Personal Data Storage and Destruction Policy
Softage Yazılım Anonim Şirketi (Estesoft)
This policy regulates the procedures and principles for storing, destroying, and anonymizing personal data by Softage Yazılım Anonim Şirketi ("Estesoft") within the scope of Turkish Personal Data Protection Law No. 6698 ("KVKK") and related legislation.
1. Purpose and Scope
This policy applies to all personal data processed by Estesoft in its capacity as data controller. The purpose is to prevent personal data from being retained longer than necessary, ensure compliance with statutory retention periods, and protect the rights of data subjects.
2. Retention Periods
Personal data is retained for whichever is longer: the period required by the processing purpose or the statutory retention period:
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Customer contract data | 10 years | Turkish Code of Obligations |
| Financial and accounting records | 10 years | Tax Procedure Law |
| Patient records | 20 years | Patient Rights Regulation |
| Contact form data | 2 years | KVKK / Legitimate interest |
| System log records | 2 years | Law No. 5651 |
| Employee personnel files | Employment + 10 years | Labor Law |
3. Destruction Methods
Personal data whose retention period has expired or whose processing purpose has ceased is destroyed by one of the following methods:
Deletion
Data stored in digital media is deleted in an irreversible manner. Anonymization or overwriting methods are applied in databases.
Destruction
Data on physical media (paper, CD, USB, etc.) is destroyed using shredding or physical destruction methods that make recovery impossible.
Anonymization
Processing data in a manner that makes it impossible to identify individuals, so it can be used for statistical or analytical purposes.
4. Periodic Destruction
Estesoft reviews its personal data inventory every six months and destroys data whose retention period has expired according to the established destruction schedule. Destruction operations are recorded and these records are retained for three years.
5. Data Subject Requests
Data subjects may request the deletion or destruction of their personal data under Article 11 of KVKK. Such requests are fulfilled within thirty days, provided that the processing purpose has ceased and the statutory retention period has expired.
6. Contact
For questions regarding our data storage and destruction policy: [email protected]