Personal Data Retention and Destruction Policy

1. Purpose of the policy

This Personal Data Retention and Destruction Policy (the “Retention and Destruction Policy”), concerning the personal data processed by Adil Onur Karahan Şahıs Şirketi (the “Company”) within the scope of the Attendify+ mobile application and website (the “Platform”), has been issued to regulate the technical and administrative protection of personal data in accordance with Law No. 6698 on the Protection of Personal Data (KVKK; the “Law”) and, where the conditions for processing no longer exist, the application of the provisions of the Regulation on the Erasure, Destruction or Anonymization of Personal Data (the “Regulation”) published in the Official Gazette (Resmî Gazete) dated 28.10.2017.

2. Recording media in which personal data is stored

Personal data is stored securely in the following media in accordance with the relevant legislation, in particular the provisions of the Law:

• Electronic media: the MySQL database and the file storage for note attachments on the Platform servers in Türkiye, server access logs, backup media, the email inbox; the database, file storage and secure storage on the user’s own device.
• Physical media: data subject applications bearing wet signatures and the related correspondence.

3. Reasons requiring retention and destruction

Personal data is retained in particular for the purposes of maintaining the Platform’s activities, fulfilling legal obligations and managing relationships with users. The reasons requiring retention are as follows:

• The personal data being directly related to the establishment and performance of a contract,
• The establishment, exercise or protection of a right,
• The existence of a legitimate interest of the Company, provided that the fundamental rights and freedoms of individuals are not harmed,
• The fulfillment of the Company’s legal obligations,
• The retention of personal data being expressly provided for in the legislation,
• The existence of the data subject’s explicit consent with respect to retention activities requiring explicit consent.

Pursuant to the Regulation, personal data is erased, destroyed or anonymized ex officio or upon request in the following cases:

• Amendment or repeal of the legislative provisions forming the basis for processing or retention,
• Elimination of the purpose requiring processing or retention,
• Elimination of the processing conditions in Articles 5 and 6 of the Law,
• Withdrawal of consent by the data subject in cases where processing is based solely on explicit consent,
• Acceptance of the data subject’s application for erasure, destruction or anonymization under subparagraphs 2 (e) and (f) of Article 11 of the Law,
• The Board finding well-founded a complaint filed with it after the Company rejected such an application, the response was found insufficient or no response was given in due time,
• The absence of any condition justifying retention for a longer period even though the maximum retention period has expired.

4. Measures taken for the protection of personal data

In accordance with Article 12 of the Law, the Company takes technical and administrative measures ensuring an appropriate level of security in order to prevent the unlawful processing of and access to personal data and to ensure its preservation. If, despite all the measures, data is obtained by third parties through unlawful means, this situation is notified to the data subject and the Board as soon as possible.

4.1. Technical measures

• Network and application security is ensured, and data transmission is encrypted with SSL/TLS.
• Passwords, verification codes and session keys are stored in irreversible (hashed) form.
• Access to servers and databases is restricted by authorization, and each user’s data can be accessed only through their own session.
• Request limits are applied to authentication endpoints, and access logs are kept regularly.
• Firewall and intrusion prevention measures are used, and software is kept up to date.
• Personal data is backed up, and the security of the backups is ensured.
• Existing risks and threats have been identified, and regular checks for security vulnerabilities are carried out.

4.2. Administrative measures

• It is ensured that personal data is accessed only by persons who need it for their duties.
• Data security provisions are added to contracts with the service providers to whom personal data is transferred, and the awareness of the providers is ensured.
• Confidentiality undertakings are made with persons who access personal data.
• Data security issues are reported promptly, and cases of unlawful acquisition are notified to the data subject and the Board as soon as possible.
• Audits are carried out on the implementation of the provisions of the Law, and identified vulnerabilities are remedied.

5. Methods of destruction of personal data

When the reasons requiring processing no longer exist, the Company destroys personal data, on its own decision or upon the request of the data subject, by one or more of the following methods. The process is carried out through the steps of identifying the data to be destroyed, identifying the persons concerned, identifying the access methods, and destroying the data.

5.1. Erasure

• Deletion of the rows or columns containing personal data in the database,
• Deletion of attachment files on the server and removal of user access rights to the files,
• Rendering data on paper illegible by redaction.

5.2. Destruction

• Overwriting of data in backup media at the end of the backup cycle so that it cannot be recovered,
• Destruction of paper documents with a paper shredder,
• Degaussing or physical destruction of magnetic media.

5.3. Anonymization

• Masking: removing the main identifying information of the personal data from the data set.
• Record suppression: removing data rows containing unique values from the records.
• Generalization (global recoding): converting the data into a more general form.

Pursuant to Article 28 of the Law, anonymized data may be processed for research, planning and statistical purposes; such processing falls outside the scope of the Law. The Company freely determines the destruction method according to the medium in which the data is recorded.

6. Retention and destruction periods

Where a period is stipulated in the legislation, that period is complied with; where none is stipulated, personal data is retained for the periods below.

Erasure requests of data subjects are fulfilled without waiting for periodic destruction. In other cases, when the period expires, personal data is erased, destroyed or anonymized in the first periodic destruction following that date. Destruction operations are recorded, and these records are kept for at least three years, without prejudice to other legal obligations.

7. Periodic destruction period

Pursuant to Article 11 of the Regulation, the periodic destruction period has been set at 6 months. Accordingly, periodic destruction is carried out every year in June and December.

8. Revision and repeal

If the Retention and Destruction Policy is amended or repealed, the new regulation is announced on the Policies page on the Platform.

9. Entry into force

This Retention and Destruction Policy enters into force on the date of its publication.