RETENTION AND DISPOSAL POLICY

BAŞARANLAR İNŞAAT MALZEMELERİ TİCARET VE SANAYİ ANONİM ŞİRKETİ

PERSONAL DATA RETENTION AND DESTRUCTION POLICY

Başaranlar İnşaat Malzemeleri Ticaret ve Sanayi Anonim Şirketi (hereinafter referred to as the “Company”) attaches great importance to the security of personal data and the protection of confidentiality. With this awareness, the personal data of data subjects are processed and retained in compliance with the KVK Law No. 6698, the Regulation on the Deletion, Destruction or Anonymization of Personal Data, published in the Official Gazette dated 28 October 2017 and entered into force, which constitutes a secondary regulation of the Law (hereinafter referred to as the “Regulation”), the Regulation on the Registry of Data Controllers, which entered into force on 1 January 2018, and other relevant regulations.

I. Purpose of Preparing the Destruction Policy

The purpose of this Policy is to set out the procedures for the deletion, destruction or anonymization of personal data, processed in accordance with the Personal Data Protection Law, by the Company ex officio or upon the request of the data subject, in the event that the conditions for processing personal data set out in Articles 4, 5 and 6 of the same Law cease to exist.

II. Definitions

Recipient Group: The category of natural or legal persons to whom personal data are transferred by the data controller.

Explicit Consent: Consent that relates to a specific subject, is based on information, and is expressed with free will.

Anonymization: Rendering personal data impossible to link with an identified or identifiable natural person under any circumstances, even by matching them with other data.

Employee: Company Personnel.

Electronic Media: Environments in which personal data can be created, read, modified and written by electronic devices.

Non-Electronic Media: All written, printed, visual and other media apart from electronic media.

Service Provider: A natural or legal person who provides services to the Personal Data Protection Authority within the framework of a specific contract.

Data Subject: The natural person whose personal data are processed.

Relevant User: Persons who process personal data within the data controller’s organization or in line with the authorization and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data.

Destruction: Deletion, destruction or anonymization of personal data.

Law: Law No. 6698 on the Processing of Personal Data.

Recording Medium: Any medium containing personal data that are processed wholly or partially by automated means, or by non-automated means provided that they are part of any data recording system.

Personal Data: Any information relating to an identified or identifiable natural person.

Personal Data Processing Inventory: The inventory that data controllers create by linking the personal data processing activities they carry out depending on their business processes to the purposes and legal grounds for processing personal data, the data category, the recipient group to which the data are transferred and the data subject group, and detail by explaining the maximum retention period necessary for the purposes for which personal data are processed, the personal data envisaged to be transferred to foreign countries, and the measures taken regarding data security.

Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, retaining, modifying, rearranging, disclosing, transferring, taking over, making available, classifying, or preventing the use of personal data, wholly or partially by automated means, or by non-automated means provided that they are part of any data recording system.

Board: The Personal Data Protection Board.

Special Categories of Personal Data: Data relating to individuals’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Periodic Destruction: The deletion, destruction or anonymization process, specified in the personal data retention and destruction policy, to be carried out ex officio at recurring intervals in the event that all of the conditions for processing personal data set out in the Law cease to exist.

Policy: The Personal Data Retention and Destruction Policy

Data Processor: A natural or legal person who processes personal data on behalf of the data controller, based on the authority granted by the data controller.

Data Recording System: The recording system in which personal data are structured according to specific criteria and processed.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Data Controllers Registry Information System: The information system, accessible via the internet, created and managed by the Presidency, which data controllers will use for applications to the Registry and for other related procedures concerning the Registry.

VERBİS: Data Controllers Registry Information System

Regulation: The Regulation on the Deletion, Destruction or Anonymization of Personal Data, published in the Official Gazette dated 28 October 2017.

III. Responsibilities and Distribution of Duties:

All units and employees of the Data Controller actively support the responsible units in the proper implementation of the technical and administrative measures taken by the responsible units within the scope of the Policy, in the training and awareness-raising of unit employees, and in monitoring and continuous auditing, as well as in taking technical and administrative measures to ensure data security in all environments where personal data are processed, in order to prevent the unlawful processing of personal data, prevent unlawful access to personal data, and ensure the lawful retention of personal data.

The distribution of the titles, units and job descriptions of those who take part in the retention and destruction processes of personal data is given in Table 1.

Table 1: Distribution of duties regarding the retention and destruction process

IV. Recording Media

The Company acts as a data controller in all circumstances. It processes and protects personal data in accordance with the Law, the Personal Data Processing and Protection Policy and this Personal Data Retention and Destruction Policy.

Electronic Media: Electronic media are servers (domain, backup, e-mail, database, web, file sharing, etc.), software (office software, portal, etc.), information security devices (firewall, intrusion detection, blocking, log files, antivirus, etc.), backup cartridges, personal computers (desktop, laptop), mobile devices (phone, tablet, etc.), optical discs (CD, DVD, etc.), removable memory (USB, memory card, etc.) and other electronic data recording media such as printers, scanners and photocopiers.

