INTRODUCTION
Purpose
The Personal Data Retention and Destruction Policy (“Policy“) has been prepared in order todetermine the procedures and principles regarding the retention and destruction activities carriedout by Alon Metal San. ve Tic. Ltd. Şti. (“DORLIVA”).
In line with its mission, vision and fundamental principles determined in its Strategic Plan, DORLIVA has adopted as a priority the processing of personal data belonging to its employees, employee candidates, business partners, suppliers, visitors and other third parties in accordancewith the Constitution of the Republic of Türkiye, international conventions, the Personal Data Protection Law No. 6698 (“Law“), and other relevant legislation, as well as ensuring that data subjects can effectively exercise their rights.
The procedures and practices regarding the retention and destruction of personal data are carriedout by DORLIVA in accordance with this Policy.
Scope
This Policy covers all personal data processed or collected by DORLIVA and applies to allrecording environments in which personal data owned by or managed by DORLIVA areprocessed, as well as all activities relating to the processing of personal data.
Abbreviations and Definitions
Recipient Group: The category of natural or legal persons to whom personal data are transferredby the data controller.
Explicit Consent: Consent given freely, based on information and relating to a specific subject.
Anonymization: Rendering personal data incapable of being associated with an identified oridentifiable natural person under any circumstances, even by matching them with other data.
Employee: Personnel of DORLIVA.
Electronic Environment: Environments in which personal data can be created, read, modifiedand written through electronic devices.
Non-Electronic Environment: All written, printed, visual and other environments outsideelectronic environments.
Service Provider: A natural or legal person providing services to DORLIVA within theframework of a mutually executed agreement.
Data Subject: The natural person whose personal data are processed.
Relevant User: Persons who process personal data within the organization of the data controlleror in accordance with the authority and instructions received from the data controller, excludingthe person or unit responsible for the technical storage, protection and backup of data.
Destruction: The deletion, destruction or anonymization of personal data.
Law: Personal Data Protection Law No. 6698.
Recording Environment: Any environment where personal data processed fully or partially byautomatic means or by non-automatic means provided that they form part of any data recordingsystem are kept.
Personal Data: Any information relating to an identified or identifiable natural person.
Personal Data Processing Inventory: The inventory prepared by data controllers by associatingthe personal data processing activities carried out depending on their business processes with thepurposes and legal grounds for processing personal data, data categories, recipient groups anddata subject groups, and detailing the maximum retention periods required for the purposes forwhich personal data are processed, the personal data intended to be transferred abroad, and themeasures taken regarding data security.
Processing of Personal Data: Any operation performed on personal data such as obtaining, recording, storing, retaining, altering, reorganizing, disclosing, transferring, taking over, makingavailable, classifying or preventing the use of personal data by wholly or partly automatic meansor by non-automatic means provided that they form part of any data recording system.
Board: Personal Data Protection Board.
Special Categories of Personal Data: Data relating to a person’s race, ethnic origin, politicalopinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and securitymeasures, as well as biometric and genetic data.
Periodic Destruction: The deletion, destruction or anonymization of personal data to be carriedout ex officio at recurring intervals specified in the personal data retention and destruction policywhere all conditions requiring the processing of personal data under the Law cease to exist.
Policy: Personal Data Retention and Destruction Policy.
Data Processor: A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
Data Recording System: A recording system in which personal data are processed by beingstructured according to specific criteria.
Data Controller: The natural or legal person responsible for determining the purposes and meansof processing personal data and for establishing and managing the data recording system.
Data Controllers Registry Information System: The information system established andmanaged by the Authority, accessible via the internet, which is used by data controllers forRegistry applications and other related Registry procedures.
VERBIS: Data Controllers Registry Information System.
Regulation: The Regulation on the Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28 October 2017.
Commission: The person or persons assigned by the Board of Directors within the Company forthe management of personal data within the scope of the Law.
