PERSONAL DATA RETENTION AND DESTRUCTION POLICY
1.INTRODUCTION
1.1 Purpose
Personal Data Storage and Destruction Policy (“Policy”) has been prepared to determine the procedures and principles regarding the works and transactions regarding the storage and destruction activities carried out by Nizip Commodity Exchange (Exchange or our Exchange) .
In line with the mission, vision and basic principles determined in the strategic plan of our Borsa; It has prioritized the processing of personal data of stock exchange employees, employee candidates, service providers, visitors, members and other third parties in accordance with the Constitution of the Republic of Turkey, international agreements, the Personal Data Protection Law No. 6698 (“Law”) and other relevant legislation and ensuring that relevant persons exercise their rights effectively.
Work and transactions regarding the storage and destruction of personal data are carried out in accordance with the Policy prepared accordingly by our Stock Exchange.
1.2 Scope
Personal data belonging to company employees, employee candidates, service providers, visitors, members and other third parties are within the scope of this Policy, and this Policy applies to all recording environments where personal data owned or managed by Borsa İstanbul is processed and activities related to personal data processing.
1.3 Abbreviations and Definitions
Recipient Group: The category of natural or legal person to whom personal data is transferred by the data controller.
Explicit Consent: Consent regarding a specific subject, based on information and expressed with free will.
Anonymization: Making personal data impossible to associate with an identified or identifiable natural person in any way, even by matching it with other data.
Employee: Our stock exchange staff.
EBYS: Electronic Document Management System Electronic Environment: Environments where personal data can be created, read, changed and written with electronic devices.
Non-Electronic Media: All written, printed, visual, etc. other than electronic media. other environments.
Service Provider: Real or legal person who provides services within the framework of a specific contract with our Stock Exchange.
Relevant Person: The real person whose personal data is processed.
Relevant User: Persons who process personal data within the data controller organization or in line with the authority and instructions received from the data controller, excluding the person or unit responsible for the technical storage, protection and backup of the data.
Destruction : Deletion, destruction or anonymisation of personal data.
Law : Personal Data Protection Law No. 6698.
Recording Environment: Any environment where personal data is processed by fully or partially automatic or non-automatic means, provided that it is part of any data recording system.
Personal Data: Any information regarding an identified or identifiable natural person.
Personal Data Processing Inventory: Personal data processing activities carried out by data controllers depending on their business processes; The inventory they create by associating the personal data with the purposes and legal reason for processing personal data, the data category, the transferred recipient group and the data subject person group, and detailing the maximum retention period required for the purposes for which personal data are processed, the personal data envisaged to be transferred to foreign countries and the measures taken regarding data security.
Processing of Personal Data: All kinds of operations performed on data such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data by fully or partially automatic or non-automatic means provided that it is part of any data recording system.
Personal Data of Special Nature: Data regarding people's race, ethnic origin, political thought, philosophical belief, religion, sect or other beliefs, appearance and dress, association, foundation or union membership, health, sexual life, criminal conviction and security measures, and biometric and genetic data.
Periodic Destruction: The process of deleting, destroying or anonymizing personal data, which is specified in the personal data storage and destruction policy and will be carried out ex officio at recurring intervals, in case all the processing conditions of personal data specified in the law are eliminated.
Policy : Personal Data Retention and Destruction Policy
Data Processor: Real or legal person who processes personal data on behalf of the data controller, based on the authority given by the data controller.
Data Recording System: A recording system in which personal data is structured and processed according to certain criteria.
Data Controller: The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system.
Data Controllers Registry Information System: The information system created and managed by the Presidency, accessible over the internet, that data controllers will use in applying to the Registry and other related transactions related to the Registry.
VERBİS: Data Controllers Registry Information System Regulation: Regulation on Deletion, Destruction or Anonymization of Personal Data published in the Official Gazette dated 28 October 2017.
2. RESPONSIBILITIES AND DUTIES DISTRIBUTION
All units and employees of our Stock Exchange actively support the responsible units in the matters of proper implementation of the technical and administrative measures taken by the responsible units within the scope of the Policy, training and awareness raising of the unit employees, monitoring and continuous supervision, and taking technical and administrative measures to ensure data security in all environments where personal data is processed, in order to prevent the unlawful processing of personal data, to prevent unlawful access to personal data, and to ensure the lawful storage of personal data.
3.RECORDING MEDIA
Personal data is stored securely by Borsa İstanbul in the environments specified below, in accordance with the law.
Personal data storage media:
- Electronic Media, Non-Electronic Media Servers (domain, backup, e-mail, database, web, file sharing, etc.)
- Software (office software,
- Information security devices (firewall, intrusion detection and prevention, log file, anti-virus, etc.)
- Personal computers (Desktop, laptop)
- Mobile devices (phone, tablet, etc.),
- Optical discs (CD, DVD, etc.)
- Removable memories (USB, Memory Card, etc.)
- Printers, scanners, photocopiers,
- Paper,
- Manual data recording systems (survey forms, visitor login book)
- Written, printed, visual media
4. EXPLANATIONS ON STORAGE AND DISPOSAL
By our stock exchange; Personal data of employees, prospective employees, visitors, members and employees of third parties, institutions or organizations with whom we have relations as service providers are stored and destroyed in accordance with the Law.
In this context, detailed explanations regarding storage and disposal are given below.
4.1 Information on Storage
In Article 3 of the Law, the concept of processing personal data is defined, in Article 4, it is stated that the personal data processed should be related to the purpose for which they are processed, limited and proportionate and should be kept for the period foreseen in the relevant legislation or for the period required for the purpose for which they are processed, and in Articles 5 and 6, the processing conditions of personal data are listed.
Accordingly, within the framework of Borsa İstanbul's activities, personal data is stored for a period of time stipulated in the relevant legislation or appropriate for our processing purposes.
4.1.1 Legal Grounds Requiring Retention
Personal data processed within the scope of our Borsa's activities are retained for the period stipulated in the relevant legislation. In this context, personal data;
- the Personal Data Protection Law No. 6698,
- Turkish Code of Obligations No. 6098,
- the Public Procurement Law No. 4734,
- the Civil Servants Law No. 657,
- the Social Insurance and General Health Insurance Law No. 5510,
- Law No. 5651 on the Regulation of Publications Made on the Internet and Combating Crimes Committed Through These Publications,
- Public Financial Management Law No. 5018,
- Occupational Health and Safety Law No. 6331,
- the Right to Information Law No. 4982,
- Law No. 3071 on the Exercise of the Right to Petition,
- the Labour Law No. 4857,
- Higher Education Law No. 2547,
- the Retirement Health Law No. 5434,
- the Social Services Law No. 2828
- Regulation on Health and Safety Measures to be Taken in Workplace Buildings and Extensions,
- Regulation on Archive Services
- Other secondary regulations in force under these laws
It is stored for the specified storage periods.
4.1.2 Processing Purposes Requiring Storage
Our stock exchange stores the personal data it processes within the scope of its activities for the following purposes.
- Carrying out human resources processes.
- Ensuring corporate communication.
- To ensure company security,
- To be able to do statistical studies.
- To be able to carry out work and transactions as a result of signed contracts and protocols.
- To ensure that legal obligations are fulfilled as required or required by legal regulations.
- To contact real/legal persons who have business relations with our stock exchange.
- Making statutory reports.
- The burden of proof as evidence in legal disputes that may arise in the future.
4.2 Reasons Requiring Destruction
Personal data;
- Amendment or abolition of the relevant legislative provisions that constitute the basis for processing,
- Disappearance of the purpose requiring their processing or retention,
- In cases where personal data is processed only on the basis of explicit consent, the relevant person must withdraw his/her explicit consent,
- In accordance with Article 11 of the Law, the application made by the relevant person for the deletion and destruction of his personal data within the framework of his rights is accepted by our Stock Exchange,
- In cases where Borsa İstanbul rejects the application made by the relevant person requesting the deletion, destruction or anonymization of his personal data, finds the answer given insufficient, or does not respond within the period stipulated in the Law; Complaining to the Board and this request being approved by the Board,
- The maximum period requiring personal data to be stored has passed and there are no conditions that justify storing personal data for a longer period of time,
In such cases, they are deleted, destroyed or ex officio deleted, destroyed or anonymized by our Stock Exchange upon the request of the relevant person.
5. TECHNICAL AND ADMINISTRATIVE MEASURES
Technical and administrative measures are taken by our Stock Exchange within the framework of adequate measures determined and announced by our Stock Exchange for special personal data in accordance with Article 12 of the Law and the fourth paragraph of Article 6 of the Law, in order to safely store personal data, prevent unlawful processing and access of them, and destroy personal data in accordance with the law.
5.1 Technical Measures
The technical measures taken by our Exchange regarding the personal data it processes are listed below:
- With penetration tests, risks, threats, vulnerabilities and vulnerabilities, if any, regarding Borsa İstanbul's information systems are revealed and necessary precautions are taken.
- As a result of real-time analysis with information security incident management, risks and threats that will affect the continuity of information systems are constantly monitored.
- Access to information systems and authorization of users are made through the access and authorization matrix and security policies through the corporate active directory.
- Necessary precautions are taken for the physical security of our Borsa's information systems equipment, software and data.
- To ensure the security of information systems against environmental threats, hardware (access control system that allows only authorized personnel to enter the system room, 24/7 monitoring system, ensuring the physical security of the edge switches that form the local area network, fire extinguishing system, air conditioning system, etc.) and software (firewalls, attack prevention systems, network access control, systems that prevent malicious software, etc.) are taken.