Non-Electronic Media: Paper, manual data recording systems (survey forms, visitor logbook), and written, printed and visual media.

V. Explanations on Retention and Destruction

The concept of “processing of personal data” is defined in Article 3 of the KVK Law; Article 4 states that processed personal data must be “relevant, limited and proportionate to the purposes for which they are processed, and retained for the period stipulated in the relevant legislation or required for the purpose for which they are processed,” and Articles 5 and 6 list the “conditions for processing personal data.”

Accordingly, within the scope of our Company’s activities, personal data are retained for the period stipulated in the relevant Legislation or for a period appropriate to our processing purposes.

A) Legal Grounds for Retention

At the Company, personal data processed within the scope of its activities are retained for the period stipulated in the relevant legislation.

 In this context, personal data are retained for the retention periods envisaged within the framework of;

• Personal Data Protection Law No. 6698,
• Turkish Code of Obligations No. 6098,
• Public Procurement Law No. 4734,
• Civil Servants Law No. 657,
• Social Insurance and General Health Insurance Law No. 5510,
• Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications,
• Public Financial Management and Control Law No. 5018,
• Occupational Health and Safety Law No. 6361,
• Right to Information Law No. 4982,
• Law No. 3071 on the Use of the Right of Petition,
• Labor Law No. 4857,
• Higher Education Law No. 2547,
• Retirement Health Law No. 5434,
• Social Services Law No. 2828
• Regulation on Health and Safety Measures to Be Taken in Workplace Buildings and Annexes,
• Regulation on Archive Services,
• and other secondary regulations in force pursuant to these laws.

B) Processing Purposes Requiring Retention

The Company retains the personal data it processes within the scope of its activities for the following purposes.

• Managing human resources processes,
• Ensuring corporate communication,
• Ensuring Company security,
• Ensuring the commercial operation of the Company,
• Managing customer relations,
• Performing work and transactions as a result of signed contracts and protocols,
• Within the scope of VERBİS, determining the preferences and needs of employees, data controllers, contact persons, data controller representatives and data processors, arranging the services provided accordingly and updating them when necessary,
• Ensuring the fulfillment of legal obligations as required or mandated by legal regulations,
• Maintaining contact with natural / legal persons who have a business relationship with the Company,
• Concluding the requests and complaints of data subjects within the scope of the Personal Data Protection Law,
• Ensuring that the necessary technical measures are taken within the scope of the Law,
• Data are retained securely in physical or electronic media, within the limits stipulated in the Law and other relevant legislation, to serve as evidence and fulfill the burden of proof in legal disputes that may arise in the future.

VI. REASONS REQUIRING DESTRUCTION

Personal data are deleted, destroyed or anonymized by the data controller, ex officio or upon the request of the data subject, using destruction methods in the following cases;

• Amendment or repeal of the relevant legislative provisions that form the basis for processing,
• Disappearance of the purpose requiring processing or retention,
• In cases where the processing of personal data takes place solely on the basis of explicit consent, withdrawal of explicit consent by the data subject,
• Acceptance by the Authority of the data subject’s application for the deletion and destruction of their personal data within the framework of their rights under Article 11 of the Law,
• In cases where the Company rejects the application made to it by the data subject requesting the deletion, destruction or anonymization of their personal data, finds the response given insufficient, or fails to respond within the period stipulated in the Law; the data subject lodging a complaint with the Board and the Board finding this request appropriate,
• Where the maximum period requiring the retention of personal data has passed and there is no condition that would justify retaining the personal data for longer, they are deleted, destroyed by the Company upon the request of the data subject, or deleted, destroyed or anonymized ex officio.

VII. Technical and Administrative Measures

Başaranlar İnşaat Malzemeleri Ticaret ve Sanayi Anonim Şirketi, in accordance with Article 12 of the KVK Law, takes the necessary technical and administrative measures to ensure an appropriate level of security in order to prevent the unlawful processing of the personal data it processes, prevent unlawful access to data and ensure the safekeeping of data, and carries out or has carried out the necessary audits in this context.

A) Technical Measures

• Technical measures appropriate to technological developments are taken, and the measures taken are periodically updated and renewed.
• Network security and application security are ensured.
• Security measures are taken within the scope of the procurement, development and maintenance of information technology systems.
• Risks aimed at preventing the unlawful processing of personal data are identified, technical measures appropriate to these risks are ensured, and technical controls are carried out on the measures taken.
• Access procedures are established within the Company, and reporting and analysis work regarding access to personal data is carried out.
• Access to the storage areas where personal data are kept is recorded, and inappropriate access or access attempts are kept under control.
• The Company takes the necessary measures to ensure that deleted personal data are inaccessible and non-reusable for relevant users.
• The Company takes the necessary measures to ensure that deleted personal data are inaccessible and non-reusable for relevant users.
• Strong passwords are used in the electronic media where personal data are processed.
• Access to personal data stored in electronic or non-electronic media is restricted according to access principles.
• A separate policy has been established for the security of special categories of personal data.
• Training on the security of special categories of personal data has been provided to employees involved in the processing of such data, confidentiality agreements have been made, and the authorizations of users with access to the data have been defined.
• Adequate security measures are taken in the physical environments where special categories of personal data are processed, kept and/or accessed, and unauthorized entry and exit are prevented by ensuring physical security.
• To ensure the security of information systems against environmental threats, hardware measures are taken (such as an access control system allowing only authorized personnel to enter the system room, a 24/7 employee monitoring system, ensuring the physical security of the edge switches forming the local area network, a fire extinguishing system, an air conditioning system, etc.).

