Personal Data Retention and Destruction Policy

POLICY OF STORAGE AND DESTRUCTION OF PERSONAL DATA

1.1 Description

In accordance with the Personal Data Storage and Destruction Policy (“Policy”), the Personal Data Protection Law No. 6698 (“KVKK” or “Law”) and the Regulation on the Deletion, Destruction or Anonymization of Personal Data (“Regulation”), MESAN METAL ALUMINUM SAN in the capacity of data controller. and tic. A. Sh. It has been prepared by (the “Company”) in order to fulfill our obligations and to inform data owners about the principles of determining the maximum storage period required for the purpose for which their personal data are processed, as well as the deletion, destruction and anonymization processes.

1.2 Scope

This Policy relates to all personal data of persons, including employees of our Company, which are fully or partially automatic or processed by non-automatic means, provided that they are part of any data recording system. In addition to the personal data processing activities and the policy carried out by our company for the related persons whose personal data will be processed; https://www.mesanaluminyum.com.tr / you can reach via our web address.

1.3 Definitions

DEFINITION ABBREVIATION
Law /KVKK Law No. 6698 on the Protection of Personal Data
Regulation On the Deletion, Destruction or Anonymization of Personal Data Regulation on the Deletion, Destruction or Anonymization of Personal Data
Board Personal Data Protection Board
Policy Storage and Destruction of Personal Data Policy
Data Controller The natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.
The Data Owner /Data Subject is the real person whose personal data is processed.
A natural or legal person who processes personal data on behalf of the data processor based on the authority granted by the data controller.
All kinds of information related to a real person whose Personal Data Identity is defined or can be determined.
Special Categories of Personal Data are race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs of persons, disguise and clothing, association, foundation or trade union membership, health, sexual life, criminal conviction and security measures related data, as well as biometric and genetic data.
Employee / Staff Company personnel
The company MESAN METAL ALUMINUM SAN. and tic. A. Sh.
Processing of Personal Data All kinds of operations performed on data such as obtaining, saving, storing, storing, changing, rearranging, disclosing, transferring, inheriting, making available, classifying or preventing the use of personal data by means that are fully or partially automatic or non-automatic, provided that they are part of any data recording system.
Deletion of Personal Data The process of making personal data inaccessible and unusable again for the Relevant Users in any way.
Destruction of Personal Data The process of making personal data inaccessible, irrevocable and unusable again by no one in any way.
Anonymization of Personal Data Anonymization of personal data makes it impossible to associate with an identified or identifiable real person in any way, even by matching it with other data.
Storage of Personal Data Storage of personal data in physical environment or digital environment.
Sharing of Personal Data Sharing of personal data in accordance with the law.
3 Of Your Personal Data.Transfer of Personal Data to a Person Transfer of personal data to a legal entity or a natural person at home or abroad.
Data Recording System A recording system in which personal data is processed by being configured according to certain criteria.
Data Security The process of protecting data from unauthorized use, unauthorized disclosure, unauthorized destruction, unauthorized modification, damage to information, or preventing unauthorized access to information.
VERBIS Data Controllers Registry Information System.
Contact Person is a natural person appointed to be contacted in the communications to be made by the Board and the Institution regarding the obligations of legal entities residing in Turkey and the representative of the legal entity data controller within the scope of the register.
The Recording Environment is any environment in which personal data is processed by means that are fully or partially automatic or that are processed by non-automatic means provided that they are part of any data recording system.
Soft Media Digital media.
Application Form A printed form that the personal data owner will fill out in case of application to the company.
A Private Power of Attorney is a written document that a person authorizes another person in writing to act on their behalf in certain affairs.
Electronic Environment Environments where personal data can be created, read, modified and written with electronic devices.
Non-Electronic Media All written, printed, visual, etc. that are outside the electronic media. other environments.
Explicit Consent is consent related to a specific topic, based on information and explained by free will.
Destruction Deletion, destruction or anonymization of personal data.
With the exception of the person or unit responsible for the technical storage, protection and backup of the relevant User Data, they are real persons who process personal data within the data controller organization or in accordance with the authority and instructions received from the data controller.
Periodic Destruction In the event that all the conditions for processing personal data contained in the law disappear, the process of erasure, destruction or anonymization of personal data will be carried out ex officio at December intervals specified in the retention and destruction policy.
The category of natural or legal person to whom personal data is transferred by the Recipient Group Data controller.
Personal Data Processing Inventory An inventory in which data controllers detail the personal data processing activities that they perform depending on their business processes, explaining the personal data processing purposes and legal reason, the data category, the recipient group transferred and the maximum retention period required for the purposes for which the personal data are processed, the personal data intended for transfer to foreign countries and the measures taken for data security.
Obligation of Clarification During the collection of personal data by the data controller or the person authorized by him, to inform the relevant persons about the identity of the data controller and his representative, if any, for what purpose the personal data will be processed, to whom and for what purpose the processed personal data may be transferred, the method and legal reason for collecting personal data, and other rights listed in Article 11 of the Law.
Update Period The table related to the updates made to this policy.

