ALKIŞ TURİZM

PERSONAL DATA STORAGE AND DESTRUCTION POLICY

Personal Data Storage and Destruction Policy (“Policy”), Personal Data Protection Law No. 6698 (“KVKK”) and Regulation on Deletion, Destruction or Anonymization of Personal Data (“Regulation”) It has been prepared by Alkış Turizm (“Company”), as the data controller, in order to determine the procedures and principles subject to our obligations in accordance with our obligations and to inform data owners about the principles of determining the maximum storage period required for the purpose for which personal data is processed and the deletion, destruction and anonymization processes. business partners, employees, shareholders and officials of the institutions we cooperate with, subcontractors and suppliers, and third parties.

The Policy is applied in the activities carried out for the processing and protection of all personal data managed by our Company.

This policy is published on our company's website (www.alkistur.com) and can be accessed by relevant persons upon the request of personal data owners

In the implementation of this Policy, its category,

Relevant Person: Except for the person or unit responsible for the technical storage, protection and backup of data, persons who process personal data within the data controller organization or in accordance with the authority and instructions received from the data controller, Destruction: Deletion, destruction or anonymization of personal data, Law: Personal Data Protection Law No. 6698, Recording medium: Any environment containing personal data processed by fully or partially automatic or non-automatic means provided that it is part of any data recording system, Personal data: Any information regarding an identified or identifiable natural person, Personal data owner: The natural person whose personal data is processed, Processing of personal data: Obtaining personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system, All kinds of operations carried out on data such as recording, storing, preserving, changing, reorganizing, disclosing, transferring, taking over, making available, classifying or preventing their use, Personal data processing inventory:The personal data processing activities carried out by data controllers depending on their business processes, the purposes of processing personal data, the data category, the maximum period required for the purposes for which the personal data are processed by associating them with the transferred recipient group and the data subject group of persons, the maximum period required for the purposes for which the personal data is processed, and the transfer to foreign countries. The inventory detailed by explaining personal data and measures taken regarding data security, Board: Personal Data Protection Board, Institution:Personal Data Protection Board, Special categories of personal data:Persons' race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and attire, association, foundation or union membership, health, sexual life, criminal conviction and data related to security measures and biometric and genetic data, Periodic destruction:In case all of the personal data processing conditions specified in the law are eliminated, the deletion, destruction or anonymization process that will be carried out ex officio at recurring intervals specified in the personal data storage and destruction policy, Data Storage and Destruction Policy:This Policy, on which the data controllers base the deletion, destruction and anonymization process, with the process of determining the maximum period required for the purpose for which personal data are processed, Protection, Processing and Privacy Policy of Personal Data:The policy that determines the procedures and principles regarding the management of personal data, located on the company's website, Registry: The data controllers' registry kept by the Personal Data Protection Authority, Data processor:The real and legal person who processes personal data on behalf of the data controller based on the authority given by the data controller, Data recording system:Certain data of personal data. Data controller:Refers to the real or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system. For definitions not included in this Policy, the definitions in the Law apply.

All unit managers of the company provide effective support to the proper implementation of technical and administrative measures regarding the processing, storage and destruction of personal data in their units. For this purpose, unit managers; It ensures the training and awareness raising of unit employees, monitors and supervises transactions, helps prevent unlawful processing of personal data and unlawful access to processed data, and helps take and implement technical and administrative measures for data security.

By increasing the knowledge and awareness of relevant users about the protection of personal data, it actively supports the processing, storage and destruction of personal data in accordance with the legislation. The titles, units and job descriptions of those involved in the storage and destruction processes of personal data are as follows: General Manager: As the representative of the data controller, he is responsible for carrying out all transactions and implementing the policy regarding the protection and destruction of personal data. Human Resources Manager: Responsible for the preparation, development, execution, publication and updating of the policy in relevant media, ensuring that the processes within its scope comply with the retention period, and the management, training and information of the personal data destruction process in accordance with the periodic destruction period. Accounting Manager: Responsible for preparing, developing, executing the policy, publishing and updating it in relevant media, ensuring that the processes within its scope comply with the retention period, and managing the personal data destruction process in accordance with the periodic destruction period. Information Systems Manager: Responsible for the technical storage, protection and backup of data, and for determining and implementing the technical solutions needed to implement the policy. Other Unit Managers: They are responsible for implementing the policy in their own units, monitoring and supervising the implementation, ensuring that the processes within their duties comply with the retention period, and managing the personal data destruction process in accordance with the periodic destruction period. Relevant Users and Data Processors: They are responsible for ensuring that the procedures regarding data processing and storage comply with the procedure and law. Specially Authorized Relevant User: Responsible for protecting and storing the personal data deleted upon the request of the relevant person or the procedure until it is destroyed and not accessed by the relevant users.

Personal data stored by the company is kept in a recording environment appropriate to the nature of the relevant data. The recording media used to store personal data are listed below. On the other hand, personal data may be stored in a different environment than those specified here due to their nature. In any case, the data controller company processes and protects personal data within the framework of international data security principles in accordance with the Law, the Personal Data Protection, Processing and Privacy Policy and this Personal Data Storage and Destruction Policy.

Electronic Environments; Servers, portable disks, software, information security devices, employee computers, optical disks, removable memories, printers, scanners and photocopiers are other digital media. Physical Environments; Paper are other media where data such as manual data recording systems, written, printed and visual media are kept by printing on paper or microfilm. Cloud Environments; Although they are not owned by the company, they are environments where encrypted internet-based systems are used by the company.

All administrative and technical measures taken within the framework of the principles in Article 12 of the KVKK in order to safely store your personal data, prevent unlawful processing, access and lawful destruction of the data are stated below.

Technical Measures

The following technical measures are taken in accordance with the characteristics of all environments where personal data is stored, the relevant data and the environment where the data is kept: Only up-to-date and secure systems compatible with technological developments are used in environments where personal data is kept. Security systems are used for environments where personal data is kept. Security tests and research are carried out to detect security vulnerabilities on information systems, and current or potential risks identified as a result of the tests and research are eliminated. By restricting access to the environments where personal data is kept, only authorized persons are allowed to access these data, limited to the purpose of storing personal data, and all access is recorded. In restricting access, whether the data is of special nature and its degree of importance are also taken into account. The company has sufficient technical personnel to ensure the security of the environments where personal data is kept. It ensures that the access rights of employees in information technology units to personal data are kept under control. The destruction of personal data is ensured in a way that cannot be recycled and does not leave an audit trail. In accordance with Article 12 of the Law, any digital environment where personal data is stored is protected by encrypted methods to meet information security requirements.

Administrative Measures

The following administrative measures are taken in accordance with the characteristics of all environments where personal data are stored, the relevant data and the environment where the data is kept: Work is carried out to increase and raise awareness of all company employees who have access to personal data on information security, personal data and privacy of private life. Legal and technical consultancy services are received to follow the developments in the field of information security, privacy of private life and protection of personal data and to take the necessary actions. If personal data is transferred to third parties due to technical or legal requirements, protocols are signed with the relevant third parties to protect personal data, and all necessary care is taken to ensure that the relevant third parties comply with their obligations in these protocols. If the processed personal data is obtained by others through illegal means, it notifies the relevant person and the Board as soon as possible. It carries out the necessary inspections and has them carried out in order to ensure the implementation of the provisions of the Law within the company. It eliminates privacy and security vulnerabilities that arise as a result of audits.

