Privacy and Data Destruction Policy

MARMARİS MAKİNA YAĞ SANAYİ VE TİCARET ANONİM ŞİRKETİ (Tax No: 6121349345) (FATİH SULTAN MAH. 2700 CAD. ARP KULE BLOK NO: 3 İÇ KAPI NO: 35 ETİMESGUT/ANKARA) POLICY ON THE DESTRUCTION, ERASURE AND ANONYMISATION OF PERSONAL DATA

1. PURPOSE OF THE DESTRUCTION POLICY

The purpose of this Destruction Policy (referred to as the Policy) is to provide a detailed explanation of the procedures for the destruction, erasure or anonymisation of personal data by Marmaris Makina Yağ Sanayi Ve Ticaret Anonim Şirketi (Tax No: 6121349345) (Fatih Sultan Mah. 2700 Cad. Arp Kule Blok No: 3 İç Kapı No: 35 Etimesgut/ANKARA) (“Marmaris Makina”) ex officio or upon the request of the data subject, in accordance with the Regulation on the Deletion, Destruction or Anonymisation of Personal Data published in the Official Gazette dated 28/10/2017 (the Regulation), in the event that the conditions for processing personal data set out in Articles 4, 5 and 6 of Law No. 6698 on the Protection of Personal Data (the Law) cease to exist.

2.DEFINITIONS

 Recipient Group: Natural or legal persons to whom personal data are transferred by the data controller.

Explicit Consent: Consent that is based on information, relates to a specific subject, and is declared freely and voluntarily.

Anonymisation: Rendering personal data incapable of being associated with an identified or identifiable natural person, even through matching with other data.

Employee: Natural persons working for our Company under a contractual relationship.

Electronic Environment: Environments where personal data can be created, read, modified and written using electronic devices.

Non-Electronic Environment: All written, printed, visual and other environments other than electronic environments.

Service Provider: Natural or legal persons providing services to our Company within the framework of a contractual relationship with our Company.

Data Subject: The natural person whose personal data are processed.

Destruction: The deletion, destruction or anonymisation of personal data.

Law: Law No. 6698 on the Protection of Personal Data.

Recording Environment: Any environment where personal data are processed by fully or partially automated means or by non-automated means provided that they are part of any data recording system.

Personal Data: Any information relating to an identified or identifiable natural person.

Personal Data Processing Inventory: The inventory created by data controllers detailing their personal data processing activities based on their business processes, by associating personal data with processing purposes, data categories, transferred recipient groups, and data subject groups, and explaining the maximum period required for the purposes for which personal data are processed, personal data intended to be transferred abroad, and the measures taken regarding data security.

Processing of Personal Data: Any operation performed on personal data, such as obtaining, recording, storing, preserving, modifying, reorganising, disclosing, transferring, taking over, making available, classifying, or preventing the use of data, by fully or partially automated means or by non-automated means provided that they are part of any data recording system.

Board: The Personal Data Protection Board.

Sensitive Personal Data: Data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance, membership of associations, foundations or trade unions, health, sexual life, criminal convictions, and security measures, as well as biometric and genetic data.

Periodic Destruction: The deletion, destruction or anonymisation process carried out ex officio at recurring intervals specified in the personal data storage and destruction policy, in the event that all conditions for processing personal data under the Law cease to exist.

Policy: The Personal Data Storage and Destruction Policy.

Data Processor: A natural or legal person who processes personal data on behalf of the data controller, based on the authorisation granted by the data controller.

Data Recording System: The recording system where personal data are structured and processed according to specific criteria.

Data Controller: The natural or legal person who determines the purposes and means of processing personal data, and is responsible for the establishment and management of the data recording system.

Data Controllers' Registry Information System: The information system established and managed by the Authority, accessible via the internet, which data controllers will use for registry applications and other related transactions. (VERBIS)

Regulation: The Regulation on the Deletion, Destruction or Anonymisation of Personal Data published in the Official Gazette dated 28 October 2017.

3. RECORDING ENVIRONMENTS

Personal data are securely stored in the recording environments shown in the table below, by lawful means and by taking all necessary measures:

4. EXPLANATIONS REGARDING STORAGE AND DESTRUCTION

Personal data obtained by Marmaris Makina regarding employees, job applicants, service providers, customers, visitors, clients, and third parties or their employees with whom a contractual relationship is established, for commercial purposes, are stored only for the periods specified in accordance with the Law, and are destroyed in accordance with the Law.

