ALGA MÜMESSİLİK VE DIŞ TİCARET ANONİM ŞİRKETİ

PERSONAL DATA STORAGE AND DESTRUCTION POLICY

 1. PURPOSE AND SCOPE

The protection of personal data is of great sensitivity to ALGA MÜMESSİLİK VE DIŞ TİCARET ANONİM ŞİRKETİ. (“Company” or “Our Company”) and is among the priorities of our Company.

In parallel with the General Policy on Processing and Protection of Personal Data published from time to time, our Company has prepared and published the Personal Data Storage and Destruction Policy ("Policy") in order to determine the maximum retention period required for the purpose of processing regarding the storage and destruction of Personal Data collected from various Data Owners, to make the deletion, destruction and anonymization processes known to Data Owners and to transparently set forth the methods adopted for these processes.

Our company attaches utmost importance to ensuring transparency in the processing of personal data.

This Policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data ("Law") and secondary legislation published pursuant to the Law. In particular, the "Regulation on the Deletion, Destruction, or Anonymization of Personal Data" ("Regulation"), which was published in the Official Gazette dated October 28, 2017, and entered into force, has been used as a basis in the preparation of this Policy.

 

2.DEFINITIONS

Explicit Consent; Consent related to a specific subject, based on information and expressed with free will.

Relevant User: Persons who process personal data within the data controller organization or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of data.

Destruction; Deletion, destruction or anonymization of personal data.

Law; Personal Data Protection Law No. 6698, published in the Official Gazette dated 07.04.2016 and numbered 29677.

Recording Medium; Any medium containing personal data processed by fully or partially automatic means or non-automatic means provided that it is part of any data recording system.

Personal Data: Any information relating to an identified or identifiable natural person.

Anonymization of Personal Data; Making personal data in no way identifiable with an identified or identifiable natural person, even when matched with other data.

Personal Data Inventory; An inventory showing which Data Owner groups the Personal Data collected within our Company belongs to on a process-by-process basis.

Processing of Personal Data; Obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, wholly or partially by automatic means or non-automatic means provided that it is part of any data recording system.

Deletion of Personal Data; Making personal data inaccessible and reusable for the relevant users in any way.

Destruction of Personal Data; The process of making personal data inaccessible, irretrievable and reusable by anyone.

Sensitive Personal Data: Data related to individuals' race, ethnic origin, political views, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership in associations, foundations or unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

Periodic Destruction: The process of deletion, destruction, or anonymization, which will be performed automatically by our Company at recurring intervals as specified in this Policy, if all the processing conditions for Personal Data stipulated in the Law cease to be met.

The Policy: Our Company's Personal Data Storage and Destruction Policy.

Company; ALGA MÜMESSİLİK VE DIŞ TİCARET ANONİM ŞİRKETİ

Company Policies: Our Company's Personal Data Storage and Destruction Policy and Personal Data Processing and Protection Policy.

Data Recording System: The recording system(s) we use to structure and process Personal Data within our Company.

Data Subject: The natural person whose personal data is/may be processed, such as employees, customers, business partners, shareholders, officers, potential customers, prospective employees, interns, visitors, suppliers, employees of institutions we collaborate with, third parties, and other individuals, including but not limited to those listed herein, of our Company and/or its subsidiaries/affiliates with whom we have commercial relationships.

Data Controller: Our Company, which determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

The Regulation: refers to the provisions of the Regulation on the Deletion, Destruction, or Anonymization of Personal Data, which entered into force upon publication in the Official Gazette dated October 28, 2017.

              

3. FUNDAMENTAL PRINCIPLES

Our Company has adopted the following fundamental principles regarding the storage and destruction of personal data. Accordingly:

I. If all the conditions for processing Personal Data stipulated in Articles 5 and 6 of the Law cease to exist, our Company will delete, destroy, or anonymize the Personal Data, either ex officio or upon the request of the Data Subject. Upon receiving a request from the Data Subject, our Company will:

1. If all the conditions for processing Personal Data have ceased to exist, our Company will delete, destroy, or anonymize the Personal Data subject to the request. The Data Subject's request will be finalized within thirty (30) days at the latest, and the Data Subject will be informed accordingly.

2. If all the conditions for processing Personal Data have not ceased to exist, the request submitted to our Company will be rejected in accordance with the third paragraph of Article 13 of the Law, after providing a reasoned information about the situation. In such a case, our rejection is notified to the Data Subject in writing or electronically within thirty (30) days at the latest.

3. If all the conditions for processing Personal Data have been eliminated, but the Personal Data subject to the Data Subject's request has been shared with third parties, the request directed to our Company is notified to the third party with whom the data was shared, and the third party is requested to take the necessary actions within the framework of this Policy and legislation, and even provided for.

II. The deletion, destruction, and anonymization of Personal Data are carried out in accordance with the principles listed in Article 4 of the Law and the technical and administrative measures required under Article 12, as well as relevant legislative provisions, Board decisions, and this Policy. In this context, pursuant to Article 4 of the Law:

1. Compliance with the law and the rules of honesty,

2. Accuracy and, where necessary, up-to-dateness,

3. Processing for specific, clear, and legitimate purposes,

4. Relevance to the purpose of processing, limitedness, and proportionality,

5. Storage for the period stipulated in the relevant legislation or necessary for the purpose of processing,

Its principles are a priority for our Company.

In line with Article 12 of the Law, our Company:

To prevent the unlawful processing of personal data,
To prevent unlawful access to personal data,
To ensure the safekeeping of personal data,

To ensure the appropriate level of security,

we implement the technical and administrative measures adopted in this Policy.

III - All actions related to the deletion, destruction, and anonymization of Personal Data are recorded by our Company, and such records are retained for a minimum of three (3) years, excluding any other legal obligations our Company must comply with.

IV - Unless otherwise decided by the Board, our Company will ex officio select the appropriate method for deleting, destroying, or anonymizing Personal Data. Furthermore, upon the Data Owner's request, the appropriate method will be selected, with a justification provided, or the Data Owner will be provided with feedback regarding the reason for not selecting the appropriate method.

 

4. OUR RECORDING ENVIRONMENTS

Our company stores the Personal Data it collects in accordance with the general rules and principles regulated in legislation and international principles regarding the privacy of Personal Data in the environments listed below:

(Example) Our Electronic Recording Environments:

……… Commercial Package Program (ERP program)
……… Human Resources Program
CRM Server
SQL Database
MySQL (website database)

(Example) Our Physical Recording Environments:

Our company's personnel files,
Storage cabinets for our students' files,
Storage cabinets for our patients' files,
Storage cabinets in our company's stores,
Cabinets for relevant departments within our company, such as accounting, marketing, and purchasing,
Archives.

 

5. LEGAL, TECHNICAL, OR OTHER REASONS REQUIRING STORAGE AND DESTRUCTION

Our Company may collect Personal Data from employees during recruitment (applications and personnel files), from customers themselves in the transactions and operations of the purchasing and sales departments, from officials and employees of legal entity customers, from overseas customers in import and export transactions, and from similar records, from purchases made through the website at …, through dealers, or from sources submitted to our Company directly by data subjects in writing, verbally, or electronically. Furthermore, IP (internet protocol) addresses and web logs are kept for users visiting our website at www.alga.com.tr, and their use of our website is facilitated through cookies and pixel tags. Furthermore, to ensure the legal security of our Company, the personal data of natural persons or natural representatives of legal entities with whom we have established contractual relationships is also stored as an annex to the contract.

Personal Data collected by our Company is stored based on one or more of the personal data processing conditions specified in Articles 5 and 6 of the Law and processed in accordance with Article 7 of the Law. In this context, Personal Data is stored for the duration of the validity of the conditions specified for the processing of Personal Data. When the processing conditions in question expire or upon the Data Owner's application to our Company (after checking other legal obligations our Company must comply with), the Personal Data stored is deleted, destroyed, or anonymized upon request. Within this framework:

Changes or repeals of legislation,
Termination or invalidation of the contract underlying the processing,
Disappearance of the purposes and conditions of processing,
Withdrawal of consent in processing activities based on explicit consent,
Data Subject's application for deletion, destruction, or anonymization, and its acceptance,
Data Subject's application and rejection of this application, resulting in the decision by the Personal Data Protection Board to meet the request,
Expiration of the retention period,
Periodic destruction processes carried out within the Company,

As a result, our Company deletes, destroys, or anonymizes the Personal Data it has collected.

The conditions listed in Articles 5 and 6 of the Law on the processing mentioned above, as well as the purposes for which our Company processes Personal Data, are further explained in our Company's "General Policy on the Processing and Protection of Personal Data." We strongly recommend that you read this General Policy on the Processing and Protection of Personal Data.

 

6. TECHNICAL AND ADMINISTRATIVE MEASURES

Our Company has taken the necessary technical and administrative measures, in accordance with the principles of Article 12 of the Law and the Regulation, to ensure the secure storage of the Personal Data it stores and processes, to prevent unlawful processing or access, and to lawfully delete and/or destroy such data. Furthermore, if the legal, technical, or other reasons necessary for the storage and processing of Personal Data cease to exist, the relevant process is meticulously monitored, and accordingly, deletion, destruction, or anonymization processes are carried out within the same technical and administrative measures.

In this context, the technical and administrative measures taken by our Company, based on the nature of the data to be protected, technological capabilities, and implementation costs, are as follows:

 

ADMINISTRATIVE MEASURES

1. Our Company has established the "ALGA MÜMESSİLİK VE DIŞ TİCARET ANONİM ŞİRKETİ Personal Data Protection Board/Committee," which is responsible for monitoring compliance with the regulations stipulated by the Law and relevant legislation, managing and updating this Policy and other related policies as necessary, implementing decisions made by Company management, and conducting other relevant regulations and internal Company audits.

The duties and powers of this Board are outlined in our Company's "Personal Data Protection Board Working Principles and Procedures Regulation."

3. All processes related to data processing activities within our Company have been analyzed by business unit under the direction of the Personal Data Protection Board. In this context, a "Personal Data Inventory" has been prepared based on data subject categories and process-based processing.

This inventory provides the necessary details regarding the Personal Data processing activities we carry out in connection with our Company's business processes, the purposes for which we process Personal Data, our data categories, our recipient groups, our data subject groups, our authorized data processing units, and the maximum periods required for the purposes for which the data is processed.

4. In storing Personal Data collected by our Company, access is limited to the personnel who require access as required by their job description and the purpose of access. Within this framework, the general or specific nature of the Personal Data being stored is also taken into account when limiting access.

5. Our Company employees undertake not to disclose the personal data they obtain to anyone else in violation of the Law and relevant legislation, and not to use it for purposes other than the purpose for which it was processed. These undertakings shall continue after the termination of the employment relationship.

6. If processed Personal Data is obtained by third parties through unlawful means, this is first reported as soon as possible to the … Personal Data Board established within our Company. Subsequently, the necessary notification of the situation is made to the Relevant Person(s) and the Board.

7. Regarding the sharing of Personal Data, additional provisions regarding "personal data protection and data security" are added to the contracts or documents governing our legal relationship with our employees, business partners, suppliers, and customers, regarding the confidentiality of shared personal data and how it should be processed and stored, or framework agreements are signed covering these issues, thereby ensuring data security.

8. Our Company equips personnel with authorized access in the relevant Company units, especially the head of the HR/Personnel Department, with the necessary legal and technical knowledge regarding the processing of Personal Data. In this context, our personnel are provided with the necessary training on personal data protection legislation and data security.

9. Our Company conducts and has the necessary audits carried out within its legal entity to ensure the implementation of the provisions of the Law and our Company's data security policies. Any confidentiality and security vulnerabilities identified as a result of these audits are remedied as soon as possible.

 

TECHNICAL MEASURES

1. Necessary internal controls are regularly conducted regarding the systems established within the Company for data security purposes and the processing, deletion, destruction, or anonymization processes carried out within these systems.

2. Risk assessments and necessary analyses are carried out within the scope of the established systems, particularly regarding information technology.

3. The provision of the technical infrastructure to prevent or monitor the leakage of Personal Data outside our Company and the establishment of the relevant technical infrastructures are ensured (for example, the ……………… firewall program and ………………. Anti-virus programs are actively installed on all computers in our Company).

4. Software and hardware, including virus protection systems and firewalls, have been installed for all our electronic data recording systems, particularly to ensure the security of digital Personal Data collected regarding users visiting our ……………….. website, such as IP (internet protocol) addresses, web logs, cookies, and pixel tags.

5. Our Company conducts security camera surveillance to ensure security at its workplace and premises. In this context, our Company acts in accordance with the Constitution, the Law, and other relevant legislation.

