PERSONAL DATA RETENTION AND DESTRUCTION POLICY

Pixwrap Limited Şirketi

TABLE OF CONTENTS

1. Entry into Force of the Policy

This Personal Data Retention and Destruction Policy (the “Policy”) entered into force on 01.09.2019. The procedures for any amendments that may be made to the Policy are set out in Article 18 of this Policy, entitled Amendments.

2. Introduction

Pixwrap undertakes to act in compliance with the law. Pixwrap encourages limiting the collection and use of personal data to what is relevant and reasonably necessary to achieve legitimate business purposes in accordance with the applicable privacy policy/notice or consent form.

In this Policy, the following basic principles are observed with regard to the retention and destruction of personal data in accordance with the relevant legislation:

Processing personal data lawfully and in good faith,

Keeping personal data accurate and, where necessary, up to date,

Processing personal data for specified, explicit and legitimate purposes,

Processing personal data in a manner that is relevant, limited and proportionate to the purposes for which they are processed,

Retaining personal data for the period stipulated in the relevant legislation or necessary for the purpose for which they are processed,

Informing and notifying data subjects,

Establishing the system necessary for data subjects to exercise their rights,

Taking the necessary measures in the retention of personal data,

Acting in accordance with the relevant legislation and Board regulations when transferring personal data to third parties in line with the requirements of the processing purpose,

Showing the necessary sensitivity to the processing and protection of special categories of personal data.

3. Purpose and scope of the preparation of the personal data retention and destruction policy

1. Purpose

This Policy has been prepared to serve as the basis for determining the maximum period necessary for the purpose for which the personal data processed by Pixwrap are processed, and for the deletion, destruction and anonymisation of personal data. The Policy contains explanations regarding the personal data processing activities carried out lawfully and the systems adopted for the protection of personal data. In this context, the Policy contains information on ensuring transparency by informing the persons whose personal data are processed by Pixwrap, primarily employees, officers, customers, providers and third parties; on checking whether there are valid reasons for retaining the processed personal data; and on the destruction of personal data for which the valid reason for retention no longer exists.

2. Scope

This Policy concerns all personal data of Pixwrap employees, customers and third parties processed by automated means or by non-automated means provided that they form part of a data filing system.

The scope of application of this policy for the groups of data subjects in the categories mentioned above may cover the entire policy or only some of its provisions (for example, only employees).

2. Principles

Pixwrap acts within the framework of the following principles in the process of retaining and destroying personal data:

In the deletion, destruction and anonymisation of personal data, it acts in accordance with the principles listed in Article 4 of the Law and the technical and administrative measures to be taken under Article 12 and specified in Article 9 of this

Policy, the provisions of the relevant legislation, Board decisions and this Policy.

All transactions relating to the deletion, destruction and anonymisation of personal data are recorded by Pixwrap.

If all of the conditions for processing personal data set out in Articles 5 and 6 of the Law cease to exist, personal data are deleted, destroyed or anonymised by Pixwrap ex officio or upon the request of the data subject. Unless the Board decides otherwise, the appropriate method of deleting, destroying or anonymising personal data ex officio is selected by Pixwrap. Upon the request of the Data Subject, the reason for the appropriate method is explained. If the Data Subject applies to Pixwrap in this regard;

Requests submitted are concluded within 30 (thirty) days at the latest and the data subject is informed,

If the personal data subject to the request have been transferred to third parties, this situation is notified to the third party to whom the data were transferred and it is ensured that the necessary actions are taken by the third parties.

5. TERMS/DEFINITIONS

Recording Media Regulated by the Policy

The personal data of data subjects are securely stored by Pixwrap in the media listed in the table below, in accordance with the relevant legislation, primarily the provisions of the Law, and within the framework of international data security principles:

A. Electronic media

a. NVR Camera Recording System

b. DVR Camera Recording System

c. IP Camera Recording System

d. IP Telephone Recording Exchange

e. Finger Print Software

f. Personnel Attendance Control System

g. Local Storage Server

h. Hetzner Online GmbH

i. Cloud Service Providers

B. Physical Media

a. Paper,

b. Manual data recording systems (survey forms, visitor log book),

c. Written, printed, visual.

