Privacy & Cookies

PERSONAL DATA PROCESSING AND PROTECTION POLICY

PART ONE

§ 1. INTRODUCTION

1.1. Introduction

As KAR TUR İNŞAAT REKLAM TURİZM VE TAŞIMACILIK LİMİTED ŞİRKETİ (the “Company” or “Marisstone Hotel”), we attach the utmost importance to the lawful processing and protection of personal data under Personal Data Protection Law No. 6698 (the “Law”) and exercise this care in all our planning and activities. With this awareness, we present this Personal Data Processing and Protection Policy (the “Policy”) both to fulfil our obligation to inform under Article 10 of the Law and to explain the administrative and technical measures we take to process and protect personal data.

1.2. Purpose of the Policy

The main purpose of this Policy is to explain the systems for processing and protecting personal data in accordance with the law and the purpose of the Law, and to inform the persons whose personal data our Company processes, particularly Company Stakeholders, Company Officers, Company Business Partners, Job Applicants, Visitors, Company Customers, Prospective Customers and Third Parties. The aim is to ensure full compliance with legislation in our personal data processing and protection activities and to protect all rights of data subjects arising from personal data legislation.

1.3. Scope of the Policy and Data Subjects

This Policy has been prepared for, and applies to, persons whose personal data our Company processes by fully or partly automated means, or by non-automated means forming part of a data filing system, particularly Company Stakeholders, Company Officers, Company Business Partners, Job Applicants, Visitors, Company Customers, Prospective Customers and Third Parties. This Policy does not apply to legal entities or data relating to legal entities.

Our Company informs these Data Subjects about the Law by publishing this Policy on its website. The Employee Personal Data Processing and Protection Policy applies to our employees. This Policy also does not apply where the data does not fall within the definition of “Personal Data” below or where our Company's processing activities are not carried out by the means specified above.

The data subjects covered by this Policy are as follows:

1.4. Definitions

The terms used in this Policy have the following meanings:

1.5. Entry into Force of the Policy

This Policy, prepared by the Company and effective as of …………………., was updated on …/…/… and is published on the Company's website (www……………………….). It is also made available to Data Subjects upon request.

PART TWO

§ 2. PROCESSING AND TRANSFER OF PERSONAL DATA

2.1. General Principles for Processing Personal Data

The Company processes Personal Data in accordance with the procedures and principles stipulated in the Law and this Policy. When processing Personal Data, the Company acts in accordance with the following principles:

• Personal Data is processed lawfully and in accordance with the requirements of good faith.
• Personal Data is kept accurate and up to date. In this regard, due care is given to identifying the sources from which data is obtained, verifying its accuracy and assessing whether it needs updating.
• Personal Data is processed for specific, explicit and legitimate purposes . A legitimate purpose means that the Personal Data processed by the Company is related to, and necessary for, its business or the services it provides.
• Personal Data is relevant to achieving the purposes determined by the Company; processing data that is unrelated to or unnecessary for those purposes is avoided. Processing is limited to the data necessary to achieve the purpose. Accordingly, the Personal Data processed is relevant, limited and proportionate to the purposes for which it is processed.
• Where the relevant legislation stipulates a retention period, the Company complies with that period; otherwise, Personal Data is retained only for as long as necessary for the purpose for which it is processed. When there is no longer a valid reason for retaining Personal Data, it is deleted, destroyed or anonymised.

2.2. Conditions for Processing Personal Data

The Company does not process Personal Data without the data subject's explicit consent. Personal Data may be processed without explicit consent where one of the following conditions exists.

