Legal

Personal Data Retention and Destruction Policy

How the company retains personal data and under which conditions it deletes or destroys it.

Last updated: April 14, 2026

This page is a translation prepared from the Turkish source documents. In case of conflict, the Turkish version prevails.

1. Purpose and scope

This policy explains why personal data belonging to employees, candidates, interns, visitors, website visitors, suppliers, subcontractor representatives, customers, shareholders, and other third parties is retained and how it is deleted, destroyed, or anonymized.

2. Key definitions

Term	Meaning
Destruction	Deletion, destruction, or anonymization of personal data.
Relevant person	The natural person whose personal data is processed.
Periodic destruction	A destruction process carried out ex officio every six months once deletion conditions are met.
Data controller	The natural or legal person determining the purposes and means of processing.

3. Responsibilities

Role	Responsibility
Company manager	Overall approval, implementation, and governance of the policy.
Personal data compliance officer	Drafting, updating, application follow-up, and institutional correspondence.
Legal counsel	Supporting legal compliance with retention periods and destruction steps.
Finance and accounting	Applying retention periods in financial processes and managing periodic destruction.

4. Storage media

Electronic media	Non-electronic media
Databases, software, portable devices, web and backup systems	Folders, files, and archive rooms

5. Reasons for retention

The company retains personal data while obligations under KVKK, the Turkish Code of Obligations, the Turkish Commercial Code, labor and social security regulations, tax legislation, and similar rules continue, or while processing purposes remain valid.

Information security, access control, and operational security.
Finance, accounting, contracts, and legal affairs.
Customer relations and request / complaint management.
Human resources, training, assignment, and career processes.
Retention, archiving, and audit activities.

6. Reasons for destruction

Processing conditions disappear or the legal basis changes.
Explicit consent is withdrawn where consent is the sole basis.
A deletion or destruction request by the relevant person is accepted.
A Board decision requires deletion, destruction, or anonymization.
The maximum retention period expires and no lawful reason remains to keep the data longer.

7. Technical and administrative safeguards

Maintaining a VERBIS-compliant data inventory and data mapping studies.
Providing periodic personal data awareness training to employees.
Reviewing data-processing activities through business-unit analyses.
Applying the safeguards announced by the Board for special categories of personal data.

8. Periodic destruction

When all processing conditions cease to exist, deletion, destruction, or anonymization is carried out ex officio at the latest every six months in line with the data inventory and this policy.

Yükleniyor

2. Key definitions

Term	Meaning
Destruction	Deletion, destruction, or anonymization of personal data.
Relevant person	The natural person whose personal data is processed.
Periodic destruction	A destruction process carried out ex officio every six months once deletion conditions are met.
Data controller	The natural or legal person determining the purposes and means of processing.

3. Responsibilities

Role	Responsibility
Company manager	Overall approval, implementation, and governance of the policy.
Personal data compliance officer	Drafting, updating, application follow-up, and institutional correspondence.
Legal counsel	Supporting legal compliance with retention periods and destruction steps.
Finance and accounting	Applying retention periods in financial processes and managing periodic destruction.

Electronic media

Non-electronic media

Databases, software, portable devices, web and backup systems

Folders, files, and archive rooms

5. Reasons for retention

Information security, access control, and operational security.
Finance, accounting, contracts, and legal affairs.
Customer relations and request / complaint management.
Human resources, training, assignment, and career processes.
Retention, archiving, and audit activities.

6. Reasons for destruction

Processing conditions disappear or the legal basis changes.
Explicit consent is withdrawn where consent is the sole basis.
A deletion or destruction request by the relevant person is accepted.
A Board decision requires deletion, destruction, or anonymization.
The maximum retention period expires and no lawful reason remains to keep the data longer.