Data Protection Notice

RAF GRUP DEPO VE ARSIV RAF SISTEMLERI SAN. TIC. LTD. STI.
PERSONAL DATA PROTECTION, PROCESSING AND PRIVACY POLICY

1- With this Policy, our Company, RAF GRUP DEPO VE ARSIV RAF SISTEMLERI SAN. TIC. LTD. STI. (the “Company”), sets out the obligations to which it is subject and the procedures and principles it will observe in obtaining, processing, erasing, destroying or anonymising the personal data of all those it deals with.

Accordingly, under Personal Data Protection Law No. 6698 (the “Law”), those holding the status of “data subject” include, in particular, job applicants, customers, company shareholders, company officers, visitors, the employees, shareholders and officers of the institutions, subcontractors and suppliers we cooperate with, and third parties.

The terms and conditions governing the personal data processing activities carried out by the Company (the “Data Controller”) under the Law are set out here, with the aim of informing data subjects, ensuring transparency and obtaining their explicit consent in the circumstances described below. The Privacy Policy is published on our Company’s website (www.rafgrup.com) and is made available to data subjects upon request.

This Privacy Policy (the “Policy”) has accordingly been prepared to ensure that personal data is processed in full compliance with Personal Data Protection Law No. 6698 (the “Law”) and to inform data subjects in that regard. Separately from this Policy, a “Policy on the Processing of Employees’ Personal Data” has been issued for the employees of RAF GRUP DEPO VE ARSIV RAF SISTEMLERI SAN. TIC. LTD. STI.

2- This Policy relates to all personal data processed by automated means, or by non-automated means provided it forms part of a data recording system, belonging in particular to job applicants, customers, company shareholders, company officers, visitors, the employees, shareholders and officers of the institutions, subcontractors and suppliers we cooperate with, and third parties.

For the categories of data subjects listed above, this Policy may apply in its entirety or only in part.

3- The legislation in force on the processing and protection of personal data takes precedence. Where there is any inconsistency between the applicable legislation and this Policy, the Company accepts that the legislation in force shall prevail.

4- Data subjects whose personal data is processed within the scope of the Policy are categorised as follows:

5- In the application of this Policy;

ifade eder.

6- Matters relating to the processing of personal data concerning our Company’s job applicants, customers, company shareholders, company officers, visitors, the employees, shareholders and officers of the institutions, subcontractors and suppliers we cooperate with, and third parties are governed by this Policy in accordance with the Law.

7- Personal data obtained with the data subject’s consent or on the other legitimate grounds listed in the Law is processed only to the extent required by the purpose stated in this Policy and in the data subject’s informed consent, or by the legal basis relied on. Where the legal basis ceases to exist and there is no consent, or consent has been withdrawn, all of your personal data will be erased, destroyed or anonymised.

8- Together with the Privacy Policy

• to set out which information belonging to the data subject is collected, and what is and is not done with that data,
• to establish, within the scope of the Law, the responsibilities of the data subject, the data controller and third parties in protecting rights and privacy,
• and to explain how information shared for the purpose of providing a functional and useful service is used.

9- By means of this text, data subjects acknowledge that they have been informed about the processing of their personal data and about the privacy policy, and that they consent to their personal data being used as described here.

10- The personal data processed by the Data Controller is categorised below in accordance with the Personal Data Protection Law. Unless expressly stated otherwise, the term “Personal Data” under the terms and conditions of this Privacy Policy shall cover the information set out below.

11- Under Articles 3 and 7 of the Personal Data Protection Law, anonymised data is not regarded as personal data, and processing activities relating to such data will be carried out without being bound by the provisions of this Privacy Policy.

12- Our Company processes personal data in accordance with the fundamental principles in Article 4 of the Personal Data Protection Law and the principles set out in this Policy. Personal data is also processed only for the purposes and under the conditions within the processing requirements set out in Article 5(2) and Article 6(3) of the Law. Those purposes and conditions are:

• Where expressly stipulated by law,
• that it is mandatory to protect the life or physical integrity of a person who is unable to give consent owing to actual impossibility, or whose consent is not legally valid, or of another person,
• that processing personal data is necessary, provided it is directly related to the conclusion or performance of a contract between the data subject and the data controller,
• Where expressly stipulated by law,
• that it is mandatory in order for the data controller to fulfil its legal obligations,
• that the data has been made public by the data subject,
• that processing is mandatory for the establishment, exercise or protection of a right,
• That processing is mandatory for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject.

The Law, moreover, defines data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, together with biometric and genetic data, as “special category” or “sensitive” personal data, and imposes stricter conditions on its processing. Accordingly, other than where the data subject’s explicit consent has been obtained, special category personal data may be processed only under the following conditions:

• Data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, criminal convictions and security measures, together with biometric and genetic data, may be processed where the law so provides.
• Personal data relating to health and sexual life may be processed only for the purposes of protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing, and only by persons under a duty of confidentiality or by authorised institutions and organisations.

13- Where the conditions set out above are not met, the Company relies on the explicit consent of data subjects in order to carry out processing. On that basis, personal data may be processed for the following purposes, among others:

• In order to carry out the work necessary for data subjects to benefit from the products and services offered by the Company: following up contract processes, customer relations, conducting sales processes, pursuing legal matters, and following up customer requests and complaints,
• Carrying out the work necessary to conduct the Company’s commercial activities, planning corporate communication activities, ensuring business continuity, establishing the information technology infrastructure, following up financial matters, conducting corporate governance activities, carrying out analyses of business activities, planning and administering the information access rights of business partners and suppliers, planning and conducting business activities, and planning and conducting research and development activities,
• In order to plan and administer the Company’s human resources policies and processes: meeting obligations arising from employment contracts and legislation for employees and job applicants, procuring the products and services needed to conduct business activities, monitoring and auditing business activities, planning and administering benefits, conducting recruitment processes, planning performance appraisal processes, planning and delivering in-house training, planning human resources processes, and planning and meeting the human resources needed for production,
• In order to ensure the legal and commercial security of those in a business relationship with the Company: planning and conducting the operational activities needed to ensure company activities are carried out in accordance with company procedures and applicable legislation, planning and conducting occupational health and safety processes, providing information to the authorities as required by legislation, following up legal matters, creating and maintaining visitor records, ensuring the security of company premises and facilities, ensuring the security of company operations, planning and conducting company audits, ensuring data is accurate and up to date, and planning and conducting the company’s financial risk processes,

The Company’s aim is, as a rule, to obtain individuals’ explicit consent in order to fulfil the purposes described. Where the exceptions listed in the Law apply, personal data is kept in a limited and proportionate manner in accordance with those exceptions. Where explicit consent has not been given, processing takes place within the framework of the exceptions set out in the Law. Where neither the exceptions in the Law permit processing nor explicit consent has been given, personal data is not processed.

14- The personal information in question may also be used to contact the data subject, or to carry out various statistical assessments, build databases and conduct market research without disclosing the data subject’s identity.

15- The Company may process the personal data of employees with whom it has an employment relationship, without seeking consent, to the extent necessary for the performance of the employment contract, the fulfilment of mutual obligations and compliance with other legal duties. The Company ensures the confidentiality and protection of its employees’ data. Separately from this Policy, a “Policy on the Processing of Employees’ Personal Data” has been issued for the employees of RAF GRUP DEPO VE ARSIV RAF SISTEMLERI SAN. TIC. LTD. STI.

In the case of applications and requests from prospective employees, the Company processes all personal data submitted by the applicant, including CVs, without seeking consent until the application or request is concluded. Processing after an application has been concluded unsuccessfully depends on the individual’s consent. Where consent is given, the personal data may be transferred to third parties. Otherwise, once the request or application has been definitively concluded unsuccessfully, the data is erased, destroyed or anonymised. Where a request or application is concluded wholly or partly successfully, personal data is retained and processed according to the terms of the new legal relationship established.

16- The camera monitoring carried out by our Company is conducted in accordance with the Law on Private Security Services and the personal data processing conditions set out in the Personal Data Protection Law.

The Company informs data subjects in accordance with Article 10 of the Personal Data Protection Law. It gives notice of camera monitoring by more than one means: notices stating that monitoring is in operation are displayed at the entrances to the areas concerned. The aim is to prevent harm to the fundamental rights and freedoms of data subjects and to ensure transparency and proper notification.

In accordance with Article 4 of the Personal Data Protection Law, the Company processes personal data in a manner connected with, limited to and proportionate to the purpose of processing.

The purpose of the Company’s video camera monitoring is limited to the purposes listed in this Policy. Accordingly, the areas covered by security cameras, their number and the times at which monitoring takes place are set at a level sufficient for, and limited to, the security purpose. Monitoring is not carried out in areas where it could intrude on privacy beyond what those security purposes require.

In accordance with Article 12 of the Personal Data Protection Law, the Company takes the technical and administrative measures necessary to secure the personal data obtained through camera monitoring.

Only a limited number of company employees have access to live camera footage and to recordings stored and retained digitally.

The Company carries out personal data processing to track visitors’ entry and exit, for security purposes and for the purposes set out in this Policy. The names of those visiting our Company are processed solely to track entry and exit, and the data concerned is recorded in the physical and electronic recording system.

To secure the premises where it conducts its business, the Company carries out personal data processing at its head office buildings and facilities through security camera monitoring and recording, access card readers and identity records, and by tracking visitor entry and exit. Camera monitoring, identity checks at entrances, card reading and the recording of these serve to protect the interests of the Company and others in maintaining security. In accordance with Article 12 of the Law, the Company takes the technical and administrative measures necessary to secure the personal data obtained through camera monitoring and identity records.

17- The data controller may share personal data, and new data obtained from the use of that personal data, with third parties such as outsourced service providers (including those sending e-mail and SMS, and hosting services), law firms, company officers, business partners, public institutions authorised by law and private organisations, in order to fulfil the purposes set out in the Privacy Policy and the Personal Data Processing Information and Consent Text, to carry out the work needed for individuals to benefit from the services offered, to conduct commercial activities and the related business processes, to ensure security, to detect fraudulent or unauthorised use, to carry out operational assessment research, and to fulfil any of these purposes.

18- Personal data collected on the legal grounds set out above may be processed and transferred for the purposes stated in the applicable legislation and in this Privacy Policy. In pursuit of legitimate and lawful processing purposes, the Company may transfer personal data to third parties on the basis of, and limited to, one or more of the processing conditions set out in Article 5 of the Personal Data Protection Law, listed below:

• if the data subject has given explicit consent,
• Where there is an explicit provision in law regarding the transfer of personal data,
• where it is mandatory to protect the life or physical integrity of the data subject or another person, and the data subject is unable to give consent owing to actual impossibility or their consent is not legally valid;
• Where the transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,
• Where the transfer of personal data is mandatory for the Company to fulfil its legal obligation,
• Where the personal data has been made public by the data subject,
• if the transfer of personal data is mandatory for the establishment, exercise or protection of a right,
• if the transfer of personal data is mandatory for the Company’s legitimate interests, provided it does not harm the fundamental rights and freedoms of the data subject.

Exercising due care, taking the necessary security measures and applying the adequate safeguards prescribed by the Personal Data Protection Board, the Company may transfer the data subject’s special category personal data to third parties in the following circumstances, in pursuit of legitimate and lawful processing purposes.

• Where the data subject has given explicit consent, or
• Where the data subject has not given explicit consent: their special category personal data other than data concerning health and sexual life (namely data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, criminal convictions and security measures, together with biometric and genetic data) may be transferred where the law so provides; while their special category personal data concerning health and sexual life may be transferred only for the purposes of protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing, and only by persons under a duty of confidentiality or by authorised institutions and organisations.

19- In pursuit of legitimate and lawful processing purposes, the Company may transfer personal data to foreign countries offering adequate protection, or where the data controller undertakes to provide adequate protection, either with the data subject’s explicit consent or, in its absence, where one of the following applies:

• Where there is an explicit provision in law regarding the transfer of personal data,
• where it is mandatory to protect the life or physical integrity of the data subject or another person, and the data subject is unable to give consent owing to actual impossibility or their consent is not legally valid;
• Where the transfer of personal data belonging to the parties to a contract is necessary, provided that it is directly related to the establishment or performance of that contract,
• Where the transfer of personal data is mandatory for the Company to fulfil its legal obligation,
• Where the personal data has been made public by the data subject,
• if the transfer of personal data is mandatory for the establishment, exercise or protection of a right,
• if the transfer of personal data is mandatory for the Company’s legitimate interests, provided it does not harm the fundamental rights and freedoms of the data subject.

20- Exercising due care, taking the necessary security measures and applying the adequate safeguards prescribed by the Personal Data Protection Board, the Company may transfer the data subject’s special category data to foreign countries offering adequate protection, or where the data controller undertakes to provide adequate protection, in the following circumstances, in pursuit of legitimate and lawful processing purposes.