Personal data belonging to data owners are stored securely in physical or electronic environments by the company within the limits specified in KVKK and other relevant legislation, especially for the purpose of continuing commercial activities, fulfilling legal obligations, planning and fulfilling employee rights and benefits, managing customer relations and for other purposes stated in the Personal Data Protection, Processing and Privacy Policy. Personal data held by the Company is deleted, destroyed or anonymized ex officio in accordance with this destruction policy upon the request of the relevant person or if the reasons listed in Articles 5 and 6 of the Law are eliminated. The reasons listed in Articles 5 and 6 of the Law are as follows:

It is clearly provided for in the law. It is necessary for the protection of the life or physical integrity of the person or someone else who is unable to express his/her consent due to actual impossibility or whose consent is not given legal validity. It is necessary to process personal data of the parties to the contract, provided that it is directly related to the establishment or performance of a contract. It is mandatory for the data controller to fulfill its legal obligation. It has been made public by the person concerned. Data processing is mandatory for the establishment, exercise or protection of a right. It is necessary to process data for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the person concerned.

The procedures and principles regarding the deletion and destruction techniques of personal data by the Company are listed below.

DELETION OF PERSONAL DATA

Blacking of Personal Data on Paper: It is a method of physically cutting the personal data on the relevant document and removing it from the document or making it invisible by using fixed ink in a way that is irreversible and unreadable with technological solutions. Secure Deletion from Software:It is a method of deleting personal data stored in the cloud or local digital environment and making it inaccessible again.

DESTRUCTION OF PERSONAL DATA

Physical Destruction: A system of physical destruction of personal data so that it cannot be used later is implemented. Documents in paper form are destroyed by shredder machines so that they cannot be reassembled. Optical and magnetic media containing personal data are physically destroyed such as melting, burning or pulverization. De-magnetization:It is a method of corrupting the data on the magnetic media in an unreadable way by passing it through special devices where it is exposed to high magnetic fields. Overwriting:It is a destruction method that eliminates the ability to read and recover old data by writing random data consisting of 0s and 1s at least seven times on magnetic media and rewritable optical media through special software.

ANONIMIZATION OF PERSONAL DATA

Removing variables: It is the method of anonymization by removing the highly descriptive variables in the data set created after the data collected about the relevant person is brought together. Regional hiding:If a single data has a deterministic nature because it creates a very less visible combination, hiding the relevant data provides anonymization. It is the process of deleting potentially distinctive information about the exceptional data. Generalization:It is the process of bringing together personal data of many people, removing their distinctive information and turning them into statistical data. Lower and Upper Bound Coding: It is a method of anonymizing the values in a data group containing predefined categories by combining them by determining a certain criterion. Micro merging: All data is first arranged in a meaningful order, divided into groups, and the value obtained by taking the average of the groups is written instead of the relevant data in the current group, thus anonymization is achieved. Data hashing and corruption:Direct or indirect identifiers in personal data are mixed with other values or corrupted, thus severing their relationship with the relevant person and causing them to lose their identifying qualities.

10- Storage and Destruction Periods

PROCESS	STORAGE PERIOD	DESTRUCTION TIME
Recruitment documents submitted to the Social Security Institution; Personal data based on notifications regarding length of service and salary	It is kept for 10 years during the continuation of the service contract and from the beginning of the calendar year following its expiration.	Within 180 days following the end of the storage period
Recruitment documents submitted to the Social Security Institution; Personnel data other than personal data based on notifications regarding length of service and wages	It is kept for 10 years during the continuation of the service contract and from the beginning of the calendar year following its termination	Following the end of the storage period
Data in Workplace Personal Health File	Keeped during the continuation of the service contract and for 10 years from its termination	Within 180 days
Occupational health and safety practices	It is kept for 10 years following the termination of the business relationship.	Within 180 days following the end of the storage period
Answering court/enforcement information requests regarding personnel	It is kept for 10 years following the termination of the business relationship.	Within 180 days following the end of the storage period
		Storage