1.4 Principles Related to the Implementation of the Policy

Our company acts in the storage and destruction of personal data within the framework of the following principles:

Personal data; 4 of the Law. It is processed taking into account the principles of compliance with the law and honesty rules listed in the Article, being accurate and up-to-date when necessary, being processed for certain clear and legitimate purposes, being related to the purpose for which they are processed, being limited and restrained, being kept for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed.
Our Company is subject to Article 12 of the Law. 5.4.2 Of the policy on erasure, destruction and anonymization of personal data and acting in accordance with the obligations related to Data Security stipulated in accordance with Article 2.4.2 of the policy on erasure, destruction and anonymization of personal data. the technical and administrative measures specified in the article, the provisions of the relevant legislation and the decisions of the Board are taken into account.
All transactions related to the deletion, destruction, anonymization of personal data are recorded by our company and these records are stored for at least 5 years, excluding other legal obligations.
Unless a decision to the contrary is taken by the Board or provided for in the legislation (secondary regulations by law), the appropriate method of erasing, destroying or anonymizing personal data is selected by our Company. However, if the person concerned requests; the appropriate method will be selected by explaining the reason.
5 of the Law. and 6. in the event that all of the conditions for processing the personal data contained in the articles disappear, the personal data are deleted, destroyed or anonymized by our company on your own or upon the request of the relevant person. In case of application to our company by the Relevant Person in this regard;
The submitted requests are finalized within 30 (thirty) days at the latest and the relevant person is informed,
If the data subject to the request has been transferred to third parties, this is notified to the third party to whom the data has been transferred and the necessary actions are taken by the third parties. Jul.

2. DUTIES AND POWERS OF THE PERSONAL DATA PROTECTION COMMITTEE

The Personal Data Protection Committee is responsible for announcing the Policy to the relevant business units and monitoring the fulfillment of its requirements. The Personal Data Protection Committee makes the necessary announcements and notifications for the relevant business units to follow up on situations such as legislative changes related to the protection of personal data, regulatory actions and decisions of the Board, court decisions or changes in processes, applications and systems and, if necessary, to update their business processes. Determines the processes for examination, evaluation, follow-up and conclusion of the decisions and regulations of the Board, court decisions and other competent authorities with the laws and secondary regulations, and announces them to the relevant units. It takes technical and administrative measures to ensure the necessary level of security in accordance with the guidelines published by the Board and performs inspections.

3. ISSUES RELATED TO THE PROTECTION OF PERSONAL DATA

In this context, our Company takes technical and administrative measures and conducts audits to ensure the necessary level of security in accordance with the guidelines published by the Board.

3.1. Obligations Related to Data Security

Our Company takes Jul all kinds of necessary technical and administrative measures to ensure the appropriate level of security in order to prevent the unlawful processing of personal data, to prevent the unlawful access to personal data, to ensure the preservation of personal data.

4. THE RIGHTS OF PERSONAL DATA OWNERS AND THE EXERCISE OF THESE RIGHTS

Personal data owners have the following rights::

To learn whether personal data is processed or not,
If your personal data has been processed, do not request information about it,
To learn the purpose of the processing of personal data and whether they are used in accordance with their purpose,
To know the third parties to whom personal data are transferred at home or abroad,
To request correction of the personal data in case of incomplete or incorrect processing and to request notification of the transaction made in this context to the third parties to whom the personal data are transferred,
Although it has been processed in accordance with the provisions of the law and other relevant laws, to request the deletion or destruction of personal data if the reasons requiring its processing disappear, and to request that the transaction made in this context be notified to the third parties to whom the personal data has been transferred,
Objecting to the occurrence of a result against the person himself by analyzing the processed data exclusively through automated systems,
To request compensation of the damage in case of damage due to unlawful processing of personal data.

