GDPR & Privacy Policies

İŞİNOLACAK BİLGİ TEKNOLOJİLERİ YAPAY ZEKA İNSAN KAYNAKLARI TİC. SAN. A.Ş.

PERSONAL DATA RETENTION AND DESTRUCTION POLICY

NATURE AND PURPOSE OF THE DESTRUCTION POLICY

INTRODUCTION

This destruction policy has been prepared by İşinolacak Bilgi Teknolojileri Artificial Intelligence Human Resources Industry and Trade Inc. (briefly referred to as “İŞİNOLACAK” or “the COMPANY”) in its capacity as data controller, in order to set out the principles and procedures to be followed by İŞİNOLACAK regarding the deletion, destruction, or anonymization of personal data in accordance with the Law on the Protection of Personal Data No. 6698 (“the Law”) and other applicable legislation.

Within this scope, the personal data of our employees, employee candidates, customers, and all real persons whose personal data is held by İŞİNOLACAK for any reason are managed, processed, stored, and destroyed in compliance with the law under the Personal Data Protection and Processing Policy and this Personal Data Retention and Destruction Policy.

DEFINITIONS

Direct identifiers: Identifiers that, on their own, directly reveal, disclose, or distinguish the individual to whom they relate.

Indirect identifiers: Identifiers that, when combined with other identifiers, reveal, disclose, or distinguish the individual to whom they relate.

Data subject: The natural person whose personal data is processed.

Destruction: The deletion, destruction, or anonymization of personal data.

Law: The Law on the Protection of Personal Data No. 6698, published in the Official Gazette dated 07.04.2016 and numbered 29677.

Regulation: The Regulation on the Deletion, Destruction, or Anonymization of Personal Data, published in the Official Gazette dated 28.10.2017 and numbered 30224.

Board: The Personal Data Protection Board.

Data recording medium: Any environment in which personal data is processed through fully or partially automated means or through non-automated means provided that they form part of a data recording system.

Personal Data Processing and Protection Policy: The policy, accessible via the website “www.isinolacak.com”, which sets out the procedures and principles governing the management of personal data held by İŞİNOLACAK.

Data recording system: The system in which personal data is processed by being structured according to specific criteria.

ENVIRONMENTS AND SECURITY MEASURES

The personal data of data subjects are stored securely by İŞİNOLACAK in environments listed below, in compliance with the law.

ENVIRONMENTS

Personal data is stored by İŞİNOLACAK in the following environments:

• Computers/servers (domain-based),

• Network devices,

• Shared/non-shared disk drives,

• Optical discs,

• Removable media (USB, memory card, external hard drive, etc.),

• Printed paper (documents, CVs, contracts, etc.),

• Backup devices,

• Cloud systems,

• Mobile devices (phones, tablets, etc.),

• Software (SAP, logo, etc.).

SECURITY MEASURES

İŞİNOLACAK takes all necessary technical and administrative measures to ensure the secure storage of personal data, to prevent unlawful access to data, and to ensure lawful destruction in compliance with the Law, relevant regulations, and the Board’s decisions. The measures taken by İŞİNOLACAK are detailed below:

• Employing firewalls and gateway security devices in information technology systems,

• Using virus protection systems and regularly updating them,

• Using strong passwords and multi-factor authentication,

• Performing regular access and authorization controls,

• Encrypting data and managing encryption keys securely,

• Restricting access to storage environments containing personal data only to authorized personnel,

• Conducting regular security scans and risk analyses,

• Keeping system access and data processing logs,

• Ensuring the security of environments where personal data is stored physically (e.g., locked cabinets, restricted access rooms),

• Training employees regarding personal data security and confidentiality,

• Executing confidentiality agreements with personnel,

• Ensuring compliance with the principle of data minimization,

• Conducting internal audits and controls related to data processing activities.

REASONS REQUIRING DESTRUCTION

Personal data;

• whose processing purposes no longer exist,

• whose processing is contrary to the law or the principle of good faith,

• whose processing is unlawful or no longer necessary even though it was lawful,

• which must be erased, destroyed, or anonymized to fulfill the data controller’s legal obligation,

• for which the retention period set forth by the relevant legislation or as required for the purpose of processing has expired,

are deleted, destroyed, or anonymized upon İŞİNOLACAK's own decision or upon the request of the data subject, within 30 (thirty) days at the latest. If the data subject applies for such processing, and if the conditions for processing the data no longer apply, the personal data in question will be deleted, destroyed, or anonymized. If the conditions for processing are still valid, the request may be denied in accordance with Article 13 of the Law, and the relevant data subject will be informed of the refusal in writing or electronically within 30 days at the latest.

METHODS OF DESTRUCTION

Destruction refers to the process by which personal data is made inaccessible, irretrievable, and unusable by anyone in any way. The destruction methods used by İŞİNOLACAK are as follows:

1. Physical Destruction

For personal data processed via non-automated means (written, printed, etc.) and stored in physical environments, destruction is carried out by physically destroying the data through shredding, burning, or using paper destruction machines.

2. Secure Deletion from Software

In cases where personal data processed fully or partially by automatic means is stored in digital environments, deletion is carried out using software-based methods to ensure that the data cannot be accessed or recovered in any way. Methods used include overwriting, de-magnetizing (degaussing), or cryptographic erasure.

3. Deletion of Data on Removable Media

Personal data stored on removable media such as USB, external disk, or memory card is deleted using appropriate software that renders the data unrecoverable.

4. Destruction of Data in the Cloud

For personal data stored in cloud systems, relevant data is deleted using cloud service provider tools or secure deletion software, ensuring that the data is inaccessible and unrecoverable.

5. Secure Deletion from Mobile Devices

Personal data on mobile devices such as phones and tablets is deleted using device management software or secure deletion software, ensuring that deleted data cannot be recovered.

METHODS OF ANONYMIZATION

Anonymization refers to rendering personal data impossible to associate with an identified or identifiable natural person, even by using matching methods with other data. İŞİNOLACAK uses the following anonymization methods when necessary:

• Masking: Certain parts of personal data (e.g., name, surname, T.R. ID number) are removed or replaced with symbols (e.g., *** or XXX) to prevent identification.

• Generalization: Data is aggregated in such a way that it cannot be attributed to any individual (e.g., 100 people living in a neighborhood).

• Data Derivation: A new dataset is created by processing the data in a way that it cannot be linked to any individual (e.g., calculating averages).

• Data Mixing: Mixing of data sets belonging to different individuals to prevent the re-identification of any one person.

STORAGE AND DESTRUCTION PERIODS

The storage periods for personal data processed by İŞİNOLACAK are determined based on the purpose of processing and the legal obligations arising from relevant legislation. At the end of the retention period, personal data is deleted, destroyed, or anonymized within the first periodic destruction period.

Unless otherwise stipulated in the legislation, personal data is stored for the duration of the statute of limitations for the establishment, exercise, or defense of legal claims (usually 10 years from the end of the legal relationship).

The storage and destruction periods of personal data are specified in the Personal Data Processing Inventory.

PERIODIC DESTRUCTION

In accordance with Article 11 of the Regulation, İŞİNOLACAK has determined the periodic destruction period as 6 months. Accordingly, personal data that has reached the end of the retention period is deleted, destroyed, or anonymized within 6-month intervals.

ENFORCEMENT AND UPDATE

This Policy enters into force as of the date of publication. In the event of changes to the Law, the Regulation, or other relevant legislation, or upon Board decisions, İŞİNOLACAK may update this Policy. Updates are announced through appropriate channels.