Personnel Financing Processes	Keeped for 10 years following the termination of the business relationship.	within 180 days following the end of the period
Identity information, contact information, financial information, Business Partner/Solution Partner/Consultant employee data regarding the conduct of the commercial relationship between the Business Partner/Solution Partner/Consultant and the company	It is kept for 10 years during and after the termination of the business/commercial relationship with the company, in accordance with the Turkish Code of Obligations Art. 146 and the Turkish Commercial Code Art. 82.	Within 180 days following the end of the storage period
Visitor's name, surname, vehicle license plate and camera records taken at the entrance to the physical spaces,	Stored for 2 years.	Within 180 days following the end of the storage period
Information in the Employee Candidate's CV and job application form	It is kept until the CV loses its current date, for a maximum of 2 years.	Within 180 days following the end of the storage period
Information in the intern's internship file	As of the beginning of the calendar year following the continuation and termination of the internship relationshipIt is also stored for 10 years.	Within 180 days following the end of the storage period
Customer's name, surname, ID number, contact information, payment information and methods, product/service preferences, transaction history,	From the presentation of each product/service purchased by the Customer, it is stored for 10 years in accordance with Turkish Code of Obligations Art. 146 and Turkish Commercial Code Art. 82.	Within 180 days following the end of the storage period
Identity information, contact information, financial information obtained during contract negotiations regarding the establishment of a commercial relationship between the Potential Customer and the company,	Stored for 2 years.	Within 180 days following the end of the storage period
Collaborating institutions, companies and	Business/commercial relationship with the company	Storage

identity information, contact information, financial information, institution, company and customer employee data with which the company cooperates, regarding the conduct of commercial relations between customers and the company	It is kept for 10 years during and after its expiry in accordance with Turkish Code of Obligations Art.146 and Turkish Commercial Code Art.82.	within 180 days following the end of the period
Planning and Execution of Corporate Communication Activities	It is kept for 10 years following the termination of the business relationship.	Within 180 days following the end of the storage period
Other Data Required to be Processed for the Establishment or Performance of a Contract or Processed Within This Scope	It is kept for 10 years during and after the business/commercial relationship with the company, in accordance with Turkish Code of Obligations Art. 146 and Turkish Commercial Code Art. 82.	Within 180 days following the end of the storage period
Information about company partners and board members	Stored for 10 years.	Within 180 days following the end of the storage period
Accident Reporting	Stored for 10 years.	Within 180 days following the end of the storage period
Document preparation	Stored for 10 years.	Within 180 days following the end of the storage period
Filing of training records	Stored for 10 years.	Within 180 days following the end of the storage period

Although no period has been determined for the storage of personal data within the scope of the law.

However, in accordance with general principles, it is essential that personal data be kept for the period stipulated in the relevant legislation or for the period required for the purpose for which they are processed. In order to determine retention periods in accordance with the said principle, the Data Controller Company makes an evaluation based on the legislation in force regarding each data processing process and the purpose of the process. It may be regulated for a longer period of time in accordance with the legislation or there may be statute of limitations, limitation period, retention periods, etc. in accordance with the legislation. If a longer period is stipulated for storage, the periods in the legislation are considered as the maximum storage period. In this regard, personal data is stored at least until the period required by legal obligations and the statute of limitations subject to the relevant Law expires. Personal data may be stored in case of any dispute that may arise between you and the Data Controller, in order to provide the necessary defenses within the scope of the dispute. When the purpose of processing the relevant personal data disappears within the scope of any process, including the expiration of the mentioned periods, personal data is anonymized, deleted or destroyed in accordance with the Law.

Personal data whose storage period has expired or the purpose of storage has ceased to be deleted, destroyed or anonymized by being destroyed every six months through a process specified in this Personal Data Storage and Destruction Policy and to be carried out ex officio at recurring intervals

Periodic destruction is also carried out in January and July of each year.

Our Company makes the necessary assignments within the Company in order to fulfill the obligations in the KVK Law and to implement the issues specified in this Policy and creates procedures accordingly.

Possible changes in the company activities and processed personal data groups, changes to be made in the legal legislation and the principle decisions of the Personal Data Protection Board are followed, and this policy is reviewed according to the need and the necessary sections are updated, changed or changed. is recreated

Clarification Text