Data Protection

Personal Data Protection, Processing, Retention and Destruction Policy

Retention and Destruction Policy

1. INTRODUCTION
   • PURPOSE

Our company, trading under the name Recep Tayyip Erdoğan University and Turkish-German University Technology Development Zone Management Joint Stock Company (the Company), carries out all its work with care in order to comply with the legislation in force on the protection of personal data. Within this scope, through this Personal Data Protection, Processing, Retention and Destruction Policy (the Policy), the Company aims to ensure transparency regarding its personal data processing activities.

• SCOPE

This policy explains the principles adopted in the processing of personal data, the data processed in the Company’s processes, the means and purposes of processing and the legal grounds for it, the data subjects, the persons and institutions to whom data is transferred and the purposes of those transfers, the conditions for retention and destruction, the technical and administrative measures taken, and the rights of the data subject.

• ABBREVIATIONS AND DEFINITIONS

Explicit consent: consent relating to a specific matter, based on information and expressed freely,

Anonymization: the anonymization of personal data, meaning rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching it with other data; and the alteration of personal data in such a way that it loses its character as personal data and this cannot be reversed,

Unit: the Personal Data Protection Unit established within the Company,

Zone: the Recep Tayyip Erdoğan University and Turkish-German University Technology Development Zone,

Job Candidate: natural persons who have applied for a job with the Company in any way or have made their CV and related information available for the Company’s review,

Startup Company: the natural and legal persons operating in the Zone,

Shareholder: the natural and legal persons who are shareholders of the Company or of a Startup Company, and their representatives,

Data Subject: the natural person whose personal data is processed,

Law: Personal Data Protection Law No. 6698,

Personal data: any information relating to an identified or identifiable natural person. (Data belonging to legal persons may constitute the personal data of a natural person only where it can be associated with that natural person’s identity.)

Personal Data Processing Inventory: the inventory that maps the data processing activities our Company carries out in connection with its business processes against the purposes of processing, the data category, the recipient group to which data is transferred and the group of data subjects, and in which we set out in detail the maximum period necessary for the purpose for which personal data is processed, the personal data envisaged for transfer to foreign countries, and the measures taken in respect of data security,

Processing of personal data: any operation performed on personal data such as its collection, recording, storage, retention, alteration, reorganization, disclosure, transfer, acquisition, making available, classification or the prevention of its use, carried out wholly or partly by automated means or by non-automated means provided that it forms part of a data filing system,

Board: the Personal Data Protection Board,

Authority: the Personal Data Protection Authority,

Special category of personal data: personal data which, if processed unlawfully, carries a risk of causing harm or discrimination to individuals, namely data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of an association, foundation or trade union, health, sexual life, criminal convictions and security measures, together with biometric and genetic data,

Company Representative: members of the Company’s board of directors and other authorized natural persons,

VERBIS: the Data Controllers’ Registry Information System,

Data Processor: the natural or legal person who processes personal data on behalf of the data controller, on the authority granted by the controller,

Data Subject Request Form: the information request form containing the application data subjects make to the Company in order to exercise their rights,

Data Controller: within the scope of this Policy, the Company, which determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system,

Directive: the Recep Tayyip Erdoğan University and Turkish-German University Technology Development Zone Management Joint Stock Company Personal Data Protection Unit Directive,

Website: belonging to our Company https://cekmekoygo.com/ means the website at that address.

• APPLICATION OF LEGISLATION

The relevant statutory provisions in force on the processing, protection, retention and destruction of personal data shall apply in the first instance. In the event of any inconsistency between the legislation in force and the Policy, the Company accepts that the legislation in force shall apply. The Policy sets out the rules established by the relevant legislation in concrete terms within the scope of the Company’s practices.

2. PROCESSING OF PERSONAL DATA
   • DATA PROCESSED

The categories of personal data to be processed under this Policy, and the data to be processed within each category, are as follows:

• COMPLIANCE WITH GENERAL PRINCIPLES
  • Processing in Compliance with the Law and the Rule of Good Faith: Our Company takes care to ensure that its processing activities are carried out in accordance with the provisions of the Law and in a way that does not conflict with the rule of good faith.
  • Personal Data Being Accurate and, Where Necessary, Up to Date: In order to ensure that personal data is accurate, our Company may obtain undertakings from data subjects that the data they share is correct. It also keeps data up to date by reflecting any changes in a data subject’s personal data in the personal data already processed.
  • Processing for Specific, Explicit and Legitimate Purposes: Through this Policy and the Personal Data Processing Inventory, the Company clearly sets out the purposes for which personal data is processed and carries out its processing within the scope of those purposes.
  • Being Relevant, Limited and Proportionate to the Purpose of Processing: The Company uses and transfers personal data only in line with the purpose of processing.
  • Retention for the Period Prescribed by the Relevant Legislation or Necessary for the Purpose of Processing: The Company retains the personal data it processes only for as long as is necessary for the purpose of processing, and in any case for no longer than the maximum periods prescribed by law. The Company observes the minimum and maximum retention periods prescribed for the storage of personal data. Where the statutory retention period expires or the purpose of processing no longer applies, the Company destroys the personal data in accordance with the periodic destruction intervals or upon the application of the data subject.

• LEGAL GROUNDS FOR PROCESSING PERSONAL DATA
  • Our Company may process personal data where one or more of the following grounds applies:

1. Where it is expressly provided for in the laws,
2. Where it is necessary to protect the life or physical integrity of the person concerned or of another person, and that person is physically unable to give consent or their consent is not legally valid,

• Where the processing of personal data belonging to the parties to a contract is necessary, provided it is directly related to the establishment or performance of that contract,

1. Where it is necessary for the data controller to fulfil a legal obligation,
2. Where the data has been made public by the data subject themselves,
3. Where processing is necessary for the establishment, exercise or protection of a right

• Where processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.
  • Because special categories of personal data may expose data subjects to discrimination or harm, the legal grounds available for processing them are more limited. Under the Law, our Company may process special categories of personal data where one of the following legal grounds applies:

1. Where it is expressly provided for in the laws,
2. Where it is necessary to protect the life or physical integrity of the person concerned or of another person, and that person is physically unable to give consent or their consent is not legally valid,

• Where the data relates to personal data made public by the data subject and is consistent with their intention in making it public,

1. Where it is necessary for the establishment, exercise or protection of a right,
2. Where it is necessary for the protection of public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning, management and financing of health services, and is carried out by persons under an obligation of confidentiality or by authorized institutions and organizations,
3. Where it is necessary for the fulfilment of legal obligations in the fields of employment, occupational health and safety, social security, social services and social assistance,

• Where the processing is carried out by foundations, associations and other non-profit organizations or formations established for political, philosophical, religious or trade union purposes, is directed at their current or former members and affiliates or at persons in regular contact with those organizations and formations, complies with the legislation to which they are subject and with their purposes, is limited to their fields of activity, and is not disclosed to third parties.
  • Where one or more of the legal grounds set out above applies to the processing of personal data and special categories of personal data, our Company may lawfully process personal data even without the explicit consent of the data subject. However, where none of the grounds listed above applies, our Company may also process personal data on the basis of the data subject’s explicit consent. For this reason, our Company may process personal data with explicit consent under Articles 5/1 and 6/3-a of the Law.

• PURPOSES OF PROCESSING PERSONAL DATA
  • In appointment scheduling: personal data is processed for the purposes of maintaining the security of physical premises, carrying out communication activities, carrying out and auditing business activities, and creating and tracking visitor records.
  • In occupational health and safety (OHS) processes: personal data is processed for the purposes of fulfilling obligations arising from employees’ employment contracts, conducting activities in compliance with legislation, and carrying out occupational health and safety activities.
  • In KVKK compliance processes: personal data is processed for the purposes of fulfilling obligations arising from employees’ employment contracts, carrying out training activities, conducting activities in compliance with legislation, carrying out assignment processes, carrying out communication activities, and ensuring the security of the data controller’s operations.
  • In recruitment processes: personal data is processed for the purposes of carrying out candidate selection and placement processes and planning human resources processes.
  • In the keeping of personnel files: personal data is processed for the purposes of fulfilling obligations arising from employees’ employment contracts, conducting activities in compliance with legislation, carrying out assignment processes, carrying out communication activities, and planning human resources processes.
  • In payroll processing: personal data is processed for the purposes of fulfilling obligations arising from employees’ employment contracts and carrying out finance and accounting operations.
  • In staff email account processes: personal data is processed for the purposes of carrying out information security processes, carrying out assignment processes, carrying out internal audit activities, carrying out communication activities, and planning human resources processes.
  • In the processes of the staff attendance control system: personal data is processed for the purposes of fulfilling obligations arising from employees’ employment contracts, carrying out audit activities, conducting activities in compliance with legislation, maintaining the security of physical premises, carrying out assignment processes, planning human resources processes, and ensuring the security of the data controller’s operations.
  • Tracking of visitor entry and exit: personal data is processed for the purposes of maintaining the security of physical premises, carrying out communication activities, and creating and tracking visitor records.
  • In website cookie usage processes: website visitors’ session identifier data is processed for the purposes of carrying out information security processes, conducting activities in compliance with legislation, and ensuring the security of the data controller’s operations.
  • In website newsletter subscription processes: personal data is processed for the purposes of carrying out training activities and carrying out communication activities.
  • In technopark pre-application processes: personal data is processed for the purposes of carrying out goods and service production and operational processes and carrying out strategic planning activities.
  • In the processes of providing services to Technopark Companies: personal data is processed for the purposes of conducting activities in compliance with legislation, carrying out and auditing business activities, carrying out goods and service production and operational processes, providing after-sales support services for goods and services, and establishing the contract and performing obligations arising from it.
  • Tracking of project writing and management processes: personal data is processed for the purposes of conducting activities in compliance with legislation, carrying out and auditing business activities, carrying out goods and service production and operational processes, and establishing the contract and performing obligations arising from it.
  • Space Allocation and Leasing in the Technopark: personal data is processed for the purposes of conducting activities in compliance with legislation, establishing the contract and performing obligations arising from it, and maintaining the security of physical premises.
  • In social media management processes: personal data is processed for the purposes of carrying out training activities, carrying out communication activities, carrying out business continuity activities, and carrying out sponsorship activities.
  • In the procurement of goods or services: personal data is processed for the purposes of carrying out communication activities, carrying out goods and service procurement processes, establishing the contract and performing obligations arising from it, and ensuring the security of the data controller’s operations.

• NOTICE REGARDING THE PROCESSING OF PERSONAL DATA

At our Company, notices regarding processing activities are given on a process-by-process basis. Within this scope:

• Cookie Notice: Data subjects are informed about the data processed through the cookies used on our website by means of a privacy notice published on that same website. The notice is displayed on screen during the visit so that the data subject can access it easily.
• Staff Privacy Notice: Our Company’s employees are informed about the data processed about them through the privacy notices provided as an annex to their employment contract.
• Job Candidate Privacy Notice: Job candidates are informed about their personal data through the privacy notices made available to them.
• Visitor Privacy Notice: The notice informing visitors entering the Zone about the data processed is published on the website. The visitor cards used by visitors when entering the Zone carry a QR code directing them to that notice.
• Startup Company Employee Privacy Notice: Employees of the companies operating in the Zone are informed about the data processed through the cards they use to enter and leave the Zone. This information is provided by means of the text on the website to which the QR code on the card directs them, and the boards at the Zone entrance.
• Privacy Notice on Camera Recordings: Information about the personal data processed through camera surveillance carried out in the Zone and in the Company’s areas outside the Zone is provided through the privacy notice on the website. Layered notice is provided by means of information boards at the entrances to the monitored areas, together with a QR code directing visitors to that privacy notice.
• Website General Privacy Notice: For our processing activities other than the processes for which separate notices are given above, data subjects are informed by means of the general privacy notice we publish on our website.

• TRANSFER OF PERSONAL DATA

In the cases provided for by law, and where necessary for the Company to fulfil its legal obligations, for the establishment and performance of a contract, or for the establishment or protection of a right, the data processed by our Company may be transferred to authorized public institutions and organizations and to private legal and natural persons even without the explicit consent of the data subject. Beyond this, we would like to set out below, in concrete terms, some of the transfers our Company may carry out.

• Our employees’ data may be transferred to the Ministry of Labour and Social Security and its affiliated institutions and organizations, as required by the Labour Law and related legislation; to the Ministry of Industry and Technology and its affiliated institutions and organizations, as required by the Technology Development Zones Law and related legislation; to the relevant insurance company for the purpose of arranging supplementary health insurance; to the legal entities from which services are procured, where this is necessary in order to receive the service given the software systems in use; to affiliates and subsidiaries, and to supplier companies and individuals for the establishment and performance of supply contracts; and, where necessary, to law enforcement and judicial authorities.
• The data of our job candidates may be transferred, subject to the candidate’s explicit consent, to third parties outside the Company who are competent in the relevant role, and to affiliates and subsidiaries, in order to carry out recruitment and placement processes and to conduct interviews with the candidate.
• The data of the companies operating in the Zone and of their employees may be transferred to the Ministry of Industry and Technology and its affiliated institutions and organizations, as required by the Technology Development Zones Law and related legislation; where necessary, to law enforcement and judicial authorities; to project evaluators; and, upon request, to universities and the academics concerned.
• Our visitors’ data may be transferred, where necessary, to law enforcement and judicial authorities, and, for the purpose of establishing contact, to the company or individuals the visitor wishes to visit in the Zone.
• The data of project evaluators, trainers and advisors, shareholders, companies allocated or renting space in the Zone, and suppliers may also be transferred to the Ministry of Industry and Technology and its affiliated institutions and organizations, as required by the legislation to which the Company is subject.
• Of the special categories of personal data, our Company collects only employees’ health information and data relating to criminal convictions and security measures, and this data is transferred only to authorized public institutions and organizations as required in the cases provided for by law.
• No direct transfer abroad takes place in respect of the personal data processed by our Company. However, because of posts made from the Company’s social media accounts, the personal data of our employees and of trainers and advisors may be transferred abroad in order to carry out promotional, informational, training and announcement activities, since the servers of those social media accounts may be located abroad. Explicit consent is obtained from the data subjects for the transfers covered by this clause.

• METHODS OF COLLECTING PERSONAL DATA

The personal data processed by our Company is obtained through one or more of the following: the data subject sharing it directly with the Company orally or in writing; CVs shared by job candidates through the CV collection sites with which the Company works; data subjects sharing it digitally through the R&D Portal used in accordance with the legislation to which the Company is subject; camera recording; photographs and videos taken at group events; information entered through the website; cookies used on the website; the transfer of data from third-party institutions and organizations; the transfer of data from third-party natural and legal persons; or the generation of new personal data through the use of data held in the Company’s systems.

3. PROTECTION OF PERSONAL DATA

In order to ensure the security of personal data, our Company takes the technical and administrative measures set out in the Law and the related regulation.

• ADMINISTRATIVE MEASURES
  • The VERBIS notification regarding personal data has been made to the Authority.
  • For the protection of personal data, a Personal Data Protection Unit has first been established within the Company in order to provide administrative management and oversight. A Data Contact Person has been designated from among the Company’s employees to make the necessary notifications on behalf of the Data Controller, and that employee has also been designated as a member of the Unit.
  • A Personal Data Inventory has been created in order to map the Company’s personal data processing activities.
  • The Directive has been prepared to set out the rules governing the Unit’s activities.
  • Company policies have been prepared for the processing, protection, retention and destruction of personal data.
  • Activity and process-based privacy notices have been prepared for data subjects.
  • An action plan for personal data processes has been set out through documents such as the data subject request management procedure, the data breach management procedure and the data transfer management procedure.
  • Staff receive personal data protection awareness training on an annual basis.
  • The principle of data minimization has been adopted within the Company, and the processing of unnecessary data is prevented.
  • In order to secure the data that must be transferred under contract to third parties with which the Company has signed agreements, supplementary data protection undertakings are signed with those recipients.
  • The Directive provides for the Unit to audit personal data processing within the Company by carrying out periodic and random internal audits.
  • The personal data access rights of departing staff are revoked.
  • Data protection undertakings are signed with staff.
  • Work is carried out to comply with international standards in order to ensure information security management.
  • Measures are taken to ensure the physical security of the media containing personal data (against risks such as fire and flood).

• TECHNICAL MEASURES
  • Network security and application security are maintained.
  • A closed system network is used for transfers of personal data over networks.
  • Key management is applied.
  • Security measures are taken in the procurement, development and maintenance of information technology systems.
  • The security of data stored in the cloud is maintained.
  • A firewall is used.

4. RETENTION OF PERSONAL DATA
   • STORAGE MEDIA

• LEGAL GROUNDS AND PURPOSES OF RETENTION

The retention of personal data forms part of the processing of personal data. For the legal grounds and purposes of retention, please see clauses 2.3 and 2.4 of this Policy.

• GROUNDS REQUIRING DESTRUCTION

In the following cases the Company erases, destroys or anonymizes personal data, either at the request of the data subject or on its own initiative:

1. The amendment or repeal of the legislative provisions on which the processing was based,
2. The disappearance of the purpose requiring the data to be processed or retained,

• Where the processing of personal data is based solely on explicit consent, the withdrawal of that consent by the data subject,

11. The Company’s acceptance of an application made by the data subject, within the scope of their rights under Article 11 of the Law, for the erasure or destruction of their personal data,
12. The expiry of the maximum period for which the personal data must be retained, and the absence of any condition justifying its retention for a longer period.

5. DESTRUCTION OF PERSONAL DATA

The erasure, destruction and anonymization techniques most commonly used by the COMPANY are listed below:

• ERASURE METHODS

• DESTRUCTION METHODS

• ANONYMIZATION METHODS

Anonymization means rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even by matching it with other data.

Depending on the nature of the data concerned, the Company uses one or more of the following anonymization methods: removing variables, local suppression, generalization, top and bottom coding, micro-aggregation, and data shuffling and perturbation.

6. RETENTION PERIODS AND DESTRUCTION PROCEDURE
   • RETENTION PERIODS

The retention periods for the personal data processed by our Company are as follows:

• DESTRUCTION PROCEDURE

Under the Directive, the Unit meets every three (3) months to identify personal data whose retention period has expired at our Company and to carry out destruction. These meetings identify data for which the purpose of processing or the legal basis no longer applies. For the data identified, the Unit obtains the approval of the Company’s General Manager, destroys the data in a manner appropriate to the storage medium, and retains the record drawn up in respect of the destroyed data for three (3) years.

7. RIGHTS OF THE DATA SUBJECT
   • DATA SUBJECT REQUEST FORM
     • Under Article 11 of the Law, data subjects have the right to: learn whether their personal data is being processed; request information about the data processed; learn the purposes of processing and ask whether the data is used in line with those purposes; request information about domestic and international transfers of the data; request the correction of personal data that is incomplete or processed incorrectly; object to a conclusion being drawn against them through the analysis of the data; and request compensation for damage suffered as a result of unlawful processing.
     • To make it easier for data subjects to exercise these rights, a Data Subject Request Form is available on our Company’s website. This form was created so that the relationship between our Company and the data subject can be established and so that a complete and accurate response can be given within the statutory period regarding the personal data processed by the Company. In order to eliminate legal risks arising from unlawful and improper data sharing and to ensure the security of personal data, the Company may request additional documents and information for the purposes of identity and authority verification.
     • Where the information shared in the form is inaccurate or out of date, or where an unauthorized application is made, our Company accepts no liability for any failure to respond to such requests or for the response not reaching the person who submitted the form.
     • Data subject requests will be answered free of charge within thirty (30) days of the date they reach our Company. If the response exceeds 10 pages, a fee for the pages beyond the tenth, and, where the response is provided electronically, the cost of the recording medium used, may be charged to the data subject under the tariff set by the Personal Data Protection Board.

• EXCEPTIONS TO DATA SUBJECT RIGHTS
  • Under Article 28 of the Law, data subjects will not be able to exercise their rights arising from the Law in the following cases, which fall outside its scope:

1. The processing of personal data by natural persons wholly within the scope of activities relating to themselves or to family members living in the same household, provided that the data is not disclosed to third parties and that data security obligations are observed.
2. The processing of personal data for purposes such as research, planning and statistics, by anonymizing it through official statistics.

• The processing of personal data for artistic, historical, literary or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defence, national security, public safety, public order, economic security, the privacy of private life or personal rights, and does not constitute a criminal offence.

1. The processing of personal data within the scope of preventive, protective and intelligence activities carried out by public institutions and organizations assigned duties and powers by law for the purposes of national defence, national security, public safety, public order or economic security.
2. The processing of personal data by judicial authorities or enforcement authorities in relation to investigation, prosecution, trial or execution proceedings.

• Under Article 28 of the Law, and provided this is not contrary to the purpose of the Law and its fundamental principles, apart from the data controller’s obligation to provide information and the data subject’s right to claim compensation for damage suffered, the data subject may not exercise the rights arising from Article 11 in the following cases, and in those cases the VERBIS registration obligation set out in Article 16 shall also not apply to the data controller:

1. Where the processing of personal data is necessary for the prevention of crime or for criminal investigation.
2. The processing of personal data made public by the data subject themselves.

• Where the processing of personal data is necessary for the performance of supervisory or regulatory duties, or for disciplinary investigation or prosecution, by public institutions and organizations and professional bodies with public institution status, acting on the authority granted by law.

1. Where the processing of personal data is necessary for the protection of the State’s economic and financial interests in relation to budgetary, tax and fiscal matters.

8. ABOUT THE POLICY
   • The Company reserves the right to amend the Policy in light of changes to the Law, decisions of the Authority, changes to the Company’s practices, or developments in the sector or in information technology.
   • Amendments to the Policy are reflected in the text immediately, and explanations of those amendments are set out at the end of the Policy.
   • This Policy enters into force on the date it is approved by the General Manager and is published on the website.