Destruction Policy

1. Introduction

The protection of personal data is among the priorities of our company. Through this policy, it is aimed to ensure transparency regarding the fundamental principles we adopt in processing personal data, our data security approach, and the rights of our employees.

Our company plans, implements, and regularly reviews personal data processing activities in compliance with the applicable legislation.

1.1. Scope

This policy covers our employees, interns, members of the board of directors, company representatives, and relevant persons affected by internal company data processing processes.

Data relating to current employees are protected during the employment relationship and throughout the legally required retention periods. Data belonging to former employees and employee candidates are evaluated in line with the relevant information notices and data processing policies.

1.2. Access to the Policy

The policy is kept accessible within the company in relevant units. Updated versions in line with changes occurring in legislation or practice are shared in a manner accessible to employees.

1.3. Definitions and Abbreviations

Abbreviation / Term	Definition
Explicit Consent	Consent relating to a specific matter, based on information and expressed by free will.
Relevant User	Except for the technical person or unit responsible for the storage, protection and backup of data; persons or units processing data within the organization of the data controller under authority and instructions.
Destruction	The deletion, destruction, or anonymization of personal data.
Destruction Policy	The company policy regarding the deletion, destruction, and anonymization of personal data.
Law	Personal Data Protection Law No. 6698.
Personal Data	Any information relating to an identified or identifiable natural person.
Processing of Personal Data	Any operation performed on data, including obtaining, recording, storing, preserving, transferring, disclosing, organizing, or preventing the use of data.
Anonymization of Personal Data	Rendering data incapable of being associated with a specific or identifiable person even if matched with other data.
Deletion of Personal Data	Rendering personal data inaccessible and unusable for relevant users.
Destruction of Personal Data	The process of rendering personal data inaccessible, irretrievable, and unusable by anyone.
Board	Personal Data Protection Board.
Special Categories of Personal Data	Data categories subject to special protection under legislation.
Periodic Destruction	The process of deleting, destroying, or anonymizing personal data at regular intervals when the conditions stipulated in the Law cease to exist.
Data Processor	A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
Data Controller	A natural or legal person responsible for determining the purposes and means of processing personal data and for the establishment and management of the data recording system.

2. Matters Regarding the Processing of Personal Data

Our company processes personal data in compliance with the principles of acting lawfully and in accordance with the rules of honesty, being accurate and up to date when necessary, being processed for specific, explicit, and legitimate purposes, being relevant, limited, and proportionate to the purpose for which they are processed, and being retained for the period required.

2.1. Processing in Compliance with Law and the Rules of Honesty

All data processing activities are carried out within the framework of the principles of legal compliance, proportionality, and transparency.

2.2. Accuracy and Being Up to Date

Internal company processes are operated in order to keep processed data accurate and update them when necessary.

2.3. Specific, Explicit, and Legitimate Purpose

Data processing purposes are limited to the employment relationship, human resources, payroll, occupational safety, legislative obligations, security, operations, and internal company management processes.

2.4. Relevant, Limited, and Proportionate Processing

Only the data that are needed are processed; processing for purposes other than those intended or processing excessive data is avoided.

2.5. Retention for the Required Period

Personal data are retained for the periods stipulated in the relevant legislation and for the period necessary for the purpose of processing.

3. Conditions for the Processing of Personal Data

Our company processes personal data in cases where the explicit consent of the relevant person exists or based on other legal grounds stipulated in the Law. In cases where data may be processed without explicit consent, the legal conditions permitted by the Law are taken as basis.

The establishment or performance of a contract, fulfillment of a legal obligation, establishment, protection, or exercise of a right, and the legitimate interest of the data controller are among the principal legal grounds evaluated within this scope.

4. Processing of Special Categories of Personal Data

Special categories of personal data are processed in accordance with the enhanced security measures stipulated in the Law and relevant Board decisions. These data are protected only to the extent necessary, with limited access authorizations and additional technical and administrative measures.

5. Transfer of Personal Data

Personal data may be transferred, in compliance with legislation and by taking the necessary security measures, to authorized public institutions and organizations, business partners, service providers, consultants, legal and financial advisors, information technology infrastructure providers, and third parties acting as data processors due to business processes.

In domestic or international data transfers, the conditions set forth in the Law are complied with, and contractual and technical measures ensuring data security are applied.

6. Methods of Collection of Personal Data and Legal Grounds

Personal data may be collected through physical forms, electronic applications, internal company software, e-mail, camera systems, job application processes, contracts, payroll and personnel files, human resources practices, and similar tools.

The collected data are processed in line with the provisions of the relevant legislation and the legal grounds required by company activities.

7. Obligation to Inform

Our company informs persons whose personal data are processed about the identity of the data controller, the purpose of processing, the recipients of transfers, the method of data collection, the legal ground, and their rights. This obligation is fulfilled through information notices, application forms, contract annexes, or other appropriate communication methods.

