisor.