Personal Data Retention and Destruction Policy
How the company retains personal data and under which conditions it deletes or destroys it.
Last updated: April 14, 2026
This page is a translation prepared from the Turkish source documents. In case of conflict, the Turkish version prevails.
1. Purpose and scope
This policy explains why personal data belonging to employees, candidates, interns, visitors, website visitors, suppliers, subcontractor representatives, customers, shareholders, and other third parties is retained and how it is deleted, destroyed, or anonymized.
2. Key definitions
| Term | Meaning |
|---|---|
| Destruction | Deletion, destruction, or anonymization of personal data. |
| Relevant person | The natural person whose personal data is processed. |
| Periodic destruction | A destruction process carried out ex officio every six months once deletion conditions are met. |
| Data controller | The natural or legal person determining the purposes and means of processing. |
3. Responsibilities
| Role | Responsibility |
|---|---|
| Company manager | Overall approval, implementation, and governance of the policy. |
| Personal data compliance officer | Drafting, updating, application follow-up, and institutional correspondence. |
| Legal counsel | Supporting legal compliance with retention periods and destruction steps. |
| Finance and accounting | Applying retention periods in financial processes and managing periodic destruction. |
4. Storage media
| Electronic media | Non-electronic media |
|---|---|
| Databases, software, portable devices, web and backup systems | Folders, files, and archive rooms |
5. Reasons for retention
The company retains personal data while obligations under KVKK, the Turkish Code of Obligations, the Turkish Commercial Code, labor and social security regulations, tax legislation, and similar rules continue, or while processing purposes remain valid.
- Information security, access control, and operational security.
- Finance, accounting, contracts, and legal affairs.
- Customer relations and request / complaint management.
- Human resources, training, assignment, and career processes.
- Retention, archiving, and audit activities.
6. Reasons for destruction
- Processing conditions disappear or the legal basis changes.
- Explicit consent is withdrawn where consent is the sole basis.
- A deletion or destruction request by the relevant person is accepted.
- A Board decision requires deletion, destruction, or anonymization.
- The maximum retention period expires and no lawful reason remains to keep the data longer.
7. Technical and administrative safeguards
- Maintaining a VERBIS-compliant data inventory and data mapping studies.
- Providing periodic personal data awareness training to employees.
- Reviewing data-processing activities through business-unit analyses.
- Applying the safeguards announced by the Board for special categories of personal data.
8. Periodic destruction
When all processing conditions cease to exist, deletion, destruction, or anonymization is carried out ex officio at the latest every six months in line with the data inventory and this policy.