6. Categorisation of Personal Data

7. Groups of Persons Governed by the Policy

7.1. White-Collar Employees

The data of natural persons working at Pixwrap under an employment relationship may be processed by Pixwrap within the conditions set out in this Policy.

7.2. Blue-Collar Employees

The data of natural persons working at Pixwrap under an employment relationship may be processed by Pixwrap within the conditions set out in this Policy.

7.3. Employee Candidates/Job Applicants

The data of natural persons who have applied for a job at Pixwrap by any means or who have made their CV and related information available for Pixwrap’s review may be processed by Pixwrap within the conditions set out in this Policy.

7.4. Sosyopix İnternet Hizmetleri Company Officers/Representatives

The personal data of Pixwrap’s company officers and representatives may be processed by Pixwrap within the conditions set out in this Policy.

7.5. Sosyopix İnternet Hizmetleri Shareholders

The personal data of Pixwrap shareholders may be processed by Pixwrap within the conditions set out in this Policy.

7.6. Business Partners/Providers

The data of natural persons, including the institutions with which Pixwrap has any kind of business relationship (such as, but not limited to, suppliers, business partners and dealers) and their employees and officers, may be processed within the conditions set out in this Policy.

7.7. Potential Customers

The personal data of any natural person who is a potential customer of Pixwrap in a commercial sense or as a consumer may be processed within the conditions set out in this Policy.

7.8. Visitors

The personal data of natural persons who come to Pixwrap’s head office as visitors may be processed within the conditions set out in this Policy.

8. Explanation of the Legal, Technical or Other Reasons Requiring the Retention and Destruction of Personal Data

Pixwrap processes and retains personal data for reasons such as offering services and products, providing customer service, better understanding customer needs, developing customer relations, offering special offers or promotions by e-mail, telephone or post and marketing our products and services, complying with applicable legal processes and pursuing legal rights; managing recruitment processes; and fulfilling Pixwrap’s obligations under the employment contract between personnel and Pixwrap.

Pursuant to the Regulation, in the cases listed below, the personal data of data subjects are deleted, destroyed or anonymised by Pixwrap ex officio or upon request:

a. Amendment or repeal of the provisions of the relevant legislation forming the basis for the processing or retention of personal data,

b. Disappearance of the purpose requiring the processing or retention of personal data,

c. Disappearance of the conditions requiring the processing of personal data under Articles 5 and 6 of the Law.

d. In cases where the processing of personal data takes place solely on the basis of explicit consent, withdrawal of consent by the data subject,

e. Acceptance by the Data Controller of the application made by the data subject for the deletion, destruction or anonymisation of his/her personal data within the framework of his/her rights under subparagraphs (e) and (f) of Article 11 of the Law,

f. In cases where the Data Controller rejects the application made to it by the data subject requesting the deletion, destruction or anonymisation of his/her personal data, where its response is found insufficient, or where it does not respond within the period stipulated in the Law; filing a complaint with the Board and the Board finding this request appropriate,

g. Absence of any condition that would justify retaining personal data for a longer period even though the maximum period requiring the retention of personal data has expired.

9. Technical and Administrative Measures Taken for the Secure Retention of Personal Data and the Prevention of Unlawful Processing and Access

All administrative and technical measures taken by Pixwrap within the framework of the principles in Article 12 of the Law and within the limits of technological possibilities for the secure retention of your personal data and the prevention of their unlawful processing and access are listed below.

In this context, Pixwrap takes the following administrative measures:

a. It limits access to stored personal data to the employees who need it.

b. It employs staff who are knowledgeable and experienced in the processing of personal data and provides its staff with the necessary training on personal data protection legislation and data security. Employees are trained on attacks that could compromise personal data security, on cyber security, and on not disclosing or sharing personal data unlawfully, and awareness activities are carried out for them.

c. The roles and responsibilities of employees regarding personal data security are defined in their job descriptions, and it is ensured that employees are aware of their roles and responsibilities in this regard.

d. It signs confidentiality undertakings with its employees within the scope of personal data protection legislation and data security.

e. If the processed personal data are obtained by others through unlawful means, it notifies the data subject and the Board of this situation as soon as possible.

f. It signs contracts that also cover the protection of personal data and data security with the persons with whom personal data are shared.

g. It carries out and has carried out the necessary audits to ensure the implementation of the provisions of the Law within its own legal entity. It eliminates confidentiality and security vulnerabilities revealed as a result of the audits.

h. It prepares a Personal Data Processing Inventory.

i. It prepares Corporate Policies (Access, Information Security, Use, Retention and Destruction, etc.).

j. It has periodic and/or random audits carried out within the scope of data security.

In this context, Pixwrap takes the following technical measures:

a. It takes technical measures in line with technological developments, and the measures taken are periodically renewed and updated.

b. It carries out the necessary internal controls within the scope of the systems established.

c. It carries out information technology risk assessment and business impact analysis processes within the scope of the systems established.

d. It ensures the provision of technical infrastructure that will prevent or monitor the leakage of data outside the organisation and the creation of the relevant matrices.

e. It ensures that system vulnerabilities are checked by obtaining penetration testing services regularly and when needed.

f. It ensures that the access rights of employees in information technology units to personal data are kept under control, restricted when necessary, and that the authorisations are reviewed.

g. It has regular security scans carried out to identify security vulnerabilities in the media where personal data are stored and ensures that the vulnerabilities are closed.

h. Pursuant to Article 12 of the Law, all digital media in which personal data are stored are protected by encryption or cryptographic methods in a way that meets information security requirements.

10. Technical and Administrative Measures Taken for the Lawful Destruction of Personal Data

Personal data obtained by Pixwrap in accordance with the KVKK and other relevant legislation are deleted, destroyed or anonymised using the techniques specified below, again in accordance with the provisions of the Law and the relevant legislation, by Pixwrap ex officio or upon the application of the Data Subject, if the personal data processing purposes listed in the Law and the Regulation cease to exist.

10.1. Deletion of Personal Data

Deletion of personal data is the process of rendering personal data inaccessible and unusable in any way for the relevant users. Since personal data can be stored in various recording media, they are deleted using methods appropriate to the recording media. These deletion techniques are described in Article 10.1.1.

10.1.1. Personal Data Deletion Techniques

Secure Deletion from Software:

When deleting data processed by fully or partially automated means and stored in digital media, methods are used for deleting the data from the relevant software in such a way that they are rendered inaccessible and unusable in any way for the Relevant Users.

Deleting the relevant data in the cloud system by issuing a delete command;

Removing the access rights of the relevant user to the file on the central server or to the directory in which the file is located; deleting the relevant rows in databases with database commands; or deleting data on portable media, i.e. flash media, using appropriate software may be counted within this scope. However, if the deletion of personal data would result in other data also becoming inaccessible and unusable within the system, personal data will also be deemed deleted if they are archived by being rendered incapable of being associated with the data subject, provided that the following conditions are met

Secure Deletion by an Expert:

In some cases, an expert may be engaged to delete personal data on its behalf. In this case, the personal data are securely deleted by the person who is an expert in this field in such a way that they are rendered inaccessible and unusable in any way for the Relevant Users.

Blacking Out Personal Data in Paper Media:

This is the method of physically cutting the relevant personal data out of the document, or making them invisible and covering them with permanent ink in a way that cannot be reversed and cannot be read with technological solutions, in order to prevent the unintended use of personal data or to delete the data whose deletion is requested.

10.2. Destruction of Personal Data

Destruction of personal data is the process of rendering personal data inaccessible, irretrievable and unusable in any way by anyone. Pixwrap takes all necessary technical and administrative measures regarding the destruction of personal data to the extent possible. These destruction techniques are described in Article 10.2.1.

10.2.1. Personal Data Destruction Techniques

Demagnetisation:

This is the method of corrupting the data on magnetic media in an unreadable way by passing the media through special devices in which they are exposed to high magnetic fields. It should be noted that if destruction by this method is not successful, the destruction process can only be completed by physically destroying the media.

Physical Destruction:

Personal data may also be processed by non-automated means provided that they form part of a data filing system. When destroying such data, a system of physically destroying the personal data so that they cannot be used later is applied. The destruction of data in paper and microfiche media must also be carried out in this way, since it is not possible to destroy them otherwise.

Overwriting:

The overwriting method is a data destruction method that makes it impossible to read and recover old data by writing random data consisting of 0s and 1s at least seven times on magnetic media and rewritable optical media using special software 11 While the situations listed above occur, Pixwrap fully complies with the provisions of the KVKK, the Regulation and other relevant legislation in order to ensure data security and takes all necessary administrative and technical measures.

10.3. Anonymisation of Personal Data

Anonymisation of personal data means rendering personal data incapable of being associated with an identified or identifiable natural person in any way, even if they are matched with other data. In order for personal data to be anonymised, Pixwrap renders the personal data incapable of being associated with an identified or identifiable natural person even through the use of techniques appropriate to the recording medium and the relevant field of activity, such as reversal by the data controller or recipient groups and/or matching the data with other data. These anonymisation techniques are described in Article 10.3.1.

10.3.1. Personal Data Anonymisation Techniques

In accordance with Article 28 of the KVK Law, anonymised personal data may be processed for purposes such as research, planning and statistics. Such processing falls outside the scope of the KVK Law, and the explicit consent of the data subject will not be required.

Variable Removal:

With the method of removing descriptive data, the existing data set is anonymised by removing the “highly descriptive” variables from the data set created after the collected data have been brought together.

Record Removal:

In the record removal method, the stored data are anonymised by removing from the records the data row that contains uniqueness among the data. For example, if there is only one senior manager in a company, the remaining data can be anonymised by removing the data belonging to this person from the records in which the seniority, salary and gender data of employees at the same level are kept.

Regional Masking:

In the regional masking method, if a single piece of data has a distinguishing character because it creates a combination that is very rarely seen, hiding the relevant data ensures anonymisation. For example, if only one person among the relevant data subjects on the company football team’s reserve list is 65 years old, writing ‘Unknown’ instead of ‘Age: 65’, or leaving this field blank, in a data set in which information on whether they can play football in terms of age, gender and health status is stored together will ensure anonymisation.

Top and Bottom Coding:

With the top and bottom coding method, values in a data group containing predefined categories are anonymised by combining them according to a specific criterion.

Generalisation:

With the data aggregation method, many data are aggregated and personal data are rendered incapable of being associated with any person. For example, showing that there are Z employees aged X without showing the ages of employees individually.

Global Coding:

With the data derivation method, a more general content is created from the content of the personal data, and the personal data are rendered incapable of being associated with any person. For example, stating ages instead of dates of birth, or stating the region of residence instead of the full address.

Anonymisation Methods Providing Value Irregularity

Unlike methods that do not provide value irregularity, anonymisation methods that provide value irregularity create distortion by changing some data in personal data groups. When using these methods, deviations must be applied carefully in line with the expected/desired benefit. The expected benefit from the data can continue to be obtained by ensuring that the overall statistics are not distorted.

Adding Noise:

In the method of adding noise to data, particularly in a data set in which numerical data are predominant, the data are anonymised by adding certain deviations in a plus or minus direction at a specified rate to the existing data. For example, in a data group containing weight values, a deviation of (+/−) 3 kg is used to prevent the actual values from being displayed and the data are anonymised. The deviation is applied equally to each value.

Micro Aggregation:

In the micro aggregation method, all data are first arranged in a meaningful order (such as from largest to smallest) and divided into groups, and anonymisation is achieved by taking the average of the groups and writing the resulting value in place of the relevant data in the existing group. For example, for salary information, if two groups are created, below and above TRY 10,000, the total salaries of those earning TRY 10,000 or less are divided by the number of persons and this value is written in the salary set of everyone earning less than TRY 10,000.

Data Swapping:

In the data swapping method, the values of a variable are exchanged between pairs selected from among the stored data. In this method, which is generally used for data that can be categorised, the aim is to transform the database by exchanging the data of data subjects with each other.

11. Special Categories of Personal Data

These are data relating to persons’ race, ethnic origin, political opinions, philosophical beliefs, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Pixwrap does not process Special Categories of Personal Data without the explicit consent of the data subject.

Special Categories of Personal Data other than health and sexual life may be processed without seeking the explicit consent of the data subject in the cases stipulated by law.

Personal data relating to health and sexual life, on the other hand, may only be processed without seeking the explicit consent of the data subject by persons under an obligation of confidentiality or by authorised institutions and organisations for the purposes of protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing.

12. Data Transfer to Third Parties/Categories of Recipient Parties

12.1. Data Transfer

Pixwrap may transfer personal data within the framework of the conditions and purposes listed in Articles 8 and 9 of the Law. In line with the personal data processing purposes it has adopted, Pixwrap may transfer personal data to the third parties specified below, based on and limited to one or more of the personal data processing conditions set out in Article 5 of the KVK Law listed below:

• Existence of the explicit consent of the data subject

• Being expressly provided for in the laws

• Being necessary for the protection of the life or bodily integrity of the person himself/herself or of another person, where the person is unable to express consent due to actual impossibility or whose consent is not legally valid

• Processing of personal data of the parties to a contract being necessary, provided that it is directly related to the conclusion or performance of a contract

• Being necessary for the data controller to fulfil its legal obligation

• Having been made public by the data subject himself/herself

• Data processing being necessary for the establishment, exercise or protection of a right

• Data processing being necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

By taking the necessary security measures and the adequate measures stipulated by the Board, Pixwrap may transfer the special categories of personal data of the Data Subject to third parties in the following cases.

• Existence of the explicit consent of the data subject

• If there is no explicit consent of the data subject;

– Special categories of personal data of the data subject other than health and sexual life (data relating to race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, criminal convictions and security measures, as well as biometric and genetic data), in the cases stipulated by law,

– Special categories of personal data relating to the health and sexual life of the data subject may only be transferred by persons under an obligation of confidentiality or by authorised institutions and organisations for the purposes of protecting public health, preventive medicine, medical diagnosis, the provision of treatment and care services, and the planning and management of health services and their financing.

12.2. Categories of Recipient Parties

Pursuant to Articles 8 and 9 of the Law, Pixwrap may transfer the personal data of data subjects to the categories of persons listed below:

13. Titles, units and job descriptions of those involved in personal data retention and destruction processes

14. You can find the titles, units and job descriptions of the personnel involved in the personal data retention and destruction process in the list in Annex-1 of this Policy.

14. Table showing retention and destruction periods

In determining the retention and destruction periods of your personal data obtained by Pixwrap in accordance with the KVKK and other relevant legislation, the criteria specified below are used in order:

If a period has been stipulated in the legislation for the retention of the personal data in question, this period is complied with.

If the period stipulated in the legislation for the retention of the personal data in question has expired, or if no period has been stipulated in the relevant legislation for the retention of the data in question, respectively;

a. Personal data are classified as personal data and special categories of personal data based on the definition in Article 6 of the KVKK. All personal data determined to be of a special nature are destroyed. The method to be applied in the destruction of such data is determined according to the nature of the data and the degree of importance of its retention for Pixwrap.

b. The compliance of the retention of the data with the principles set out in Article 4 of the KVKK is examined; for example, whether Pixwrap has a legitimate purpose in retaining the data is questioned. Data whose retention is determined to potentially violate the principles in Article 4 of the KVKK are deleted, destroyed or anonymised.

c. It is determined under which of the exceptions stipulated in Articles 5 and 6 of the KVKK the retention of the data can be evaluated. Reasonable periods for which the data must be retained are determined within the framework of the identified exceptions. When these periods expire, the data are deleted, destroyed or anonymised. You can find the retention, destruction and periodic destruction periods determined by Pixwrap in the ‘Personal Data Retention and Destruction Periods Table’ in the annex (Annex-2) to this Policy. Personal data whose retention period has expired are destroyed in 6-month periods in accordance with the procedures set out in this Policy, within the framework of the destruction periods in the annex (Annex-2) to this Policy.

You can find the retention, destruction and periodic destruction periods determined by Pixwrap in the ‘Periodic Destruction Periods Table’ in the annex (Annex-2) to this Policy.

16. Rights of data subjects

In addition to obtaining the information specified in this text, we would like to remind you that you have the following rights:

a. To learn whether your personal data are processed,

b. To access and request information about your personal data,

c. To have your personal data corrected if they are incorrect or incomplete,

d. To know the third parties in Turkey or abroad to whom personal data have been transferred,

e. To request the deletion or destruction of personal data if the reasons requiring their processing cease to exist, even though they have been processed in accordance with Law No. 6698 and the provisions of other relevant laws,

f. To request that your request for the correction or deletion of your data be notified to the third parties to whom your personal data have been disclosed,

g. To object to adverse decisions affecting you as a result of the analysis of the processed personal data exclusively through automated systems,

h. To claim compensation if you suffer damage due to the unlawful processing of your personal data.

To exercise your rights, you can contact Pixwrap by post at Kızılırmak Mahallesi, Dumlupınar Bulvarı (Eskişehir Yolu) Next Level, Çankaya / Ankara.

17. Amendments

This Policy enters into force as of 01.09.2019 (should the company’s incorporation date be written?). Those Involved in Personal Data Retention and Destruction Processes listed in ANNEX-1 are authorised regarding the amendments to be made to the Policy and the manner in which they will be put into effect. This Policy is reviewed every 3 months.

18. Application to the Data Controller

You can contact Pixwrap by regular post at Kızılırmak Mahallesi, Dumlupınar Bulvarı (Eskişehir Yolu) Next Level, Çankaya / Ankara.

In addition, to apply to Pixwrap: Data Controller Application Guide (The relevant Guide has previously been sent by us.)

Annexes:

Annex-1: Table on the Titles, Units and Job Descriptions of Those Involved in Personal Data Retention and Destruction Processes

Annex-2: Personal Data Retention and Destruction Periods Table

Annex-3: Amendments and Updates Made to the Policy

Annex-1: Table on the Titles, Units and Job Descriptions of Those Involved in Personal Data Retention and Destruction Processes

Annex-2: Personal Data Retention and Destruction Periods Table

Annex-3: Amendments and Updates Made to the Policy

Recipient Group | The category of natural or legal persons to whom personal data are transferred by the data controller

Explicit Consent | Consent relating to a specific subject, based on information and given of free will.

Anonymisation | Rendering personal data incapable of being associated in any way with an identified or identifiable natural person, even by matching them with other data.

Obligation to Inform | Refers to the information provided to data subjects by the data controller or the person authorised by it during the collection of personal data. In this context, the data controller or the person authorised by it informs the data subject on the following matters:

• The identity of the data controller and, if any, its representative,

• The purpose for which the personal data will be processed,

• To whom and for what purpose the processed personal data may be transferred,

• Informing the data subject about the rights of the data subject set out in Article 11 of the Law,

The method and legal basis of the collection of personal data,

Employee | Pixwrap personnel.

Electronic Medium | Media in which personal data can be created, read, changed and written with electronic devices.

Non-Electronic

Medium | All other written, printed, visual, etc. media outside electronic media

Service Provider | A natural or legal person providing services to Pixwrap within the framework of a specific contract.

Data Subject | The natural person whose personal data are processed.

Destruction | Deletion, destruction or anonymisation of personal data.

Law/KVKK | Personal Data Protection Law

Recording Medium | Any medium containing personal data processed by fully or partially automated means or by non-automated means provided that they form part of any data filing system.

Filing System | Any system that is fully or partially automated, or non-automated provided that it forms part of any data filing system.

Personal Data | Any information relating to an identified or identifiable natural person.

Processing of

Personal Data | Any operation performed on data, such as obtaining, recording, storing, preserving, changing, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of personal data, by fully or partially automated means or by non-automated means provided that they form part of any data filing system.

Personal Data Processing Inventory | The inventory created by data controllers by associating the personal data processing activities they carry out depending on their business processes with the purposes and legal basis of processing personal data, the data category, the recipient group to which they are transferred and the data subject group, and in which they detail the maximum retention period required for the purposes for which the personal data are processed, the personal data envisaged to be transferred to foreign countries and the measures taken regarding data security.

Anonymisation of Personal Data | Rendering personal data incapable of being associated with an identified or identifiable natural person, even through the use of techniques appropriate to the recording medium and the relevant field of activity, such as reversal by the data controller, recipient or recipient groups and matching the data with other data.

Deletion of

Personal Data | Rendering personal data inaccessible and unusable in any way.

Destruction of Personal Data | The process of rendering personal data inaccessible, irretrievable and unusable in any way by anyone.

Board | Personal Data Protection Board

Authority | Personal Data Protection Authority

Special Category of Personal Data | Data relating to persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.

Periodic Destruction | The deletion, destruction or anonymisation process to be carried out ex officio at recurring intervals specified in the personal data retention and destruction policy, in the event that all of the conditions for processing personal data set out in the Law cease to exist.

Policy | Personal Data Retention and Destruction Policy

Data Processor | A natural or legal person who processes personal data on behalf of the data controller based on the authority granted by it.

Data Controller | The natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data filing system.

Data Controllers Registry | A mandatory registration system, to be kept open to the public by the Presidency of the Personal Data Protection Authority, in which those who are data controllers under the Law are obliged to register.

Regulation | Regulation on the Deletion, Destruction or Anonymisation of Personal Data

Type of Personal Data | Description

Identity Information | Data containing information about the identity of the person, processed fully or partially automatically or non-automatically as part of a data filing system, of the data subjects in all groups of persons governed by this Policy: documents such as driving licences, identity cards and passports containing information such as name-surname, Turkish ID number, mother’s name-father’s name, nationality, place/date of birth and gender, as well as information such as tax number, social security number, signature information, vehicle licence plate, etc.

Contact Information | Information such as telephone number, address, e-mail address, fax number and IP address of the data subjects in all groups of persons governed by this Policy, processed fully or partially automatically or non-automatically as part of a data filing system

Financial Information | Personal data processed relating to information, documents and records showing all kinds of financial results, and data such as credit card information, bank account number and IBAN number, of the data subjects in all groups of persons governed by this Policy, processed fully or partially automatically or non-automatically as part of a data filing system

Special Categories of Personal Data | Data relating to persons’ race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data

Customer Information | Information obtained and produced about the data subject as a result of commercial and service activities and the operations carried out by business units within this framework, processed fully or partially automatically or non-automatically as part of a data filing system, of the data subjects governed by this Policy.

Camera Recording/Physical Premises Entry Information | Image data captured at Pixwrap’s head office, factories and stores during entry into and stay in the physical premises, processed fully or partially automatically or non-automatically as part of a data filing system, of the data subjects governed by this Policy.

Employees’ Personnel Information | All kinds of personal data aimed at obtaining information that forms the basis of personnel rights such as positions and salaries, processed fully or partially automatically or non-automatically as part of a data filing system, of the data subjects in the employee groups governed by this Policy

Employee Candidate Information | Personal data relating to any data subject who has applied to become a salaried employee at Pixwrap or who is evaluated as an employee candidate by the human resources department, processed fully or partially automatically or non-automatically as part of a data filing system, of the data subjects governed by this Policy.

IT Infrastructure Information | Personal data recorded in all kinds of commercial, marketing and business-relationship IT infrastructures operated within Pixwrap, processed fully or partially automatically or non-automatically as part of a data filing system, of the data subjects in the employee and customer groups governed by this Policy.

Request and Complaint Management Information | Personal data relating to the receipt and evaluation of all kinds of requests or complaints addressed to Pixwrap through various channels (e-mail, telephone, social media), processed fully or partially automatically or non-automatically as part of a data filing system, of the data subjects governed by this Policy.

Persons to Whom Personal Data May Be Transferred | Definition | Purpose

Supplier | Refers to third parties providing services to Pixwrap under a Contract while Pixwrap carries out its activities. | Transferred for the purpose of providing the services necessary for Pixwrap to carry out its commercial activities.

Shareholders | Refers to the shareholders of Pixwrap Limited Şirketi. | Transferred limited to the purposes of the activities Pixwrap carries out within the scope of company law, event management and corporate communication processes.

Company Officer | Of Pixwrap Limited Şirketi | Of Pixwrap Limited Şirketi

| within it | relating to its activities

| refers to the board members and | designing strategies,

| other officers. | at the highest level

ensuring management

| | and for audit purposes

| | limited to

| | transferred.

Authorised Public Institutions and | Under the provisions of the relevant legislation, from Pixwrap Limited Şirketi | Of the Authorised Public Institution and

Organisations | | Organisation’s legal

| authorised to receive personal data

public institutions and organisations | within its authority, requested

limited to the purpose

| | transferred.

Private Law Persons | Private law persons authorised under the provisions of the relevant legislation to receive personal data from Pixwrap Limited Şirketi | Transferred limited to the purpose requested by the Authorised Private Law Person within its legal authority.

PERSONNEL | DUTY | RESPONSIBILITY

Information Technology Unit Manager | Information Technology Department | Personal Data Retention and

Responsible for the Implementation of the Destruction Policy

Personnel Directorate Unit Manager | Personnel Directorate Department | Personal Data Retention and

Responsible for the Implementation of the Destruction Policy

Legal Counsel | Legal Consultancy Provided to Pixwrap | Personal Data Retention and

Responsible for the Implementation of the Destruction Policy

Relevant Process | Data Retention Period | Data Destruction Period

Job Application via

Kariyer.net | Data can be accessed via Kariyer.net. There is no registration in the system at this stage. | 180 Days-

Physical Job Application to Pixwrap | 1 Year | 180 Days

Hand delivery to the relevant managers | 1 Year | 180 Days

Storage of the contact information of accepted candidates physically and electronically | 5 Years | 180 Days

Creation of the Personnel File by Collecting Documents | 10 Years Following the Termination of the Employment Contract | 180 Days

Sharing employee information with İŞKUR | 10 Years Following the Termination of the Employment Contract | 180 Days

Social Security (SGK) Entry Notification Process | 10 Years Following the Termination of the Employment Contract | 180 Days

Preparation of Payrolls | 10 Years Following the Termination of the Employment Contract | 180 Days

Private Pension Membership | 10 Years Following the Termination of the Employment Contract | 180 Days

Special telephone list provided to employees | Not applicable. | 180 Days

Special telephone list and invoice statement provided to employees | No period policy exists. | 180 Days

Employees’ clock-in and clock-out records | No period policy exists. | 180 Days

Entry and exit of authorised Employees to the cafeteria and unit departments | No period policy exists. | 180 Days

Payment of employees’ monthly wages. | No period policy exists. | 180 Days

Making payments under contracts concluded with outsourced service companies. | No period policy exists. | 180 Days

Opening accounts through the system for companies having a current account relationship with Pixwrap. | 10 Years | 180 Days

Conducting Finance and Accounting

Operations | No period policy exists. | 180 Days

Message and contact information obtained via www.pixwrap.com | No period policy exists. | 180 Days

Date of Amendment | Scope of Amendment

??????????????????? | Date the Policy was created.