• The Company may process Data Subjects' Personal Data without explicit consent where expressly provided for by law. For example, Article 230 of the Tax Procedure Law does not require a person's explicit consent for their name to appear on an invoice.
• Personal Data may be processed without explicit consent where necessary to protect the life or physical integrity of a person who is unable to express consent due to practical impossibility, or whose consent is not legally valid, or that of another person. For example, where a person is unconscious or their consent is invalid due to mental illness, their Personal Data may be processed during medical intervention to protect life or physical integrity. Data such as blood group, previous illnesses and operations, and medications used may be processed through the relevant healthcare system.
• The Company may process Personal Data belonging to the parties to a contract where this is directly related to the establishment or performance of that contract. For example, a creditor's account number may be obtained to make a payment required under a contract.
• The Company may process Data Subjects' Personal Data where necessary to fulfil its legal obligations as data controller.
• The Company may process Personal Data made public by Data Subjects themselves, in other words disclosed to the public by any means, because the legal interest requiring protection no longer exists.
• The Company may process Data Subjects' Personal Data without explicit consent where processing is necessary to exercise or protect a legally legitimate right.
• The Company may process Data Subjects' Personal Data where necessary for its legitimate interests, provided that this does not harm the fundamental rights and freedoms protected under the Law and the Policy. The Company takes due care to comply with the fundamental principles of personal data protection and to maintain a balance between the interests of Data Subjects.

2.3. Conditions for Processing Special Categories of Personal Data

The Company does not process Special Categories of Personal Data without the data subject's explicit consent. However, Personal Data other than data relating to health and sex life may be processed without explicit consent where provided for by law. The Company processes Personal Data relating to health and sex life without explicit consent only for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing, where we are subject to a duty of confidentiality. The Company takes the necessary steps to implement the adequate measures determined by the Board for processing Special Categories of Personal Data.

2.4. Conditions for Transferring Personal Data

Our Company may transfer Data Subjects' Personal Data and Special Categories of Personal Data to third parties in accordance with the Law, by establishing the necessary confidentiality conditions and taking security measures for its processing purposes. Our Company complies with the statutory rules when transferring Personal Data. For legitimate and lawful processing purposes, transfers are based on and limited to one or more of the conditions in Article 5 of the Law listed below.

Personal Data may be transferred to third parties:

• Where the Data Subject has given explicit consent;
• Where a law expressly provides for the transfer of Personal Data; or where it is necessary to protect the life or physical integrity of the Data Subject or another person and
• the Data Subject is unable to express consent due to practical impossibility, or their consent is not legally valid;
• Where the transfer of Personal Data belonging to the parties to a contract is necessary and directly related to establishing or performing that contract;
• Where the transfer is necessary for our Company to fulfil a legal obligation;
• Where the Personal Data has been made public by the Data Subject;
• Where the transfer is necessary to establish, exercise or protect a right;
• Where the transfer is necessary for our Company's legitimate interests, provided that the Data Subject's fundamental rights and freedoms are not harmed.

2.4.1. Conditions for Transferring Personal Data Abroad

Our Company may transfer Data Subjects' Personal Data and Special Categories of Personal Data to third parties abroad by taking the necessary security measures for its processing purposes. Personal Data may be transferred to countries declared by the Personal Data Protection Board to provide adequate protection or, where adequate protection is lacking, to countries where the data controllers in Türkiye and the relevant foreign country provide a written undertaking of adequate protection and the Board has authorised the transfer.

2.5. Conditions for Transferring Special Categories of Personal Data

By exercising due care, taking the necessary security measures and implementing the adequate measures stipulated by the Personal Data Protection Board, the Company may transfer a Data Subject's Special Categories of Personal Data to third parties for legitimate and lawful processing purposes in the following circumstances:

• Where the Data Subject has given explicit consent; or
• Without the Data Subject's explicit consent where the following conditions apply:
• For Special Categories of Personal Data other than health and sex life data (race, ethnic origin, political opinions, philosophical beliefs, religion, religious denomination or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, criminal convictions and security measures, and biometric and genetic data), where provided for by law;
• For Special Categories of Personal Data relating to health and sex life, only by persons subject to a duty of confidentiality or authorised institutions and organisations, for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

2.5.1. Transfer of Special Categories of Personal Data Abroad

By exercising due care, taking the necessary security measures and implementing the adequate measures stipulated by the Personal Data Protection Board, the Company may transfer a Data Subject's Special Categories of Personal Data, for legitimate and lawful processing purposes, to foreign countries providing adequate protection or where a data controller undertakes to provide adequate protection, in the following circumstances:

• Where the Data Subject has given explicit consent; or
• Without the Data Subject's explicit consent where the following conditions apply:
• For Special Categories of Personal Data other than health and sex life data (race, ethnic origin, political opinions, philosophical beliefs, religion, religious denomination or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, criminal convictions and security measures, and biometric and genetic data), where provided for by law;
• For Special Categories of Personal Data relating to health and sex life, only by persons subject to a duty of confidentiality or authorised institutions and organisations, for the protection of public health, preventive medicine, medical diagnosis, treatment and care services, and the planning and management of healthcare services and their financing.

PART THREE

§ 3. PURPOSES OF PROCESSING AND TRANSFERRING PERSONAL DATA AND RECIPIENTS

3.1. Purposes of Processing and Transferring Personal Data

Personal Data is processed lawfully and in accordance with the purpose of the Law, for the Company's following purposes:

• Planning and implementing human resources policies in the best possible way;
• Properly planning, conducting and managing business partnerships and strategies;
• Ensuring the legal, commercial and physical security of the Company and its business partners;
• Ensuring corporate operations and planning and carrying out management and communication activities;
• Enabling Data Subjects to benefit from products and services in the best possible way, and tailoring and recommending them according to their requests, needs and wishes;
• Ensuring the highest level of data security;
• Improving the services offered on the website and resolving website errors;
• Contacting Data Subjects who submit requests and complaints, and managing those requests and complaints;
• Event management;
• Managing relationships with business partners or suppliers;
• Conducting recruitment processes;
• Supporting the planning and implementation of benefits and entitlements for senior Company executives;
• Carrying out and monitoring financial reporting and risk management operations;
• Conducting and monitoring the Company's legal affairs;
• Carrying out activities to protect its reputation;
• Managing investor relations;
• Providing information required by legislation to authorised institutions;
• Creating and monitoring visitor records.

Processing is limited to these purposes and subject to the conditions specified in Articles 5 and 6 of the Law. If processing for these purposes does not meet any of the conditions stipulated in the Law, the Company obtains your explicit consent for the relevant processing activity.

3.2. Recipients of Personal Data

Personal Data may be shared with our business and solution partners, banks and third parties that perform technical, logistical and similar operations on our behalf, to ensure that the services provided to you are complete and without defects, and only to the extent appropriate to the nature of the service. These third parties are limited to persons who must have access to the relevant information to provide those services fully and properly.

Your Personal Data may also be transferred, limited to the relevant person or institution, where sharing with other third parties is necessary to provide the service fully and properly, to fulfil the Company's legal obligations, where expressly provided for by law, or where a judicial or administrative order has been issued in accordance with the law.

Some Personal Data may be shared with advertisers solely in an aggregated, anonymised form together with information about other users, to adapt advertisements to their target audience.

Anonymised data cannot be matched to you as visitors or customers, does not contain your identity information and does not make you identifiable. Your privacy is protected in anonymised data.

PART FOUR

§ 4. METHODS AND LEGAL GROUNDS FOR COLLECTING PERSONAL DATA; DELETION, DESTRUCTION, ANONYMISATION AND RETENTION PERIODS

4.1. Methods and Legal Grounds for Collecting Personal Data

For the purpose of checking compliance with Article 1, which sets out the purpose of the Law, and Article 2, which sets out its scope, Personal Data is collected verbally, in writing or electronically, through technical and other means, including stores, dealer/franchise channels, sales outlets, call centres, Company websites and mobile applications. It is collected to achieve the purposes in this Policy and to fulfil statutory responsibilities fully and correctly, on legal grounds arising from legislation, contracts, requests and demands, and is processed by the Company or processors appointed by the Company.

4.2. Deletion, Destruction or Anonymisation of Personal Data

Without prejudice to provisions in other laws on deletion, destruction or anonymisation, the Company deletes, destroys or anonymises Personal Data on its own initiative or at the data subject's request, in accordance with its Personal Data Retention and Disposal Policy, when the reasons requiring processing cease to exist, even if the data was processed in accordance with this Law and other laws.

4.3. Retention Periods for Personal Data

Where legislation stipulates a retention period, the Company retains Personal Data for that period. Where no period is specified, Personal Data is processed for as long as required by the relevant activity, the Company's practices and commercial custom, and is then deleted, destroyed or anonymised.

Where the processing purpose and the retention periods stipulated by legislation and the Company have ended, Personal Data may be retained solely as evidence in possible legal disputes or to assert a related right or establish a defence. Such periods are determined by reference to the limitation periods for asserting the right and examples of previous claims made against the Company on the same matters even after those limitation periods. In this case, retained Personal Data is not accessed for any other purpose and is accessed only when needed in the relevant legal dispute. Once these periods also expire, the Personal Data is deleted, destroyed or anonymised.

Detailed provisions concerning the Company's techniques for retaining, deleting, destroying and anonymising Personal Data are set out in the Company's Personal Data Retention and Disposal Policy.

PART FIVE

§ 5. MATTERS RELATING TO THE PROTECTION OF PERSONAL DATA

In accordance with Article 12 of the Law, the Company takes the necessary technical and administrative measures to ensure an appropriate level of security to prevent unlawful processing of and unlawful access to the Personal Data it processes, and to ensure its safekeeping. It carries out or commissions the necessary audits in this regard.

5.1. Ensuring the Security of Personal Data

5.1.1. Technical and Administrative Measures to Ensure Lawful Processing of Personal Data

The Company takes technical and administrative measures to ensure lawful processing of Personal Data, taking technological capabilities and implementation costs into account.

• Technical Measures to Ensure Lawful Processing of Personal Data

The principal technical measures taken by the Company to ensure lawful processing of Personal Data include, but are not limited to, the following:

• Personal Data processing activities within the Company are monitored through established technical systems.
• Technical measures are periodically reported to the relevant persons as part of the internal audit mechanism.
• Personnel with technical knowledge are employed.
• Administrative Measures to Ensure Lawful Processing of Personal Data

The principal administrative measures taken by the Company to ensure lawful processing of Personal Data include, but are not limited to, the following:

• Employees are informed and trained on personal data protection law and lawful processing of Personal Data.
• All Company activities are analysed in detail for each business unit, and the Personal Data processing activities associated with each unit's operations are identified.
• For each business unit and its specific activities, the requirements to be fulfilled to ensure that Personal Data processing complies with the processing conditions of the Law are determined.
• Awareness is raised and implementation rules are established in the relevant business units to meet the legal compliance requirements identified for each unit. Necessary administrative measures are implemented through internal policies and training to monitor these matters and ensure continuity of implementation.
• Contracts and documents governing the relationship between the Company and its employees include obligations not to process, disclose or use Personal Data except under the Company's instructions or statutory exceptions. Employee awareness is raised and audits are conducted to fulfil obligations arising from the Law.

5.1.2. Technical and Administrative Measures to Prevent Unlawful Access to Personal Data

The Company takes technical and administrative measures to prevent negligent or unauthorised disclosure, access or transfer, and all other forms of unlawful access to Personal Data, taking into account the nature of the data, technological capabilities and implementation costs.

• Technical Measures to Prevent Unlawful Access to Personal Data

The principal technical measures taken by the Company to prevent unlawful access to Personal Data include, but are not limited to, the following:

• Technical measures are taken in line with technological developments and are periodically updated and renewed.
• Technical access and authorisation solutions are implemented in accordance with the legal compliance requirements identified for each business unit.
• Access permissions are restricted and regularly reviewed.
• Technical measures are periodically reported to the relevant persons as part of the internal audit mechanism. Matters posing risks are reassessed and the necessary technological solutions are developed.
• Software and hardware incorporating antivirus systems and firewalls are installed.
• Personnel with technical knowledge are employed.
• Applications in which Personal Data is collected undergo regular security scans to identify vulnerabilities, and identified vulnerabilities are remedied.
• Administrative Measures to Prevent Unlawful Access to Personal Data

The principal administrative measures taken by the Company to prevent unlawful access to Personal Data include, but are not limited to, the following:

• Employees are trained on the technical measures required to prevent unlawful access to Personal Data.
• Internal access and authorisation processes for Personal Data are designed and implemented in accordance with each business unit's legal compliance requirements for processing.
• Employees are informed that they may not disclose Personal Data they learn to others in breach of the Law or use it for purposes other than processing, and that these obligations continue after leaving their role. The necessary undertakings are obtained from them accordingly.
• Contracts with persons to whom the Company lawfully transfers Personal Data include provisions requiring recipients to take the security measures necessary to protect Personal Data and to ensure compliance with those measures within their organisations.

5.1.3. Retention of Personal Data in Secure Environments

The Company takes the necessary technical and administrative measures to retain Personal Data in secure environments and prevent its destruction, loss or alteration for unlawful purposes, taking technological capabilities and implementation costs into account.

• Technical Measures for Retaining Personal Data in Secure Environments

The principal technical measures taken by the Company to retain Personal Data in secure environments include, but are not limited to, the following:

• Systems consistent with technological developments are used to retain Personal Data securely.
• Personnel with technical expertise are employed.
• Technical security systems are established for storage areas. Security tests and research are conducted to identify vulnerabilities in information systems, and existing or potential risks identified by these activities are remedied. Technical measures are periodically reported to the relevant persons as part of the internal audit mechanism.
• Backup programs are used lawfully to ensure secure retention of Personal Data.
• Access to environments holding Personal Data is restricted to authorised persons and to the purpose of retention. Access to storage areas containing Personal Data is logged, and inappropriate access or access attempts are reported to the relevant persons immediately.
• Administrative Measures for Retaining Personal Data in Secure Environments

The principal administrative measures taken by the Company to retain Personal Data securely are listed below:

• Employees are trained on ensuring secure retention of Personal Data.
• Legal and technical consultancy services are obtained to monitor developments in information security, privacy and personal data protection and to take the necessary action.
• Where external services are obtained for technical requirements relating to Personal Data retention, contracts with the companies to which data is lawfully transferred include provisions requiring recipients to take the necessary security measures to protect Personal Data and ensure compliance within their organisations.

5.1.4. Auditing Personal Data Protection Measures

In accordance with Article 12 of the Law, the Company carries out or commissions the necessary internal audits. Audit results are reported to the relevant department through the Company's internal procedures, and the activities necessary to improve measures are undertaken.

5.1.5. Measures in the Event of Unauthorised Disclosure of Personal Data

In accordance with Article 12 of the Law, the Company operates a system to notify the relevant Data Subject and the Personal Data Protection Board as soon as possible if processed Personal Data is obtained unlawfully by others. If the Board considers it necessary, the incident may be announced on the Board's website or by other means.

5.2. Safeguarding Data Subjects' Statutory Rights

The Company safeguards all statutory rights of Data Subjects through implementation of the Policy and the Law and takes all measures necessary to protect those rights. Detailed information on Data Subjects' rights is provided in Part Six of this Policy.

5.3. Protection of Special Categories of Personal Data

The Law attaches particular importance to certain Personal Data because unlawful processing may cause harm or discrimination. This includes data relating to race, ethnic origin, political opinions, philosophical beliefs, religion, religious denomination or other beliefs, appearance and clothing, membership of associations, foundations or trade unions, health, sex life, criminal convictions and security measures, and biometric and genetic data. The Company exercises the utmost care in protecting lawfully processed Personal Data designated as “special categories” by the Law. Technical and administrative measures for protecting personal data are also applied with the utmost care to these categories, and the necessary internal audits are ensured.

PART SIX

§ 6. DATA SUBJECTS' RIGHTS, EXERCISE OF RIGHTS AND ASSESSMENT

6.1. Informing Data Subjects

The Company informs Data Subjects when Personal Data is obtained, in accordance with Article 10 of the Law. This includes the identity of the Company's representative, if any, the purposes of processing, the recipients and purposes of any transfers, the methods and legal grounds for collecting Personal Data, and the Data Subject's rights.

6.2. Data Subjects' Rights under the Personal Data Protection Law

Under Article 10 of the Law, the Company informs you of your rights, explains how to exercise them and establishes the necessary internal procedures and administrative and technical arrangements. Under Article 11, persons whose Personal Data is collected have the following rights:

• To learn whether their Personal Data is being processed;
• To request information if their Personal Data has been processed;
• To learn the purpose of processing and whether their Personal Data is used in accordance with that purpose;
• To know the third parties to whom Personal Data is transferred domestically or abroad;
• To request correction of incomplete or inaccurate Personal Data;
• To request deletion or destruction of Personal Data under the conditions in Article 7 of the Law;
• To request notification to third-party recipients of the actions taken under subparagraphs (d) and (e) of Article 11 of the Law;
• To object to a result that is detrimental to them arising from analysis of processed data exclusively through automated systems;
• To claim compensation for damage caused by unlawful processing of Personal Data.

The Company recognises these rights.

6.3. Exercise of Data Subjects' Rights

Data Subjects may submit requests concerning the rights listed in section 6.2 free of charge, with information and documents establishing their identity, by completing and signing the Application Form available at the ……………. link and submitting it through the methods below or other methods determined by the Personal Data Protection Board:

• After completing the form, delivering a copy bearing a handwritten signature in person or through a notary to [………………………………];
• After completing and signing the form with a “secure electronic signature” under Electronic Signature Law No. 5070, sending it by registered electronic mail to ……………...@..............kep.tr;
• Applying in person with proof of identity and information and documents relating to the request, and submitting the form using the email address previously notified to the Company and registered in its system.

For third parties to apply on behalf of a data subject, the applicant must hold a special power of attorney issued by the data subject through a notary.

6.4. Procedure and Time Limit for Responding to Applications

The Company resolves requests free of charge as soon as possible, and no later than thirty days, depending on their nature. If the procedure entails an additional cost, a fee may be charged according to the tariff set by the Personal Data Protection Board. The Company may accept a request or reject it with reasons, and communicates its response in writing or electronically. If a request is accepted, the Company takes the necessary action.

6.5. Data Subjects' Right to Complain to the Personal Data Protection Board

If an application is rejected, the response is inadequate or no response is provided within the time limit, the data subject may complain to the Personal Data Protection Board within thirty days of learning of the response and, in any event, within sixty days of the application date.

PART SEVEN

§ 7. COMPANY MANAGEMENT STRUCTURE UNDER THE PERSONAL DATA PROCESSING AND PROTECTION POLICY

A Personal Data Committee has been established by decision of senior management to administer this Policy and related policies. The Committee is authorised and responsible for taking the steps necessary to retain and process Data Subjects' data in accordance with the law, this Policy and related policies. Detailed provisions on the Committee's members and their duties appear in the Company's Personal Data Retention and Disposal Policy.

PART EIGHT

§ 8. UPDATES, COMPLIANCE AND AMENDMENTS

8.1. Updates and Compliance

The Company reserves the right to amend this Policy and related policies in response to changes in the Law, decisions of the Personal Data Protection Board, or developments in the sector or information technology.

Amendments to this Policy are incorporated into the text immediately, with explanations of the changes at the end of the Policy.

8.2. Amendments

*There are no earlier amendments.*

KAR TUR İNŞAAT REKLAM TURİZM VE TAŞIMACILIK LİMİTED ŞİRKETİ 

PERSONAL DATA RETENTION AND DISPOSAL POLICY

PART 1: NATURE AND PURPOSE OF THE DISPOSAL POLICY

1.1. INTRODUCTION

This disposal policy has been prepared by KAR TUR İNŞAAT REKLAM TURİZM VE TAŞIMACILIK LİMİTED ŞİRKETİ (the “Company” or “Marisstone Hotel”) to establish the procedures and principles to be applied by KAR TUR for deleting, destroying or anonymising the personal data we hold as data controller, under Personal Data Protection Law No. 6698 and other applicable legislation.

Accordingly, the personal data of our employees, job applicants, customers and all natural persons whose data is held by KAR TUR for any reason is managed lawfully under the Personal Data Processing and Protection Policy and this Personal Data Retention and Disposal Policy.

All KAR TUR employees must apply this Policy to the extent relevant to their job descriptions.

1.2. DEFINITIONS

PART 2: ENVIRONMENTS AND SECURITY MEASURES

2.1. ENVIRONMENTS IN WHICH PERSONAL DATA IS RETAINED

Personal data held by KAR TUR is retained in a recording medium appropriate to the nature of the data and our legal obligations.

The recording media generally used for retaining personal data are listed below. Some data may be held in other media because of its special nature or our legal obligations. In all cases, KAR TUR acts as data controller and processes and protects personal data in accordance with the Law, the Personal Data Processing and Protection Policy and this Personal Data Retention and Disposal Policy.

2.2. ENSURING THE SECURITY OF ENVIRONMENTS

KAR TUR takes all necessary technical and administrative measures appropriate to the nature of the personal data and the environment in which it is held, to ensure secure retention and prevent unlawful processing and access.

These measures include, but are not limited to, the following administrative and technical measures, to the extent appropriate to the data and its storage environment.

2.2.1. Technical Measures

KAR TUR takes the following technical measures for all environments in which personal data is retained, as appropriate to the nature of the data and its storage environment:

• Only current, secure systems consistent with technological developments are used in environments holding personal data.
• Security systems are used for environments holding personal data.
• Security tests and research are conducted to identify vulnerabilities in information systems, and existing or potential risks identified through those activities are remedied.
• Access to environments holding personal data is restricted to authorised persons and limited to the purpose of retention; all access is recorded.
• KAR TUR employs sufficient technical personnel to secure the environments in which personal data is held.

2.2.2. Administrative Measures

KAR TUR takes the following administrative measures for all environments in which personal data is retained, as appropriate to the nature of the data and its storage environment:

• Activities are carried out to raise awareness and understanding of information security, personal data and privacy among all KAR TUR employees with access to personal data.
• Legal and technical consultancy services are obtained to monitor developments in information security, privacy and personal data protection and take the necessary action.
• Where personal data is transferred to third parties for technical or legal requirements, agreements are signed with those parties to protect personal data, and all due care is taken to ensure their compliance with those agreements.

2.2.3. Internal Audit

Under Article 12 of the Law, KAR TUR conducts internal audits concerning implementation of the Law, this Personal Data Retention and Disposal Policy and the Personal Data Processing and Protection Policy.

Any deficiencies or shortcomings in implementation identified by internal audits are remedied immediately.

If an audit or other means reveals that personal data for which KAR TUR is responsible has been obtained unlawfully by others, KAR TUR notifies the data subject and the Board as soon as possible.

PART 3: DISPOSAL OF PERSONAL DATA

3.1. REASONS FOR RETENTION AND DISPOSAL

3.1.1. Reasons for Retention

Personal data held by KAR TUR is retained for the purposes and reasons specified in the Law and our Personal Data Processing and Protection Policy (the relevant policy is available at the KAR TUR address).

3.1.2. Reasons for Disposal

Personal data held by KAR TUR is deleted, destroyed or anonymised under this Policy at the data subject's request or, on KAR TUR's own initiative, where the data subject has not given explicit consent and the grounds listed in Article 5(2) and Article 6(3) of the Law cease to exist.

The grounds listed in Article 5(2) and Article 6(3) of the Law are as follows:

• Processing is expressly provided for by law.
• Processing is necessary to protect the life or physical integrity of a person who is unable to express consent due to practical impossibility or whose consent is not legally valid, or that of another person.
• Processing the personal data of the parties to a contract is necessary and directly related to establishing or performing that contract.
• Processing is necessary for the data controller to fulfil a legal obligation.
• The data has been made public by the data subject.
• Processing is necessary to establish, exercise or protect a right.
• Processing is necessary for the legitimate interests of the data controller, provided that the data subject's fundamental rights and freedoms are not harmed.

3.2. DISPOSAL METHODS

When the reasons requiring processing cease to exist, KAR TUR deletes, destroys or anonymises personal data retained in accordance with the Law, other legislation and the Personal Data Processing and Protection Policy, at the data subject's request or on its own initiative during periodic disposal within the periods specified in this Policy. Where disposal is performed at the data subject's request, the reasons for choosing the appropriate method are explained.

The deletion, destruction and anonymisation techniques most commonly used by KAR TUR are listed below:

3.2.1.1. Deletion Methods

3.2.1.2. Destruction Methods

3.2.1.3. Anonymisation Methods

Anonymisation means rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even by matching it with other data.

KAR TUR uses one or more of these anonymisation methods depending on the nature of the data. When applying these methods, KAR TUR may use the statistical methods K-Anonymity, L-Diversity and T-Closeness.

KAR TUR selects the most appropriate, suitable and proportionate disposal method after assessing the data subject's request, the Company's interests and the nature of the data concerned.

3.3. RETENTION AND DISPOSAL PERIODS

3.3.1. Retention Periods

* If legislation stipulates a longer period, including a longer limitation, forfeiture or retention period, the statutory period is treated as the maximum retention period.

3.3.2. Disposal Periods

KAR TUR deletes, destroys or anonymises personal data for which it is responsible at the first periodic disposal following the date on which the obligation to dispose of it arises under the Law, relevant legislation, the Personal Data Processing and Protection Policy and this Personal Data Retention and Disposal Policy.

Where a data subject applies to KAR TUR under Article 13 of the Law to request deletion or destruction of their personal data:

• If all conditions for processing have ceased to exist, KAR TUR deletes, destroys or anonymises the data concerned using an appropriate disposal method within 30 (thirty) days of receipt, explaining its reasons. For the request to be deemed received, it must have been made in accordance with the Personal Data Processing and Protection Policy. In all cases, KAR TUR informs the data subject of the action taken.
  
• If not all conditions for processing have ceased to exist, KAR TUR may reject the request with reasons under Article 13(3) of the Law and communicates the rejection within thirty days through the communication method requested by the data subject.

3.4. PERIODIC DISPOSAL

When all statutory conditions for processing personal data cease to exist, KAR TUR deletes, destroys or anonymises the data on its own initiative at the recurring intervals specified in this Personal Data Retention and Disposal Policy.

Periodic disposal begins on …./…../…….. and is repeated every 6 (six) months.

3.5. AUDITING THE LAWFULNESS OF DISPOSAL

KAR TUR conducts disposal, whether at a data subject's request or on its own initiative during periodic disposal, in accordance with the Law, other legislation, the Personal Data Processing and Protection Policy and this Personal Data Retention and Disposal Policy.

KAR TUR takes administrative and technical measures to ensure that disposal complies with these provisions.

3.5.1. Technical Measures

• KAR TUR maintains technical tools and equipment appropriate to each disposal method in this Policy.
• KAR TUR ensures the security of the location where disposal is carried out.
• KAR TUR keeps access records of the persons performing disposal.
• KAR TUR employs qualified, experienced personnel to perform disposal or obtains services from qualified third parties where necessary.

3.5.2. Administrative Measures

• KAR TUR carries out activities to raise awareness and understanding of information security, personal data and privacy among employees performing disposal.
• KAR TUR obtains legal and technical consultancy services to monitor developments in information security, privacy, personal data protection and secure disposal techniques and to take the necessary action.
• Where third parties perform disposal for technical or legal reasons, KAR TUR signs agreements with them to protect personal data and takes all due care to ensure their compliance with those agreements.
• KAR TUR regularly audits whether disposal complies with the law and the conditions and obligations in this Personal Data Retention and Disposal Policy and takes the necessary action.
• KAR TUR records all operations relating to the deletion, destruction and anonymisation of personal data and retains these records for at least three years, without prejudice to other legal obligations.

PART 4: PERSONAL DATA COMMITTEE

KAR TUR establishes a Personal Data Committee. The Committee is authorised and responsible for carrying out or arranging the procedures necessary to retain and process data subjects' data in accordance with the law, the Personal Data Processing and Protection Policy and the Personal Data Retention and Disposal Policy, and for overseeing these processes.

The Personal Data Committee consists of two people: an Information Technology Officer and a Human Resources Officer. Those selected for the Committee serve as one manager and two specialists. The duties of the Committee's manager and specialists are set out below:

PART 5: UPDATES AND COMPLIANCE

KAR TUR may amend the Personal Data Processing and Protection Policy or this Personal Data Retention and Disposal Policy in response to changes in the Law, decisions of the Authority or developments in the sector or information technology.

Amendments to this Personal Data Retention and Disposal Policy are incorporated into the text immediately, with explanations of the changes at the end of the Policy.

5.1. AMENDMENT NOTES

*There are no earlier amendments.*