RESPONSIBILITIES AND DISTRIBUTION OF DUTIES
All departments and employees of DORLIVA actively support the responsible units in implementing the technical and administrative measures adopted under this Policy, increasing theawareness and training of department personnel, monitoring and continuously auditingcompliance, preventing the unlawful processing of personal data, preventing unlawful access topersonal data, and ensuring the lawful retention of personal data by taking technical andadministrative measures aimed at ensuring data security in all environments where personal data are processed.
The distribution of the titles, departments and duties of those involved in personal data retentionand destruction processes is provided in Table 1.
Table 1: Distribution of Duties in Retention and Destruction Processes
TITLE | DEPARTMENT | DUTY |
Members of the Board of Directors | Management | Responsible for ensuring that employees actin compliance with the Policy. |
Members of theCommission | Commission | Responsible for preparing, developing, implementing, publishing and updating thePolicy in the relevant environments. |
Members of Department | IT Department | Responsible for providing the technicalsolutions required for the implementation of the Policy. |
Members of Department | Legal Department | Responsible for providing the legal andadministrative solutions required for theimplementation of the Policy. |
All Department Managers | Other Departments | Responsible for implementing the Policy in accordance with their respective duties. |
RECORDING ENVIRONMENTS
Personal data are securely retained by the Company in compliance with the law within theenvironments listed in Table 2.
Table 2: Personal Data Storage Environments
Electronic Environments | Non-Electronic Environments |
Servers and Cloud (domain, backup, e-mail, database, web, file sharing, etc.) | Paper |
Software (office software, portal, ERP, etc.) | Manual data recording systems(survey forms, visitor logbooks) |
Information security devices (firewall, intrusion detectionand prevention systems, log records, antivirus software, etc.) | Written, printed and visual media |
Personal computers (desktop, laptop) |
|
Mobile devices (telephone, tablet, etc.) |
|
Optical disks (CD, DVD, etc.) |
|
Removable storage devices (USB drives, memory cards, etc.) |
|
Printers, scanners, photocopy machines |
|
Personnel Attendance Control Systems (where necessary) |
|
EXPLANATIONS ON RETENTION AND DESTRUCTION
Personal data belonging to our employees, customers, potential customers, employeecandidates, company shareholders, company officials, visitors, employees, shareholders andofficials of institutions with which we cooperate, and third parties are retained and destroyed byDORLIVA in accordance with the Law.
Within this scope, detailed explanations regarding retention and destruction are providedbelow.
Explanations on Retention
Article 3 of the Law defines the concept of the processing of personal data. Article 4 states thatprocessed personal data must be relevant, limited and proportionate to the purposes for whichthey are processed and must be retained for the period stipulated by the relevant legislation orrequired for the purpose for which they are processed. Articles 5 and 6 set forth the legal grounds for processing personal data.
Accordingly, within the scope of our Company’s activities, personal data are retained for theperiod stipulated by the relevant legislation or for the period required for the purposes of processing.
Legal Grounds Requiring Retention
Within the scope of its activities, the Company retains the personal data it processes for theperiods prescribed under the relevant legislation.
Processing Purposes Requiring Retention
DORLIVA retains the personal data it processes within the scope of its activities for thefollowing purposes:
Grounds Requiring Destruction
Personal data shall be deleted, destroyed or anonymized where:
In such cases, personal data shall, upon the request of the data subject or ex officio byDORLIVA, be deleted, destroyed or anonymized in accordance with the applicable legislation.
TECHNICAL AND ADMINISTRATIVE MEASURES
In order to ensure the secure retention of personal data, to prevent unlawful processing andunlawful access, and to ensure that personal data are destroyed in accordance with the law, DORLIVA implements technical and administrative measures within the scope of availableopportunities, in accordance with Article 12 of the Law and the adequate measures determinedand announced by the Personal Data Protection Board pursuant to paragraph four of Article 6 of the Law regarding special categories of personal data.
Within this scope, the technical and administrative measures currently implemented byDORLIVA are explained in detail in the “DORLIVA Personal Data Protection andProcessing Policy.”
