TABLE OF CONTENTS

1. INTRODUCTION 1……………………………………………………………………………………………………. …………………………………………………………………………………………………….
2. Purpose and Scope 1………………………………………………………………………………………………. ……………………………………………………………………………………………….
3. Definitions 2………………………………………………………………………………………………………….. ………………………………………………………………………………………………………….
4. RECORDING MEDIA 4…………………………………………………………………………………………….. …………………………………………………………………………………………….
5. Electronic Environments 4………………………………………………………………………………………. ……………………………………………………………………………………….
6. Non-Electronic Environments 4………………………………………………………………………………… ………………………………………………………………………………..

III. DESCRIPTION OF STORAGE and DISPOSAL 4………………………………………………………. ……………………………………………………….

5. Remarks on Storage 5…………………………………………………………………………………………….. …………………………………………………………………………………………….
6. Legal Reasons for Retention 5……………………………………………………………………………. …………………………………………………………………………….
7. Processing Purposes Requiring Storage 6……………………………………………………………… ………………………………………………………………
8. Reasons for Destruction 7………………………………………………………………………………………. ……………………………………………………………………………………….
9. TECHNICAL and ADMINISTRATIVE MEASURES 7……………………………………………….. ………………………………………………..
10. Technical Measures 7……………………………………………………………………………………………… ………………………………………………………………………………………………
11. Administrative Measures 8………………………………………………………………………………………. ……………………………………………………………………………………….
12. DESTRUCTION TECHNIQUES OF PERSONAL DATA 9………………………………………….. …………………………………………..
13. Deletion of Personal Data 9…………………………………………………………………………………….. …………………………………………………………………………………….
14. Destruction of Personal Data 11………………………………………………………………………………. ……………………………………………………………………………….
15. Anonymization of Personal Data 12…………………………………………………………………………. ………………………………………………………………………….
16. STORAGE and DISPOSAL PERIODS 12…………………………………………………………………… ……………………………………………………………………
17. Retention Period 12………………………………………………………………………………………………… …………………………………………………………………………………………………
18. Disposal Time 12……………………………………………………………………………………………………. ……………………………………………………………………………………………………

VII. PUBLICATION and RETENTION OF the POLICY 12……………………………………………… ………………………………………………

VIII. VIOLATION OF the POLICY and SANCTIONS 12…………………………………………………. ………………………………………………….

12. ENFORCEMENT OF THE POLICY 12…………………………………………………………………….. ……………………………………………………………………..

I. INTRODUCTION

A. Purpose and Scope

This Policy has been prepared by the Data Controller PROCAT in order to determine the procedures and principles to be followed in accordance with Article 7 of the LPPD.

PROCAT undertakes to comply with this Policy and the tools, programs and processes to be applied in accordance with this Policy during the deletion, destruction or anonymization of personal data it contains, which are fully or partially automatic or processed by non-automatic means, provided that they are part of any recording system.

This Policy; Employee, Employee Candidate, Employee Relative, Supplier Official, Supplier Employee, Product or Service Receiver, Potential Product or Service Receiver, Intern, Visitor, Employee Relative, Employee’s Authorized Person in the Old Workplace, Employer, Workplace Physician, Public Official, Institution Official, Reference Person, Receiver and Deliverer Person involved in any process in which PROCAT processes personal data and Other 3. personal data of individuals.

This Policy covers all destruction activities to be carried out by PROCAT on personal data and will be applied as a result of all kinds of destruction requirements.

This Policy will not apply to data that is not personal data.

In the event that new legislation on the subject is published or the relevant legislation is updated, this Policy will be updated in accordance with the relevant legislation and the requirements of the legislation will be complied with.

• Network devices,

• Shared/non-shared disk drives used for data storage on the network,

• Computers/servers used on behalf of PROCAT,

• Flash memories,

• Paper,

• Magnetic tapes,

• Microfiche,

• Mobile phones and all storage areas inside,

• Optical discs,

• Peripherals such as printers, fingerprint readers and face scans.

B. Definitions

II. RECORDING MEDIA

A. Electronic Environments

• Information security devices (firewall, intrusion detection and blocking, log file, antivirus, etc.)

• Removable memories (USB, memory card, etc.)

• Personal computers (Desktop, laptop)

• Mobile devices (phone, tablet, etc.)

• Optical discs (CD, DVD, etc.)

• Servers (Domain, backup, email, database, web, file sharing, etc.)

• Video recording and audio recording

• Printer, scanner, copier

• Software (Office software, ….)

