Personal Data Storage and Destruction Policy
Policy No: VSİP-1.0 · Version: 1.0 · Effective Date: 01.10.2026 · Last Updated: 15.10.2026
With this Policy; It is aimed to prevent personal data from being stored for longer than necessary, to keep personal data only for as long as necessary, to determine the retention periods, to destroy the personal data whose storage period has expired with appropriate methods, to protect the security of personal data and to record the destruction processes.
1. Purpose
This Policy has been prepared in order to determine the procedures and principles regarding the storage of personal data processed by CAROB TÜRKİYE ("Company") in accordance with the relevant legislation and the deletion, destruction or anonymization of personal data processed by {{}} ("Company") by lawful methods in case the purposes of processing disappear or the retention periods expire.
2. Scope
This Policy covers personal data processed by the Company through automated or non-automated methods.
Within the scope of the policy; personal data of employees, customers, potential customers, suppliers, business partners, visitors, website users, company officials, contact and quote requesters can be evaluated.
Storage and destruction processes are applied according to the nature of the personal data processed by the company.
3. Legal Basis
This Policy is primary; It has been prepared by taking into account the current legislation on the storage and destruction of personal data, including the Personal Data Protection Law No. 6698, the Regulation on the Deletion, Destruction or Anonymization of Personal Data, the Turkish Commercial Code, tax legislation, labor legislation and other relevant national legislation.
The Company may update this Policy in line with the changes that may occur in the legislation.
4. Definitions
Personal Data: It refers to any information relating to an identified or identifiable natural person.
Personal Data Processing: It refers to obtaining, recording, storing, preserving, changing, transferring, classifying, making available or similar operations of personal data.
Storage: It refers to the secure storage of personal data for the specified period.
Destruction: It refers to any of the processes of deleting, destroying or anonymizing personal data.
Deletion: It refers to making personal data inaccessible and unusable for the relevant users in any way.
Destruction: It refers to making personal data inaccessible, unrecoverable and unusable by anyone.
Anonymization: It refers to the rendering of personal data that cannot be associated with a specific or identifiable natural person, even if it is matched with other data.
5. Purposes Requiring Storage of Personal Data
Personal data is stored only to the extent necessary for the realization of legitimate purposes such as: fulfillment of legal obligations, execution of commercial activities, establishment and execution of contractual relationships, management of offer and request processes, execution of customer and potential customer relations, execution of supplier and business partner relations, execution of financial and accounting processes, execution of human resources processes, follow-up of legal processes, ensuring information security, ensuring the security of the website and information systems, managing commercial electronic message processes, meeting the demands of authorized institutions and organizations.
Personal data is not stored unnecessarily in cases where none of the above purposes are met.
6. Determination of Retention Period
The following criteria are taken into account when determining the retention period of personal data: the retention period stipulated in the relevant legislation, whether the purpose of processing continues, whether the commercial relationship continues, contractual obligations, legal obligations, statute of limitations, the nature of possible legal disputes, the legitimate interests of the Company, the rights and freedoms of the data owner, whether the legal reason that causes the processing of the data continues.
In case more than one legislative provision is applied, the periods stipulated by the relevant legislation are evaluated separately.
7. Personal Data Retention Periods
The periods below show the general retention periods that may apply to the categories of data that the Company processes.
| Data Category | Retention Period |
|---|---|
| Contact form registrations | 2 years |
| Quote / quote request records | 2 years |
| Customer contact records | 10 years from the end of the relationship |
| Lead records | 2 years |
| Business correspondence | 10 years |
| Contract records | 10 years after contract expiration |
| Accounting/finance records | 10 years |
| Invoice and business document records | 10 years |
| Employee/staff records | 10 years from the termination of the employment relationship |
| Job application records | 1 year |
| Camera recordings | 30 days |
| System/server logs | 2 years |
| Website technical records | 2 years |
| Cookie preference records | Not applied |
| Commercial electronic message permissions | Until permission is withdrawn |
| Commercial electronic message rejection records | Indefinite |
| Legal dispute files | Relevant statute of limitations + 10 years |
| Other records | The period stipulated in the relevant legislation, if not, until the purpose is achieved |
8. Expiration of the Retention Period
When the purpose requiring the processing of personal data disappears or the retention period stipulated in the relevant legislation expires, personal data is included in the destruction process.
