PERSONAL DATA STORAGE AND DESTRUCTION POLICY

KYS-ELK05

This document belongs to 'NUCLEUS GENETIC PRODUCTS INC.' and its Group Companies. It may not be copied or taken outside the company without permission.

TOPICS PAGE NUMBER

1. INTRODUCTION 1
2. OBJECTIVE 1
3. SCOPE 1
4. DEFINITIONS 2
5. GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA 3
6. Compliance with the Law and Rules of Honesty 3
7. Being Accurate and Up-to-Date (3)
8. Processing for Specific, Explicit and Legitimate Purposes 3
9. Being Relevant, Limited, and Proportional to the Purpose for Which They Are Committed 3
10. Retention for the period stipulated in the relevant legislation or for the period necessary for the purpose for which they were processed. 3
11. PROCESSING OF PERSONAL DATA 3
12. Conditions for Processing Personal Data 4
13. Processing of Special Categories of Personal Data 4
14. Categorization of Personal Data Processed by Our Company 4
15. ENSURING THE SECURITY AND PRIVACY OF PERSONAL DATA 5
16. Technical Measures Taken to Ensure the Lawful Processing of Personal Data and Prevent Unlawful Access 6
17. Administrative Measures Taken to Ensure the Lawful Processing of Personal Data and Prevent Unlawful Access 6
18. Measures to be Taken in Case of Unlawful Disclosure of Personal Data 6
19. PURPOSES OF PROCESSING PERSONAL DATA AND STORAGE PERIODS 6
20. Purposes of Processing Personal Data 6
21. Personal Data Retention Periods 7
22. DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA 7
23. Techniques for Deleting and Destroying Personal Data 7
24. Physical Destruction 7
25. Safely Deleting/Deleting Software 7
26. Expert-Guided Safe Deletion/Destruction 7
27. Techniques for Anonymizing Personal Data 7
28. Masking 7
29. Consolidation 7
30. Data Generation 8
31. Data Hash 8
32. THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED AND THE PURPOSES OF TRANSFER 8
33. Domestic Transfer of Personal Data 8
34. Transfer of Personal Data Abroad 8
35. Groups of Individuals to Whom Personal Data is Transferred by Our Company 8
36. OUR COMPANY'S LIGHTING OBLIGATION 9
37. RIGHTS OF PERSONAL DATA SUBJECTS AND THE EXERCISE OF THESE RIGHTS 9
38. Right to Apply 9
39. Situations Excluded from the Scope of Application 9
40. Procedure for Responding 10
41. PERSONAL DATA PROCESSING ACTIVITIES CARRIED OUT WITHIN THE COMPANY

DATA PROCESSING ACTIVITIES PERFORMED ON THE WEBSITE 10

1. Implementing Monitoring with Cameras 10
2. Customer Arrivals and Departures at the Company: 10
3. Website Visitors 10
4. PERSONAL DATA STORAGE AND DESTRUCTION POLICY 10
5. The Purpose of Policy 10
6. Scope of Policy 11
7. Definitions 11
8. Regulated Record Media by Policy 12
9. Environments Where Personal Data is Stored 12
10. Ensuring the Safety of Environments 12
11. Technical Measures 12
12. Administrative Measures 12
13. Internal Audit 13
14. Duties and Powers of the Personal Data Protection Committee 13
15. Actions to be Taken When the Conditions for Processing Personal Data Cease to Exist 13
16. Policy Implementation, Violations and Sanctions 14
17. Persons Involved in Personal Data Storage and Destruction Processes and Their Responsibilities 14
18. Personal Data Protection Committee 14
19. Reasons for Storage and Destruction 15
20. Reasons for Storage 15
21. Reasons for Destruction 15
22. Destruction Methods 15
23. Deletion Methods 15
24. Methods of Destruction 16
25. Anonymization Methods 16
26. Personal Data Storage and Destruction Periods 17
27. Personal Data Retention Periods Table (Durations) 17
28. Destruction Periods 18
29. Periodic Destruction Intervals 18
30. MONITORING THE LEGALITY OF THE DESTRUCTION PROCESS 19
31. Technical Measures 19
32. Administrative Measures 19
33. 19
34. UPDATE AND COMPLIANCE 19
35. FORMS AND ATTACHMENTS 19

1. INTRODUCTION

 According to Article 20 of the Constitution of the Republic of Turkey ( https://www.anayasa.gov.tr/tr/mevzuat/anayasa/ ), everyone has the right to request the protection of their personal data. This right includes the right to be informed about personal data concerning oneself, to access this data, to request its correction or deletion, and to learn whether it is being used for its intended purposes.

In the context of exercising this constitutional right, the Law No. 6698 on the Protection of Personal Data ( “KVKK” ), which regulates the protection of fundamental rights and freedoms of individuals in the processing of personal data and the obligations of natural and legal persons processing personal data, as well as the procedures and principles they must comply with, has been published and entered into force. NUCLEUS GENETIC PRODUCTS INC. ( “NUCLEUS GENETICS” ) demonstrates the necessary diligence in complying with the requirements set forth in the KVKK and makes this a company policy with this Personal Data Protection and Processing Policy (“ Policy ”).

The subject of this policy is the protection of personal data belonging to job applicants, employees, dealers, suppliers, contractors, visitors, employees of institutions we cooperate with, customers, and third parties (guarantors, victims/right holders) by “NUCLEUS GENETİK ” . Activities related to the protection of our employees' personal data are managed within the framework of the Information Security Management System, disciplinary regulations, employee explicit consent, employee confidentiality procedures, and supplier confidentiality agreements.

2. OBJECTIVE

The purpose of this Policy is to provide explanations regarding the personal data processing activities carried out by "NUCLEUS GENETIC PRODUCTS INC." in accordance with the Personal Data Protection Law (KVKK) and the principles adopted for the protection of personal data, and to ensure   transparency by informing individuals whose personal data is processed by "NUCLEUS GENETIC PRODUCTS INC.", primarily Job Applicants, Dealers, Suppliers, Contractors, Visitors, Employees of Institutions with which we cooperate, Customers, and Third Parties with rights.

3. SCOPE

 Data subjects whose personal data is processed within the scope of this Policy are categorized as follows:

4. DEFINITIONS

The definitions used in this Policy are listed below:

5. GENERAL PRINCIPLES REGARDING THE PROCESSING OF PERSONAL DATA

According to Article 3 of the KVKK (Law on the Protection of Personal Data), any operation performed on personal data, such as obtaining, recording, storing, preserving, modifying, reorganizing, disclosing, transferring, acquiring, making available, classifying, or preventing the use of data, whether wholly or partly through non-automatic and/or automated means, falls within the scope of processing personal data.

The following principles must be observed in the processing of personal data:

5.1. Compliance with the Law and Principles of Honesty

“: 'NUCLEUS GENETIC PRODUCTS INC.' ' '  Personal Data Processing Activities; Compliance with Legal Requirements and Control Procedure .

The Turkish Constitution , the Personal Data Protection Law (KVKK), related legislation, and principles of honesty are followed in its implementation.

5.2. Being Accurate and Up-to-Date When Necessary

While carrying out personal data processing activities, all administrative and technical measures to ensure the accuracy and timeliness of personal data  are taken by "NUCLEUS GENETIC PRODUCTS INC.".

5.3. Processing for Specific, Explicit and Legitimate Purposes

"NUCLEUS GENETIC PRODUCTS INC.  clearly and precisely defines the purpose of personal data processing before commencing any personal data processing activity. "

5.4. Being Relevant, Limited, and Proportional to the Purpose for Which They Are Used

Personal data is processed by “NUCLEUS GENETİK ÜRÜNLERİ ANONİM ŞİRKETİ” only  for specific, explicit, and legitimate purposes, and only to the extent necessary and in connection with the relevant purpose. Data processing is not carried out with the assumption that it may be used later.

5.5. Retention for the Period Stipulated in the Relevant Legislation or for the Period Necessary for the Purpose for Which They Were Processed

"NUCLEUS GENETIC PRODUCTS INC."  stores personal data for a period limited to that stipulated in the Personal Data Protection Law and related legislation, or as required by the purposes of the data processing activity.

6. PROCESSING OF PERSONAL DATA

"NUCLEUS GENETIC PRODUCTS INC." conducts its personal data and special categories of personal data processing activities in accordance with the data processing conditions set forth in Articles 5 and 6 of the KVKK (Law on Protection of Personal Data).

6.1. Conditions for Processing Personal Data

“NUCLEUS GENETIC PRODUCTS INC.” may process personal data with the explicit consent of the data subject or, in the cases stipulated in Article 5 of the Personal Data Protection Law and listed below, without explicit consent:

1. If it is explicitly provided for in the laws.
2. Consent must be given in cases where the person is unable to express their consent due to factual impossibility or where their consent is not legally valid, and it must be necessary for the protection of their own life or the life or physical integrity of another person.
3. The processing of personal data belonging to the parties to a contract is necessary provided that it is directly related to the establishment or performance of the contract.
4. This is necessary for NUCLEUS GENETİK to fulfill its legal obligations.
5. The personal data has been made public by the data owner themselves.
6. Data processing is necessary for the establishment, exercise, or protection of a right.
7. Data processing is necessary for the legitimate interests of NUCLEUS GENETİK, provided that it does not harm the fundamental rights and freedoms of the personal data owner.

6.2. Processing of Special Categories of Personal Data

"NUCLEUS GENETIC PRODUCTS INC."  processes special categories of personal data, which carry the risk of creating discrimination if processed unlawfully, in accordance with the data processing conditions set forth in Article 6 of the Personal Data Protection Law.

Processing special categories of personal data without the explicit consent of the data subject is prohibited. However, personal data other than health and sexual life data may be processed in cases stipulated by law; and personal data relating to health and sexual life may only be processed by persons or authorized institutions and organizations bound by an obligation of confidentiality, without seeking the explicit consent of the data subject, for the purposes of protecting public health, preventive medicine, medical diagnosis, treatment and care services, and planning and managing health services and their financing.

Measures determined by the Personal Data Protection Board for processing special categories of personal data by NUCLEUS GENETİK

It is effectively implemented by [the relevant authority].

6.3. Categorization of Personal Data Processed by Our Company Categories of Personal Data Processed

7. ENSURING THE SECURITY AND PRIVACY OF PERSONAL DATA

"NUCLEUS GENETIC PRODUCTS INC."  takes all necessary technical and administrative measures, in accordance with Article 12 of the Personal Data Protection Law, to ensure the lawful processing and storage of personal data it processes and to prevent unlawful access to said personal data.