6. Camera recordings obtained for security purposes also enable the supervision of personnel from various units to ensure data security. In this context, records are periodically inspected, and procedures are implemented regarding any detected violations, in accordance with relevant legislation and Company policies.

7. Penetration testing services are conducted periodically, or as needed, to determine whether stored and processed Personal Data is maintained in compliance with relevant legislation and Company policies, thus ensuring the presence of system vulnerabilities.

8. The access rights of authorized unit personnel within our Company, particularly store employees and IT department personnel, to personal data are controlled.

9. Backup programs are used in accordance with the law to ensure the secure storage of Personal Data.

10. All electronic media where personal data is stored are protected with encrypted or cryptographic methods to meet information security requirements. In this context, information on Company computers cannot be transferred to another device, such as a USB, or removed from the Company without the written approval of the ………………... Data Protection Board.

 

7. PERSONAL DATA DELETION, DESTRUCTION, AND ANONYMIZATION PROCEDURES

Our Company deletes, destroys, or anonymizes the Personal Data it collects, either automatically or upon the Data Subject's request, if the reasons requiring processing no longer exist. Pursuant to Article 28 of the Law, anonymized personal data may be processed for purposes such as research, planning, and statistics. Such processing after anonymization falls outside the scope of the Law, and in such cases, the explicit consent of the Data Subject is not required.

In this context, our Company selects one or more of the following deletion, destruction, or anonymization methods and follows the most appropriate method for the purpose:

Secure Deletion from Software:

Personal Data stored in our Company's digital environments is deleted from the relevant software, rendering it inaccessible and unusable by any means for the Relevant Users.

Data can be deleted by issuing a delete command to electronic recording media such as commercial package programs, human resources programs, and SQL databases we use; by revoking access rights for relevant users to files on our central server or the directory containing the files; by deleting relevant rows in databases using database commands; or by deleting personal data stored on removable media (USB, HDD, etc.) using appropriate software.

However, if some personal data is deleted and other data becomes inaccessible to the system, the personal data subject to deletion can be archived and rendered untraceable to the relevant data owner. In such cases, the relevant personal data is considered deleted. In such cases, our Company takes all necessary technical and administrative measures to ensure that only authorized individuals can access the personal data.

Obliteration of Personal Data on Paper:

Personal Data collected on paper, such as physical application forms, contracts, and personnel files collected for the purpose of our Company's commercial activities, can also be deleted by rendering them unreadable on their hard copy. In particular, to prevent malicious or unintended use, or to delete Personal Data requested for deletion, all relevant or requested personal data is physically cut from a portion of the document or rendered invisible using permanent ink, making it irreversible and unreadable by technological means.

Physical Destruction:

Personal Data collected by our company and processed by non-automated means, as part of our data recording systems, can also be destroyed by physically destroying the media (paper, microfiche) on which it resides, preventing the subsequent use of the Personal Data.

Overwriting:

The magnetic media and rewritable optical media used in our company use a data destruction method that eliminates the possibility of reading and recovering old data by writing random numerical data using specialized software. Any reusable magnetic media containing Personal Data is overwritten using the overwriting method, ensuring that the data on it is irreversibly erased.

 

Masking:

Using the masking method, certain areas of Personal Data are rendered inaccessible to the natural person who is the Data Subject by crossing them out, coloring them, and/or using asterisks. For example, the identification data of a customer within our Company is removed from our database, making it impossible to identify the Data Subject.

Data Generation:

As the Data Controller, our Company may use certain Personal Data it stores for marketing purposes. If circumstances arise that require the deletion of such data from our database, our Company uses data generation to create a more generalized form of the Personal Data, rendering the Personal Data unattributable to any natural person.

Generalization:

The generalization method of Personal Data is used by our Company to aggregate a large amount of data in the database, rendering it unattributable to any natural person. This allows our Company to track certain results linked to Data Subjects without storing any Personal Data. This allows us to track, for example, which year, position, and age range of employees whose employment contracts have ended, without revealing their birth dates or identification information.

8. ENFORCEMENT AND IMPLEMENTATION

If the entire policy or specific articles are updated, the updates will take effect on the date they are published. The policy is updated to the latest date

It is published in hard copy on our website www.alga.com.tr.

This Policy and our other Company policies are implemented by the Personal Data Protection Board. In the event of a conflict between this Policy and the Law or relevant legislation, the provisions of the Law and other relevant legislation will prevail.

Sincerely,