The Personal Data Storage and Disposal Policy (Policy) includes the technical and administrative measures to be taken by the Directorate of Rotary Capital Management Of Istanbul Ataturk Culture Centre (AKM) while obtaining data from personal data owners (Data Subjects). AKM reserves the right to update the text of the Policy at any time within the framework of the changes that can be made in the current legislation.

Purpose

AKM brings it to the attention of our visitors, participants and employees and other third parties, in order to fulfill its obligation of disclosure arising from the Policy and Article 10 of Personal Data Protection Law No. 6698 ("Law").

Scope

Personal data of visitors, participants, employees, employee candidates, collaborators and all other third parties are covered by the Policy. The Policy will be applied in all recording media obtained and in activities related to personal data processing.

Definitions

Explicit consent  means freely given, specific and informed consent,

Anonymization means rendering personal data impossible to link with an identified or identifiable natural person, even through matching them with other data,

Data subject (natural person concerned) means the natural person, whose personal data are processed,

Personal data means any information relating to an identified or identifiable natural person,

Processing of personal data means any operation which is performed on personal data, wholly or partially by automated means or non-automated means which provided that form part of a data filing system, such as collection, recording, storage, protection, alteration, adaptation, disclosure, transfer, retrieval, making available for collection, categorization, preventing the use thereof,

Board means the Personal Data Protection Board,

Authority means the Personal Data Protection Authority,

Data Processor means the natural or legal person who processes personal data on behalf of the data controller upon its authorization,

Data filing system means the system where personal data are processed by being structured according to specific criteria,

Data Controller means the natural or legal person who determines the purposes and means of processing personal data and is responsible for the establishment and management of the data filing system.

2. DISTRIBUTION OF RESPONSIBILITIES AND DUTIES

All units and employees of AKM will take technical and administrative measures as specified in this Policy, Law and relevant legislation during the processing, storage and destruction of data obtained from Data Subjects, and will prevent the unlawful processing of data of Data Subjects and ensure their security.

3. RECORDING ENVIRONMENTS

Personal Data are stored by AKM in electronic and non-electronic media.

Electronic media are as follows.

• Servers
• Software
• Information security devices
• Personal computers
• Mobile devices
• Optical discs
• Removable memories

Non-electronic Media

• Manual data recording systems
• Written, printed media

4. EXPLANATIONS ON STORAGE AND DISPOSAL

Legal Reasons for Retaining and Processing Purposes

Personal data is collected and processed within the framework of Articles 5 and 6 of the Law and the provisions of the relevant legislation, due to the legal reason that it is compulsory for the legitimate interests of the Data Controller, taking care not to harm the fundamental rights and freedoms of the Data Subject.

Personal data collected from Data Subjects are processed for the following reasons within the scope of the services carried out within the Atatürk Culture Centre and within the framework of Articles 5 and 6 of the Law. Personal data are processed for the purposes of,

• Management and execution of services, events, organizations and projects carried out by AKM,
• Carrying out processes of events and fulfilling obligations such as organizing events, and communicating with participants,
• Access to the contact information allowed for the purpose of informing, promoting and marketing the products and services offered by AKM through communication channels,
• Publishing the oral, written, visual and audio recordings obtained within the scope of the events offered by AKM,
• Customizing the services and products offered by AKM according to the preferences of the Data Subject,
• Conducting studies, surveys, social media studies,
• Sharing images of events and meetings to AKM on physical and digital platforms,
• Carrying out the processes of receiving, evaluating and finalizing the requests, complaints, opinions and suggestions of the Data Subjects,
• Fulfillment of public security and legal obligations within the scope of all activities and services carried out.
• Ensuring the security and control of physical spaces belonging to AKM with camera recording and other systems
• Using it as evidence in legal disputes that may arise in the future and fulfilling the burden of proof

Reasons for Disposal

Personal data is destroyed for the following reasons.

• Required by Article 138 of the Turkish Criminal Code,
• Required by Article 7 of Personal Data Protection Law
• Required by the Regulation on the Deletion, Destruction and Anonymization of Personal Data
• Despite the fact that it is processed in accordance with the provisions of the law, the reasons that require it to be processed disappear,
• Upon the request of the Data Subject, if AKM evaluates the request and decides in line with the request,
• In cases where the processing of personal data takes place only on the basis of explicit consent, the data subject withdraws his explicit consent.

In such cases, the data is deleted, destroyed or anonymized by AKM upon the request of the Data Subject.

5. TECHNICAL AND ADMINISTRATIVE MEASURES

AKM takes technical and administrative measures to ensure the legal processing and protection of personal data.

Technical Measures

All necessary technical measures have been taken for all kinds of internal and external attacks.

Administrative Measures

• All processes of personal data processing, storage and destruction are carried out in accordance with the law.
• AKM employees are informed about the protection and legal processing of personal data.
• The signed contracts include data security and confidentiality provisions.
• Access rights to physical and digital media containing personal data are limited.
• Periodic audits are carried out for the institution.

6. PERSONAL DATA DISPOSAL TECHNIQUES

In cases where the situations specified in article 4 of the Policy and the laws occur and the destruction of data is required, the destruction processes are carried out with the methods specified below. According to By-Law on Erasure, Destruction or Anonymization of Personal Data;

• Erasure of personal data : Erasure of personal data is the process of rendering personal data inaccessible and non-reusable for the users concerned, by no means.
• Destruction of personal data : Destruction is the process of rendering personal data inaccessible, irretrievable or non-reusable by anyone, by no means.
• Anonymization of personal data : Anonymization is the process of rendering personal data impossible to link with an identified or identifiable natural person, even though matching them with other data.

7. STORAGE AND DISPOSAL DURATIONS

Personal data processed by AKM are kept for a suitable period for the purpose of processing and then they are destroyed. AKM has planned a periodical destruction period twice a year and this information is stated in the AKM Personal Data Retention and Disposal Policy document. On the other hand, if Data Subject requests for personal data to be deleted or withdraws the Explicit Consent that is given before, the personal data will be destroyed without waiting for the periodic destruction period.

Laws Including Duration of Personal Data
Source Of Personal Data	Duration	Legal Basis
Call Center Audio Recordings	3 Years	Law No. 6563 and Related Legislation
Membership and Reservation Records	10 Years	Law No. 6098
All Records Related to Accounting and Financial Transactions	10 Years	Law No. 6102, Law No. 213
Cookies and Logs	6 Months – Up to 2 years	Law No. 5651
Commercial Electronic Mail Confirmation Records	1 Year from the date of withdrawal of consent	Law No. 6563 and Related Legislation
Information on Online Visitors	2 Years	Law No. 5651
Personal Data About Customers	3 years within the framework of Law No. 6563 and related legislation, 10 Years after the legal relationship ends	Law No. 6563, Law No.  6102, Law No. 6098, Law No. 213, Law No. 6502
Personal Data About Suppliers	10 Years after the legal relationship ends	Law No. 6102, Law No. 6098, Law No. 213
Personal Data Protection Board Transactions	10 Years	Personal Data Storage and Disposal Policy Published by the Personal Data Protection Board
Contracts	10 years after the termination of contract	Personal Data Storage and Disposal Policy Published by the Personal Data Protection Board
Communication Activities	10 years after the activity ends	Personal Data Storage and Disposal Policy Published by the Personal Data Protection Board
Processes of Human Resources	10 years after the activity ends	Personal Data Storage and Disposal Policy Published by the Personal Data Protection Board
Hardware and Software Access Processes	2 Years	Personal Data Storage and Disposal Policy Published by the Personal Data Protection Board
Registration of Visitors and Meeting Users	2 years after the event ends	Personal Data Storage and Disposal Policy Published by the Personal Data Protection Board
Camera Recordings	2 Years	Personal Data Storage and Disposal Policy Published by the Personal Data Protection Board
Data stored under labor law	5 years from the end of the employment relationship	Law No. 4857 and Related Legislation
Data on Personal Files Stored under the Labor Law	10 years from the end of the employment relationship	Law No. 4857 and Related Legislation, Law No. 6098
Data that may be subject to union compensation from data stored under the Labor Law	10 years from the end of the employment relationship	Law No. 6098
Data Collected within the Scope of Occupational Health and Safety Legislation	15 years from the end of the employment relationship	Communique No. 6331
Data kept within the scope of SSI Legislation	10 years from the end of the employment relationship	Law No. 5510 and Related Legislation

8. PERIODIC DESTRUCTION DURATION

Since the period of periodic destruction is determined as 6 months according to Article 11 of By-Law on Erasure, Destruction or Anonymization of Personal Data, AKM carries out actions in this direction.

9. OTHER RIGHTS OF THE RELATED PERSON ENUMERATED IN ARTICLE 11 OF THE LAW

In accordance with Article 11 of the Law, each person has the right to request to the Data Controller about him/her;

• To learn whether his/her personal data are processed or not,
• To demand for information as to if his/her personal data have been processed
• To learn the purpose of the processing of his/her personal data and whether these personal
• Data are used in compliance with the purpose,
• To know the third parties to whom his personal data are transferred in country or abroad,
• To request the rectification of the incomplete or inaccurate data, if any,
• To request the erasure or destruction of his/her personal data under the conditions referred to in article 7,
• To request reporting of the operations carried out pursuant to sub-paragraphs (d) and (e) to third parties to whom his/her personal data have been transferred,
• To object to the occurrence of a result against the person himself/herself by analysing the data processed solely through automated systems,
• To claim compensation for the damage arising from the unlawful processing of his/her personal data.

10. ENFORCEMENT AND REVOCATION OF THE POLICY

The policy is deemed to have entered into force as of the date it is published on the AKM website. AKM reserves the right to update the text of the Policy at any time within the framework of the changes that can be made in the current legislation.