However; In case of an ongoing legal dispute, an examination carried out by the competent authority, a retention obligation arising from the legislation, the necessity of data retention for the establishment, exercise or protection of a right, the relevant data may continue to be stored for the required period.
9. Disposal Methods
The Company destroys the personal data whose storage period has expired by one of the methods suitable for the environment and technical structure of the data.
9.1. Deletion of Personal Data — Personal data in electronic media that have expired are deleted in a way that the relevant users cannot access and reuse. Records in the physical environment are removed from the filing systems in a way that unauthorized persons cannot access and the necessary destruction processes are carried out.
9.2. Destruction of Personal Data — In cases where the deletion of personal data is not sufficient or the relevant environment must be completely eliminated, the data is destroyed by physical or technical methods. Physical documents can be shredded or irreversibly destroyed by appropriate methods. Data in electronic storage media can be rendered inaccessible and irreversible by using the necessary technical methods.
9.3. Anonymization of Personal Data — In cases where it is necessary to continue to use the data for statistical, analytical or similar purposes, personal data may be anonymized in such a way that it cannot be associated with a specific or identifiable natural person. Anonymized data is not subject to the personal data provisions within the scope of this Policy to the extent that it loses its personal data character.
10. Time of Destruction Operations
In the event that the reasons requiring the processing of personal data disappear or the retention periods expire, the Company checks the relevant data every 6 months and performs the necessary destruction procedures.
When necessary, the destruction process can be carried out without waiting for the determined periodic destruction time.
11. Periodic Destruction
The frequency of periodic disposal operations to be carried out by the company is determined as twice a year (in June and December).
Within the scope of periodic destruction: 1) The data whose storage period has expired is determined. 2) It is checked whether there is an ongoing legal or legal reason that requires the data to be stored. 3) The destruction method is determined. 4) Deletion, destruction or anonymization is performed. 5) The transaction performed is recorded.
12. Keeping Records of Destruction
Necessary records regarding the destruction operations carried out are kept by the Company. In the destruction records, to the extent possible; information such as the date of destruction, the category of data destroyed, the method of destruction, the unit or person performing the destruction, and the reason for destruction may be included.
Destruction records are kept for the periods stipulated in the relevant legislation. Retention Period of Destruction Records: 3 years.
13. Data Security
The Company takes the necessary technical and administrative measures during the storage and destruction of personal data. In this context, according to the nature of the data and the characteristics of the information systems used; measures such as authorization, access control, management of user accounts, encryption, secure backup, logging, physical security, network and system security, protection against malware, up-to-date software and security mechanisms can be applied.
14. Data in Backup Systems
If deleted or destroyed personal data is in backup systems, technical and administrative measures are applied to prevent this data from being restored to active systems or accessed during ordinary use.
The data in the backup systems are safely destroyed within the framework of the relevant backup cycle and technical destruction possibilities. Backup Retention Period: During the relevant backup cycle.
15. Data Breach Status
In the event that a data security breach is detected, such as unlawful acquisition, loss, alteration, deletion or access of personal data by unauthorized persons, the Company makes the necessary evaluations within the scope of the relevant legislation and makes the necessary notifications.
16. Liability
The Company Management is responsible for the implementation of this Policy and the execution of the storage and destruction processes of personal data in accordance with the legislation.
When necessary, support can be obtained from information processing, human resources, accounting, law and other relevant units.
Policy Officer: Duran Yılmaz · Position: Company Owner
17. Rights of Relevant Persons
Persons whose personal data are processed can exercise their rights under Article 11 of the KVKK.
Applications can be made through the following channels:
E-mail: [email protected]
Address: Saray Mah, Hanımağa Sokak 3-1, 07400 Alanya/Antalya
Application Methods: KVKK Application Methods
Applications are evaluated in accordance with the time and procedures stipulated in the relevant legislation.
18. Updating the Policy
This Policy; It is updated when necessary due to legislative changes, changes in the Company's data processing activities, technological developments, use of new information systems, changes in retention periods.
Policy Version: 1.0 · Last Update: 15.10.2026
19. Enforcement
This Policy enters into force on 01.10.2026.
CAROB TÜRKİYE
Address: Saray Mah, Hanımağa Sokak 3-1, 07400 Alanya/Antalya
Phone: 0850 255 02 07
Email: [email protected]
Web: www.carobturkiye.com
