Personal Data Retention and Destruction Policy

1. Purpose of the policy

This Personal Data Retention and Destruction Policy (the “Retention and Destruction Policy”), concerning personal data processed by Adil Onur Karahan Şahıs Şirketi (the “Company”) within the scope of the Race Of Words mobile application and website (the “Platform”), has been issued to regulate the technical and organisational protection of personal data in accordance with Law No. 6698 on the Protection of Personal Data (the “Law”) and, where the conditions for processing no longer exist, the application of the provisions of the Regulation on the Deletion, Destruction or Anonymisation of Personal Data (the “Regulation”) published in the Official Gazette dated 28.10.2017.

2. Recording media in which personal data is stored

Personal data is stored securely in the following media in accordance with the relevant legislation, in particular the provisions of the Law:

• Electronic media: the MySQL database on the Platform servers, server access logs, backup media, the e-mail inbox, and secure storage and the local database on the user’s own device.
• Physical media: data subject applications bearing wet signatures and the related correspondence.

3. Reasons requiring retention and destruction

Personal data is retained in particular for the purposes of maintaining the Platform’s activities, fulfilling legal obligations and managing relationships with users. The reasons requiring retention are as follows:

• The personal data is directly related to the establishment and performance of a contract,
• The establishment, exercise or protection of a right,
• The existence of a legitimate interest of the Company, provided that it does not harm the fundamental rights and freedoms of persons,
• The fulfilment of the Company’s legal obligations,
• The retention of personal data is expressly provided for in the legislation,
• The existence of the data subject’s explicit consent for retention activities requiring explicit consent.

Pursuant to the Regulation, personal data is deleted, destroyed or anonymised ex officio or upon request in the following cases:

• Amendment or repeal of the provisions of the legislation forming the basis for processing or retention,
• Elimination of the purpose requiring processing or retention,
• Elimination of the processing conditions in Articles 5 and 6 of the Law,
• Withdrawal of consent by the data subject in cases where processing is based solely on explicit consent,
• Acceptance of the data subject’s application for deletion, destruction or anonymisation under sub-paragraphs (e) and (f) of paragraph 2 of Article 11 of the Law,
• The Board finding well-founded a complaint lodged with it after the Company rejects such an application, the response is found insufficient or no response is given in time,
• The absence of any condition justifying retention for a longer period despite the expiry of the maximum retention period.

4. Measures taken for the protection of personal data

In accordance with Article 12 of the Law, the Company takes technical and organisational measures ensuring an appropriate level of security in order to prevent the unlawful processing of and access to personal data and to ensure its safekeeping. If, despite all measures, data is obtained by third parties by unlawful means, this situation is notified to the data subject and the Board as soon as possible.

4.1. Technical measures

• Network and application security is ensured, and data transmission is encrypted with SSL/TLS.
• Passwords are stored in an irreversible (hashed) form; card details are not held by the Company.
• Server and database access is restricted by authorisation, and user account management and authorisation control are applied.
• Access logs are kept regularly.
• Firewall and intrusion prevention measures are used, and software is kept up to date.
• Personal data is backed up and the security of backups is ensured.
• The security of personal data held in the cloud and on servers is ensured.
• Existing risks and threats have been identified, and regular checks for security vulnerabilities are carried out.

4.2. Organisational measures

• It is ensured that only persons who need personal data for their duties have access to it.
• Data security provisions are included in contracts with service providers to whom personal data is transferred, and the awareness of such providers is ensured.
• Confidentiality undertakings are obtained from persons who access personal data.
• Data security issues are reported promptly, and cases of unlawful acquisition are notified to the persons concerned and the Board as soon as possible.
• Audits are carried out for the implementation of the provisions of the Law, and identified vulnerabilities are remedied.

5. Methods of destruction of personal data

Where the reasons requiring processing no longer exist, the Company destroys personal data, on its own initiative or upon the request of the data subject, by one or more of the following methods. The process is carried out through the steps of identifying the data to be deleted, identifying the persons concerned, identifying the access methods and destroying the data.

5.1. Deletion

• Deletion of the rows or columns in the database containing personal data,
• Removal of user access rights to files,
• Rendering data on paper illegible by the blackout (redaction) method.

5.2. Destruction

• Overwriting data in backup media at the end of the backup cycle so that it cannot be recovered,
• Destruction of paper documents with a paper shredder,
• Demagnetisation or physical destruction of magnetic media.

5.3. Anonymisation

• Masking: removing the key identifying information of the personal data from the data set.
• Record removal: removing data rows containing uniqueness from among the records.
• Regional suppression: concealing data that may be identifying on its own.
• Generalisation (global recoding): converting data into more general content (e.g. country instead of exact location).
• Adding noise: adding a deviation at a determined rate to numerical data.

Pursuant to Article 28 of the Law, anonymised data may be processed for research, planning and statistical purposes; such operations fall outside the scope of the Law. The Company freely determines the destruction method according to the medium in which the data is recorded; within the scope of Article 13 of the Regulation, the method to be used in the destruction category chosen by the data subject is also determined by the Company.

6. Retention and destruction periods

Where a period is provided for in the legislation, that period is complied with; otherwise, personal data is retained for the periods below. In determining the periods, the general limitation period under the Turkish Code of Obligations (10 years) has been taken into account.

Deletion requests from data subjects are fulfilled without waiting for the periodic destruction. In other cases, upon expiry of the period, personal data is deleted, destroyed or anonymised in the first periodic destruction following that date. Destruction operations are recorded, and such records are retained for at least three years, without prejudice to other legal obligations.

7. Periodic destruction interval

Pursuant to Article 11 of the Regulation, the periodic destruction interval has been set at 6 months. Accordingly, periodic destruction is carried out every year in June and December.

8. Revision and repeal

In the event that the Retention and Destruction Policy is amended or repealed, the new arrangement is announced on the Policies page on the Platform.

9. Entry into force

This Retention and Destruction Policy enters into force on the date of its publication.