Personal Data Protection Policy

ARTI RETAIL FOOD INDUSTRY AND TRADE LIMITED COMPANY - HALKTAN

PERSONAL DATA RETENTION AND DESTRUCTION POLICY

1. INTRODUCTION

1.1 Purpose

This Personal Data Retention and Destruction Policy (“Policy”) applies to all operations of Artı Perakende Gıda Sanayi ve Ticaret Limited Şirketi – HALKTAN (hereinafter referred to as the “Company”) within the framework of the applicable legislation and is based on nationally accepted fundamental principles regarding the destruction of personal data. It contains the framework and principles regarding the implementation of the necessary destruction activities under the relevant legislation.

Paragraph 3 of Article 7 of the Personal Data Protection Law (“Law”) states that “the procedures and principles regarding the deletion, destruction or anonymization of personal data shall be regulated by a regulation.” Based on this provision and subparagraph (e) of paragraph 1 of Article 22 of the Law, the Personal Data Protection Board (“Board”) prepared the Regulation on the Deletion, Destruction or Anonymization of Personal Data (“Regulation”), which was published in the Official Gazette dated 28 October 2017 and numbered 30224.

Based on the above regulation, the purpose of this Policy is to determine the procedures and principles regarding the deletion, destruction or anonymization of personal data processed by the Company in the course of its activities in accordance with the Regulation.

1.2 Scope

This Policy covers the personal data of employees, employee candidates, visitors, third parties with whom we cooperate, and the employees of such third parties. This Policy applies to all recording environments where personal data owned or managed by the Company are processed, as well as to all activities related to the processing of personal data.

1.3 Abbreviations and Definitions

2. RESPONSIBILITIES AND DISTRIBUTION OF DUTIES

All departments and employees of the Company actively support the responsible units in implementing the technical and administrative measures taken under the Policy, increasing the training and awareness of department employees, monitoring and continuous auditing, preventing the unlawful processing of personal data, preventing unlawful access to personal data, ensuring the lawful retention of personal data, and taking technical and administrative measures to ensure data security in all environments where personal data are processed.

The distribution of titles, departments and job descriptions of those involved in personal data retention and destruction processes is provided below.

Table 1: Distribution of Duties in Retention and Destruction Processes

3. RECORDING ENVIRONMENTS

Personal data are securely retained in compliance with the law in the environments listed in Table 2 by the Company.

Table 2: Personal Data Storage Environments

4. EXPLANATIONS REGARDING RETENTION AND DESTRUCTION

The Company retains and destroys the personal data of natural persons, including employees, employee candidates, interns, supplier representatives, supplier employees, persons receiving products or services, potential recipients of products or services, shareholders/partners and other third parties, in accordance with the Personal Data Protection Law (“KVKK”).

Detailed explanations regarding retention and destruction are provided below respectively.

4.1 Explanations Regarding Retention

Article 3 of the Law defines the concept of processing personal data; Article 4 states that personal data must be processed in connection with, limited to and proportionate to the purpose for which they are processed and must be retained for the period stipulated by the relevant legislation or required for the purpose for which they are processed; Articles 5 and 6 set forth the conditions for processing personal data.

Accordingly, within the scope of the Company's activities, personal data are retained for the period prescribed by the relevant legislation or required for our processing purposes.

4.1.1 Legal Grounds Requiring Retention

The Company retains personal data processed within the scope of its activities for the periods stipulated in the relevant legislation. In this context, personal data are retained pursuant to:

• Tax Procedure Law No. 213

• Identity Notification Law No. 1774

• Labour Law No. 4857

• Turkish Penal Code No. 5237

• Social Insurance and General Health Insurance Law No. 5510

• Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed Through Such Publications

• Turkish Code of Obligations No. 6098

• Turkish Commercial Code No. 6102

• Occupational Health and Safety Law No. 6331

• Personal Data Protection Law No. 6698

as well as the retention periods specified in other secondary legislation currently in force.

4.1.2 Processing Purposes Requiring Retention

The Company retains personal data processed within the scope of its activities for the following purposes:

• Carrying out information security processes

• Carrying out employee candidate application processes

• Fulfilment of obligations arising from employment contracts and legislation for employees

• Carrying out employee fringe benefits and benefit processes

• Carrying out audit / ethics activities

• Carrying out training activities

• Ensuring activities are carried out in compliance with legislation

• Carrying out finance and accounting operations

• Ensuring physical premises security

• Carrying out assignment processes

• Monitoring and conducting legal affairs

• Carrying out communication activities

• Managing human resources processes

• Carrying out / auditing business activities

• Carrying out occupational health and safety activities

• Carrying out business continuity activities

• Carrying out logistics activities

• Carrying out goods/service procurement processes

• Carrying out goods/service sales processes

• Carrying out contract processes

• Ensuring the security of movable property and resources

• Providing information to authorized persons, institutions and organizations

4.2 Reasons Requiring Destruction

Personal data shall be destroyed where:

• The relevant legislative provisions forming the basis for processing are amended or repealed,

• The purpose requiring the processing or retention of the data ceases to exist,

• In cases where personal data are processed solely on the basis of explicit consent, the data subject withdraws their explicit consent,

• An application made by the data subject for the deletion or destruction of personal data pursuant to Article 11 of the KVKK is accepted,

• The Company rejects the application made by the data subject requesting the deletion or destruction of personal data, finds the response inadequate, or fails to respond within the period stipulated by the KVKK, and the data subject files a complaint with the Board which is found justified by the Board, and

• The maximum retention period requiring the retention of personal data has expired and there is no condition justifying the retention of personal data for a longer period.

In such cases, personal data shall be deleted, destroyed or anonymized by the Company upon the request of the data subject or ex officio.

5. TECHNICAL AND ADMINISTRATIVE MEASURES

In order to ensure the secure retention of personal data, prevent unlawful processing and access, and ensure the lawful destruction of personal data, the Company implements technical and administrative measures within the framework of Article 12 and paragraph 4 of Article 6 of the KVKK and the adequate measures announced by the Board for special categories of personal data.

5.1 Technical Measures

The measures taken by the Company regarding the personal data it processes are listed below:

• A closed network system is used for personal data transfers conducted through networks.

• Security measures are implemented within the scope of procurement, development and maintenance of information technology systems.

• An authorization matrix has been established for employees.

• Access logs are regularly maintained.

• Up-to-date anti-virus systems are used.

• Firewalls are used.

• Monitoring of personal data security is carried out.

• Personal data are backed up and the security of backed-up personal data is also ensured.

• User account management and authorization control systems are implemented and monitored.

• Log records are maintained in a manner that prevents user intervention.

• Intrusion detection and prevention systems are used.

• Cybersecurity measures are implemented and continuously monitored.

• Encryption is applied.

• Data loss prevention software is used.

5.2 Administrative Measures

The measures taken by the Company regarding the personal data it processes are listed below:

• Training and awareness activities regarding data security are conducted for employees at regular intervals.

• Necessary security measures are taken regarding entry and exit to physical environments containing personal data.

• The security of physical environments containing personal data is ensured against external risks (fire, flood, etc.).

• The security of environments containing personal data is ensured.

• Personal data are minimized as much as possible.

6. PERSONAL DATA DESTRUCTION TECHNIQUES

At the end of the period stipulated in the relevant legislation or the retention period required for the purpose for which they are processed, personal data are destroyed by the Company ex officio or upon the application of the data subject, again in accordance with the provisions of the relevant legislation, by the techniques specified below.

6.1 Deletion of Personal Data

Personal data are deleted by the methods provided in Table-3.

Table 3: Deletion of Personal Data

6.2 Destruction of Personal Data

As the Company, the methods used by us in order to carry out the destruction of personal data in accordance with the law are as follows:

Table 4: Destruction of Personal Data

6.3 Anonymization of Personal Data

Anonymization of personal data means rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances, even if matched with other data.

In order for personal data to be anonymized, personal data must be rendered incapable of being associated with an identified or identifiable natural person even through the use of techniques appropriate for the recording environment and the relevant field of activity, such as the reversal of personal data by the data controller or third parties and/or matching the data with other data.

7. RETENTION AND DESTRUCTION PERIODS

Regarding the personal data processed by the Company within the scope of its activities;

• Retention periods on the basis of personal data for all personal data within the scope of activities carried out depending on processes are included in the Personal Data Processing Inventory;

• Retention periods on the basis of data categories are included in the registration with VERBIS;

• Retention periods on the basis of processes are included in this Personal Data Retention and Destruction Policy.

The destruction process of personal data is carried out by the Company in line with the retention periods determined in accordance with the relevant legislation for each relationship. Personal data whose retention periods have expired are deleted, destroyed or anonymized within the periodic destruction periods determined by the Company.

Table 5: Table of Retention and Destruction Periods by Process

Ex officio deletion, destruction or anonymization procedures for personal data whose retention periods have expired are carried out by the departments specified under the heading “2. RESPONSIBILITIES AND DISTRIBUTION OF DUTIES”.

8. PERIODIC DESTRUCTION PERIOD

Pursuant to Article 11 of the Regulation, the periodic destruction period has been determined by the Company as [6] months. Accordingly, the Company carries out periodic destruction procedures every year in June and December.

9. PUBLICATION AND RETENTION OF THE POLICY

The Policy is published in two different formats, namely with a wet signature (printed paper) and electronically, and is disclosed to the public on the website. A printed copy is also retained in the Human Resources Department files.

10. POLICY UPDATE PERIOD

The Policy shall be updated whenever necessary and when there are changes in processes.

11. EFFECTIVENESS AND REPEAL OF THE POLICY

This Policy shall be deemed to have entered into force upon its publication on the Company's website.

In the event that it is decided to repeal the Policy, the previous wet-signed copies of the Policy shall be cancelled with the company seal and the signature of the authorized company representative (by affixing a cancellation stamp or writing “cancelled”), signed accordingly, and retained by the Human Resources Department for a minimum period of 5 years.