B) Administrative Measures

• Employees receive awareness training on the technical measures to be taken to prevent unlawful access to personal data.
• Confidentiality undertakings are made.
• A disciplinary procedure to be applied to employees who do not comply with security policies and procedures has been prepared.
• A Personal Data Inventory is prepared and updated over the course of the process.
• The obligation to inform data subjects is fulfilled.
• Personal data are minimized as much as possible.
• Periodic and random internal audits are carried out.

VIII. Personal Data Destruction Techniques

At the end of the period stipulated in the relevant Legislation or the retention period necessary for the purpose for which they are processed, personal data are destroyed by the Company, ex officio or upon the application of the data subject, in accordance with the relevant legislative provisions, using the techniques specified below.

A) Deletion of Personal Data

Deletion of personal data is the process of rendering personal data inaccessible and non-reusable in any way for relevant users.

• Personal data on paper will be processed using the blackout method, by striking through, painting over, cutting out or erasing.
• Personal data in electronic media for which the period requiring retention has expired are rendered inaccessible and non-reusable in any way for employees (relevant users) other than the database administrator.
• Personal data kept in flash-based storage media for which the period requiring retention has expired are encrypted by the system administrator, and access authorization is given only to the system administrator; the encryption keys are stored in secure environments.
• When necessary, they will be securely deleted with the assistance of an expert.

B) Destruction of Personal Data

• Personal data on paper for which the period requiring retention has expired are destroyed in paper shredders in an irreversible manner.
• Personal data on optical media and magnetic media for which the period requiring retention has expired are physically destroyed by melting, burning or pulverizing. In addition, magnetic media are passed through a special device and exposed to a high-value magnetic field, so that the data on them become unreadable.

C) Anonymization of Personal Data

Anonymization of personal data means rendering personal data impossible to link with an identified or identifiable natural person under any circumstances, even by matching them with other data.

For personal data to be anonymized, they must be rendered impossible to link with an identified or identifiable natural person, even through the use of techniques appropriate to the recording medium and the relevant field of activity, such as the data being reversed by the data controller or third parties and/or being matched with other data.

In accordance with Article 28 of the KVK Law, anonymized personal data may be processed for purposes such as research, planning and statistics. Such processing is outside the scope of the KVK Law, and the explicit consent of the personal data subject will not be sought.

The Company may decide ex officio on the deletion, destruction or anonymization of personal data and may freely determine the method to be used according to the category it has selected. In addition, within the scope of Article 13 of the Regulation, if the data subject selects one of the categories of deletion, destruction or anonymization of their personal data at the time of application, the Company shall likewise be free regarding the methods to be used within the relevant category.

IX. Retention and Destruction Periods

With regard to the personal data processed by the Company within the scope of its activities;

• Retention periods on a personal data basis for all personal data within the scope of activities carried out depending on processes are included in the Personal Data Processing Inventory,
• Retention periods on a data category basis are included in the VERBİS registration,
• Retention periods on a process basis are included in the Personal Data Retention and Destruction Policy.

The destruction process of personal data is carried out by the Company in line with the retention periods determined for each relationship in accordance with the relevant legislation.

Personal data whose retention periods have expired are deleted, destroyed and anonymized in the periodic destruction periods determined by the Company.

Table 2: Retention and destruction periods

X. Periodic Destruction Period

Pursuant to Article 11 of the Regulation, the Company has determined the periodic destruction period as 6 months. Accordingly, periodic destruction is carried out at the Company every year in June and December.

XI. Publication and Retention of the Policy

The Policy is published in two different media, namely wet-signed (printed paper) and electronic form; it is also published on the Company’s website and made available to the relevant persons upon the request of personal data subjects. The printed paper copy is also kept in the KVKK File by the Accounting unit.

XII. Updating and Repeal of the Policy

The Company reserves the right to make the necessary arrangements and adapt the amendments if needed, in accordance with changed and updated provisions of the Legislation and the Regulation.

The Policy is deemed to have entered into force following its publication on the Company’s website.

Başaranlar İnşaat Malzemeleri Ticaret ve Sanayi Anonim Şirketi

Merkezefendi Caddesi No:47/A Postal Code:20020 Merkezefendi/Denizli