Legal Grounds Requiring Storage: Personal data disclosed to Marmaris Makina by data subjects are stored for the following reasons:

• The personal data are directly related to the establishment and performance of contracts,
• The personal data are necessary for the establishment, exercise or protection of a right,
• The storage of personal data is within the legitimate interest, provided that it does not harm the fundamental rights and freedoms of individuals,
• The storage of personal data is mandatory for the fulfilment of any legal obligation,
• The personal data have been made public by the data subject,
• Storage is explicitly prescribed by law,
• There is explicit consent of data subjects for storage activities that require obtaining explicit consent.

Legal Grounds Requiring Destruction: Pursuant to the Law, the Regulation and Board decisions, personal data belonging to data subjects shall be deleted, destroyed or anonymised ex officio or upon request in the following cases:

• The provisions of the relevant legislation that form the basis for processing personal data are amended or repealed,
• The purpose requiring the processing or storage of personal data ceases to exist,
• In cases where processing personal data is based solely on the condition of explicit consent, the data subject withdraws their explicit consent,
• The natural person's request for deletion or destruction of their personal data is accepted by the Board pursuant to Article 11 of the Law, or the Board accepts the natural person's destruction request based on another legal reason,
• The maximum period required for storing personal data has expired, and there is no reason to justify storing the personal data for a longer period.

5.MEASURES TAKEN FOR THE PRESERVATION OF PERSONAL DATA

For the lawful preservation of personal data, Marmaris Makina takes adequate measures determined by the Board for personal data, as well as technical and administrative measures, as required by Article 12 and paragraph 4 of Article 6 of the Law. These measures are regulated in the Policy, and if, despite all measures, data is accessed through unlawful means, the relevant department and the Board are notified immediately.

• Technical Measures:
  • Appropriate technical measures are taken for storage, destruction and against data leakage, in line with technological infrastructures. These measures are periodically updated and renewed as needed.
  • Personnel are employed to provide support on technical issues, and training is provided to ensure alignment with technical updates.
  • Necessary protective software is provided to prevent malicious software from compromising the privacy of personal data and violating legal obligations; their updates and reliability are tested at regular intervals.
  • Access of Marmaris Makina employees to personal data is limited within the scope of the “need-to-know” principle.
  • Marmaris Makina security systems are tested regularly.
  • The destruction of personal data is carried out in a way that is irreversible with any technological tool.

5.2 Administrative Measures:

• A personal data processing inventory has been prepared.
• Marmaris Makina has employees sign confidentiality agreements.
• Marmaris Makina fulfills its obligation to inform data subjects before processing personal data.
• Before processing sensitive personal data, Marmaris Makina requests and verifies the existence of explicit consent from the data subjects.
• While Marmaris Makina’s activities continue, both periodic and unplanned/spot audits are conducted.
• Marmaris Makina provides in-service training to its employees within the scope of the Law.
• Marmaris Makina announces the principles and policies adopted under the Law to service recipients, providers, third parties and its personnel through printed publications and electronic means.

6. MEASURES TAKEN FOR THE DESTRUCTION OF PERSONAL DATA

At the end of the period prescribed by legislation or the storage period necessary for the purpose for which they are processed, personal data are destroyed by Marmaris Makina ex officio or upon the request of the data subject, using the techniques specified below, in accordance with the relevant legislation.

Marmaris Makina may use one or more of the methods specified in the tables below for deleting, destroying or anonymising personal data, depending on the environment in which the data are recorded:

• Deletion of Personal Data

• Destruction of Personal Data

• Anonymisation of Personal Data

 Anonymisation of personal data means rendering them incapable of being associated with an identified or identifiable natural person, even through matching with other data. When necessary, Marmaris Makina renders the data incapable of being associated with an identified or identifiable natural person, even through means such as reversal by third parties or matching with other data.

7. PERSONAL DATA STORAGE AND DESTRUCTION PERIODS

If a period is prescribed by legislation for the storage of the relevant personal data, that period is complied with. If no period is prescribed by legislation, personal data will be stored for the maximum period required for storage of personal data as shown in the table, and will be destroyed during the first periodic destruction period following the end of that period.

8. COMPANY PERIODIC DESTRUCTION PERIOD

 Marmaris Makina’s periodic destruction period is 6 months. Personal data whose storage period has expired are destroyed within the framework of the destruction periods set out in this Policy, at 6-month intervals, in accordance with the procedures specified in this Policy.

9. PUBLICATION AND PRESERVATION OF THE POLICY

 The Policy is published in two environments: printed paper and electronic media. It is made available to the public on the Marmaris Makina website, and any relevant person may request the Policy to be sent to them via their official e-mail address.

10. UPDATING THE POLICY

 The Policy is reviewed as needed, and necessary sections are updated and announced.

11. ENTRY INTO FORCE

This Policy enters into force on 22.09.2021 and is announced.