info@bellotekstil.com.tr 0 (212) 417 45 82
info@bellotekstil.com.tr 0 (212) 417 45 82

PERSONAL DATA STORAGE AND DESTRUCTION POLICY

BELLO TEXTILE INDUSTRY AND TRADE LTD. CO. PERSONAL DATA STORAGE AND DESTRUCTION POLICY

    TABLE OF CONTENTS

  • INTRODUCTION
  • Purpose of the Policy
  • Scope of the Policy
  • Definitions
  • Principles Regarding the Implementation of the Policy
  • MATTERS RELATED TO THE PROTECTION OF PERSONAL DATA
  • Obligations Regarding Data Security
  • RIGHTS OF PERSONAL DATA OWNERS AND THE EXERCISE OF THESE RIGHTS
  • Exercising the Rights of Personal Data Owners
  • Our Company's Response to Applications from Relevant Persons
  • STORAGE AND DESTRUCTION OF PERSONAL DATA
  • Explanations Regarding the Storage of Personal Data
  • Legal Reasons for Data Storage
  • Purposes of Processing that Require Data Storage
  • Reasons Requiring the Destruction of Personal Data
  • Methods of Storage and Destruction of Personal Data by Our Company
  • Recording Environments
  • Technical and Administrative Measures
  • Personnel
  • Methods of Destruction of Personal Data
  • Deletion of Personal Data
  • Destruction of Personal Data
  • Anonymization of Personal Data
  • STORAGE AND DESTRUCTION PERIODS
  • PERIODIC DESTRUCTION PERIOD
  • PUBLICATION AND STORAGE OF THE POLICY
  • UPDATE PERIOD OF THE POLICY
  • ENTRY INTO FORCE AND REPEAL OF THE POLICY

Purpose of the Policy

Our Personal Data Storage and Destruction Policy (“Policy”) has been prepared by Bello Textile Industry and Trade Ltd. Co. (“Company”) in its capacity as the data controller to fulfill our obligations under the Law No. 6698 on the Protection of Personal Data (“KVKK” or “Law”) and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data (“Regulation”), and to inform data owners about the maximum storage period necessary for the purposes for which their personal data are processed, as well as the processes of deletion, destruction, and anonymization.

Scope of Our Policy

This Policy applies to all personal data of individuals, including our employees, that are processed fully or partially by automated means or by non-automated means as part of any data recording system. You can also access the personal data processing activities and the policy conducted by our Company through page-personal-data-storage-and-destruction-policy-8address.

Definitions

DEFINITION ABBREVIATION
Law/KVKK Law No. 6698 on the Protection of Personal Data
Regulation Regulation on the Deletion, Destruction, or Anonymization of Personal Data
Board Personal Data Protection Board
Policy Personal Data Storage and Destruction Policy
Data Controller The real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
Data Owner/Relevant Person The real person whose personal data is processed.
Data Processor The real or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller.
Personal Data Any information relating to an identified or identifiable natural person.
Special Category Data Data related to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect, or other beliefs, clothing and attire, membership in associations, foundations, or unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.
Employee/Personnel Company personnel
Company Bello Textile Industry and Trade Ltd. Co.
Processing of Personal Data Any operation performed on personal data, such as obtaining, recording, storing, preserving, altering, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of personal data, whether by automated means or not.
Deletion of Personal Data The process of making personal data inaccessible and unusable for the relevant users in any way.
Destruction of Personal Data The process of making personal data inaccessible, irretrievable, and unusable by anyone in any way.
Anonymization of Personal Data The process of making personal data no longer related to an identified or identifiable natural person, even when combined with other data.
Storage of Personal Data The preservation of personal data in physical or digital environments.
Sharing of Personal Data The lawful sharing of personal data.
Transfer of Personal Data to Third Parties The transfer of personal data to legal or real persons within or outside the country.
Data Recording System A system in which personal data is processed according to certain criteria.
Data Security The protection of data from unauthorized use, unauthorized disclosure, unauthorized destruction, unauthorized alteration, or damage to the data, or preventing unauthorized access to the data.
VERBIS Data Controllers Registry Information System.
Contact Person The real person appointed to be contacted by the Board and the Authority regarding the obligations of legal entities and their representatives in Turkey.
Recording Environment Any environment where personal data is processed by automated means or as part of a data recording system.
Soft Environment Digital environment.
Application Form The printed form that the personal data owner will fill out when applying to the company.
Special Power of Attorney A written document that authorizes someone to act on behalf of another person in specific matters.
Electronic Environment Environments where personal data can be created, read, modified, and written using electronic devices.
Non-Electronic Environment All written, printed, visual, and other environments outside of electronic environments.
Explicit Consent Consent that is informed and expressed freely regarding a specific issue.
Destruction The deletion, destruction, or anonymization of personal data.
Relevant User Real persons who process personal data within the data controller organization or those who process personal data based on the authority and instructions received from the data controller, excluding those responsible for the technical storage, protection, and backup of the data.
Periodic Destruction The deletion, destruction, or anonymization of personal data that will be carried out automatically at regular intervals after the conditions for processing personal data specified in the law have ceased to exist.
Recipient Group The category of real or legal persons to whom personal data is transferred by the data controller.
Personal Data Processing Inventory An inventory created by data controllers that details the personal data processing activities they carry out based on their business processes, including the purposes and legal reasons for processing personal data, data categories, recipient groups, and the maximum retention periods for personal data.
Obligation to Inform During the acquisition of personal data, the data controller or the authorized person must inform the relevant persons about;
  • The identity of the data controller and, if applicable, its representative,
  • The purpose of processing personal data,
  • To whom and for what purpose the processed personal data may be transferred,
  • The method and legal reason for collecting personal data,
  • The other rights listed in Article 11 of the Law.
Update Period A table regarding the updates made to this policy.