• Where the data subject has given explicit consent, or
• Where the data subject has not given explicit consent: their special category personal data other than data concerning health and sexual life (namely data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, criminal convictions and security measures, together with biometric and genetic data) where the law so provides; and their special category personal data concerning health and sexual life only where processed for the purposes of protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing, by persons under a duty of confidentiality or by authorised institutions and organisations.

21- Personal data collected on the legal grounds set out above may be processed and transferred for the purposes stated in Articles 5 and 6 of Law No. 6698 and in this Privacy Policy.

22- Under Article 11 of the Law, data subjects have the following rights

• to learn whether personal data concerning them is being processed,
• to request information if personal data concerning them has been processed,
• to learn the purpose of processing and whether the data is used in line with that purpose,
• to know the third parties in Turkey or abroad to whom the personal data is transferred,
• to request correction where personal data has been processed incompletely or inaccurately,
• to request the erasure or destruction of personal data where the reasons requiring its processing have ceased to exist, even though it was processed in accordance with the Law and other applicable legislation,
• to request that any correction, erasure or destruction carried out be notified to the third parties to whom the personal data was transferred,
• to object to a result to their detriment arising from the analysis of processed data solely by automated systems,
• and to claim compensation where they suffer loss because personal data has been processed unlawfully.

23- Under Article 13(1) of the Personal Data Protection Law, you must submit your request to exercise the rights set out above to our Company in writing, or by the other methods determined by the Personal Data Protection Board.

Accordingly, when applying to our Company under Article 11 of the Personal Data Protection Law, you may send your request by registered post with return receipt to the address below, together with the information necessary to establish your identity and an explanation of the right you wish to exercise, stating which of the rights set out in Article 11 your request concerns:

RAF GRUP DEPO VE ARSIV RAF SISTEMLERI SAN. TIC. LTD. STI.
ADDRESS: Kocaeli KOBI OSB, Koseler Mah. 26. Sk. No: 10 Dilovasi / KOCAELI 

Requests may not be made by third parties on behalf of data subjects. For anyone other than the data subject to submit a request, there must be a special power of attorney on the matter issued by the data subject in favour of the person making the application.

24- In accordance with Article 13 of the Personal Data Protection Law, our Company concludes application requests made by data subjects free of charge, as soon as possible and in any event within 30 (thirty) days, depending on the nature of the request. Where the process entails an additional cost, however, the fee set out in the tariff determined by the Board may be charged.

Our Company may accept the data subject’s application, or may reject it for the reasons listed below by explaining its grounds, and may communicate its response to the data subject in writing or electronically.

• Where it would impede the rights and freedoms of others,
• Requiring disproportionate effort,
• Where the information is publicly available,
• Endangering the privacy of others,

Where one of the cases falling outside the scope of the Personal Data Protection Law applies, or where the data subject’s application is rejected, the response is found inadequate, or no response is given within the time allowed, the data subject has the right to complain to the Personal Data Protection Board within thirty days of learning the data controller’s response and, in any event, within sixty days of the date of application.

The Company takes the technical and administrative measures necessary, under the conditions set out in the applicable legislation or in this Privacy Policy, to prevent the unlawful processing of personal data, prevent unlawful access to it and ensure its safekeeping. The data controller does not disclose personal data obtained from the data subject to others, or use it outside the purpose of processing, in a manner contrary to this Privacy Policy and the provisions of the Personal Data Protection Law.

25- This Privacy Policy may be updated from time to time to keep pace with changing conditions and legislation.

26- Although the Law sets no specific retention period for personal data, the general principles require that it be retained for the period prescribed in the applicable legislation or for as long as necessary for the purpose of processing. In order to set retention periods in line with that principle, the Company as data controller assesses each processing activity against the legislation in force and the purpose of the process. Accordingly, personal data is retained at least for the period required by legal obligations and until the relevant limitation periods under the Law have expired.

Personal data may be retained in order to mount the necessary defence in any dispute that may arise between you and the data controller. Including on the expiry of the periods mentioned, once the purpose of processing the personal data concerned ceases to exist in any process, the data is anonymised, erased or destroyed in accordance with the Law.

