This Data Retention and Disposal Policy (the "Disposal Policy") sets out the procedures and principles for retaining, erasing, destroying and anonymising personal data processed by ORELSİS BİLİŞİM MAKİNE OTOMASYON SANAYİ VE TİCARET LİMİTED ŞİRKETİ ("ORELSIS" or the "Company"), under Article 7 of Law No. 6698 and the Regulation on the Erasure, Destruction or Anonymisation of Personal Data. The general principles on the processing of personal data are set out in the Personal Data Protection Policy.
Scope
The Disposal Policy covers all personal data of our customers, prospective customers, business partners, suppliers and their representatives and employees, our employees, job applicants and website visitors that is processed wholly or partly by automated means, or by non-automated means as part of a data filing system.
Storage media
- Electronic media: servers, cloud services, email accounts, CRM, ERP, accounting and project management software, company computers and shared drives
- Physical media: contract and invoice files, business cards, cabinets and archives
The Company will include any other storage media it starts using in the scope of this Policy.
Reasons for retention and disposal
Personal data is retained for as long as one of the processing conditions in Articles 5 and 6 of the Law continues to apply, such as explicit consent, express provision by law, establishment or performance of a contract, legal obligation, data having been made public, establishment, exercise or protection of a right, and legitimate interest. When all of these conditions cease to exist, the data is disposed of ex officio or at the data subject's request.
Security measures
During retention, the technical and organisational measures described in the Personal Data Protection Policy and the Information Security Policy are applied: role-based access control, encrypted connections, logging, backups, vulnerability management, employee training and confidentiality undertakings.
Disposal methods
Erasure
Rendering personal data inaccessible to and non-reusable by the relevant users in any way. Records in databases are deleted with database commands; files are deleted via the operating system or application, or the relevant users' access rights are removed; data in cloud and email services is deleted with the provider's deletion functions. Data on paper is redacted so that it cannot be read again.
Destruction
Rendering personal data inaccessible, irretrievable and non-reusable by anyone in any way. Paper documents are shredded; decommissioned disks and storage units are overwritten with secure-erase software or physically destroyed.
Anonymisation
Rendering personal data impossible to associate with an identified or identifiable natural person, even when matched with other data. Methods such as masking, grouping, generalisation and aggregation are used. Anonymous data may be used for statistics and product development.
Responsibilities
| Role | Responsibility |
|---|---|
| General Manager | Approving the Policy, providing the necessary resources and overseeing its implementation |
| KVKK Compliance Officer | Tracking compliance with the Law, secondary legislation and Board decisions; planning and recording periodic disposal; managing data subject applications |
| IT Officer | Retention, backup and technical disposal of data in electronic media; managing access rights |
| Unit managers | Keeping the data in their own processes in line with the retention periods and disposing of it |
Data categories and data subject groups
| Data subject group | Data categories |
|---|---|
| Prospective customer and website form user | Identity, contact, professional, customer transactions |
| Customer and customer representative / employee | Identity, contact, professional, customer transactions, financial, legal transactions |
| Supplier and business partner representative / employee | Identity, contact, professional, financial, legal transactions |
| Job applicant | Identity, contact, CV, education and work experience |
| Employee | Identity, contact, personnel file, financial, education, health (under occupational health law) |
| Website visitor | Transaction security (IP, browser, access logs), marketing and cookie data with consent |
| Newsletter subscriber | Contact, marketing, consent record for commercial electronic messages |
Retention and disposal periods
| Process / data | Retention period | Disposal |
|---|---|---|
| Contact, demo, support and partnership form requests (not leading to a contract) | 2 years from conclusion of the request | At the first periodic disposal after the period ends |
| Quotation, contract and customer relationship records | 10 years from the end of the contractual relationship (Turkish Code of Obligations Art. 146, Turkish Commercial Code Art. 82) | At the first periodic disposal after the period ends |
| Invoice, accounting and financial records | 10 years from the end of the relevant calendar year (Turkish Commercial Code Art. 82, Tax Procedure Law Art. 253) | At the first periodic disposal after the period ends |
| Technical support and service records | 10 years from the end of the contract | At the first periodic disposal after the period ends |
| Job applications (applicant not hired) | 6 months from conclusion of the application; 2 years with explicit consent | At the first periodic disposal after the period ends |
| Employee personnel file | 10 years from the end of employment | At the first periodic disposal after the period ends |
| Web server access and security logs | 2 years (Law No. 5651 and related regulations) | At the first periodic disposal after the period ends |
| Newsletter subscription and consent for commercial electronic messages | Until consent is withdrawn; the consent record for 3 years from the date of withdrawal | At the first periodic disposal after the period ends |
| Cookie preference | In your browser, until you delete it | By the user, in browser settings |
| Data subject applications and responses | 10 years from conclusion of the application | At the first periodic disposal after the period ends |
Where the law requires a longer period or a dispute is pending, data is retained for that period or until the dispute is resolved.
Periodic disposal
Under the Regulation, personal data is erased, destroyed or anonymised at the first periodic disposal following the date on which the obligation to dispose of it arises. Periodic disposal is carried out twice a year, at six-month intervals. Where a data subject requests disposal and all processing conditions have ceased to exist, the data is disposed of within thirty days at the latest. All disposal operations are recorded, and those records are kept for at least three years, without prejudice to other legal obligations.
Updates
The Disposal Policy is reviewed and updated in line with changes in law and business processes. The current version is published on this page.