- Risks to prevent unlawful processing of personal data are identified, technical measures appropriate to these risks are taken, and technical controls are carried out for the measures taken.
- Access to storage areas containing personal data is logged, and inappropriate access or access attempts are kept under control.
- Our stock exchange takes the necessary measures to ensure that deleted personal data is inaccessible and unusable for relevant users.
- Security vulnerabilities are monitored, appropriate security patches are installed and information systems are kept up to date.
- Strong passwords are used in electronic environments where personal data is processed.
- Secure record keeping (logging) systems are used in electronic environments where personal data is processed.
- Data backup programs are used to ensure safe storage of personal data.
- Access to personal data stored in electronic or non-electronic media is limited according to access principles.
If transfer is made between servers in different physical environments, data transfer is made between the servers by establishing a VPN or using the FTP method. If it is necessary to transfer the document via paper, necessary precautions are taken against risks such as theft, loss or viewing of the document by unauthorized persons, and the document is sent in "confidential" format.
5.2 Administrative Measures
The administrative measures taken by our Exchange regarding the personal data it processes are listed below:
- In order to improve the qualifications of employees, training is provided on preventing unlawful processing of personal data, preventing unlawful access to personal data, ensuring the preservation of personal data, communication techniques, technical knowledge and skills, Law No. 657 and other relevant legislation.
- Employees are required to sign confidentiality agreements regarding the activities carried out by our stock exchange.
- A disciplinary procedure has been prepared for employees who do not comply with security policies and procedures.
- Before starting to process personal data, Borsa İstanbul fulfills its obligation to inform the relevant persons.
- A personal data processing inventory has been prepared.
- Periodic and random audits are carried out within the company.
- Information security training is provided to employees.
6. TECHNIQUES FOR DESTRUCTION OF PERSONAL DATA
At the end of the period stipulated in the relevant legislation or the storage period required for the purpose for which they are processed, personal data are destroyed by Borsa İstanbul ex officio or upon the application of the relevant person, using the techniques specified below, in accordance with the relevant legislation.
6.1 Erasure of Personal Data
Personal data is deleted using the methods described below.
- Personal Data on Servers:
For personal data on the servers whose retention period has expired, the system administrator removes the access authorization of the relevant users and deletes them.
- Personal Data in Electronic Environments:
Among the personal data in the electronic environment, those whose period of storage has expired are made inaccessible and unusable for other employees (relevant users) except the database administrator.
- Personal Data in Physical Environments:
For personal data kept in physical media, for which the period requiring its storage has expired, it is made inaccessible and unusable in any way for other employees, except for the unit manager responsible for the document archive. In addition, blackening is also applied by drawing/painting/erasing the surface so that it cannot be read.
6.2 Destruction of Personal Data
Personal data is destroyed by the methods described below.
- Personal Data in Physical Environments:
Personal data stored on paper that have expired are irreversibly destroyed in paper shredding machines.
- Personal Data on Optical / Magnetic Media:
Personal data contained in optical media and magnetic media whose storage period has expired are physically destroyed, such as melting, burning or pulverizing. In addition, the data on the magnetic media is rendered unreadable by passing it through a special device and exposing it to a high magnetic field.
6.3 Anonymization of Personal Data
Anonymization of personal data means making it impossible to associate personal data with an identified or identifiable natural person in any way, even if it is matched with other data.
In order for personal data to be anonymized; Personal data must be returned by the data controller or third parties and/or made impossible to associate with an identified or identifiable natural person, even through the use of appropriate techniques in terms of the recording environment and relevant field of activity, such as matching the data with other data.
7. STORAGE AND DISPOSAL PERIOD
With regard to the personal data processed by our Exchange within the scope of its activities;
- Personal data-based retention periods for all personal data within the scope of activities carried out depending on the processes are included in the Personal Data Processing Inventory;
- Retention periods based on data categories are recorded in VERBIS;
- Process-based retention periods are in the Personal Data Storage and Destruction Policy.
accordingly.
For personal data whose storage period has expired, the ex officio deletion, destruction or anonymization process is carried out by Borsa İstanbul.
8. PERIODIC DESTRUCTION PERIOD
Our exchange has determined the periodic destruction period as 6 months.
9. PUBLISHING AND STORAGE OF THE POLICY
The policy is published on our website and disclosed to the public on the website. The printed paper copy is also kept in the relevant unit within our Stock Exchange.
10. UPDATED PERIOD OF THE POLICY
The policy is reviewed as needed and necessary sections are updated.
11. ENFORCEMENT AND REPEAL OF THE POLICY
The Policy is deemed to have entered into force after it is published on the website of our Stock Exchange.