Purpose and scope
This policy sets out the procedures and principles for the retention and destruction of personal data processed by Elit Restorasyon İnşaat Taahhüt Sanayi ve Ticaret Anonim Şirketi (the "Company"), in accordance with Law No. 6698 on the Protection of Personal Data and the Regulation on the Erasure, Destruction or Anonymization of Personal Data. It covers the data of customers, website visitors, job applicants, and business partners.
Definitions
| Deletion | Rendering personal data inaccessible and unusable in any way for the relevant users. |
|---|---|
| Destruction | Rendering personal data inaccessible, irretrievable and unusable by anyone in any way. |
| Anonymization | Rendering personal data impossible to associate with an identified or identifiable person, even when matched with other data. |
| Periodic destruction | The ex officio deletion, destruction or anonymization of data whose retention period has expired, at the intervals specified in this policy. |
Storage media
- The website's database and file servers (hosting service in Turkey),
- Company computers, email accounts and backup media,
- Accounting and e-invoicing software,
- Paper-based quotations, contracts, invoices, job forms and petitions (kept in locked cabinets).
Reasons Requiring Retention and Destruction
Personal data is retained for the performance of the contract, the fulfillment of legal obligations, the protection of rights in the event of potential disputes, and for the periods prescribed in the relevant legislation. Where the purpose of processing no longer exists, the retention period under the relevant legislation expires, explicit consent is withdrawn, or the data subject makes a justified request, the data is deleted, destroyed, or anonymized.
Retention and destruction periods
| Data / process | Retention period | Time of destruction |
|---|---|---|
| Business, invoice, accounting and payment records | 10 years (Turkish Commercial Code, Tax Procedure Law) | First periodic destruction following the end of the period |
| Service agreement and warranty records | For the duration of the warranty and 10 years from its expiry | First periodic destruction following the end of the period |
| Contact form, quotation and support requests | 2 years from the conclusion of the request | First periodic destruction following the end of the period |
| Customer reviews and reference photos | For as long as they remain published; 1 year from withdrawal of consent | First periodic destruction following the end of the period |
| Internet traffic (log) records, IP address | 2 years (Law No. 5651) | First periodic destruction following the end of the period |
| Form submission and security records | Maximum 1 year | Automatic nightly cleanup |
| Commercial electronic message consent records | 3 years from withdrawal of consent | First periodic destruction following the end of the period |
| Cookies | Session duration up to a maximum of 2 years, depending on the cookie type — see Cookie Policy | When the period expires in the browser |
| Job applications and résumés | 1 year from the application (earlier if requested by the applicant) | First periodic destruction following the end of the period |
Destruction methods and periodic destruction
- Electronic media: irreversible deletion of database records, secure deletion of files, and anonymization of data kept for statistical purposes.
- Paper media: shredding documents with a document shredder so that they cannot be read.
- Backups: overwriting old backups once the backup cycle is completed.
Data whose retention period has expired at intervals not exceeding 6 months is destroyed periodically. Temporary records on the site whose retention period has expired are cleaned automatically every night. A data subject's deletion request is concluded within 30 days at the latest. The destruction operations carried out are recorded and kept for at least 3 years.
Technical and administrative measures
- Connections are encrypted with TLS (https); payment card details are not stored on the Company's systems.
- Panel access is based on authorization and roles; administrators can use two-step verification, and all actions are written to activity logs.
- Confidential settings and access keys are stored in encrypted form; servers are protected by a firewall and backed up regularly.
- Employees are informed about the protection of personal data and are bound by a confidentiality obligation.
Entry into force and updates
This policy enters into force on the date it is published on the website; it is updated in line with changes in legislation or processes. For your rights regarding your personal data, you can use the application channels on the KVKK Privacy Notice page.