Principles Regarding the Implementation of the Policy

Our Company acts in accordance with the following principles in the storage and destruction of personal data:

  • Personal data is processed in accordance with the principles of legality and honesty, accuracy and, when necessary, being up to date, being processed for specific, explicit, and legitimate purposes, being relevant, limited, and proportionate to the purpose for which they are processed, and being retained only for the period required by the relevant legislation or for the purpose for which they are processed, as stated in Article 4 of the Law.
  • Our Company acts in accordance with the obligations regarding data security stipulated in Article 12 of the Law and takes into account the technical and administrative measures specified in Article 4.3.2 of the policy, relevant legal provisions, and Board decisions in the deletion, destruction, and anonymization of personal data.
  • All operations related to the deletion, destruction, and anonymization of personal data are recorded by our Company, and these records are kept for at least 1 year, except for other legal obligations.
  • Unless a contrary decision is made by the Board or unless otherwise stipulated in the legislation (laws and secondary regulations), our Company selects the appropriate method for the deletion, destruction, or anonymization of personal data. However, if requested by the relevant person, the reason for the selected method will be explained.
  • In cases where all the conditions for processing personal data specified in Articles 5 and 6 of the Law cease to exist, personal data is deleted, destroyed, or anonymized by our Company either ex officio or upon the request of the relevant person. In this regard, if the relevant person applies to our Company;
  • Requests are concluded within a maximum of 30 (thirty) days, and the relevant person is informed,
  • If the data subject's data has been transferred to third parties, this is communicated to the third party, and necessary actions are ensured to be taken with respect to the third parties.

MATTERS RELATED TO THE PROTECTION OF PERSONAL DATA

In this context, our Company takes the necessary technical and administrative measures to ensure the required level of security in accordance with the guidelines published by the Board and conducts audits.

Obligations Regarding Data Security

Our Company takes all necessary technical and administrative measures to prevent the unlawful processing of personal data, to prevent unauthorized access to personal data, and to ensure the preservation of personal data.

RIGHTS OF PERSONAL DATA OWNERS AND THE EXERCISE OF THESE RIGHTS

Personal data owners have the following rights:

  • To learn whether personal data is processed,
  • If personal data has been processed, to request information regarding it,
  • To learn the purpose of processing personal data and whether they are used in accordance with that purpose,
  • To know the third parties to whom personal data is transferred, domestically or abroad,
  • If personal data is incomplete or incorrectly processed, to request correction and to request that the operation carried out in this context be notified to third parties to whom personal data has been transferred,
  • To request the deletion or destruction of personal data in cases where the reasons necessitating the processing of personal data have ceased to exist, and to request that the operation carried out in this context be notified to third parties to whom personal data has been transferred,
  • To object to the occurrence of a result against the person himself/herself by means of the analysis of processed data exclusively through automated systems,
  • To request compensation for damages in case of damage due to unlawful processing of personal data.

Exercising the Rights of Personal Data Owners

Personal Data Owners can submit their requests regarding the rights listed in Section 3 of this chapter to Bello Textile Industry and Trade Ltd. Co. free of charge by filling out and signing the Application Form with the information and documents that will identify their identity, using the methods specified below or other methods determined by the Personal Data Protection Board:

  • By delivering a printed copy of the filled-out form with a wet signature in person or via notary to “Muratpaşa mah. Ata cad. Özden sok. no:3 Bayrampaşa/Istanbul”
  • By sending the filled-out and signed form via email to mehmetilhan@bellotekstil.com

In order for third parties to apply on behalf of personal data owners, a special power of attorney issued through a notary must be available.

OUR COMPANY'S RESPONSE TO APPLICATIONS FROM RELEVANT PERSONS

Our Company takes the necessary administrative and technical measures to conclude applications made by personal data owners in accordance with the Law and the Regulation. If the personal data owner submits their request in accordance with the procedure specified in Section 3.1 of this chapter, our Company will conclude the request free of charge within a maximum of thirty days, depending on the nature of the request. However, if a fee is foreseen by the KVKK Board, our Company will charge the applicant the fee determined by the KVKK Board.

STORAGE AND DESTRUCTION OF PERSONAL DATA

EXPLANATIONS REGARDING THE STORAGE OF PERSONAL DATA

Personal data belonging to data owners are securely stored by our company in physical or electronic environments, especially for the purposes of (i) fulfilling legal obligations, (ii) sustaining commercial activities, (iii) planning and executing employee rights and benefits, (iv) being explicitly stipulated in the law, (v) managing customer relations, within the limits specified in the KVKK and other relevant legislation.

The reasons for storage are as follows:

  • Explicitly stipulated in the legislation,
  • Necessary for the protection of the life or bodily integrity of the person who is unable to express their consent due to physical impossibility or whose consent is not legally valid,
  • Directly related to the establishment and performance of contracts,
  • Necessary for the fulfillment of the legal obligation of our Company,
  • Made public by the relevant person themselves,
  • Necessary for the establishment, use, or protection of a right.
  • Necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the relevant person.
  • Necessary for the legitimate interests of our Company, provided that it does not harm the fundamental rights and freedoms of the relevant person,
  • In terms of storage activities requiring the explicit consent of data owners, the explicit consent of the data owners must be obtained.

LEGAL REASONS FOR DATA STORAGE

  • Law No. 6698 on the Protection of Personal Data,
  • Turkish Code of Obligations No. 6098,
  • State Personnel Law No. 657,
  • Social Insurance and General Health Insurance Law No. 5510,
  • Public Financial Management and Control Law No. 5018,
  • Occupational Health and Safety Law No. 6331,
  • Law No. 4982 on the Right to Information,
  • Law No. 3071 on the Right to Petition,
  • Labor Law No. 4857,
  • Higher Education Law No. 2547,
  • Pension Health Law No. 5434,
  • Social Services Law No. 2828,
  • Regulation on Health and Safety Measures to be Taken in Workplace Buildings and Attachments,
  • Regulation on Archive Services

PURPOSES OF PROCESSING THAT REQUIRE DATA STORAGE

Our Company stores the personal data it processes for the following purposes:

  • To carry out human resources processes.
  • To ensure corporate communication.
  • To ensure the security of the institution,
  • To conduct statistical studies.
  • To fulfill the business and transactions resulting from signed contracts and protocols.
  • To identify the preferences and needs of employees, data controllers, contact persons, data controller representatives, and data processors within the scope of VERBIS, to organize the services accordingly, and to update them when necessary.
  • To ensure the fulfillment of legal obligations required or mandated by legal regulations.
  • To establish contact with real/legal persons who have a business relationship with the institution.
  • To make legal reports.
  • To fulfill the burden of proof in potential future legal disputes.

REASONS REQUIRING THE DESTRUCTION OF PERSONAL DATA

According to the Regulation, personal data belonging to data owners will be deleted, destroyed, or anonymized by our company ex officio or upon request in the following cases:

  • Changes or repeal of the legal provisions that constitute the basis for the processing or storage of personal data,
  • Ceasing the purpose that necessitated the processing or storage of personal data,
  • Ceasing to exist of the conditions for processing personal data specified in Articles 5 and 6 of the Law.
  • In cases where the processing of personal data is based solely on explicit consent, the relevant person withdraws their consent,
  • The relevant person’s request for the deletion, destruction, or anonymization of their personal data within the scope of the rights specified in Articles 11(2)(e) and (f) of the Law is accepted by the data controller,
  • In cases where the data controller rejects the request made by the relevant person for the deletion, destruction, or anonymization of their personal data, finds the response insufficient, or does not respond within the time specified in the Law; a complaint is made to the Board, and this request is found appropriate by the Board,
  • In cases where the maximum retention period for personal data has expired, and there is no condition justifying the retention of personal data for a longer period.

METHODS OF STORAGE AND DESTRUCTION OF PERSONAL DATA BY OUR COMPANY

RECORDING ENVIRONMENTS

Personal data belonging to data owners are securely stored by our company in the environments listed in the table below, primarily in accordance with the provisions of the KVKK and within the framework of international data security principles:

Non-Electronic Environments Electronic Environments
Paper (folders, files, etc.) Manual data recording systems (survey forms, candidate application forms, etc.) Written, printed, visual environments Servers (domain, backup, email, database, web, file sharing, etc.) Software (office software, etc.) Personal computers (desktop, laptop) Mobile devices (phones, tablets, etc.) Removable storage devices (USB, memory cards, etc.)

TECHNICAL AND ADMINISTRATIVE MEASURES

To ensure the secure storage of your personal data, to prevent unlawful processing, to prevent unauthorized access, and to ensure the lawful destruction of data, all administrative and technical measures taken by our company are listed below in accordance with the principles in Article 12 of the KVKK:

Administrative Measures:

Our company, under administrative measures;

  • Limits access to stored personal data to personnel who need to access it based on their job descriptions. The degree of importance and whether the data is of special nature is also taken into account in limiting access.
  • In the event that personal data processed unlawfully is obtained by others, this situation is reported to the relevant person and the Board as soon as possible.
  • Regarding the sharing of personal data, it ensures data security by signing framework agreements with the persons to whom personal data is shared or by adding provisions to existing agreements.
  • Employs knowledgeable and experienced personnel regarding the processing of personal data and provides necessary training on personal data protection legislation and data security. These trainings enhance the technical knowledge/skills of personnel within the company and ensure that the procedures for processing/storing and destroying personal data are carried out in accordance with the law and regulations by the relevant personnel.
  • Conducts periodic audits to ensure the implementation and control of the legal provisions within its own legal entity. It addresses any confidentiality and security vulnerabilities that arise or may arise as a result of these audits.
  • Signs confidentiality agreements with employees regarding the activities carried out by the company for the protection of personal data and data security or ensures data security by adding provisions to existing agreements.
  • Before starting to process personal data, informs the relevant persons about who will process the data, for what purposes, and on what legal grounds, fulfilling the obligation to inform.
  • Commits to not process personal data without the explicit consent of the relevant person, except in cases of exceptions provided by the legislation. In cases where explicit consent is required, the explicit consent of the relevant person is obtained based on information.
  • Upon the expiration of the data retention period specified in the law or in the policy, the first periodic destruction process will be initiated for the deletion, destruction, or anonymization of such personal data.
  • Takes all reasonable precautions to prevent the theft, loss, or damage of information.

Technical Measures;

Our company, under technical measures;

  • Conducts necessary internal controls within the established systems.
  • Takes necessary precautions for the physical security of IT equipment, software, and data.
  • Conducts risk assessments and business impact analyses for information technology systems.
  • Identifies risks related to unlawful data processing and takes appropriate technical measures against these risks. In the event that unlawful data processing is detected, a system and infrastructure are established to notify the relevant person and the Board.
  • Establishes and implements procedures for access rights and role distributions. Accesses are recorded, and unauthorized accesses are monitored, and destruction processes are defined and implemented in accordance with the storage and destruction policy.
  • Regularly purchases penetration testing services to identify risks, threats, vulnerabilities, and any weaknesses in IT systems and takes necessary precautions.
  • Ensures that access rights of employees working in information technology units are controlled.
  • Ensures that the destruction of personal data is carried out in a way that is irreversible and leaves no audit trail.
  • In accordance with Article 12 of the Law, all digital environments where personal data is stored are protected by encryption or cryptographic methods that meet information security requirements. Security vulnerabilities are monitored, and appropriate security patches are applied.
  • Uses backup programs that ensure the secure storage of personal data.
  • Keeps secure transaction records (Log records) according to established rules.
  • Keeps transaction records (log records) according to established rules.
  • Establishes access procedures within the company and conducts reporting and analysis studies regarding access to personal data.
  • Records accesses to storage areas containing personal data and monitors unauthorized accesses or access attempts.
  • Uses data backup programs that ensure the secure storage of personal data.
  • Access to personal data stored in electronic or non-electronic environments is restricted according to access principles.
  • Takes hardware (access control systems that allow only authorized personnel to enter the server room, 24/7 monitoring systems, physical security of edge switches forming the local area network, fire extinguishing systems, climate control systems, etc.) and software (firewalls, intrusion prevention systems, network access control, systems that prevent malware, etc.) measures to ensure the security of IT systems against environmental threats.

PERSONNEL

You can find the titles, units, and job descriptions of the personnel involved in the personal data storage and destruction process in the list in APPENDIX-1 of this Policy.

METHODS OF DESTRUCTION OF PERSONAL DATA

Personal data obtained by our company in accordance with the KVKK and other relevant legislation will be destroyed by our company in accordance with the Law and the Regulation when the purposes of processing personal data cease to exist, either ex officio or upon the request of the relevant person, using the methods specified below.

DELETION OF PERSONAL DATA

Personal data is deleted using the methods specified below.

Data Recording Environment Description
Personal Data on Servers For personal data on servers, once the retention period has expired, the system administrator will remove access rights of the relevant users and carry out the deletion process.
Personal Data in Electronic Environment For personal data in electronic environments, once the retention period has expired, it will be made inaccessible and unusable for all employees (relevant users) except for the database administrator.
Personal Data in Physical Environment For personal data held in physical environments, once the retention period has expired, it will be made inaccessible and unusable for all employees except for the unit manager responsible for document archiving. Additionally, a redaction process will be applied by marking/painting/scratching out the data so that it cannot be read.
Personal Data on Portable Media For personal data stored on flash-based storage media, once the retention period has expired, it will be encrypted by the system administrator, and access rights will be granted only to the system administrator, with encryption keys stored in secure environments.

DESTRUCTION OF PERSONAL DATA

Your personal data will be destroyed by our company using the methods specified below.

Data Recording Environment Description
Personal Data in Physical Environment For personal data in paper format, once the retention period has expired, it will be destroyed in paper shredders in a way that cannot be reversed.
Personal Data on Optical/Magnetic Media For personal data on optical and magnetic media, once the retention period has expired, physical destruction will be applied, such as melting, burning, or breaking. Additionally, old data on servers will be deleted by overwriting with new data.

ANONYMIZATION OF PERSONAL DATA

Anonymization of personal data means making personal data no longer related to an identified or identifiable natural person, even when combined with other data. For personal data to be considered anonymized, it must be made impossible to relate to an identified or identifiable natural person, even through the use of appropriate techniques for the recording environment and relevant activity area.

STORAGE AND DESTRUCTION PERIODS

The storage and destruction periods of your personal data obtained by our company in accordance with the KVKK and other relevant legal provisions are determined based on the following criteria:

  • If a period for the storage of personal data is explicitly stipulated in the legislation, this period is adhered to. After the expiration of the mentioned period, the data will be processed according to the provisions of this policy.

If there is no period stipulated in the legislation for the storage of the personal data, the following criteria will be sequentially applied:

  • Personal data will be classified as personal data and special category personal data based on the definitions in Article 6 of the KVKK. All personal data identified as special category will be destroyed if there is no explicit consent from the data owner. The method of destruction will be determined based on the nature of the data and its importance within the company.
  • The legality of the data storage will be evaluated based on whether the company has a legitimate purpose for retaining the data in accordance with Article 4 of the KVKK. Any data found to be in violation of these principles will be deleted, destroyed, or anonymized.
  • The retention periods for data will be determined based on the exceptions outlined in Articles 5 and 6 of the KVKK. Once these periods expire, the data will be deleted, destroyed, or anonymized.

The retention and destruction periods established by Bello Textile Industry and Trade Ltd. Co. can be found in the "Table of Retention, Destruction, and Periodic Destruction Periods" in Appendix-2 of this Policy.

Personal data that has reached the end of its retention period will be destroyed in accordance with the methods specified in this Policy at six-month intervals. A "Data Destruction Record" will be maintained, and you can access it in Appendix-4.

All operations related to the deletion, destruction, and anonymization of personal data will be recorded, and these records will be kept for at least ... years, excluding other legal obligations.

PERIODIC DESTRUCTION PERIOD

The periodic destruction period set by our company is six months. Accordingly, destruction will be carried out in June and December of each year.

PUBLICATION AND STORAGE OF THE POLICY

The Policy will be published in both printed (wet signature) and electronic formats and will be disclosed on our company's website. A printed copy will also be kept in the accounting department of our company's headquarters.

UPDATE PERIOD OF THE POLICY

The Policy will be reviewed and necessary sections updated as needed or upon request from relevant parties. Updates will be announced within 30 business days at our company's address: “Muratpaşa mah. Ata cad. Özden sok. no:3 Bayrampaşa/Istanbul,” and a printed copy will be available in the accounting department of our company's headquarters.

ENTRY INTO FORCE AND REPEAL OF THE POLICY

This Policy was established by our company and came into effect on 01.02.2020. In the event of any changes to the Policy, the effective date and relevant articles will be updated accordingly. The Update Table is included in Appendix-3. In case of any inconsistency between the KVKK and other relevant legal provisions and this Policy, the provisions of the KVKK and other relevant legal provisions will prevail.