27- The personal data we collect must be accurate and, where necessary, kept up to date. If any of your personal data changes, you may therefore notify the relevant department of our Company.

28- Our Company makes the necessary internal appointments and establishes procedures accordingly in order to fulfil its obligations under the Personal Data Protection Law and to implement the matters set out in this Policy.

The policy containing the articles set out above is provided to data subjects together with the other relevant information and consent texts, notably the “RAF GRUP DEPO VE ARSIV RAF SISTEMLERI SAN. TIC. LTD. STI. Information and Consent Text on the Personal Data Protection, Processing and Privacy Policy”. The policy is also provided and made accessible to data subjects on request.

RAF GRUP DEPO VE ARSIV RAF SISTEMLERI SAN. TIC. LTD. STI.
PERSONAL DATA RETENTION AND DESTRUCTION POLICY

1- The Personal Data Retention and Destruction Policy (the “Policy”) has been prepared by RAF GRUP DEPO VE ARSIV RAF SISTEMLERI SAN. TIC. LTD. STI. (the “Company”) in its capacity as data controller, in accordance with Personal Data Protection Law No. 6698 and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data, in order to set out the procedures and principles governing our obligations and to inform data subjects about the principles for determining the maximum retention period necessary for the purpose of processing and about the erasure, destruction and anonymisation processes.

2- Within the scope of this Policy, the natural persons whose data is processed by automated or non-automated means as part of a data recording system include customers, prospective customers, job applicants, employees, company shareholders, company officers, visitors, business partners, the employees, shareholders and officers of the institutions, subcontractors and suppliers we cooperate with, and third parties.

The Policy applies to all activities carried out by our Company for the processing and protection of personal data.

3- This policy is published on our Company’s website (www.rafgrup.com) and is made available to data subjects upon request.

4- In the application of this Policy, its category,

• Data Subject: persons who process personal data within the data controller’s organisation, or on the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of data,
• Destruction: the erasure, destruction or anonymisation of personal data,
• Kanun: Personal Data Protection Law No. 6698,
• Recording medium: any medium containing personal data processed wholly or partly by automated means, or by non-automated means provided that it forms part of a data recording system,
• Personal data: any information relating to an identified or identifiable natural person,
• Personal data subject: the natural person whose personal data is processed,
• Processing of personal data: any operation performed on personal data, such as obtaining, recording, storing, retaining, altering, reorganising, disclosing, transferring, taking over, making available, classifying or preventing the use of that data, whether wholly or partly by automated means or by non-automated means provided it forms part of a data recording system,
• Personal data processing inventory: the inventory in which data controllers set out the personal data processing activities they carry out in connection with their business processes, linking them to the purposes of processing, the data category, the recipient group to which data is transferred and the group of data subjects, and detailing the maximum period necessary for the purposes of processing, the personal data intended to be transferred to foreign countries and the measures taken for data security,
• Kurul: the Personal Data Protection Board,
• Kurum: the Personal Data Protection Authority,
• Special category personal data: data relating to a person’s race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, together with their biometric and genetic data,
• Periyodik imha: the erasure, destruction or anonymisation carried out of the controller’s own motion at the recurring intervals stated in the personal data retention and destruction policy, where all the processing conditions set out in the Law have ceased to exist,
• Data Retention and Destruction Policy: this Policy, on which data controllers rely in determining the maximum period necessary for the purpose of processing and in carrying out erasure, destruction and anonymisation,
• Personal Data Protection, Processing and Privacy Policy: the policy published on the Company’s website setting out the procedures and principles for managing personal data,
• Sicil: the registry of data controllers maintained by the Personal Data Protection Authority,
• Data processor: the natural or legal person who processes personal data on behalf of the data controller, on the authority granted by the controller,
• Data recording system: the recording system in which personal data is processed, structured according to specific criteria,
• Veri sorumlusu: Means the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.

For terms not defined in this Policy, the definitions in the Law apply.

5- All department managers of the Company give active support to the proper implementation of the technical and administrative measures relating to the processing, retention and destruction of personal data within their departments. To that end they provide training and raise awareness among their staff, monitor and audit operations, and assist in preventing the unlawful processing of personal data and unlawful access to processed data, and in taking and applying technical and administrative measures for data security.

Provides active support so that processing, retention and destruction operations relating to personal data are carried out in accordance with legislation, by increasing the knowledge and awareness of relevant users on personal data protection.