8. Retention of Personal Data

Personal data processed by our company are retained for the periods stipulated in the relevant laws and legislation and for the period required within the framework of the purposes of data processing. First, it is determined whether a retention period is prescribed in the legislation; if a period is prescribed, it is complied with; if not, the period necessary for the purpose of data processing is taken as basis.

9. Actions to Be Taken at the End of the Retention Period

Data whose retention period has expired or whose processing purpose has ceased to exist are periodically evaluated within the framework of the relevant legislation and the company destruction policy and are deleted, destroyed, or anonymized by appropriate methods.

10. Procedures for the Deletion, Destruction, and Anonymization of Personal Data

When the reasons requiring processing cease to exist, personal data are deleted, destroyed, or anonymized upon company decision or upon the request of the relevant person.

In deletion and destruction processes, physical destruction, secure software deletion, and, when necessary, irreversible methods with expert support may be used. In anonymization processes, techniques such as masking, aggregation, data derivation, and similar methods are used.

11. Measures Taken for the Protection of Personal Data

Our company takes technical and administrative measures in line with Article 12 of the Law in order to prevent the unlawful processing and access of personal data, ensure the preservation of the data, and establish an adequate level of security.

11.1. Administrative Measures

Personnel knowledgeable and experienced in data processing are assigned, and necessary training is provided.
Corporate policies regarding access, information security, use, retention, and destruction processes are created.
Access and authorization processes are designed and implemented on a business-unit basis.
Data masking measures are applied where necessary.
Confidentiality and data protection obligations are added to documents and contracts made with employees.
Lawful information processes are carried out for data processed within the scope of employees' business activities.
The relevant employee is given the opportunity to explain and defend themselves before disciplinary or complaint processes.
Data security obligations are added to contracts made with third parties to whom data are transferred.
The number of employees who may access the data is limited as much as possible.
Physical access security and organizational control mechanisms are implemented.
In cases of unlawful acquisition, notification is made to the relevant person and the Board.
Regular audits are conducted and security vulnerabilities are remedied.
Awareness and supervision of data processing service providers are ensured.

11.2. Technical Measures

Technical training is provided to prevent unlawful access to personal data.
Security measures appropriate to technological developments are taken and updated periodically.
Reasonable measures are applied against risks of unauthorized access, data loss, deletion, and damage.
Access records and audit trail mechanisms are established and regularly checked.
Network and application security are ensured; closed network systems are used where necessary.
Key management and encryption processes are implemented.
Security measures are taken in information technology procurement, development, and maintenance processes.
Additional protection methods are applied when data are extracted through portable devices.
Access authorizations are restricted, regularly reviewed, and an authorization matrix is used.
Virus protection, firewalls, penetration testing, and attack detection and prevention systems are kept active.
Security scans are performed and vulnerabilities are closed when detected.
Backup processes are operated and the security of backups is ensured.
Log records are kept without user intervention.
Cyber security measures are continuously monitored.
Encryption is applied when transferring special categories of data through portable media.
Data loss prevention and irreversible destruction methods are used.

11.3. Audit of the Measures Taken

Our company fulfills the necessary obligations under the relevant legislation in its capacity as data controller and appoints responsible persons within the company to follow compliance processes. The effectiveness of data protection processes is monitored through periodic reporting, internal control, and presentation mechanisms to management.

12. Rights of Our Employees and the Exercise of These Rights

Our employees have the following rights within the scope of the Law:

To learn whether their personal data are being processed,
To request information if their personal data have been processed,
To learn the purpose of processing and whether they are used in accordance with that purpose,
To know the third parties to whom the data are transferred domestically or abroad,
To request the correction of incomplete or incorrectly processed data,
To request the deletion or destruction of data within the framework of the conditions stipulated in the Law,
To request that correction, deletion, or destruction requests be notified to third parties to whom the data have been transferred,
To object to the emergence of a result against them through analysis by automated systems,
To request compensation for damages in the event of damage arising due to unlawful processing.

12.1. Application Procedures

Relevant persons may submit their requests to the company through written application, notary public, registered electronic mail, or the e-mail address registered in the system.

Application Method	Application Address	Description
Written Application	100. Yıl Bulvarı No: 6 PK 06370 Ostim / Ankara – Türkiye	The phrase “Information Request Within the Scope of the Personal Data Protection Law” should be written on the envelope or notification.
Application via Registered Electronic Mail (KEP)	ceyhun.gunen@hs01.kep.tr	The subject line of the e-mail should state “Personal Data Protection Law Information Request”.
Application via Registered E-mail Address in the System	info@cagcelik.com	The subject line of the e-mail should state “Personal Data Protection Law Information Request”.