B. Non-Electronic Environments

• Paper

• Manual data recording systems (survey forms, visitor entry book)

• Written, printed, visual media

III. EXPLANATIONS ON STORAGE and DISPOSAL

By PROCAT; Employee, Employee Candidate, Employee Relative, Supplier Official, Supplier Employee, Product or Service Receiver, Potential Product or Service Receiver, Intern, Visitor, Employee Relative, Employee’s Authorized Person in the Old Workplace, Employer, Workplace Physician, Public Official, Institution Official, Reference Person, Receiver and Deliverer, Person Subject to the News and Other 3. Personal data of individuals are stored and destroyed in accordance with the Law.

In this context, detailed descriptions of storage and disposal are given below, respectively.

A. Remarks on Storage

In Article 3 of the LPPD, the concept of processing personal data is defined, in Article 4 of the LPPD, it is stated that the personal data processed should be related, limited and proportionate to the purpose for which they are processed and should be kept for the period stipulated in the relevant legislation or for the purpose for which they are processed, and in Articles 5 and 6 of the LPPD, the processing conditions of personal data are listed. Accordingly, within the framework of PROCAT activities, personal data are stored for the period stipulated in the relevant legislation or in accordance with our processing purposes.

1.  Legal Reasons for Retention

• Tax Procedure Law No. 213

• Enforcement and Bankruptcy Law No. 2004

• Customs Law No. 4458

• Law No. 5651 on the Regulation of Broadcasts on the Internet and Combating Crimes Committed Through These Broadcasts

• Turkish Code of Obligations No. 6098

• Turkish Commercial Code No. 6102

• Capital Market Law No. 6362

• Law No. 6502 on Consumer Protection

• Personal Data Protection Law No. 6698

• Industrial Property Law No. 6769

• Regulation on Internet Collective Use Providers

• Regulation on Occupational Health and Safety Services

• Regulation on the Use of Personal Protective Equipment in Workplaces

• Trade Registry Regulation

• Regulation on the Payment of Wages, Premiums, Bonuses and All kinds of Remuneration of this nature through Banks

Personal data are stored for the retention periods stipulated within the framework of these laws and other secondary regulations in force.

2.      Processing Purposes Requiring Storage

PROCAT stores the personal data it processes within the framework of its activities for the following purposes:

• Execution of Emergency Management Processes
• Execution of Information Security Processes
• Conducting Employee Candidate / Intern / Student Selection and Placement Processes
• Execution of Application Processes of Employee Candidates
• Fulfillment of Obligations Arising from Employment Contract and Legislation for Employees
• Execution of Side Benefits and Benefits Processes for Employees
• Other(Execution of Debit Activities)
• Conducting Training Activities
• Execution of Access Authorities
• Conducting Activities in accordance with the Legislation
• Execution of Finance and Accounting Affairs
• Ensuring Physical Space Security
• Execution of Assignment Processes
• Follow-up and Execution of Legal Affairs
• Conducting Internal Audit / Investigation / Intelligence Activities
• Conducting Communication Activities
• Planning Human Resources Processes
• Execution / Supervision of Business Activities
• Execution of Occupational Health / Safety Activities
• Execution of Goods / Service Procurement Processes
• Execution of Customer Relationship Management Processes
• Organization and Event Management
• Conducting Marketing Analysis Studies
• Execution of Performance Evaluation Processes
• Execution of Storage and Archive Activities
• Execution of Contract Processes
• Managing Supply Chain Management Processes
• Foreign Personnel Employment and Residence Permit Procedures
• Providing Information to Authorized Persons, Institutions and Organizations
• Creating and Tracking Visitor Records

B. Reasons Requiring Destruction

In the event that PROCAT rejects the application made to it by the Data Subject for the deletion, destruction or anonymization of his/her personal data, finds his/her response insufficient or does not respond within the period stipulated in the PPDL;

• Amendment or repeal of the provisions of the relevant legislation that constitute the basis for processing,

• The disappearance of the purpose requiring processing or storage,

• In cases where the processing of personal data only takes place based on the explicit consent condition, the withdrawal of the explicit consent of the Relevant Person,

• The maximum period requiring the storage of personal data has expired and there are no conditions to justify storing personal data for a longer period,

• Complaining to the PPD Board and this request is approved by the PPD Board,

• Pursuant to Article 11 of the LPPD, PROCAT accepts the application for the deletion and destruction of personal data within the framework of the rights of the Relevant Person,

is deleted, destroyed or ex officio deleted, destroyed or anonymized by PROCAT upon the request of the Relevant Person.

IV. TECHNICAL and ADMINISTRATIVE MEASURES

In order to store personal data securely, to prevent unlawful processing and access, and to destroy personal data in accordance with the law, technical and administrative measures are taken by PROCAT within the framework of adequate measures determined and announced by the KVK Board for sensitive personal data in accordance with Article 12 of the KVKK and the fourth paragraph of Article 6 of the KVKK.

A. Technical Measures

• Network security and application security are provided.
• Key management is implemented.
• Information systems are kept up-to-date, and strong passwords are used in electronic environments where personal data is processed.
• Security measures are taken within the scope of supply, development and maintenance of information technology systems.
• Necessary measures are taken for the physical security of information systems equipment, software and data.
• The security of personal data stored in the cloud is ensured. An authorization matrix has been created for the employee.
• Access logs are kept regularly.
• Arrangements for access authority and role distributions are being created and implemented.
• Corporate policies on access, information security, use, storage and destruction have been prepared and implemented.
• The powers of the Employee who changes his/her job or leaves the job are removed.
• Current anti-virus systems are used.
• Appropriate security patches are installed and firewalls are used by monitoring security vulnerabilities.
• The security of environments containing personal data is ensured.
• Personal data is backed up and the security of the backed up personal data is also ensured.
• Backup programs that ensure the secure storage of personal data are used and access to personal data stored in electronic or non-electronic media is limited according to the principles of access.
• User account management and authorization control system are implemented and followed up.

B. Administrative Measures

• There are disciplinary regulations that include data security provisions for the employee.
• Training and awareness studies on data security are carried out for the employee at regular intervals.
• Confidentiality agreements are signed by the Employee.
• The quality and technical knowledge/skills of the Employee are improved.
• Disciplinary processes to be applied to the Employee who does not comply with Procat regulations are implemented, the obligation to inform the Relevant Persons is fulfilled, internal periodic and random audits are carried out and information security trainings are provided to the Employee.
• Confidentiality commitments are made. Signed contracts contain data security provisions.
• Trainings are provided on communication techniques and relevant legislation.
• Personal data security policies, instructions and procedures have been determined.
• Necessary security measures are taken regarding the entry and exit of physical environments containing personal data.
• Physical environments containing personal data are protected against external risks (fire, flood, etc.).
• Unlawful access to personal data is prevented.
• Unlawful processing of personal data is prevented.
• Personal data is protected.
• In-house periodic and random audits are carried out and information security trainings are provided to the Employee.

V. DESTRUCTION TECHNIQUES OF PERSONAL DATA

At the end of the period stipulated in the relevant legislation or the retention period required for the purpose for which they are processed, personal data shall be destroyed or anonymized by PROCAT ex officio or upon the application of the Relevant Person using the following techniques in accordance with the provisions of the relevant legislation.

A. Deletion of Personal Data

Personal data is destroyed by PROCAT or, if deemed necessary, by another third party determined by PROCAT by the methods specified below.

B.  Destruction of Personal Data

Personal data is destroyed by PROCAT by the methods specified below.

During the realization of the above-mentioned situations, PROCAT fully complies with the provisions of the LPPD, the Regulation and other relevant legislation in order to ensure data security and takes all necessary administrative and technical measures.

C. Anonymization of Personal Data

Anonymization of personal data is the process of making personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even if it is paired with other data.

In order for personal data to be anonymized, it must be made unrelated to an identified or identifiable natural person, even through the use of appropriate techniques in terms of the Recording Media and the relevant field of activity, such as the return of personal data by the data controller or third parties and/or the matching of data with other data.

VI. STORAGE and DISPOSAL PERIODS

A. Retention Period

PROCAT makes a determination by taking into account the legislation in force and the purposes of processing the data subject to the process while determining the storage periods of personal data.

In any case, retention periods are determined in the light of legal obligations and relevant statute of limitations.

Updates can be made by PROCAT on the said storage periods if necessary. In the event that the purpose of data processing disappears, the data is deleted, destroyed or anonymized unless there is another legal reason or basis that allows the data to be kept.

B. Destruction Time

In accordance with Article 11 of the Regulation, PROCAT has determined the periodic destruction period as 6 months. Accordingly, periodic destruction is carried out in June and December each year.

VII. PUBLICATION and STORAGE OF THE POLICY

The policy is published in two different media, wet signed (printed paper) and electronic, and is explained on the official website. The printed paper copy is also stored in PROCAT.

VIII. VIOLATION OF THE POLICY and SANCTIONS

In case of violation of this Policy, in accordance with the Instruction; by operating the disciplinary process valid at that time, warning, reprimand, collection of fine can be applied and one or more of the contract termination sanctions can be applied, and legal action can be initiated.

IX. ENFORCEMENT OF THE POLICY

This Policy issued by Procat entered into force on 26.06.2020 and necessary updates will be made in case of renewal of all or certain articles of the Policy.

The Committee shall carry out the implementation, updating and announcement of this Policy.