4.1. Exercising the Rights of Personal Data Owners

Personal Data Owners are subject to section 3 of this section. By filling out and signing the Application Form with the information and documents that will identify the requests for the rights listed under the heading MESAN METAL ALUMINUM SAN. and by the methods specified below or by other methods determined by the Personal Data Protection Board, by filling out and signing the Application Form. and tic. A. Sh.’what will they be able to transmit for free:

a. https://www.mesanaluminyum.com.tr / after filling out the form at the address, a wet signed copy of the form is sent by hand personally or through a notary “MESAN METAL ALUMINUM SAN. and tic. A. Sh. Hadımköy Mah. Metin Oktay Cad. No:8/1 Arnavutkoy / ISTANBUL to be forwarded to the address ”,

b. https://www.mesanaluminyum.com.tr / after filling out and imazing the form located at the address, in a soft environment kvkk@mesanaluminyum.com.tr to be sent by e-mail to the address,

c. You can send it by applying with the other methods specified in the KVK Law.

In order for third parties to request an application on behalf of the personal data owners, there must be a special power of attorney issued by the data owner through a notary public on behalf of the person who will apply.

4.2 Our Company Responds to the Applications of Interested Parties

Our Company takes the necessary administrative and technical measures to finalize the applications to be made by the personal data owner in accordance with the Law and Regulation. The owner of the personal data must comply with section 4.1 of this section. if he submits his request in accordance with the procedure set out in the section entitled, our company will finalize the relevant request free of charge within thirty days at the latest, depending on the nature of the request. However, if a fee is stipulated by the KVK Board, the fee in the tariff determined by the KVK Board will be charged by our company from the applicant.

5. STORAGE AND DESTRUCTION OF PERSONAL DATA

5.1. Legal Reasons that Require Data to be Stored

Provided that it is clearly stipulated in the laws, it is necessary to process personal data belonging to the parties to the contract, it is mandatory for the data controller to fulfill his legal obligations, it has been made public by the data subject himself, data processing is mandatory for the establishment, use or protection of a right, data processing is mandatory for the legitimate interests of the data subject, provided that it does not harm the fundamental rights and freedoms of the data subject, the protection of public health, the administration of the company, the execution of the work is processed in the event that one or more of the cases of implementation of the company’s policies are found.

5.2. Processing Purposes that Require Data to be Stored

Our Company stores the personal data it processes within the framework of its activities in accordance with the following purposes and legal bases:

Execution of Emergency Management Processes, Execution of Information Security Processes, Execution Of Employee Candidate / Intern/Student Selection And Placement Processes, Execution of Employee Candidate Application Processes, Execution Of Employee Satisfaction And Loyalty Processes, Fulfillment Of Obligations Arising From Business Contracts And Legislation For Employees, Execution of Benefits And Benefits For Employees, Annual And Other Employee Leave Approvals, Execution of Audit/Ethics Activities, Determination of Regulatory Process And Company Management Responsibilities, Execution of Educational Activities, Execution of Access Authorizations, Execution of Activities in Accordance with Legislation, Planning and Management of Harmonization of Activities with Relevant Legislation or Company Procedures, Execution of Finance and Accounting Affairs, Execution of Loyalty Processes to Companies / Products / Services, Provision of Physical Space Security, Receipt of Entry and Exit Records, Execution of Assignment Processes, Tracking and Execution of Legal Affairs, Execution of Internal Audit / Investigation / Intelligence Activities, Execution of Communication Activities Jul, Planning of Human Resources Processes, Conducting / Auditing of Business Activities, Collecting Entry and Exit Records of Business Partner/Supplier Employees, Sharing with Business Partners for Candidate Evaluation Purposes, Sharing with Business Partners, Business Partners, Planning and Management of Suppliers’ Access to Information and Facilities, Business Partners, Managing Relationships with Suppliers, Conducting Occupational Health/ Safety Activities, Receiving and Evaluating Recommendations for Improving Business Processes, Conducting Business Continuity Activities, Fulfillment of Dismissal Processes, Display of Remaining Permits And Making Permit Arrangements, Ensuring Compliance with Corporate Policies and Supervision, Execution of Logistics Activities, Execution of Goods / Services Purchase Processes, Execution of Goods / Services After-sales Support Services, Execution of Goods / Services Sales Processes, Execution of Goods / Services Production And Operation Processes, Execution of Customer Relationship Management Processes, Execution of Customer Satisfaction Activities, Organization And Event Management, Jul-Jul, Execution of Marketing Analysis Studies, Performance Evaluation Processes, Execution of Advertising / Campaign / Promotion Processes, Execution of Risk Management Processes, Execution Of Storage And Archive Activities, Execution of Contract Processes, Execution Of Strategic Planning Activities, Tracking of Claims / Complaints, Ensuring The Security of Movable Goods And Resources, Management of Relations with Suppliers, Execution of Remuneration Policy, Execution of Marketing Processes of Products / Services, Ensuring the Security of Data Controller Operations, Work And Residence Permit Procedures for Foreign Personnel, Conducting Talent / Career Development Activities, Providing Information to Authorized Persons, Institutions And Organizations, Conducting Management Activities.

