Ege Seramik Personal Data Storage and Destruction Policy

1. Purpose

The purpose of this destruction policy (“Destruction Policy”) is to ensure that Ege Seramik Sanayi ve Ticaret A.Ş. (“Ege Seramik”) determines the maximum retention periods required for the purposes of processing personal data and carries out the deletion, destruction, and anonymization of such data in compliance with the applicable legislation, primarily the Law No. 6698 on the Protection of Personal Data (“KVKK”) and the Regulation on the Deletion, Destruction or Anonymization of Personal Data (“Regulation”).

2. Scope of the Destruction Policy

The principles and methods to be followed in the processes of retention and destruction of personal data are addressed within the scope of this Policy.

3. Definitions and Terms

• Anonymization: Rendering personal data incapable of being associated with an identified or identifiable natural person under any circumstances.
• Relevant User: Persons who process personal data.
• Destruction: The deletion, destruction, or anonymization of personal data.
• Personal Data: Any information relating to an identified or identifiable natural person.
• Deletion: Rendering personal data inaccessible and non-reusable.
• Destruction (Physical Erasure): Rendering personal data irretrievable and non-reusable.

4. Reasons for Retention and Destruction of Personal Data

Reasons for Retention

• Being directly related to the establishment or performance of a contract
• Fulfillment of a legal obligation
• Establishment or protection of a right
• Legitimate interest
• Explicitly stipulated by legislation
• Explicit consent

Reasons for Destruction

• Elimination of the reason for processing
• Amendment of the legislation
• Acceptance of the data subject’s request
• Expiration of the maximum retention period

5. Retention and Destruction Periods

Personal data shall be retained for the period stipulated in the legislation; if no such period is specified, for the period necessary for the purpose of processing.

After the reason for processing ceases to exist, personal data shall be deleted within 6 months at the latest.

The periodic destruction period is 6 months. Records of destruction processes shall be retained for at least 8 years.

6. Methods of Destruction

Deletion

• Removal of access authorizations
• Physical removal or rendering irrecoverable in paper environments
• Conducting log checks

Destruction (Physical Erasure)

Data stored in physical environments are destroyed by a contracted and certified destruction company, and a destruction report is issued.

Anonymization

The masking method is applied to ensure that data cannot be associated with an identifiable person.

7. Personnel

The personnel responsible for retention and destruction processes are specified in Annex 2.

8. Policy Amendments

Policy amendments shall enter into force on the date they are published at www.egeseramik.com.

ANNEX 1 – Retention and Destruction Periods Table

ANNEX 2 – Personnel Table