PERSONAL DATA RETENTION AND DESTRUCTION POLICY
1. Purpose and Scope
This policy has been prepared to establish the procedures and principles for the retention and destruction of personal data held by Polymerio Emtia Elektronik Alım Satım Hizmetleri Anonim Şirketi (“Polymerio”).
This policy covers personal data of company employees, job applicants, customers, service providers, visitors, and other third parties.
2. Responsibilities and Task Allocation
All units and employees of the company are responsible for implementing the measures and processes defined in this policy. As the data controller, Polymerio oversees and coordinates these processes.
3. Storage Environments
Personal data may be stored in the following environments:
- Electronic Environments: Servers, software, cloud systems, databases, portable storage devices.
- Physical Environments: Filing cabinets, archive rooms, paper documents.
4. Retention and Destruction Descriptions
Retention: Personal data is retained for the periods prescribed by the relevant legislation. Retention periods are recorded in the personal data processing inventory.
Destruction: When the purposes of processing personal data cease to exist, the data is destroyed using the following methods:
- Deletion: Rendering data inaccessible and unusable by users.
- Erasure: Physically destroying the data.
- Anonymization: Rendering data incapable of being linked to an identifiable person.
5. Technical and Administrative Measures
Technical Measures: Firewalls, data masking, access control systems, encryption, and logging.
Administrative Measures: Creating policies and procedures, training employees, confidentiality agreements.
6. Retention and Destruction Periods
Retention periods for personal data are determined based on data category and processing purposes. These periods are reviewed and updated regularly.
| Process | Retention Period | Destruction Period |
|---|---|---|
| Board Transactions | 10 years | During the first scheduled destruction period following the end of the retention period |
| Contract Preparation | 10 years after contract termination | During the first scheduled destruction period following the end of the retention period |
| Execution of Institutional Communication Activities | 10 years after activity completion | During the first scheduled destruction period following the end of the retention period |
| Execution of Human Resources Processes | 10 years after activity completion | During the first scheduled destruction period following the end of the retention period |
| Log Tracking Systems | 10 years | During the first scheduled destruction period following the end of the retention period |
| Execution of Hardware and Software Access Processes | 2 years | During the first scheduled destruction period following the end of the retention period |
| Registration of Visitors and Meeting Participants | 2 years after event conclusion | During the first scheduled destruction period following the end of the retention period |
| Camera Recordings | 2 years | During the first scheduled destruction period following the end of the retention period |
The scheduled destruction period takes place every June and December.
7. Scheduled Destruction Period
The scheduled destruction period for personal data is six months. At the end of this period, data whose retention period has expired is identified and destroyed.
8. Publication and Retention of the Policy
This policy is published on the company’s website and communicated to all stakeholders. It is made accessible to employees and other interested parties.
9. Effective Date and Repeal
This policy enters into force on the date of publication and remains valid until updated.
Polymerio Emtia Elektronik Alım Satım Hizmetleri Anonim Şirketi – 0732196805600001
Hamidiye Mahallesi Cendere Caddesi No: 103-2, T3 Block, Floor 7, Office 58, 34398 Kâğıthane/Istanbul
0850 840 95 55
