Personal Data Processing and Destruction Policy

BIODEN ENERGY PRODUCTION INDUSTRY AND TRADE INC.
PERSONAL DATA PROCESSING, STORAGE, AND DESTRUCTION POLICY.
 

1. PURPOSE

The purpose of this Personal Data Processing and Destruction Policy (“Policy”) is to establish the procedures and principles regarding the processing, protection, deletion, destruction, and anonymization of personal data in compliance with the Constitution, international agreements, Law No. 6698 on the Protection of Personal Data (“Law”), Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, “GDPR”), the Regulation on the Deletion, Destruction, or Anonymization of Personal Data (“Regulation”), and other relevant legal regulations.

This Policy applies to all personal data processing, storage, and destruction activities conducted by Bioden Energy Production Industry and Trade Inc. (“Company”) in facilities owned or managed by the Company. Another aim of this Policy is to inform and ensure transparency for individuals whose personal data is processed.
In case of any conflict between this Policy and the provisions of the Law, the provisions of the applicable legislation shall prevail.

2. PRINCIPLES FOR PROCESSING PERSONAL DATA


Compliance with Law and Principles of Honesty
Personal data is processed in accordance with legal regulations and principles of honesty. In this context, personal data is processed proportionally and limited to the purpose for which it is processed.

Ensuring Personal Data is Accurate and Up-to-Date When Necessary
Periodic checks and updates are made to ensure the accuracy and currency of processed data, and necessary measures are taken accordingly. Systems are established within the Company to verify the accuracy of personal data and to make necessary corrections.

Processing for Specific, Explicit, and Legitimate Purposes
Within the framework of data minimization, personal data is processed based on specific and explicit purposes and only as necessary for these purposes. The purposes for which data will be processed are determined before the personal data processing activity begins.

Being Relevant, Limited, and Proportionate to the Purpose for Which They Are Processed
Personal data is processed in a manner suitable for achieving the determined purposes, and processing of personal data that is not related to or necessary for the realization of the purpose is avoided.

Retention for the Period Stipulated in the Relevant Legislation or Required for the Purpose for Which They Are Processed
The Company retains personal data only for the period specified in the relevant legislation or as required for the purpose for which they are processed. In this context, it is first determined whether a retention period is specified in the relevant legislation; if a period is specified, compliance with this period is ensured; if no period is specified, personal data is retained for the duration necessary for the purpose for which they are processed. Upon expiration of the period or elimination of the reasons requiring processing, and in the absence of any legal reason allowing for longer processing, personal data is deleted, destroyed, or anonymized according to the Company’s policy in this regard.

2.1 CONDITIONS FOR PROCESSING PERSONAL DATA

The explicit consent of the personal data subject is one of the legal bases that make the processing of personal data lawful. In addition to explicit consent, personal data may also be processed under the following conditions. The legal basis for personal data processing may be one or more of the conditions listed below..

Processing of Personal Data Based on the Explicit Consent of the Data Subject
If personal data is not processed based on another legal condition, it is processed based on the explicit consent of the data subject. Data subjects are informed about which personal data is processed, the purposes and reasons for processing, the sources from which personal data is collected, with whom this personal data will be shared, and how it will be used, and their explicit consent is obtained accordingly.

Explicitly Stipulated by Laws
If the processing of personal data is explicitly stipulated by law, the Company processes personal data without obtaining the explicit consent of the data subject.
Inability to Obtain Consent Due to Actual Impossibility
If it is necessary to process personal data to protect the life or physical integrity of the data subject or another person, and the data subject is unable to express consent due to actual impossibility or legal invalidity, personal data is processed without obtaining explicit consent.

Processing is Necessary for the Establishment or Performance of a Contract
If it is necessary to process personal data of the parties to a contract, provided that it is directly related to the establishment or performance of the contract, personal data is processed.

Processing is Necessary for Compliance with a Legal Obligation
If processing is necessary for the data controller to fulfill its legal obligations, personal data is processed without obtaining explicit consent.

Personal Data Made Public by the Data Subject
If the data subject has made their personal data public, personal data is processed without obtaining explicit consent.

Processing is Necessary for the Establishment, Exercise, or Protection of a Right
If processing is necessary for the establishment, exercise, or protection of a right, personal data is processed without obtaining explicit consent.Gebkim+1enerjisauretim.com.tr+1

Processing is Necessary for the Legitimate Interests of the Data Controller
Provided that it does not harm the fundamental rights and freedoms of the data subject, if processing is necessary for the legitimate interests of the Company, personal data is processed without obtaining explicit consent.

2.2 RECORDING ENVIRONMENTS REGULATED BY THE POLICY

The electronic and physical storage environments where personal data is stored are listed in the table below. The electronic and physical storage environments listed below are the current storage environments used by the Company as of the date this Policy was prepared, and changes may be made to these environments from time to time.

Electronic Storage Environments
Non-Electronic Environments
  • Servers (ERP servers, domain, backup, email, database, internet, file sharing, etc.)
  • Software (Office software, Document Management System, VERBIS)
  • Information security devices (firewall, intrusion detection and prevention, log files, antivirus, etc.)
  • Personal computers (desktop, laptop)
  • Mobile devices (phone, tablet, etc.)
  • Optical disks (CD, DVD, etc.), removable media (USB, memory card, etc.)
  • Departmental file server files
  • Printer, scanner, photocopier
  • Paper
  • Manual data recording systems (survey forms, visitor entry book)
  • Written, printed, visual media

 

2.3 EXPLANATIONS REGARDING THE STORAGE AND DESTRUCTION OF PERSONAL DATA

The Company stores and destroys personal data of data subjects in accordance with the Law. Detailed explanations regarding storage and destruction are provided below.

2.3.1 Legal Reasons Requiring Storage
Personal data processed within the scope of the Company’s activities are retained for the period stipulated in the relevant legislation. In this context, personal data is retained for the periods specified in:
  • Law No. 6698 on the Protection of Personal Data
  • Turkish Code of Obligations No. 6098
  • Social Insurance and General Health Insurance Law No. 5510
  • Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications
  • Occupational Health and Safety Law No. 6331
  • Law No. 4982 on the Right to Information
  • Law No. 3071 on the Use of the Right to Petition
  • Labor Law No. 4857
  • Regulation on Health and Safety Measures to be Taken in Workplace Buildings and Their Additions
  • and other applicable secondary regulations.
2.3.2 Reasons Requiring Destruction
Personal data is deleted, destroyed, or anonymized by the Company upon the request of the data subject or ex officio in the following cases:
  • Amendment or repeal of the provisions of the relevant legislation that constitute the basis for processing
  • Elimination of the purpose requiring processing or storage
  • Withdrawal of explicit consent by the data subject in cases where processing is based solely on explicit consent
  • Acceptance of the data subject’s request for deletion or destruction of personal data by the Company or the Authority within the scope of Article 11 of the Law
  • Rejection of the data subject’s request by the Company, insufficient response, or failure to respond within the period stipulated in the Law, and the data subject’s complaint to the Board and the Board’s approval of this request
  • Expiration of the maximum retention period requiring the storage of personal data and the absence of any condition justifying longer storage
Privacy Overview

This website uses cookies to provide you with the best possible user experience. Cookie information is stored in your browser and performs functions such as recognising you when you return to our website and helping our team understand which parts of the website you find most interesting and useful.