Personal Data Storage and Destruction Policy

Term

Definition

Recipient Group

The category of natural or legal persons to whom personal data is transferred by the data controller.

Explicit Consent

Consent regarding a specific subject, based on information and expressed with free will.

Anonymization

Making personal data impossible to associate with an identified or identifiable natural person under any circumstances, even by matching it with other data.

Employee

Carpex Kurumsal personnel.

Electronic Media

Environments where personal data can be created, read, changed, and written with electronic devices.

Non-Electronic Media

All written, printed, visual, etc. media other than electronic media.

Service Provider

Natural or legal person providing services to the Personal Data Protection Authority within the framework of a specific contract.

Data Subject (Relevant Person)

The natural person whose personal data is processed.

Relevant User

Persons who process personal data within the organization of the data controller or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for technical storage, protection, and backup of the data.

Destruction

Deletion, destruction, or anonymization of personal data.

Law

Personal Data Protection Law No. 6698.

Recording Medium

Any environment where personal data is processed by fully or partially automated means or by non-automated means provided that it is part of any data recording system.

Personal Data

Any information that makes a person identified or identifiable.

Personal Data Processing Inventory

An inventory in which data controllers detail their personal data processing activities based on business processes, associating them with the purposes and legal reasons for processing, data category, transferred recipient group, and data subject group, and explaining the maximum retention period required for the purposes for which personal data are processed, personal data envisaged to be transferred to foreign countries, and the measures taken regarding data security.

Processing of Personal Data

Any operation performed on data such as obtaining, recording, storing, preserving, changing, reorganizing, explaining, transferring, taking over, making available, classifying, or preventing the use of personal data by fully or partially automated means or by non-automated means provided that it is part of any data recording system.

Board

Personal Data Protection Board.

Special Categories of Personal Data

Data regarding race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, dress and appearance, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

Periodic Destruction

The process of deletion, destruction, or anonymization to be carried out ex officio at repeated intervals specified in the personal data storage and destruction policy in case all the conditions for processing personal data in the Law disappear.

Policy

Personal Data Storage and Destruction Policy.

Data Processor

Natural or legal person processing personal data on behalf of the data controller based on the authority granted by the data controller.

Data Recording System

The recording system where personal data are structured and processed according to specific criteria.

Data Controller

Natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

Data Controllers Registry Information System

The information system created and managed by the Presidency, accessible via the internet, which data controllers will use for application to the Registry and other relevant transactions.

VERBİS

Data Controllers Registry Information System.

Regulation

The Regulation on the Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated October 28, 2017.

Data Recording Medium

Description

Electronic Media

Servers (Domain, backup, e-mail, database, web, file sharing, file server, etc.), Disk Units, Software (Office software, Intranet Portal, ERP software, “Netsis”, etc.), Information security devices (Firewall, intrusion detection and prevention, log files, anti-virus, etc.), Company computers (Desktop, laptop), Company-owned mobile devices (Phone, tablet, etc.), Optical disks (CD, DVD, etc.), Removable memories (USB, memory card, etc.)

Non-Electronic Media

Paper, Manual data recording systems (Notebooks, printed forms), Written, printed, visual media

Title

Job Description

Personal Data Manager

Responsible for directing all kinds of planning, analysis, research, and risk identification studies in projects carried out during the Law compliance process; managing the processes that must be carried out in accordance with the Law, the Personal Data Processing and Protection Policy, the Personal Data Storage and Destruction Policy, and other regulated policies and procedures; and deciding on and responding to requests from relevant persons.

Carpex Kurumsal Personal Data Protection Specialist (Technical and Administrative)

Responsible for examining the requests of relevant persons and reporting them to the Personal Data Manager for evaluation; performing the transactions regarding the requests of relevant persons evaluated and decided by the Personal Data Manager in accordance with the decision of the Personal Data Manager; auditing the storage and destruction processes and reporting these audits to the Personal Data Manager; and carrying out the storage and destruction processes.

Human Resources Manager

Responsible for the execution and audit of policies and procedures in terms of personnel in accordance with job descriptions, and for audits regarding the protection, storage, and destruction of personal data.

Method

Description

Blacking Out (Physical)

Cutting out data from documents or making it invisible with permanent ink.

Secure Software Deletion

Deletion via digital command so that only the database manager can access it, making it unusable.

Removal of Access Rights

Removing user access rights from servers by the system administrator.

Method

Description

Physical Destruction

Using paper shredders for physical documents; melting, burning, or pulverizing optical/magnetic media.

Degaussing

Corrupting data on magnetic media by exposing it to a high magnetic field.

Overwriting

Writing random data (0s and 1s) at least seven times on rewriteable media.

Cloud Destruction

Deleting via digital command and destroying encryption keys upon termination of the cloud service relationship.

Method

Description

Variable Extraction

Removing direct identifiers that could identify the person.

Generalization

Aggregating data into statistical values, removing distinguishing details.

Masking

Making data unintelligible (encryption, symbols, blurring) without changing the format.

Data Shuffling

Mixing or corrupting identifiers to break the link with the relevant person.

PROCESS

STORAGE PERIOD

DESTRUCTION PERIOD

Human Resources Processes

10 years following the end of activity

First periodic destruction period following storage expiry

OHS Personal Health Files

15 years following resignation

First periodic destruction period following storage expiry

Log Records Systems

10 years following the end of activity

First periodic destruction period following storage expiry

Internet Access Records

2 years following the end of relationship

First periodic destruction period following storage expiry

Visitor Records

1 year following the record

First periodic destruction period following storage expiry

Camera Recordings

2 Months

Destroyed on the first day following the storage period

Contracts Execution

10 years following the end of contract

First periodic destruction period following storage expiry