The titles, departments and job descriptions of those involved in personal data retention and destruction processes are as follows:

• General Manager: As the data controller representative, responsible for carrying out all operations relating to the protection and destruction of personal data and for implementing the policy.
• Human Resources Manager: Responsible for preparing, developing and implementing the policy, publishing and updating it in the relevant media,
  
  ensuring that the processes within their remit comply with retention periods, managing the personal data destruction process in line with the periodic destruction cycle, and providing training and information.
• Accounting Manager: Responsible for preparing, developing and implementing the policy, publishing and updating it in the relevant media, ensuring that the processes within their remit comply with retention periods, and managing the personal data destruction process in line with the periodic destruction cycle.
• Information Systems Manager: Responsible for the technical storage, protection and backup of data, and for identifying and implementing the technical solutions required to apply the policy.
• Other Department Managers: Responsible for applying the policy within their own departments and for monitoring and auditing that application, ensuring that the processes within their remit comply with retention periods, and managing the personal data destruction process in line with the periodic destruction cycle.
• Relevant Users and Data Processors: Responsible for ensuring that data processing and retention operations comply with procedure and the law.
• Specially Authorised Relevant User: Responsible for protecting and retaining personal data erased under the procedure or at the data subject’s request until it is destroyed, and for ensuring it is not accessed by relevant users.

6- Personal data held by the Company is kept in a recording medium appropriate to the nature of the data concerned. The recording media used for storing personal data are set out below. Personal data may, however, be held in a medium other than those stated here where its nature requires. In every case the Company, as data controller, processes and protects personal data within the framework of international data security principles, in accordance with the Law, the Personal Data Protection, Processing and Privacy Policy and this Personal Data Retention and Destruction Policy.

Elektronik Ortamlar; Other digital media such as servers, portable drives, software, information security devices, employee computers, optical discs, removable memory, printers, scanners and photocopiers.

Fiziki Ortamlar; Other media in which data is kept printed on paper or microfilm, such as paper, manual data recording systems and written, printed or visual media.

Bulut Ortamlar; Media that are not held on the Company’s own premises but are used by the Company, involving encrypted internet-based systems.

7- All the administrative and technical measures taken within the framework of the principles in Article 12 of the Personal Data Protection Law, in order to store your personal data securely, prevent its unlawful processing and access to it, and destroy it lawfully, are set out below.

Teknik Tedbirler

The following technical measures are taken for all media in which personal data is stored, appropriate to the nature of the data and of the medium concerned:

• Only current and secure systems in line with technological developments are used in the media where personal data is kept.
• Security systems are used for the media in which personal data is kept.
• Security tests and research are carried out to identify vulnerabilities in information systems, and matters presenting an actual or potential risk that are identified as a result are remedied.
• Access to the media in which personal data is kept is restricted so that only authorised persons may access that data, and only within the limits of the purpose for which it is stored; all access is logged. Whether the data is of a special category, and its degree of importance, are also taken into account when restricting access.
• The Company maintains sufficient technical staff to secure the media in which personal data is kept, and ensures that the access rights of information technology staff to personal data are kept under control.
• The destruction of personal data is carried out so that it cannot be recovered and leaves no audit trail.
• Under Article 12 of the Law, all digital media in which personal data is stored is protected by encrypted methods meeting information security requirements.

Administrative Measures

The following administrative measures are taken for all media in which personal data is stored, appropriate to the nature of the data and of the medium concerned:

• Work is carried out to raise the awareness of all company employees with access to personal data on information security, personal data and privacy.
• Legal and technical consultancy services are obtained in order to follow developments in information security, privacy and personal data protection and to take the necessary action.
• Where personal data is transferred to third parties for technical or legal reasons, protocols are signed with those third parties for the protection of personal data, and all due care is taken to ensure they comply with their obligations under those protocols.
• Where processed personal data is obtained unlawfully by others, this is reported to the data subject and to the Board as soon as possible.
• The Company carries out and commissions the necessary audits to ensure the provisions of the Law are applied, and remedies any privacy and security weaknesses revealed by those audits.

8- Personal data belonging to data subjects is stored securely by the Company in physical or electronic media, within the limits set out in the Personal Data Protection Law and other applicable legislation, in particular in order to sustain commercial activities, meet legal obligations, plan and provide employee rights and benefits, manage customer relations and fulfil the other purposes set out in the Personal Data Protection, Processing and Privacy Policy. Personal data held by the Company is erased, destroyed or anonymised in accordance with this destruction policy at the data subject’s request or, of the Company’s own motion, where the grounds listed in Articles 5 and 6 of the Law cease to exist. The grounds listed in Articles 5 and 6 of the Law are as follows:

• Where expressly stipulated by law.
• That it is mandatory to protect the life or physical integrity of a person who is unable to give consent owing to actual impossibility, or whose consent is not legally valid, or of another person.
• That processing personal data belonging to the parties to a contract is necessary, provided it is directly related to the conclusion or performance of that contract.
• That it is mandatory in order for the data controller to fulfil its legal obligation.
• That the data has been made public by the data subject.
• That processing is mandatory for the establishment, exercise or protection of a right.
• That processing is mandatory for the legitimate interests of the data controller, provided it does not harm the fundamental rights and freedoms of the data subject.

9- The procedures and principles for the techniques used by the Company to erase and destroy personal data are set out below.

DELETION OF PERSONAL DATA

Redaction of Personal Data Held on Paper: the method of physically cutting the personal data out of the document, or making it invisible using permanent ink so that it cannot be recovered or read by technological means.

Secure Deletion from Software: the method of erasing personal data held in the cloud or on local digital media so that it can never be accessed again.

DESTRUCTION OF PERSONAL DATA

Fiziksel Yok Etme: A system of physically destroying personal data so that it cannot subsequently be used is applied. Paper documents are destroyed with shredders so that they cannot be reassembled. Optical and magnetic media containing personal data are destroyed physically, by melting, incineration or reduction to dust.

De-manyetize Etme: the method of passing magnetic media through special devices that expose it to strong magnetic fields, corrupting the data so that it becomes unreadable.

Overwriting: A destruction method that removes any possibility of reading or recovering the old data by writing random data made up of 0s and 1s over magnetic media and rewritable optical media at least seven times using specialist software.

ANONYMISATION OF PERSONAL DATA

Removing variables: the method of anonymising data by removing the highly descriptive variables from the data set created after the data collected about the data subject has been brought together.

Regional masking: Where a single data item is identifying because it creates a rarely occurring combination, masking that data achieves anonymisation. This is the process of deleting information that could be distinguishing in relation to such exceptional data.

Generalisation: the process of bringing together personal data belonging to many people and turning it into statistical data by removing distinguishing information.

Lower and Upper Bound Coding: the method of anonymising data by combining the values in a data group containing predefined categories according to a set criterion.

Micro aggregation: All data is first arranged in a meaningful order and divided into groups; anonymisation is achieved by replacing the relevant data in each group with the value obtained from the group average.

Data hashing and perturbation: Direct or indirect identifiers within the personal data are mixed with other values or perturbed so that their link to the data subject is broken and they lose their identifying quality.

10- Retention and Destruction Periods

11- Although the Law sets no specific retention period for personal data, the general principles require that it be retained for the period prescribed in the applicable legislation or for as long as necessary for the purpose of processing. In order to set retention periods in line with that principle, the Company as data controller assesses each processing activity against the legislation in force and the purpose of the process. Where legislation prescribes a longer period, or provides a longer period for limitation, forfeiture or retention, the periods in the legislation are taken as the maximum retention period. Accordingly, personal data is retained at least for the period required by legal obligations and until the relevant limitation periods under the Law have expired.

Personal data may be retained in order to mount the necessary defence in any dispute that may arise between you and the data controller. Including on the expiry of the periods mentioned, once the purpose of processing the personal data concerned ceases to exist in any process, the data is anonymised, erased or destroyed in accordance with the Law.

12- Personal data whose retention period has expired or whose purpose of retention has ceased is erased, destroyed or anonymised every six months by means of the operations carried out of the Company’s own motion at recurring intervals as set out in this Personal Data Retention and Destruction Policy. Periodic destruction is additionally carried out in January and July each year.

13- Our Company makes the necessary internal appointments and establishes procedures accordingly in order to fulfil its obligations under the Personal Data Protection Law and to implement the matters set out in this Policy.

14- Changes in company activities and in the categories of personal data processed, amendments to legislation and the principle decisions of the Personal Data Protection Board are monitored, and this policy is reviewed as the need arises, with the relevant sections updated, amended or rewritten