This Personal Data Storage and Destruction Policy (‘Policy’) is prepared by Arson (The company) as data controller to meet the obligations and give information about processes of erasure, destruction and anonymization, determine duration of the storage period in compliance with Law No.6698 on the Protection of Personal Data Law (‘Law’) or Destruction or Anonymization of Personal Data (‘Guidelines’) that constitutive secondary regulations
Definitions
Explicit Consent: Freely given, specific and informed consent
Relevant User: Except those who are responsible for the technical storage, preservation and backup of the data, those who process personal data within the organization of the data controller or with the authority given by the data controller.
Destruction: The deletion, destruction or anonymization of personal data
Recording Medium: Any medium in which personal data is recorded to be processed fully or partially by automatic ways as apart of ant data recording system
Personal Data: Any information relating to an identified or identifiable natural person
Processing of personal data : Any operation which is performed on personal data, wholly or partially by automated means or non-aoutomated means which provided that form part of a data filling system, such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization, preventing the use thereof
Anonymization: Rendering personal data impossible to link with an identified or identifiable natural person, even though matching them with other data
Deletion of personal data: Deletion of personal data he processes of making personal data inaccessible to and not-usable by the relevant user
Destruction of personal data: Deletion of personal data is the process of making personal data inaccessible to and not-usable by anyone
Periodic Destruction: Periodic destruction, deletion or anonymization of personal data that is no longer processed validly, as described in the personal data retention and destruction policy
Data subject (natural person concerned): The natural person, whose personal data are processed
Principles
The company act about stored and erasure of the personal data under the following conditions
- The requests shall be concluded at the latest within 30(thirty) days
- In case of transferring the data to third parties, this case is informed third parties, necessary process is applied in the presence of third parties.
Explanations of Reasons Required to be Storage and Deletion of Personal Data
The personal data is stored by company especially for i) maintain of commercial activities, (ii) Perform one’s legal obligations, iii) Plan the rights and side benefits of the employees within relevant legislation
The reasons that require storing are as follows;
Under the relevant laws, the personal data are erased, destructed or anonymized ex officio or the request of the data subject in following cases;
Storage and Destruction Durations
Following steps are used that determined storage and destruction durations of the data by the company according to following steps in compliance with procedures;
- The personal data are subjected to classification as the personal data and special qualified personal data according to 6. Article of PDRL. The personal data are determined have special qualified are destructed. Destruction method of these data is determined according to qualified of data and importance of storing this data for the company.
- Suitable of storing of data is questioned according to 4. Article of PDRL, for example; there is legitimate purpose of the company exists or not is questioned. The data that store of data is illegal pursuant to 4. Article of PDRL is erased, destructed or anonymized.
- Storing of data is evaluated with which one of the exception/exceptions according to 5. And 6. Article of PDRL. According the exceptions, convenience time of storing the data is determined. In case of expiration, the data are erased, destructed or anonymized
The duration of storage and periodic destruction is determined by the company is available in the appendix of this policy. The personal data which duration’s is expired are anonymized or destruction period of 6 (six) months according to duration time is mentioned in the appendix in compliance with this policy. The processes about erasure, destruction or anonymization of the personal data are recorded and these records (except for other legal obligations) is preserved at least 3 (three) years.
Procedures, Technic and Administrative Measures Related to Storage and Destruction of the Personal Data
If there is a necessary case that our company is able to meet the obligations that it must fulfill within the scope of employment, data processing is compulsory for the establishment of a right, you can benefit from customer services, consumer rights and other opportunities and/or to fulfill commercial financial legal responsibilities related to it, to endure the safety of our company or to legitimate purposes of our company, the personal data are collected the system. In addition, all data stored as digital copies are saved on the company’s server.
All administrative and technic measurements determined by the company according to 12. Article of Law to storage of the personal data, process illegally, protect of accessing the data, and destruct the data legally are listed below.
Within the scope of the company administrative the company;
Technic Measures:
Within the scope of the company administrative the company;
- If the data need to be transferred via e-mail, the data are transferred by institutive e-mail with password or using KEP,
- If the data need to be transferred by flash memory like CD, DVD, the data access by creating password with cryptographic method,
- If the data need to be transferred between different servers, the data are transferred by using VPN or sFTP,
- If the data need to be transferred as paper work, the paper is transferred in the format of ‘Classified Information’
Duties of The Personal Data Protection Authority
The Committee on Protection of Personal Data is responsible for announcing the Policy to related persons and following meeting the requirements or not. Alteration of legislations about protection of personal data, decision of organizing and processing of Authority, court decisions or change in processing and the system with decision and process are announced related units to follow and update job processes if necessary. The committee determines the processes within decision and updating of the Authority, considering, following and be conclude of court decisions and decisions and/or requests of other authorities and the information is announced to related units.
Be Entered into Force of Policy Violated Situations and Sanctions
Title, Department and Duty of Personal List
Duration of Destruction and Storage of The Personal Data Table
The personal data is stored according to 4. Article of PDRL, period of store is mentioned in following table, and the personal data destructed or anonymized end of the period;
Process |
Period of Store |
Period of destruction |
The data stored within labour law (performance records ect.) |
11 following years after the end of the business relationship |
180 following days after end of the period of store |
The data collected within occupational health safety law (medical reports ect.) |
11 following years after the end of the business relationship |
180 following days after end of the period of store |
The data kept within SGK law |
11 following years after the end of the business relationship |
180 following days after end of the period of store |
Documents can be used related to work accident/occupational disease in the request/case |
11 following years after the end of the business relationship |
180 following days after end of the period of store |
Collected the data according to other relevant legislation |
Period provided related legislation |
180 following days after end of the period of store |
Related data being subject to a crime according to Turkish Criminal Law or other relevant legislation |
During period limitation of actions |
180 following days after end of the period of store |
Data of clients |
11 following years after recording of the data |
180 following days after end of the period of store |
If the purpose of using of the related personal is not finished, duration of the storage of the personal data according to related legislation is more than value in the table or the period of limitation of the case is more than period of storage of the data, the values in the table are used. Duration of storage of the personal data is applied which of the special legislation or period of limitation of the case ends later is applied.
ARSON EXPLORATION TOOLS © 2021 All rights reserved.
.