This is an English translation provided for convenience. In the event of any discrepancy, the Turkish version of this document prevails.
ÜRMAKSAN PERSONAL DATA RETENTION AND DESTRUCTION POLICY — INFORMATION SHEET
Document Name:
ÜRMAKSAN MAKİNE İNŞAAT TAAHÜT SANAYİ VE TİCARET LİMİTED ŞTİ. — Personal Data Retention and Destruction Policy.
Target Audience:
All natural persons other than Ürmaksan employees whose personal data is processed by Ürmaksan.
Prepared by:
Ürmaksan Makine İnşaat Taahüt Sanayi ve Ticaret Limited Şti. Personal Data Protection Committee
Version: 2.0
Approved by:
Ürmaksan Makine İnşaat Taahüt Sanayi ve Ticaret Limited Şti.
Effective Date:
01/05/2024
1 PURPOSE OF THE POLICY
The principal purpose of this Policy is to determine the main methods for the erasure, destruction or anonymisation of personal data that has been processed in accordance with the PDPL and other relevant legislation, where the reasons requiring its processing cease to exist. The main objective is thereby to ensure that the relevant operations are carried out systematically within Ürmaksan and, by providing explanations regarding the systems adopted, to ensure the transparency of the operations applied in respect of our employees, job candidates, interns, company shareholders, company officers, visitors, the employees of the companies with which we cooperate, and all persons whose personal data is processed by our Company. In line with the purpose of the Policy, the aim is to achieve full compliance with legislation in the personal data protection, retention and destruction activities carried out by our Company.
1.2. SCOPE OF THE POLICY
This Policy has been prepared for, and will be applied in respect of, our employees, job candidates, interns, company shareholders, company officers, visitors, the employees of the companies with which we cooperate or from which we receive services, and all third parties whose personal data is processed by our Company. This Policy will apply to the persons referred to above where our Company processes their personal data wholly or partly by automated means, or by non-automated means provided that it forms part of a data filing system. Where the data does not fall within the scope of “Personal Data” as set out below, or where the personal data processing activity carried out by our Company is not conducted by the means described above, this Policy will not apply, since there can be no personal data processing within the meaning of the PDPL.
1.4. APPLICATION OF THE POLICY AND THE RELEVANT LEGISLATION
The statutory provisions in force concerning the retention and destruction of personal data shall apply as a matter of priority. In the event of any inconsistency between the legislation in force and the Policy, our Company accepts that the legislation in force shall prevail. The Policy has been created by giving concrete form to the rules laid down by the relevant legislation within the scope of Ürmaksan’s practices.
2) RETENTION PERIODS FOR PERSONAL DATA
Where prescribed by the relevant laws and legislation, Ürmaksan retains personal data for the period specified in that legislation. Where no period is prescribed in legislation as to how long personal data must be retained, personal data is processed for the period required in accordance with our Company’s practices in connection with the services provided when processing that data, the requests of the relevant authority or authorities arising from operating in a regulated sector, and commercial custom, and is thereafter deleted, destroyed or anonymised. Detailed information on this matter is set out in Section 5 of this Policy. Where the purpose of processing the personal data has ended and the retention periods set out in the relevant legislation and determined by the company have also expired, personal data may be retained solely for the purpose of constituting evidence in potential legal disputes, asserting a right connected to the personal data, or establishing a defence. In determining these periods, retention periods are set on the basis of the statutes of limitation applicable to the assertion of the right in question, together with examples from requests previously submitted to our Company on the same matters despite the expiry of those limitation periods. In such cases, the retained personal data is not accessed for any other purpose, and access is provided only when the data needs to be used in the relevant legal dispute. Once the period in question expires, the personal data is likewise deleted, destroyed or anonymised.
3) LEGAL EXPLANATION OF THE OBLIGATION TO RETAIN, ERASE, DESTROY AND ANONYMISE PERSONAL DATA
As set out in Article 138 of the Turkish Penal Code and Article 7 of the PDPL, personal data is erased, destroyed or anonymised — at our Company’s own decision or upon the request of the data subject — where the reasons requiring its processing cease to exist, even though it was processed in compliance with the relevant statutory provisions. In this context, our Company fulfils this obligation by the methods described in this section. Where such a request is received from a data subject, a review is carried out in accordance with the relevant Ürmaksan policy, whichever of erasure, destruction or anonymisation is the most appropriate method is selected, the operation is performed, and the data subject is informed.
3.1 Techniques for the Erasure, Destruction and Anonymisation of Personal Data
The erasure, destruction and anonymisation of personal data is carried out in accordance with the Regulation and the techniques set out in the relevant guidance published by the Personal Data Protection Board.
