Data Retention, Anonymization and Destruction Policy
1. Purpose
The purpose of this procedure is to ensure that all printed and written content, information technology assets and peripherals used in the acquisition, processing and storage of information are safely destroyed when necessary and in accordance with the Law on the Protection of Personal Data No. 6698.
2. Scope
The procedure covers all personal, commercial data records and business processes.
3. Definitions
Law: Refers to the Law No. 6698 on the "Protection of Personal Data".
Personal Data : Personal data refers to any information relating to an identified or identifiable natural person. The fact that a person is specific or identifiable means that the existing data is associated with a natural person in any way, making that person's identity identifiable.
Blackening : Processes such as scraping, painting, icing all personal data in a way that cannot be associated with an identified or identifiable natural person,
Recording medium : Any medium containing personal data that is fully or partially automated or processed by non-automatic means, provided that it is a part of any data recording system,
Personal data retention and destruction policy : The policy that data controllers take as a basis in determining the maximum period required for the purpose for which personal data is processed and in the process of deletion, destruction and anonymization,
Masking : Processes such as deleting, drawing, painting, starring certain areas of personal data in a way that cannot be associated with a specific or identifiable natural person,
Special Quality Personal Data : Data related to the person's race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, disguise, membership to associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric data. datas . and genetic data.
Periodic destruction : It is the deletion, destruction or anonymization process that will be carried out ex officio at repetitive intervals and specified in the personal data storage and destruction policy, in case all the processing conditions of personal data in the law are no longer valid.
4. References
Regulation on the Protection of Personal Data No. 6698, No. 30224, on the Deletion, Destruction or Anonymization of Personal Data dated 28.10.2018
5. Application
5.1. Disposal of Assets
In the event that the purpose factor for the processing of personal data is eliminated, the express consent is withdrawn, or all the conditions for processing personal data in Articles 5 and 6 of the Law are eliminated, or if there is a situation where none of the exceptions in the aforementioned articles can be applied, the processing conditions are eliminated. personal data is deleted by the relevant business unit, taking into account business needs, within the scope of Articles 7, 8, 9 or 10 of the Regulation (Deletion, Destruction or Anonymization of Personal Data), by explaining the reason for the method applied, destroyed or anonymized. However, in case of a finalized court decision, the method of destruction determined by the court decision must be applied.
The information on any device with information recording feature is deleted against unauthorized access and the disk and recording mechanism on the device are physically destroyed. The Media/Device Disposal Report is filled in and signed by the information systems operator. Date, device information, reason for destruction, etc. The destruction process is recorded by entering the information.
Data Deletion Methods
a. Personal Data in Paper Media: They are deleted by destroying with a paper shredder or by using the blackout method when necessary.
b. Office Files on the Central Server: They are deleted with the delete command in the operating system.
c. Data in Removable Media: It is deleted with the delete command in the operating system.
d. Databases : Relevant rows with data are deleted with database commands.
Methods of Destruction of Assets and Data
a. In Local Systems: De-magnetizing, physical destruction, overwriting is destroyed by using the appropriate method.
b. Environmental Systems:
• Network devices (switches, routers, etc.): Destroyed by appropriate methods specified in item a.
• Flash-based media: It is destroyed by the methods recommended by the relevant manufacturer or by the methods specified in item a.
• Magnetic tape: It is destroyed by demagnetizing or by physical methods such as burning or melting.
• Sim Card and fixed memory cards: They are destroyed by the appropriate methods specified in item a.
• Optical discs: they are destroyed by physical methods such as burning, breaking into small pieces, melting.
• Peripherals with fixed Data Recording Media: They are destroyed by the appropriate methods specified in item a.
c. Printed Media: It is destroyed using paper shredders. Personal data transferred from original paper format to electronic media by scanning are destroyed by appropriate methods according to their environment.
Methods of Anonymization of Personal Data:
At the stage of anonymizing personal data, the appropriate method of making Personal Data Anonymous is used, which is shown in the Guide on Deletion, Destruction or Anonymization of Personal Data published by the Personal Data Protection Authority.
As a result of periodic reviews or when it is determined that the data processing conditions have disappeared at any time, the relevant user or data owner will decide to delete, destroy or anonymize the relevant personal data from the recording medium within its own body in accordance with this policy. In case of hesitation, action will be taken by obtaining the opinion of the relevant data owner business unit.
In the destruction of data, the regulation stating the retention periods published by the General Directorate of State Archives is taken into consideration. The data that are not inconvenient to be destroyed are destroyed after the required time has expired in the unit archive, the institution archive or the state archives.
5.1.1. Destruction of Multi-Stakeholder Data
When it is necessary to take a decision regarding the destruction of personal data with multi-stakeholder data ownership in the Central Information Systems, it is decided to store or delete, destroy or anonymize the data in accordance with this policy, by taking the opinion of the Data Controller Representative.
5.1.2. Destruction of Personal Data Upon Data Owner's Request
When the real person who owns the personal data requests the deletion, destruction or anonymization of his personal data by applying to the University with the "Personal Data Owner Application Form" pursuant to Article 13 of the Law, it is finalized within thirty days at the latest from the application date. Requests for the deletion or destruction of personal data will only be considered if the identity of the person concerned has been identified. The applicant is informed through the methods specified in the application form. If the processing conditions have not been lifted due to legal requirements; It is declared to the data owner that the personal data subject to the request cannot be deleted. The unit where the relevant data is processed examines whether all the conditions for processing personal data have disappeared. If all the processing conditions have disappeared; deletes, destroys or anonymizes the personal data subject to the request within three months at the latest. If all the conditions for processing personal data have been removed and the personal data subject to the request has been transferred to third parties, the unit where the relevant data is processed immediately notifies the third party to which the data is transferred and ensures that the necessary actions are taken within the scope of the Regulation before the third party.
5.2. Periodic Review of Personal Data
All users who process or store personal data and data subject units will review the data recording media they use, within six-month periods at the latest, whether the conditions related to the processing have disappeared. Upon the application of the personal data owner or the notification of a court, the relevant users and units will make this review in the data recording media they use, regardless of the period of periodic inspection. All transactions regarding the deletion, destruction or anonymization of personal data are recorded and these records are kept for at least three years, excluding other legal obligations.
In the deletion, destruction or anonymization of personal data, it is necessary to act in accordance with the general principles of article 4 (Processing of Personal Data) and technical and administrative measures to be taken within the scope of article 12 (Data Security Obligations), provisions of the relevant legislation, Board decisions and court decisions. is being done.
5.3. Storage of Personal Data
The processing times of personal data are specified in the "Personal Data Processing Inventory".
The storage and destruction periods in question will be taken into account in the periodic destruction or on-demand destruction processes. Storage and destruction processes may vary upon the request of the data owner, unless there is a legal obligation.
In order to ensure personal data security, physical security measures such as documents in paper media containing personal data, CD, DVD and USB devices are kept locked when not in use, only authorized personnel can access them and the entrances and exits are monitored by camera. The servers containing the personal data kept in the digital environment are stored in the University system room, with the necessary security measures taken.
Administrative and technical measures taken to ensure the Security of Personal Data are detailed in the Personal Data Protection and Processing Policy.
6. Control
The documents are checked periodically once a year, as they are revised as needed.
All services provided in our store KURTULUS MAH. ULUS CAD. YESIL NILKENT SITESI NO: 6 G/B NILUFER/ BURSA, belongs to our company and is operated by our company.
Due to the nature of the business, our store collects some personal information about the members (such as name-surname, company information, telephone, address or e-mail addresses) by filling out various forms and surveys on membership or our store.
Our company may send campaign information, information about new products, promotional offers to its customers and members in certain periods. Our members can make all kinds of choices about whether or not to receive such information while becoming a member, then change the selection from the account information section after logging in as a member, or make a notification with the link in the information message received.
During the approval process via our store or by e-mail, personal information transmitted to our store electronically by our members will not be disclosed to third parties, except for the purposes and scope determined by the 'User Agreement' we made with our members.
Our company records and uses the IP addresses of its members in order to identify system-related problems and quickly resolve any problems or disputes that may arise regarding the service provided. IP addresses can also be used to identify users in a general way and to gather comprehensive demographic information.
Our company may use the requested information for direct marketing purposes, either by itself or by the people it cooperates with, except for the purposes and scope determined by the Membership Agreement. Personal information can also be used to contact the user when necessary. Information requested by our company and information provided by the user or information about transactions made through our store; It can be used in various statistical evaluations, database creation and market research without disclosing the identity of our members, outside the scope and purposes determined by the 'Membership Agreement' by our company and its collaborators.
Our company, to keep confidential information strictly private and confidential, to consider it a confidentiality obligation, to ensure and maintain confidentiality, to take all necessary measures and to take all necessary care to prevent all or any part of confidential information from entering the public domain or unauthorized use or disclosure to a third party. commits to show
CREDIT CARD SECURITY
Our company prioritizes the security of credit card holders who shop at our shopping sites. Your credit card information is not stored in any way our system.
When you enter the transaction process, there are two things you need to pay attention to to understand that you are on a secure site. One of them is a key or lock icon on the bottom line of your browser. This indicates that you are on a secure website and all your information is encrypted and protected. This information is only used depending on the sales process and in the direction of your instructions. The information about the credit card used during shopping is encrypted with 128-bit SSL (Secure Sockets Layer) protocol, independent of our shopping sites, and sent to the relevant bank for questioning. If the card availability is approved can be sustained for shopping. Since no information about the card can be viewed and recorded by us, third parties are prevented from using this information under any circumstances.
The reliability of payment/invoice/delivery address information of orders placed online by credit card is audited by our company against Credit Card Fraud. Therefore, the accuracy of financial and address/telephone information must first be confirmed in order for customers who place an order from our shopping site for the first time to reach the supply and delivery stage. In order to control this information, if necessary, the customer who has the credit card or the relevant bank is contacted.
Only you can access and change all the information you provide while becoming a member. If you protect your member login information securely, it is not possible for others to access and change information about you. For this purpose, it is acted within the 128-bit SSL security area during membership transactions. This system is an international encryption standard that cannot be broken.
Internet shopping sites that have an information line or customer service service and specify open address and telephone information are more preferred today. In this way, you can get detailed information about all the issues that come to your mind, and you can get healthier information about the reliability of the company that provides online shopping service.
Link(s): The link(s) that enables access to another website, files, content or from another website to the Website, files and content through the Website.
THIRD PARTY WEBSITES AND APPS
Our store may link to other sites within the website. Our company does not bear any responsibility for the privacy practices and contents of the sites accessed through these links. Advertisements published on the website of our company are distributed to our users through our advertising partners. The Privacy Policy Principles in this agreement are only for the use of our Store and do not cover third party websites.
EXCEPTIONAL CIRCUMSTANCES
In the limited cases specified below, our company may disclose the information of users to third parties, except for the provisions of this 'Privacy Policy'. These cases are limited in number;
1. To comply with the obligations imposed by the laws, Decree-Laws, Regulations, etc., issued by the competent legal authority and in force;
2. In order to fulfill the requirements of the 'Membership Agreement' and other agreements concluded by our store with users and to put them into practice;
3. Requesting information about users for the purpose of conducting an investigation and investigation duly carried out by the competent administrative and judicial authority;
4. In cases where it is necessary to provide information to protect the rights or security of users.
EMAIL SECURITY
Never write your credit card number or password in the e-mails you send to our store's Customer Service regarding any of your orders. Information contained in e-mails can be viewed by third parties. Our company cannot guarantee the security of the information transferred from your e-mails under any circumstances.
You can send an e-mail to info@marbleact.com for any questions and suggestions regarding our privacy policy. You can reach our company's contact information below.
Company Name : Marble ACT
Adress : PUSULA KALIP TASARIM TİCARET VE SANAYİ LİMİTED ŞİRKETİ
Adres: KURTULUS MAH. ULUS CAD. YESIL NILKENT SITESI NO: 6
G/B NILUFER/ BURSA
Tel : +905376194637