“Mandatory data processing for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned,” which is included in the legal bases

The personal data belonging to the data owners are collected by our Company, in particular:

Ability to maintain and carry out activities,
Planning and execution of employee and customer rights,
Ensuring in-house security,
Ability to manage business relationships,
Management of company policies and business processes.

For this purpose, it is stored securely in the physical or electronic environments listed above within the limits specified in the Law and other relevant legislation.

5.3. Reasons Requiring the Destruction of Personal Data

In accordance with the Regulation, in the following cases, the personal data belonging to the data owners are deleted, destroyed or anonymized by our company re ’sen or upon request:

Amendment or interest of the provisions of the relevant legislation that constitute the basis for the processing or storage of personal data,
Elimination of the purpose that requires the processing or storage of personal data,
5 of the Law. and 6. elimination of the conditions requiring the processing of personal data in the articles.
In cases where the processing of personal data takes place only on the basis of explicit consent, the withdrawal of the consent of the person concerned,
The person concerned, 11 of the Law. acceptance of the application made by the data controller regarding the deletion, destruction or anonymization of his personal data within the framework of the rights in subparagraphs (e) and (f) of article 2 by the data controller,
If the data controller rejects the application made to him with the request to delete, destroy or anonymize his personal data by the relevant person, his response is insufficient or he does not respond within the period stipulated in the Law, a complaint is filed with the Board and this request is deemed appropriate by the Board,
Although the maximum period of time requiring the storage of personal data has passed, there are no conditions that justify storing personal data for a longer period of time

5.4. Storage of Personal Data by Our Company and Destruction Procedures

5.4.1. Recording Media

The personal data belonging to the data owners are stored securely by our company in the environments listed in the table below in accordance with the relevant legislation, especially the provisions of the KVKK, and within the framework of international data security principles:

Storage of Data Recording Media
Personal data contained in the physical environment The personal data contained in the physical environment are stored in closed environments and are kept closed to the access of unauthorized persons.
Personal data contained in the databases, the relevant user’s access authority to the database is defined by assigning a role and permission, and access to personal data is blocked for people who have left the task or changed their area of duty.
Personal data stored on the central servers, the relevant user’s access authority to the database is defined by assigning roles and permissions, and access to personal data is blocked for people who have left the task or whose area of duty has been changed.

5.4.2 Technical and Administrative Measures

12 Of the KVKK for the purpose of storing your personal data securely, processing it illegally, preventing access to it and destroying the data in accordance with the law. Within the framework of the principles in the article, all administrative and technical measures taken by our company are listed below:

Administrative Measures:

Our company within the scope of administrative measures;

It limits internal access to the stored personal data to the personnel who are required to access it according to the job definition. In limiting access, whether the data is of a special nature and the degree of importance are also taken into account.
In case of obtaining the processed personal data by others by unlawful means, it notifies the relevant person and the Board of this situation as soon as possible.
Regarding the sharing of personal data, it signs a framework agreement on the protection of personal data and data security with the persons to whom personal data is shared, or ensures data security with the provisions added to its existing agreement.
It employs knowledgeable and experienced personnel about the processing of personal data and provides the necessary trainings to its personnel within the scope of the legislation on the protection of personal data and data security. With these trainings, the technical knowledge / skills of the personnel within the company are improved and the procedures for processing / storage and destruction of personal data are carried out by the relevant personnel in accordance with the law and legislation.
Performs and makes the necessary audits periodically in order to ensure the implementation and control of the provisions of the law before its own legal entity. Addresses the privacy and security weaknesses that arise/are likely to arise as a result of audits.
In order to protect personal data and ensure data security, it signs confidentiality agreements with employees regarding the activities carried out by the company or ensures data security with the provisions added to existing agreements, if any.
Before starting to process personal data, it fulfills its obligation to inform the relevant persons whose personal data are processed by informing them about who, for what purposes and for legal reasons this data can be processed, to whom it can be transferred for what purposes.
Except for the exceptional cases stipulated by the legislation; It undertakes to the relevant persons that it will not process personal data without the explicit consent of the relevant person. If it is necessary to obtain explicit consent, this obligation is fulfilled by obtaining the consent of the relevant person related to a certain subject, based on being informed and explained by free will.
In case the data storage period stipulated in the law or specified in the policy expires, the process of erasure, destruction or anonymization of these personal data is operated during the first periodic destruction process to be performed by the company.
It is ensured that all reasonable measures are taken to prevent the theft, loss or corruption of information.
Technical Measures: