Personal Data Retention and Destruction Policy

ARCANUS HOTELS SORGUN

PERSONAL DATA RETENTION AND DESTRUCTION POLICY

(KVSI POLICY)

TABLE OF CONTENTS

1. BASIS, PURPOSE AND SCOPE 3

2. TERMS AND DEFINITIONS 4

3. DELETION, DESTRUCTION OR ANONYMIZATION OF PERSONAL DATA 8

4. COMMON PROVISIONS 14

5. POLICY ANNEXES AND RISK ANALYSIS REPORTS 14

6. UPDATES 15

7. ENTRY INTO FORCE AND REPEAL 15

1. BASIS, PURPOSE AND SCOPE

Basis

This policy, created by the DATA CONTROLLER, is based on the provisions of the KVSY Regulation published in the Official Gazette No. 30224 dated 28.10.2017 pursuant to Article 7/3 of the KVK Law and Article 22/1(e) of the same law.

Purpose

The purpose of this KVSI Policy is to determine the procedures and principles regarding the deletion, destruction, and anonymization of personal data belonging to data subjects after the processing phase, in accordance with the KVK Policy, KVK Law, and national and international legal regulations, by the DATA CONTROLLER as a personal data processor and controller.

Scope

This policy covers personal data processed by the DATA CONTROLLER in accordance with the KVK Law, national and international laws, regulations, directives, decisions of regulatory and supervisory bodies, international agreements, and contracts, whether fully or partially automated or as part of any data recording system.

2. TERMS AND DEFINITIONS

The following terms used in this policy:

Convention No. 108; The Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data, prepared and signed by the Council of Europe, which entered into force on 01.10.1985.

Directive 95/46/EC; The Directive of the European Parliament and of the Council adopted in 1995 on the Protection of Individuals with Regard to the Processing of Personal Data and on the Free Movement of Such Data.

Explicit consent; Consent that is related to a specific subject, based on being informed, and expressed with free will.

ECHR; The European Convention on Human Rights, prepared by the Council of Europe, which entered into force on 03.09.1953.

Flow Chart; The chart that schematically shows the activities, working methods and procedures of the DATA CONTROLLER and the personal data processing process, which is an annex and integral part of this KVK Policy.

Recipient group; The category of natural or legal persons to whom personal data are transferred by the DATA CONTROLLER.

Anonymization; Making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching with other data.

AYYGE Communiqué; The Communiqué on Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, published in the Official Gazette by KVKK on 10.03.2018.

DHKD Law; The Law on the Exercise of the Right of Petition.

Direct identifiers; Identifiers that directly reveal, disclose and distinguish the person they are associated with, on their own.

Indirect identifiers; Identifiers that reveal, disclose and distinguish the person they are associated with when combined with other identifiers.

Interaction and communication; All types of relationships creating responsibility and obligation from legal, commercial, financial, contractual, etc. perspectives, whether written or verbal, remote or in person, by the DATA CONTROLLER.

GDPR; The General Data Protection Regulation No. 2016/679 of the European Union, which repealed Directive 95/46/EC on 25.05.2018.

Data subject; The natural person whose personal data is processed by the DATA CONTROLLER.

Relevant user; Persons who process personal data within the organization of the data controller or in accordance with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of data.

Destruction; The deletion, destruction or anonymization of personal data.

Redaction; Operations such as crossing out, painting over and blurring the entirety of personal data in a way that they cannot be associated with an identified or identifiable natural person.

Recording medium; Any medium containing personal data processed fully or partially by automatic means or as part of any data recording system by non-automatic means.

Personal data; Any information relating to an identified or identifiable natural person.

Processing of personal data; Any operation performed on personal data fully or partially by automatic means or as part of any data recording system by non-automatic means, including obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing the use of data.

KVKK; The Personal Data Protection Authority.

KVK Law; The Personal Data Protection Law No. 6698, adopted on 24.03.2016 and published in the Official Gazette No. 29677 on 07.04.2016.

KVK Board; The authorized board within the KVKK.

KVK Policy; The Personal Data Protection Policy adopted and implemented by the DATA CONTROLLER.

KVSI Policy; The Personal Data Retention and Destruction Policy prepared in accordance with the KVSYH Regulation, determining the maximum period for which personal data are needed for the purpose they are processed, and the procedures for deletion, destruction and anonymization of personal data.

KVSYH Regulation; The Regulation on Deletion, Destruction or Anonymization of Personal Data issued under the KVK Law.

Masking; Operations such as deletion, crossing out, painting over and starring of certain fields of personal data in a way that they cannot be associated with an identified or identifiable natural person.

Automatic processing; Processing carried out by an interconnected and interactive electrical or electronic system that minimizes the need for human intervention or assistance.

Non-automatic processing; Personal data processing activities carried out manually through human intervention or assistance.

Special categories of personal data; Data concerning people's race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance, dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.

Periodic destruction; The deletion, destruction or anonymization process to be carried out automatically at recurring intervals specified in the personal data retention and destruction policy when all conditions for processing personal data under the Law have ceased to exist.

OG; Official Gazette.

Registry; The data controllers' registry maintained by the KVKK Presidency.

Deletion; The process of making personal data inaccessible and unusable in any way for relevant users.

Table; The table created for the systematic and understandable explanation of the activities related to the processing of personal data by the DATA CONTROLLER, which is an annex and integral part of the KVK Policy.

TCC; Turkish Criminal Code No. 5237.

TCC; Turkish Civil Code No. 4721.

VERBİS; The Data Controllers Registry Information System, an internet-accessible information system created and managed by the KVKK Presidency, which data controllers will use for registry applications and other related transactions.

Data transferor; The natural or legal person who transfers personal data from their own system to another data controller.

Data recipient; The natural or legal person to whose system personal data is transferred by another data controller.

Data inventory; The inventory that the DATA CONTROLLER has created in connection with their business processes, detailing the personal data processing activities; the purposes of processing, data categories, recipient groups and data subject groups, the maximum period required for the purpose of processing, personal data envisaged to be transferred abroad, and the measures taken regarding data security.

Data processor; The natural or legal person who processes personal data on behalf of the data controller based on the authority given by the data controller.

Data recording system; The recording system that can be created in electronic or physical medium where personal data are structured and processed according to specific criteria.

Data controller; ARCANUS HOTELS SORGUN, operating domestically and abroad, which determines the purposes and means of processing personal data and is responsible for the establishment and management of the data recording system.

VSBUH Communiqué; The Communiqué on Procedures and Principles of Application to the Data Controller, issued by KVKK and published in the Official Gazette on 10.03.2018.

VSSH Regulation; The Regulation on the Data Controllers Registry issued under the KVK Law.

Destruction; The process of making personal data inaccessible, non-recoverable and unusable by anyone in any way.

refers to the above terms.

For terms and definitions not included in this article, the term and definition provisions in the relevant legislation shall apply.

3. DELETION, DESTRUCTION OR ANONYMIZATION OF PERSONAL DATA

General

The deletion, destruction or anonymization of personal data that has been processed by the DATA CONTROLLER and for which all processing conditions have ceased to exist, i.e., the destruction of personal data, is carried out by the DATA CONTROLLER either ex officio or upon the request of the data subject in accordance with the KVK Law, KVSYH Regulation and this KVSI Policy, using appropriate techniques and in accordance with the general principles of the KVK Law.

Destruction of Data Processed Before the KVK Law

Within the scope of Provisional Article 1/3 of the KVK Law, personal data previously processed by the DATA CONTROLLER shall be brought into compliance with the provisions of the KVK Law and secondary regulations within two years from the date of publication of the law. Personal data that do not comply with the provisions of the law shall be deleted, destroyed or anonymized immediately.

For personal data that has been processed previously and for which explicit consent has not been obtained, or for personal data obtained without requiring explicit consent within the framework of Articles 5 and 6 of the KVK Law, in the event that the data subject submits a request for the deletion, destruction or anonymization of personal data, the data controller shall complete such request within the framework of the procedures and principles set forth in the KVK Law.

On the other hand, consents lawfully obtained by the DATA CONTROLLER before the date of publication of the KVK Law shall be deemed valid for those personal data if no contrary declaration of will is made within one year.

Destruction of Data Processed After the KVK Law

After the entry into force of the KVK Law, the DATA CONTROLLER destroys personal data for which all processing conditions have ceased to exist, and in any case at the end of the maximum retention period specified in this KVSI Policy and/or the KVK Policy, by deletion, destruction or anonymization methods either ex officio during the first periodic destruction process or upon the request of the data subject.

When the data subject applies to the data controller and requests the deletion, destruction or anonymization of their personal data:

a) If all conditions for processing personal data have ceased to exist, the data controller shall delete, destroy or anonymize the personal data that is the subject of the request. The data controller shall conclude the request of the data subject within thirty days at the latest and inform the data subject.

b) If all conditions for processing personal data have ceased to exist and the personal data that is the subject of the request has been transferred to third parties, the data controller shall notify the third party and ensure that the necessary actions are taken within the framework of the KVSYH Regulation.

c) If all conditions for processing personal data have not ceased to exist, the data controller may reject the request by explaining the reason to the data subject in accordance with paragraph 3 of Article 13 of the KVK Law.

Techniques

Regarding the destruction of personal data, the DATA CONTROLLER shall select the appropriate method from among the methods of deletion, destruction or anonymization of personal data ex officio. At the request of the data subject, the data controller shall select the appropriate method by explaining the reason.

Personal Data Destruction Process

In the process to be followed by the DATA CONTROLLER regarding the destruction of personal data, the following operations and activities shall be included in order:

⦁ Determination of personal data subject to destruction,

⦁ Identification of relevant users for each personal data using an access authorization and control matrix or similar system,

⦁ Determination of the access, retrieval, and reuse authorizations and methods of the relevant users,

⦁ Closing and eliminating the access, retrieval, and reuse authorizations and methods of the relevant users within the scope of personal data.

Deletion of Personal Data

The activities and operations for making personal data inaccessible and unusable for relevant users in any way are carried out for each personal data in the relevant recording medium according to the nature of the recording medium, using one or more of the following methods:

⦁ Software Deletion Methods

Personal data processed wholly or partially by automatic means and stored in digital media are deleted from the relevant software by commands that make the data inaccessible and unusable in any way for relevant users. This deletion process is irrevocable if the necessary technical measures are taken by the DATA CONTROLLER. The deleted data can no longer be accessed by the relevant users.

⦁ Expert-Assisted Deletion

In certain cases, the DATA CONTROLLER may appoint an expert to delete personal data on its behalf. In this case, the personal data is deleted by the expert in a way that makes them inaccessible and unusable in any way, and this takes place under the full responsibility of the data controller.

⦁ User-Level Deletion (Blackout Method)

Making personal data inaccessible and unusable for relevant users by redacting and blacking out the data on paper and similar media. This method is applied by physically cutting, painting over, or erasing the personal data area on the document in such a way that it cannot be returned to its original state.

Destruction of Personal Data

The DATA CONTROLLER destroys personal data, making them inaccessible, non-recoverable and unusable by anyone in any way, using one or more of the following methods:

⦁ Physical Destruction

Personal data can also be destroyed by physical means. In this case, the data is made physically inaccessible. Optical and magnetic media data carriers are melted, burned or pulverized to make them physically inaccessible and unusable.

⦁ Demagnetization (Degaussing)

It is the process of corrupting data on magnetic media in an unreadable manner by passing them through a special device that exposes them to a high magnetic field. For this method to be successfully applied, the degausser device used must be suitable for the magnetic media.

⦁ Overwriting

The overwriting method is the process of preventing the recovery of old data by writing random data consisting of at least 7 times of 0s and 1s on magnetic media and rewritable optical media. This process is performed by using special software.

⦁ Encryption and Destruction of Cryptographic Keys

It is the technique of rendering personal data completely inaccessible and meaningless by encrypting them with cryptographic methods and destroying all copies of the encryption keys. The data, whose encryption keys have been destroyed, can no longer be accessed by anyone.

Anonymization of Personal Data

Anonymization of personal data means making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching with other data. The DATA CONTROLLER carries out the anonymization of personal data ex officio or upon the request of the data subject, using appropriate methods in accordance with the KVK Law and KVSYH Regulation.

In order for personal data to be anonymized, the personal data must be made impossible to associate with an identified or identifiable natural person in any way, even by using appropriate techniques in the recording medium, by the data controller or recipient groups, and/or by matching with other data.

Anonymization Methods

The following methods may be applied alone or in combination for the anonymization of personal data:

⦁ Value-Based Anonymization Techniques

⦁ Removing variables: It is the process of removing one or more variables entirely from the table, provided that they are high-risk variables.

⦁ Removing records: It is the method of removing the record containing the data that creates distinctiveness by removing a singular or rare value from the data set.

⦁ Variable reduction: It is the process of reducing the detail of the data to bring it from a high-detail level to a lower level. For example, instead of a specific date of birth, only the year of birth is used.

⦁ Generalization: It is the process of converting special values of personal data into more general values.

⦁ Lower and upper band coding: The lower and upper extreme values of a certain variable are combined and expressed as a category.

⦁ Micro aggregation: In this technique, all records in the data set are first ranked in a meaningful order and then the whole set is divided into a certain number of subsets, and the average of each subset is taken and the set is replaced by the average value.

⦁ Data exchange: It is the process of changing the values of pairs of records selected within the set.

⦁ Noise addition: It is the process of adding or subtracting a randomly selected number in a certain ratio to the values of the selected variable.

Environments for Destruction of Personal Data

The environments in which personal data are stored or kept and the methods to be applied for their destruction are listed below:

⦁ Local Systems

The DATA CONTROLLER destroys personal data recorded or stored in local systems such as servers, desktop computers, portable computers, hard drives, USB memories, CDs, DVDs, data tapes and similar local systems using one or more of the following appropriate methods: software deletion, expert-assisted deletion, physical destruction, overwriting, demagnetization, encryption and destruction of cryptographic keys.

⦁ Centralized/Cloud Server Systems

The DATA CONTROLLER sends deletion commands to the relevant administrator within the relevant application for personal data stored in central server systems and cloud systems. In cases where the deleted data can be retrieved by the relevant user, the system administrator takes the necessary measures to prevent the relevant user from reaccessing the deleted data. One or more of the software deletion, physical destruction and encryption and destruction of cryptographic keys methods are used for centralized systems.

⦁ Portable, Peripheral and Similar Systems

The DATA CONTROLLER destroys personal data recorded or stored in systems such as network switches, main network routers, portable memory media, mobile SIM cards and related fixed memory areas, data recording media, removable printers, fingerprint security access systems and similar peripheral systems, using one or more of the appropriate methods listed in the preceding "local systems" paragraph of this policy.

⦁ Paper Medium

The DATA CONTROLLER destroys personal data stored in permanent and physical paper and microfiche media by cutting them into incomprehensible size pieces, both horizontally and vertically as much as possible, in a manner that cannot be reassembled, using paper shredding or cutting machines.

Personal data that has been transferred from paper format to electronic format by scanning, if any, is also destroyed according to the electronic medium in which it is stored, in accordance with the appropriate methods described in the preceding paragraphs of this policy.

Retention and Destruction Periods

The DATA CONTROLLER keeps personal data for the periods specified in the relevant legislation. If no period is specified in the legislation, personal data are processed for the period required for the purpose for which they are processed. If the purpose for processing personal data has ceased to exist and the retention periods determined by the relevant legislation and the DATA CONTROLLER have expired, personal data may only be stored for the purpose of presenting evidence in possible legal disputes or asserting the relevant right associated with the personal data, or for defense purposes. When determining these periods, the statute of limitations for asserting the relevant right and the retention periods demanded by the DATA CONTROLLER based on past similar requests are taken into account.

If the purpose of processing personal data has ceased to exist, if the applicable statutory limitation periods and the retention periods set by the DATA CONTROLLER have expired, the personal data will be deleted, destroyed, or anonymized by the DATA CONTROLLER either ex officio during the periodic destruction process or upon the request of the data subject.

Periodic Destruction

In cases where all the conditions for processing personal data under the KVK Law have ceased to exist, the DATA CONTROLLER shall ex officio delete, destroy or anonymize personal data at recurring intervals specified in this KVSI Policy. The periodic destruction period has been determined as 6 (six) months by the DATA CONTROLLER. Periodic destruction processes are carried out and recorded in June and December of each year.

4. COMMON PROVISIONS

The DATA CONTROLLER takes all necessary technical and administrative measures to ensure the safe storage and processing of personal data, to prevent unlawful access to personal data, and to destroy personal data in accordance with the law. In this context, the DATA CONTROLLER acts in accordance with the decisions of the KVK Board.

In the event that personal data must be destroyed, the DATA CONTROLLER shall take all necessary measures to prevent the disclosure of personal data in accordance with the technical and administrative measures and policies undertaken within the scope of the KVK Law and shall ensure the destruction of personal data in the environment determined by the KVK Board.

The DATA CONTROLLER keeps records of all transactions related to the deletion, destruction or anonymization of personal data and retains these records for at least three (3) years, excluding other legal obligations.

5. POLICY ANNEXES AND RISK ANALYSIS REPORTS

The annexes listed below are integral parts of this KVSI Policy:

⦁ Personal Data Processing Inventory

⦁ Personal Data Retention and Destruction Period Table

⦁ Information Security Risk Analysis Reports and Records

⦁ Personal Data Destruction Transaction Records

⦁ Data Processing Activities Records

6. UPDATES

This KVSİ Policy shall be reviewed and updated when required by changes in legislation or decisions of the KVK Board, in line with developments in the sector and the field of personal data protection, and changes in the data processing activities of the DATA CONTROLLER.

When any updates are made to this KVSİ Policy, the updates shall be published and announced to the relevant persons by appropriate methods (announcement on the website, e-mail notification, etc.).

7. ENTRY INTO FORCE AND REPEAL

This KVSİ Policy has been prepared by the DATA CONTROLLER and has entered into force as of the date it was published on the website.

When this KVSI Policy is decided to be repealed, the old dated and wet-signed copies (if any) shall be cancelled by the DATA CONTROLLER and stamped/wet-signed and retained for a minimum of 5 (five) years.