Our Company may erase or destroy personal data at its own decision or upon the request of the data subject where the reasons requiring its processing cease to exist, even though it was processed in compliance with the relevant statutory provisions. The erasure and destruction techniques most frequently used by our Company are listed below:
- Physical Destruction: Personal data may also be processed by non-automated means, provided that it forms part of a data filing system. When such data is erased or destroyed, the method of physically destroying the personal data so that it cannot subsequently be used is applied.
- Secure Deletion from Software: When data that is processed wholly or partly by automated means and stored in digital environments is erased or destroyed, methods are used to delete the data from the relevant software in a manner that makes it unrecoverable.
- Secure Deletion by an Expert: In some cases Ürmaksan may engage an expert to erase personal data on its behalf. In such cases, the personal data is securely erased or destroyed by that expert in a manner that makes it unrecoverable.
3.2.1 TECHNIQUES FOR ANONYMISING PERSONAL DATA
Anonymisation of personal data means rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching it with other data. Our Company may anonymise personal data when the reasons requiring the processing of lawfully processed personal data cease to exist. In accordance with Article 28 of the PDPL, anonymised personal data may be processed for purposes such as research, planning and statistics. Such processing falls outside the scope of the PDPL and the explicit consent of the data subject will not be required. The anonymisation techniques most frequently used by our Company are listed below.
- Masking
Data masking is the method of anonymising personal data by removing the key identifying information from within the data set.
- Aggregation
With the data aggregation method, a large amount of data is aggregated and the personal data is rendered incapable of being associated with any individual.
- Data Derivation
With the data derivation method, more general content is created from the content of the personal data, ensuring that the personal data cannot be associated with any individual.
- Data Shuffling
With the data shuffling method, the values within the personal data set are mixed, thereby breaking the link between the values and the individuals.
4. PERSONAL DATA RETENTION AND DESTRUCTION PERIODS
4.1. TABLE SHOWING PERSONAL DATA RETENTION AND DESTRUCTION PERIODS
Personal data retention and destruction periods are shown in the table below on a category basis, indicating the longest applicable periods.
In accordance with the relevant process of the Personal Data Protection Committee, the retention period for personal data such as CVs received and processed during the job application process of job candidates is 6 months; once this period expires, the data is destroyed as part of the periodic destruction processes. Where a data subject applies to our Company requesting the destruction of their personal data, our company shall:
(a) if all of the conditions for processing personal data have ceased to exist:
(i) conclude the data subject’s request within no later than thirty days and inform the data subject; and
(ii) where the personal data subject to the request has been transferred to third parties, notify the third party accordingly and ensure that the necessary actions are taken by that third party.
(b) if not all of the conditions for processing personal data have ceased to exist, the data subject’s request may be refused by explaining the grounds pursuant to Article 13(3) of the Law, and the refusal shall be notified to the data subject in writing or electronically within no later than thirty days.
4.1 INFORMATION ON PERIODIC DESTRUCTION PERIODS
Periodic destruction shall be carried out every 6 (six) months, starting from the date on which the Regulation entered into force, and the logs of the operations performed shall be retained for 3 (three) years.
5. ROLES AND RESPONSIBILITIES
All bodies and departments of the Company are responsible for overseeing compliance with the Personal Data Retention and Destruction Policy and for cooperating with the Personal Data Protection Committee. The personal data retention and destruction processes shall be carried out by the Board of Directors and the Human Resources unit. Every relevant unit and department that processes personal data — and primarily the Board of Directors and Human Resources — is directly responsible for the implementation of this Policy. Legal Counsel acts as a source of advice, a consultant and a guide in the conduct of these processes.
6. REVIEW
This Policy document enters into force upon its approval by the Company’s Deputy General Manager for People and Culture. Any amendment to this Policy and its entry into force is subject to the approval of the Personal Data Protection Committee. Implementation rules setting out how the matters referred to in this Policy are to be carried out in relation to specific subjects shall be issued in the form of Procedures based on this Policy. Procedures shall be published and enter into force upon the approval of the Deputy General Manager for People and Culture. This Policy shall in any event be reviewed once a year and, if any amendments are required, shall be updated by submission to the approval of the Deputy General Manager for People and Culture. In the event of a conflict between the legislation in force concerning the protection and processing of personal data and the Personal Data Retention and Destruction Policy, the Company accepts that the legislation in force shall prevail. The Personal Data Retention and Destruction Policy is published on the Company website (www.urmaksan.com) and is accessible to data subjects. In parallel with any amendments and updates made to the relevant legislation, amendments made to the Personal Data Retention and Destruction Policy shall be made accessible to data subjects in a manner that allows them easy access.