Storage and Destruction of Personal Data

1. Purpose

This policy outlines the principles and practices of the Company regarding the storage and destruction of personal data.

2. Scope

This policy encompasses all personal data processed within the activities of the Company.

3. Basic Principles

The Company adheres to the following basic principles regarding the storage and destruction of personal data:

• Compliance with legality and fairness: Personal data is stored and destroyed in accordance with legal and fairness principles.
• Time limitation: Personal data is stored for the duration necessary for the purpose of processing.
• Confidentiality: Personal data is processed in accordance with the principle of confidentiality during the storage and destruction processes.
• Security: Personal data is protected by security measures during the storage and destruction processes.

4. Storage of Personal Data

The Company stores personal data for the duration necessary for the purpose of processing. The storage period is determined based on relevant legislation and the nature of the processed personal data.

During the storage, the following points are considered:

• Personal data is stored only in a way accessible to authorized personnel.
• Data is stored in a way that protects against unauthorized access, use, disclosure, alteration, or destruction.
• Technical and administrative measures are taken to secure personal data.

5. Destruction of Personal Data

The Company destroys personal data in accordance with relevant legislation when the reasons requiring processing cease to exist.

The destruction of personal data is carried out using the following methods:

• Physical destruction: Personal data is physically destroyed. This method is used when appropriate for the physical destruction of personal data.
• Anonymization: Personal data is destroyed by anonymizing it. Techniques allowing the anonymization of personal data are employed for this method.

The Company pays attention to the following points during the destruction of personal data:

• Personal data is destroyed in a way that is accessible only to authorized personnel.
• Data is destroyed in a way that protects against unauthorized access, use, disclosure, alteration, or destruction.
• The destruction of personal data is ensured through technical and administrative measures.

6. Changes

This policy can be modified by the Company when necessary. Changes to the policy will be announced to the relevant parties by being published on the Company's website.

RUNITAS INFORMATION TECHNOLOGY INDUSTRY AND TRADE JOINT STOCK COMPANY