PERSONAL DATA DESTRUCTION METHODS
At the end of the retention period prescribed under the relevant legislation or required for thepurpose for which the personal data have been processed, personal data shall be destroyed bythe Company ex officio or upon the request of the data subject in accordance with theapplicable legislation by using the methods specified below.
Techniques for the Deletion and Destruction of Personal Data
Although personal data have been processed in accordance with the applicable legislation, where the reasons requiring their processing cease to exist, the Company may delete or destroysuch personal data upon its own decision or upon the request of the data subject. The deletionand destruction techniques most commonly used by the Company are set out below.
Physical Destruction
Personal data may also be processed by non-automatic means, provided that they form part of a data recording system. In the deletion/destruction of such data, the method of physicallydestroying the personal data in such a manner that they cannot be used again is applied.
Secure Deletion Through Software
When deleting/destroying data processed wholly or partially by automatic means and retainedin digital environments, methods are used to permanently delete the data from the relevantsoftware in such a way that they cannot be recovered.
Secure Deletion by an Expert
In certain cases, the Company may engage an expert to delete personal data on its behalf. Insuch cases, the personal data are securely deleted/destroyed by a qualified expert in a mannerthat prevents their recovery.
TECHNIQUES FOR THE ANONYMIZATION OF PERSONAL DATA
The anonymization of personal data refers to rendering personal data incapable of beingassociated with an identified or identifiable natural person under any circumstances, even bymatching them with other data. Where the legal grounds requiring the processing of personaldata lawfully processed by the Company cease to exist, the Company may anonymize suchpersonal data.
Pursuant to Article 28 of the Personal Data Protection Law, anonymized personal data may be processed for purposes such as research, planning and statistics. Such processing falls outsidethe scope of the Personal Data Protection Law and, therefore, the explicit consent of the data subject shall not be required. Since anonymized personal data fall outside the scope of thePersonal Data Protection Law, the rights regulated under this Policy shall not apply to suchdata.
The anonymization techniques that may be used by the Company where necessary are as follows:
Masking
Data masking is a method of anonymizing personal data by removing the principal identifyinginformation from the data set.
Aggregation
Through the data aggregation method, multiple data sets are aggregated, thereby rendering thepersonal data incapable of being associated with any individual.
Data Derivation
Through the data derivation method, a more general content is generated from the content of the personal data, thereby ensuring that the personal data cannot be associated with anyindividual.
Data Mixing
Through the data mixing method, the values contained within the personal data set are mixed in such a way as to sever the link between the values and the individuals.
RETENTION AND DESTRUCTION PERIODS
With respect to the personal data processed by DORLIVA within the scope of its activities:
The retention periods applicable to all personal data processed within the scope of each processand the activities carried out in connection with such processes are determined by DORLIVA in accordance with the retention periods and limitation periods prescribed under the applicablelegislation for the relevant personal data.
Where necessary, such retention periods may be updated by the Management.
Upon the expiry of the applicable retention periods, personal data shall be deleted, destroyed oranonymized ex officio by persons duly authorized by the Management in accordance with theapplicable procedures.
PERIODIC DESTRUCTION PERIOD
Pursuant to Article 11 of the Regulation, DORLIVA has determined the periodic destructionperiod as 12 months. Accordingly, periodic destruction procedures shall be carried out by theCompany every year during the months of january.
PUBLICATION AND RETENTION OF THE POLICY
This Policy is published in two different formats, namely as a wet-ink signed hard copy and in electronic form, and is made publicly available on the Company’s website.
The hard copy of the Policy shall also be retained in the Board of Directors’ records.
POLICY REVIEW PERIOD
The Policy shall be reviewed whenever necessary, and the relevant sections shall be updatedaccordingly.
ENTRY INTO FORCE AND REPEAL OF THE POLICY
This Policy shall be deemed to have entered into force on the date of its execution.
Should a decision be made to repeal the Policy, the previous wet-ink signed hard copies of thePolicy shall be cancelled by the Board of Directors (by affixing a cancellation stamp or writing“Cancelled“), signed accordingly, and retained by the Board of Directors for a minimum periodof five (5) years.