The Company's GDPR unit, which undertakes the corporate compliance function, is responsible for the internal coordination of the activities within the scope of the GDPR, ensuring that these activities are carried out adequately and effectively as a whole within the framework of this policy. In this context, the said unit;

1. This policy will be monitored and updated as needed, and submitted to the Board of Directors for approval.
2. Developing other policies and procedures outside of this policy regarding the protection, processing, and destruction of personal data in coordination with the relevant company units.
3. Assigning tasks necessary for the implementation of policies and procedures and submitting them for approval to senior management,
4. Planning the monitoring and supervision of the implementation of all technical and administrative measures taken in accordance with the article of the law,
5. Monitoring the processes related to applications and requests made by personal data owners and ensuring the necessary coordination to resolve any problems that may arise.
6. Identifying and overseeing the implementation of measures necessary to ensure compliance with the Personal Data Protection Law and related legislation.
7. Authorized to conduct relations with the Personal Data Protection Board.

7.1. Technical Measures Taken to Ensure the Lawful Processing of Personal Data and Prevent Unlawful Access

All necessary technical security measures have been taken to protect personal data, and an adequate level of protection has been provided against potential risks. The main technical measures taken are listed below.

1. "NUCLEUS GENETIC PRODUCTS INC. periodically implements authorization and access controls on systems that provide access to personal data."
2. The technical measures taken are also monitored separately from executive activities within the scope of risk management, internal control, and internal audit processes.
3. Employing personnel with a sufficient level of expertise.

7.2. Administrative Measures Taken to Ensure the Lawful Processing of Personal Data and Prevent Unlawful Access

1. "NUCLEUS GENETIC PRODUCTS INC. employees comply with the Personal Data Protection Law (KVKK)."

They are being educated and made aware of the issue.

1. In cases involving the transfer of personal data, general terms and conditions are established with the parties to whom the personal data is transferred, outlining the obligations that must be fulfilled for the security of personal data in accordance with the Personal Data Protection Law, and these terms and conditions are signed by each of the counterparties.
2. To ensure compliance with the Personal Data Protection Law (KVKK), implementation rules are determined on a per-business-unit basis, and necessary administrative measures are implemented through internal company procedures and training to ensure their continuity.
3. "Contracts and documents governing the legal relationship between NUCLEUS GENETIC PRODUCTS INC. and the other parties include clauses obligating employees not to process, disclose, or use personal data, except as per NUCLEUS GENETIC's instructions and exceptions mandated by law. Employees are made aware of this obligation, and audits are conducted."

7.3. Measures to be Taken in Case of Unlawful Disclosure of Personal Data

In line with the requirements for compliance with the Personal Data Protection Law (KVKK), an internal procedure has been developed to ensure that if personal data processed is obtained by others through unlawful means, this situation is reported to the relevant data owner and the KVKK Board as soon as possible.

8. PURPOSES OF PROCESSING PERSONAL DATA AND STORAGE PERIODS

8.1 Purposes of Processing Personal Data

 Personal data is processed by "NUCLEUS GENETIC PRODUCTS INC." for the purposes listed below:

1. Managing after-sales support processes for goods/services,
2. Receiving and evaluating suggestions for improving business processes,
3. Execution of customer relationship management processes,
4. Conducting activities aimed at customer satisfaction,
5. Execution of marketing processes for products/services,
6. Execution of advertising/campaign/promotion processes
7. Planning and execution of our company's commercial and/or business strategies,
8. Execution of Finance and Accounting Operations
9. Monitoring and Execution of Legal Affairs
10. Execution of Logistics Activities
11. Execution of Goods/Services Procurement Processes
12. Execution of After-Sales Support Services for Goods/Services
13. Execution of Goods/Services Sales Processes
14. Execution of Goods/Services Production and Operation Processes
15. Execution of Customer Relationship Management Processes
16. Execution of Contract Processes
17. Implementation of Strategic Planning Activities
18. Conducting Marketing Analysis Studies
19. Conducting activities aimed at customer satisfaction.
20. Execution of Customer Relationship Management Processes
21. Implementation of Wage Policy

8.2 Retention Periods for Personal Data

"NUCLEUS GENETIC PRODUCTS INC.   determines whether a specific retention period for personal data is stipulated in the relevant legislation, and in accordance with Article 138 of the Turkish Penal Code and Articles 4 and 7 of the Personal Data Protection Law, ensures that processed personal data is retained only for the period stipulated in the relevant legislation, or, if no period is stipulated in the relevant legislation, for the period required by the purpose of personal data processing."

9. DELETION, DESTRUCTION AND ANONYMIZATION OF PERSONAL DATA

If the purpose for processing personal data has ended and the retention periods determined by the relevant legislation and/or NUCLEUS GENETİK have expired, personal data is deleted, destroyed or anonymized by NUCLEUS GENETİK ÜRÜNLERİ ANONİM ŞİRKETİ, either upon the request of the data subject or ex officio.

The procedures and principles regarding this matter are determined within the framework of the Personal Data Protection Law (KVK Law) and the Regulation on the Deletion, Destruction, or Anonymization of Personal Data.

9.1. Techniques for Deleting and Destroying Personal Data

It is essential that personal data be deleted and destroyed using appropriate methods on the data storage media.   The possible deletion or destruction techniques that "NUCLEUS GENETIC PRODUCTS INC." may use are listed below:

9.1.1. Physical Destruction

Personal data can also be processed through non-automated means, provided it is part of a data recording system. When such data is deleted/destroyed, a system is applied that physically destroys the personal data in a way that prevents its subsequent use.

9.1.2. Safely Deleting/Destroying Software

When data processed entirely or partially automatically and stored in digital environments is deleted/destroyed, methods are used to ensure that the data is erased from the relevant software in such a way that it cannot be recovered by specific individuals or in any form whatsoever.

9.1.3. Safe Deletion/Destruction by an Expert

"NUCLEUS GENETIC PRODUCTS INC. may, in some cases, contract with an expert to delete/destroy personal data on its behalf. In this case, the personal data will be securely deleted/destroyed by the expert in a way that prevents its recovery."

9.2. Techniques for Anonymizing Personal Data

Anonymization of personal data means rendering personal data such that, even when combined with other data, it cannot in any way be linked to an identified or identifiable natural person.

In accordance with Article 28 of the Personal Data Protection Law (KVKK), anonymized personal data may be processed for purposes such as research, planning, and statistics. Such processing falls outside the scope of the KVKK, and the explicit consent of the data subject will not be required. Since personal data processed in anonymized form falls outside the scope of the KVKK, the rights stipulated in Section 12 of this Policy will not apply to this data. The most likely anonymization techniques to be used by "NUCLEUS GENETİK ÜRÜNLERİ ANONİM ŞİRKETİ" are listed below.

9.2.1. Masking

Data masking is a method of anonymizing personal data by removing its key identifying information from a dataset.

9.2.2. Consolidation

Data aggregation methods combine many types of data, and personal data is not shared with any individual.

It is being made impossible to relate to it.

9.2.3. Data Derivation

Data extraction methods are used to create more general content from the content of personal data, making it impossible to link the personal data to any single individual.

9.2.4. Data Hashing

Data mixing involves shuffling the values ​​within a personal data set, thereby breaking the link between those values ​​and individuals.

10. THIRD PARTIES TO WHOM PERSONAL DATA IS TRANSFERRED AND THE PURPOSES OF TRANSFER

The procedures and principles to be applied in the transfer of personal data are regulated in Articles 8 and 9 of the Law on the Protection of Personal Data (KVKK). For the purpose of fulfilling the services provided by NUCLEUS GENETİK  , personal data is processed within the framework of the provisions of the Labor Law, the Occupational Health and Safety Law, the Law No. 6502 on Consumer Protection and other regulations related to these laws, the regulations of supervisory and regulatory institutions and organizations, and cases where public authorities mandate it, but not limited to these, and may be transferred to natural persons or private legal entities, our business partners, affiliates and subsidiaries, organizations from which we receive information technology support, and authorized public institutions and persons.

Except for the exceptions specified in the Personal Data Protection Law (KVKK), personal data cannot be transferred without the explicit consent of the data subject.

10.1. Transfer of Personal Data Within the Country

In accordance with Article 8 of the Personal Data Protection Law, the transfer of personal data within the country is possible only if one of the conditions specified in section 6.1 titled "Conditions for Processing Personal Data" of this Policy is met.

10.2. Transfer of Personal Data Abroad

In accordance with Article 9 of the Law on the Protection of Personal Data (KVKK), when personal data is transferred abroad, in addition to fulfilling the conditions for domestic transfers, one of the following conditions must be met:

1. The country to which the data transfer will be made must be among the countries declared by the GDPR Board as having adequate protection.
2. If adequate protection is not available in the country to which the data will be transferred, the data controllers in Türkiye and the relevant foreign country must provide a written commitment to adequate protection and obtain the permission of the Personal Data Protection Board for this.

10.3. Groups of Individuals to Whom Our Company Transfers Personal Data

NUCLEUS GENETİK may transfer the personal data of data subjects, in accordance with Articles 8 and 9 of the KVKK (Personal Data Protection Law) and within the scope of this Policy, to the following groups of individuals for the purposes stated below:

11. OUR COMPANY'S LIGHTING OBLIGATIONS

"NUCLEUS GENETIC PRODUCTS INC. informs personal data owners during the collection of personal data in accordance with Article 10 of the Law on the Protection of Personal Data (KVKK). In this context, NUCLEUS GENETIC fulfills its obligation to inform by providing the following information to personal data owners:"

1. NUCLEUS GENETİK's title as data controller
2. The purpose for which personal data will be processed
3. To whom and for what purpose can processed personal data be transferred?
4. Method and legal basis for collecting personal data.
5. Data subject rights

12. RIGHTS OF PERSONAL DATA SUBJECTS AND THE EXERCISE OF THESE RIGHTS

In accordance with Article 13 of the Personal Data Protection Law (KVKK), data subjects may submit their requests regarding the rights listed under section 12.1 of this chapter to NUCLEUS GENETİK by filling out and signing the Application Form using the methods specified below or other methods determined by the KVKK Board . The request will be processed free of charge, depending on its nature.

After filling out the application form found on  the NUCLEUS GENETİK corporate website (https://nucleusgenetics.com.tr/);

A signed copy must be delivered in person or via notary public to the following address: NUCLEUS GENETIC PRODUCTS INC.,   KAZIM DIRIK NEIGHBORHOOD, UNIVERSITY STREET NO: 79/24, BORNOVA/IZMIR.

1. After being signed with a "secure electronic signature" within the scope of the Electronic Signature Law No. 5070, the form with the secure electronic signature must be sent to the registered electronic mail address of derensu.

"NUCLEUS GENETIC PRODUCTS INC." may request information from the data subject to determine whether they are the data subject's personal data owner and may ask questions to clarify the matters included in the data subject's application.

12.1. Right to Apply

In accordance with Article 11 of the Law on the Protection of Personal Data (KVKK), data subjects have the right to make requests to AVRASYA regarding the following matters  :

1. To find out whether your personal data is being processed,
2. If your personal data has been processed, you have the right to request information about it.
3. To learn the purpose of processing your personal data and whether your personal data is being used in accordance with its purpose,
4. To learn the third parties to whom your personal data is transferred, whether domestically or internationally.
5. The right to request the correction of personal data if it has been processed incompletely or inaccurately, and to request that this correction be notified to third parties to whom the personal data has been transferred.
6. The right to request the deletion, destruction, or anonymization of personal data if the reasons requiring its processing cease to exist, and to request that this action be notified to third parties to whom the personal data has been transferred.
7. The right to object to an outcome that is detrimental to the data subject, resulting solely from the analysis of their processed data by automated systems.
8. The right to claim compensation for damages incurred as a result of the unlawful processing of personal data.

12.2. Situations Excluded from the Scope of the Right to Apply

According to Article 28 of the Personal Data Protection Law (KVKK), the following cases are excluded from the scope of the KVKK, and therefore, personal data owners cannot exercise their right to apply in these situations:

1. Personal data may be processed for purposes such as research, planning, and statistics, through official statistics and by anonymizing the data.
2. Personal data may be processed for artistic, historical, literary, or scientific purposes, or within the scope of freedom of expression, provided that it does not violate national defense, national security, public safety, public order, economic security, privacy, or personal rights, or constitute a crime.

According to Article 28, paragraph 2 of the Law on the Protection of Personal Data (KVKK), data subjects cannot assert their rights in the following cases, except for the right to claim compensation for damages:

1. The processing of personal data is necessary for the prevention of crime or for criminal investigation.
2. Processing of personal data that has been made public by the data subject themselves.

12.3. Procedure for Responding

In accordance with Article 13 of the Personal Data Protection Law (KVKK), “NUCLEUS GENETIC PRODUCTS INC.” processes the applications submitted by the personal data owner free of charge as soon as possible and within a maximum of 30 (thirty) days, depending on the nature of the request. However, if the process requires additional costs, it is possible to charge the fee specified in the tariff determined by the KVKK Board.

“NUCLEUS GENETIC PRODUCTS INC.” may accept the personal data owner's application or reject it for the reasons listed below, and may notify the data subject of its response in writing or electronically.

1. Infringing on the rights and freedoms of other people
2. Requiring disproportionate effort
3. The information being publicly available
4. jeopardizing the privacy of others
5. The existence of one of the situations that fall outside the scope of the Personal Data Protection Law.

If a personal data owner's application is rejected, if they find the response insufficient, or if they do not receive a response within the stipulated time, they have the right to file a complaint with the Personal Data Protection Board within thirty days of learning of the data controller's response, and in any case within sixty days of the application date.

13. PERSONAL DATA PROCESSING ACTIVITIES CARRIED OUT WITHIN THE COMPANY AND DATA PROCESSING ACTIVITIES CARRIED OUT ON THE WEBSITE

13.1. Implementing Monitoring with Cameras

"NUCLEUS GENETIC PRODUCTS INC." monitors its headquarters and dealerships through cameras inside the buildings.

In accordance with the regulations in the Personal Data Protection Law (KVKK), "NUCLEUS GENETİK ÜRÜNLERİ ANONİM ŞİRKETİ" posts notification notices regarding camera surveillance activities at the entrances of the areas where camera surveillance is conducted, and provides the necessary information through this Policy on our website.

Monitoring is not permitted in areas that could result in an intrusion into personal privacy. Security camera recordings are only accessible to a limited number of company employees and, if necessary, employees of the security company acting as a supplier. These individuals, through a signed confidentiality agreement, declare their commitment to protecting the confidentiality of the data they access.

13.2. Customer Arrivals and Departures for Company Visits

NUCLEUS GENETİK processes personal data to track the entry and exit of its visitors. The personal information of individuals visiting NUCLEUS GENETİK is processed solely for the purpose of tracking their entry and exit, and this personal data is recorded electronically in the data system.

13.3. Website Visitors

NUCLEUS Health's website records the internet activity of visitors (via technical means such as cookies) in order to display personalized content and conduct online advertising activities.

14. PERSONAL DATA STORAGE AND DESTRUCTION POLICY

14.1. Purpose of the Policy

The purpose of this policy is to define all the rules, roles, and responsibilities to be applied throughout “NUCLEUS GENETİK ÜRÜNLERİ ANONİM ŞİRKETİ” in order to fulfill the obligations regarding the storage and destruction of personal data and other obligations specified in the Regulation on the Deletion, Destruction, or Anonymization of Personal Data, which was issued based on the Law No. 6698 on the Protection of Personal Data (the Law) and published in the Official Gazette No. 30224 on October 28, 2017, in accordance with Articles 5 and 6     of the Regulation.

14.2. Scope of the Policy

Policy: “The personal data and special categories of personal data held by NUCLEUS GENETIC PRODUCTS INC.  , as defined by Law No. 6698, encompass all  employees, managers, consultants, and, in all cases where personal data sharing is involved, affiliates, external service providers, and  other natural and legal persons with whom NUCLEUS Health has a legal relationship.  ”

As stated in the Policy Law, this covers personal data contained in systems where data is processed wholly or partly automatically, or through non-automatic means provided that it is part of any data recording system.

Unless otherwise stated in this Policy, personal data and special categories of personal data will be referred to generally as "Personal Data".

14.3. Definitions

1. Anonymization : The process of rendering personal data in such a way that, even when combined with other data, it cannot be linked in any way to an identified or identifiable natural person.
2. Destruction : The deletion or destruction of personal data.
3. Personal Data : Any information relating to an identified or identifiable natural person.
4. Personal Data Retention Table (Periods) : Personal data: This table shows the periods for which personal data will be kept by “NUCLEUS GENETIC PRODUCTS INC.”
5. Personal Data Processing Inventory : An inventory created by data controllers detailing their personal data processing activities based on their business processes; associating these activities with the purposes of processing, data category, recipient group to whom the data is transferred, and data subject group; and specifying the maximum period for which the personal data is necessary for the purposes for which it is processed, the personal data intended to be transferred to foreign countries, and the measures taken regarding data security.
6. Deletion of Personal Data: The process of making personal data completely inaccessible and unusable for the relevant users.
7. Destruction of Personal Data : The process of rendering personal data inaccessible, irretrievable, and unusable by anyone in any way.
8. Special Categories of Personal Data: Data relating to a person's race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and clothing, membership in associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data.
9. Periodic Destruction : The process of deleting, destroying, or anonymizing personal data, which will be carried out automatically at recurring intervals as specified in the personal data retention and destruction policy, when all the conditions for processing personal data stipulated in the law cease to exist.
10. Data Recording System : A recording system in which personal data is processed by structuring it according to specific criteria.
11. Direct Identifiers : Identifiers that, on their own, directly reveal, disclose, and distinguish the person they are related to.
12. Indirect Identifiers : Identifiers that, when combined with other identifiers, reveal, disclose, and distinguish the person with whom they are related.
13. Law : The Law No. 6698 on the Protection of Personal Data, published in the Official Gazette dated 07.04.2016 and numbered 29677.
14. Regulation : The Regulation on the Deletion, Destruction or Anonymization of Personal Data, published in the Official Gazette dated 10.2017 and numbered 30224.
15. Board : The Personal Data Protection Board,
16. DATA RECORDING MEDIUM : Any medium containing personal data processed wholly or partly automatically, or by non-automatic means as part of any data recording system, https://nucleusgenetics.com.tr/
17. Personal Data Protection and Processing Policy : This policy, accessible at [address], sets out the procedures and principles for managing personal data held by “NUCLEUS GENETİK ÜRÜNLERİ ANONİM ŞİRKETİ”.
18. Data Recording System : A recording system in which personal data is processed by structuring it according to specific criteria.

It expresses.

14.4. Registration Media Regulated by Policy

Any medium containing personal data processed wholly or partly automatically, or through non-automatic means provided it is part of a data recording system, falls within the scope of recording media.

14.4.1. Environments Where Personal Data is Stored

Personal data stored by “NUCLEUS GENETİK ” is kept in a record-keeping environment appropriate to the nature of the data and our legal obligations.

The storage media used for personal data are generally listed below. However, some data may be stored and kept in a different medium than those shown here due to their special nature or our legal obligations. “Öyküm Su ” acts as the data controller and processes and protects personal data in accordance with the Personal Data Protection Law, the Personal Data Protection, Processing, Storage and Destruction Policy.

14.4.2. Ensuring the Security of Environments

“NUCLEUS GENETİK ” takes all necessary technical and administrative measures, in accordance with the characteristics of the personal data and the environment in which it is stored, to ensure the secure storage of personal data and to prevent its unlawful processing and access.

These measures include, but are not limited to, the following administrative and technical measures, to the extent that they are appropriate to the nature of the personal data and the medium in which it is stored.

14.4.2.1. Technical Measures

“NUCLEUS GENETİK ” takes the following technical measures in all environments where personal data is stored, in accordance with the nature of the data and the environment in which the data is kept:

1. Only up-to-date and secure systems that are in line with technological advancements are used in environments where personal data is stored; security systems are used for environments where personal data is stored.
2. Security tests and investigations are conducted to identify security vulnerabilities in information systems, and the existing or potential risks identified as a result of these tests and investigations are reported.
3. By restricting access to the environments where personal data is stored, only authorized persons are allowed to access this data, and this access is limited to the purpose for which the personal data is stored.
4. “NUCLEUS GENETİK” employs sufficient technical personnel to ensure the security of the environments where personal data is stored.

14.4.2.2. Administrative Measures

“NUCLEUS Health ” takes the following administrative measures within the scope of the Personal Data Protection Law (KVKK) in accordance with the nature of the data and the environment in which the data is stored:

1. All “NUCLEUS health” personnel who have access to personal data
2. "Efforts are being made to increase and educate employees on information security, personal data, and the privacy of private life."
3. Legal and technical consultancy services are obtained to monitor developments in the fields of information security, privacy, and personal data protection, and to take necessary actions.
4. When personal data is transferred to third parties due to technical or legal requirements, protocols are signed with these third parties to protect the personal data, and all necessary care is taken to ensure that these third parties comply with their obligations in these protocols.

14.4.2.3. Internal Audit

“NUCLEUS GENETİK  ” conducts internal audits in accordance with Article 12 of the Law regarding the implementation of the provisions of the Law and the provisions of this Personal Data Protection, Processing, Storage and Destruction Policy, in compliance with the KVKK (Personal Data Protection Law).

If internal audits reveal any deficiencies or shortcomings in the implementation of these provisions, these deficiencies or shortcomings shall be rectified immediately.

If, during an audit or otherwise, it is discovered that personal data under the responsibility of “NUCLEUS GENETICS” has been obtained by others through unlawful means, “NUCLEUS HEALTH”

 "This situation will be reported to the relevant party and the Board as soon as possible."

14.5. Duties and Powers of the Personal Data Protection Committee

The Personal Data Protection Committee is responsible for communicating the policy to the relevant business units and ensuring its implementation at “NUCLEUS Health ”.

" is responsible for monitoring the implementation by the relevant units. "

The Personal Data Protection Committee makes the necessary announcements and notifications to the relevant business units so that they can monitor changes in legislation regarding the protection of personal data, regulatory actions and decisions of the Board, court decisions, or changes in processes, practices and systems, and update their business processes if necessary.

The Personal Data Protection Committee defines the processes for examining, evaluating, monitoring, and concluding the Law and its secondary regulations, the Board's decisions and regulations, court decisions, and decisions and/or requests of other authorized authorities, and communicates them to the relevant units.

14.6. Actions to be Taken When the Conditions for Processing Personal Data Cease to Exist

If the purpose for processing personal data ceases to exist, if explicit consent is withdrawn, or if all the conditions for processing personal data set forth in Articles 5 and 6 of the Law cease to exist, or if none of the exceptions in the aforementioned articles apply, the personal data for which the processing conditions have ceased to exist shall be deleted, destroyed, or anonymized by the relevant business unit, taking into account business needs, within the scope of Articles 7, 8, 9, or 10 of the Regulation, with an explanation of the justification for the method applied. However, in the case of a final court decision, the destruction method ordered by the court decision must be applied.

All users and units of “ NUCLEUS GENETİK ÜRÜNLERİ ANONİM ŞİRKETİ” that process or store personal data shall review whether the conditions related to processing have ceased to exist in the data storage media they use, at the latest within periods of four months. Upon the application of the personal data owner or upon notification from the Board or a court, the relevant users and units shall conduct this review in the data storage media they use, regardless of the periodic review period.

If, as a result of periodic reviews or at any time, it is determined that the conditions for data processing have ceased to exist, the relevant user or data owner will decide whether to delete, destroy (eliminate), or anonymize the relevant personal data from the storage medium under their control, in accordance with this policy. In cases of doubt, the relevant data owner business unit will be consulted before proceeding. When a decision needs to be made regarding the destruction of personal data with multi-stakeholder ownership in the Central Information Systems, the opinion of the Personal Data Protection Committee will be sought, and the relevant data owner business unit will decide whether to retain, delete, destroy (eliminate), or anonymize the data in accordance with this policy.

All processes related to the deletion, destruction, or anonymization of personal data are recorded, and these records are kept for at least three years, excluding other legal obligations.

In accordance with Article 7.4 of the Regulation, the methods applied for the deletion, destruction (elimination), and anonymization of personal data will be published and explained after the Policy enters into force.

The deletion, destruction (elimination), or anonymization of personal data must comply with the general principles set forth in Article 4 of the Law, the technical and administrative measures required under Article 12, relevant legislation, Board decisions, and court rulings.

When a natural person, the owner of personal data, requests the deletion, destruction, or anonymization of their personal data by applying to "NUCLEUS Health " pursuant to Article 13 of the Law, the relevant data owner business unit examines whether all the conditions for processing the personal data have ceased to exist. If all the processing conditions have ceased to exist, it deletes, destroys, or anonymizes the personal data in question.

In this case, as detailed in the Data Destruction Procedure, the request is finalized within a maximum of thirty days from the date of application, and the relevant person is informed through the GDPR contact person appointed by the GDPR Officer. If all conditions for processing personal data have ceased to exist and the personal data subject to the request has been transferred to third parties, the relevant data owner business unit immediately notifies the third party to whom the data has been transferred and ensures that the necessary actions are taken by the third party in accordance with the Regulation.

In cases where all conditions for processing personal data have not ceased to exist, requests from personal data owners for the deletion or destruction of their data will be processed by "NUCLEUS GENETİK" in accordance with Article 13 of the Law.

1. According to the relevant article, the application may be rejected with an explanation of the reasons. The rejection will be communicated to the applicant in writing or electronically within a maximum of 30 days.

Requests for the deletion or destruction of personal data will only be considered if the data subject's identity has been verified. Requests made through channels other than these will direct data subjects to channels where identity verification or authentication can be performed.

14.7. Implementation of the Policy, Violations and Sanctions

This Policy will come into effect upon announcement to all employees and data subjects via the “NUCLEUS GENETİK” website and will be binding on all business units, consultants, customers, insurance companies, external service providers, and anyone else processing personal data within “NUCLEUS GENETİK” from the moment it enters into force.

Monitoring whether "NUCLEUS GENETİK" employees comply with the requirements of the Policy will be the responsibility of the relevant employees' supervisors. If any violation of the Policy is detected, the matter will be immediately reported by the employee's supervisor to their immediate superior. If the violation is significant, the superior will promptly inform the Personal Data Protection Committee.

Following an evaluation by Human Resources, the necessary administrative action will be taken regarding the employee who violated the policy.

To fulfill policy requirements, "NUCLEUS GENETICS" takes all necessary security measures within the scope of the Personal Data Protection Law (KVKK).

14.8. Persons Involved in Personal Data Storage and Destruction Processes and Their Responsibilities

Within "NUCLEUS GENETİK," all employees, customers, insurance companies, consultants, external service providers, and anyone else who stores and processes personal data within "NUCLEUS GENETİK " are responsible for fulfilling the data destruction requirements specified in the Law, Regulations, and Policies .

Each business unit is responsible for storing and protecting the data it generates in its own business processes; however, if the generated data exists solely in information systems and is outside the control and authority of the business unit, then that data will be stored by the units responsible for the information systems.

Periodic deletions that may affect business processes and lead to data integrity breaches, data loss, and violations of legal regulations will be carried out by the relevant information systems departments, taking into account the type of personal data, the systems in which it is located, and the business unit that owns the data.

14.8.1. Personal Data Protection Committee

“NUCLEUS GENETİK” establishes a Personal Data Protection Committee. The Personal Data Protection Committee is authorized and responsible for taking/having taken the necessary actions and overseeing the processes to ensure that the data of the relevant individuals is stored and processed in accordance with the law and the Personal Data Protection, Processing, Storage and Destruction Policy.

The Personal Data Protection Committee consists of at least three people: a manager, an administrative expert, and a technical expert. The titles and job descriptions of the “NUCLEUS GENETİK” employees serving on the Personal Data Committee are listed below:

14.8.2. Reasons for Storage and Destruction

14.8.2.1. Reasons for Storage

Personal data held within “NUCLEUS GENETİK” is stored in accordance with the Law and our Personal Data Policy (which can be accessed at “ https://nucleusgenetics.com.tr/ ”), for the purposes and reasons stated herein.

14.8.2.2. Reasons for Destruction

Personal data held by “NUCLEUS GENETİK  ” will be deleted, destroyed (eliminated), or anonymized in accordance with this data destruction policy, either upon request by the data subject or automatically when the reasons listed in Articles 5 and 6 of the Law cease to exist. The reasons listed in Articles 5 and 6 of the KVKK (Personal Data Protection Law) are as follows:

1. If it is explicitly provided for in the laws.
2. Consent must be given in cases where the person is unable to express their consent due to factual impossibility or where their consent is not legally valid, and it must be necessary for the protection of their own life or the life or physical integrity of another person.
3. The processing of personal data belonging to the parties to a contract is necessary provided that it is directly related to the establishment or performance of the contract.
4. It is necessary for the data controller to fulfill its legal obligations.
5. It must have been made public by the person concerned themselves.
6. Data processing is necessary for the establishment, exercise, or protection of a right.
7. Data processing is necessary for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

14.8.3. Disposal Methods

“NUCLEUS GENETİK” deletes, destroys (eliminates), or anonymizes personal data it stores in accordance with the Law and other relevant legislation, as well as its Personal Data Protection, Processing, Storage, and Destruction Policy, upon the request of the data subject when the reasons requiring the processing of the data cease to exist, or automatically within the periods specified in this Personal Data Protection, Processing, Storage, and Destruction Policy.

The most commonly used deletion, deletion, and anonymization techniques by "NUCLEUS GENETICS" are listed below:

14.8.3.1. Deletion Methods

14.8.3.2. Disposal Methods

14.8.3.3. Anonymization Methods

Anonymization is the process of rendering personal data in such a way that it cannot be linked to an identified or identifiable natural person, even when combined with other data.

“NUCLEUS GENETİK” uses one or more of the aforementioned anonymization methods to anonymize personal data, depending on the nature of the data. When using these anonymization methods, “NUCLEUS GENETİK” may utilize K-Anonymity, L-Diversity, and T-Proximity statistical methods.

14.9. Personal Data Storage and Destruction Periods

The following table shows the retention and destruction periods for personal data. These retention and destruction periods will be taken into account for periodic destruction or destruction upon request. The table showing the retention and destruction periods for personal data will be updated by the business units responsible for the processes included in the “NUCLEUS GENETİK” personal data inventory, taking into account the evaluations of the Personal Data Protection Committee in case of any doubts.

14.9.1. Personal Data Retention Table (Periods)

* If a longer period is stipulated in the legislation, or if a longer period is provided for statutes of limitations, forfeiture periods, retention periods, etc., in accordance with the legislation, the periods in the legislation provisions shall be considered as the maximum retention period.

14.9.2. Destruction Periods

“NUCLEUS GENETİK ” deletes, destroys, or anonymizes personal data in accordance with the Law, relevant legislation, and the Personal Data Protection, Processing, Storage, and Destruction Policy, during the first periodic destruction process following the date on which the obligation to delete, destroy, or anonymize personal data for which it is responsible arises.

When the relevant person, pursuant to Article 13 of the Law, applies to “NUCLEUS GENETİK” requesting the deletion or destruction of their personal data;

1. If all conditions for processing personal data have ceased to exist, "NUCLEUS GENETİK" will delete, destroy, or anonymize the personal data in question within 30 (thirty) days from the date of receipt of the request, explaining the reason and using an appropriate method of destruction. For "NUCLEUS GENETİK" to be considered to have received the request, the data subject must have made the request in accordance with the Personal Data Protection and Processing Policy. "NUCLEUS GENETİK ÜRÜNLERİ ANONİM ŞİRKETİ" will, in any case, inform the data subject about the action taken.
2. If all the conditions for processing personal data have not ceased to exist, this request may be rejected by "NUCLEUS GENETİK" in accordance with the third paragraph of Article 13 of the Law, with an explanation of the reasons, and the rejection response shall be notified to the relevant person in writing or electronically within thirty days at the latest.

14.10. Periodic Destruction Intervals

If all the conditions for processing personal data stipulated in Law No. 6698 on the Protection of Personal Data (KVKK) cease to exist, “NUCLEUS GENETİK” will delete, destroy (eliminate), or anonymize the personal data for which the processing conditions have ceased to exist, through a process that will be carried out automatically at recurring intervals as specified in this Personal Data Protection, Processing, Storage, and Destruction Policy.

15. MONITORING THE LEGALITY OF THE DESTRUCTION PROCESS

"NUCLEUS GENETIC PRODUCTS INC." carries out its destruction processes, both upon request and ex officio during periodic destruction processes, in accordance with the Law, other relevant legislation, and its Personal Data Protection, Processing, Storage, and Destruction Policy.

“NUCLEUS GENETIC PRODUCTS INC.” takes a number of administrative and technical measures to ensure that destruction procedures are carried out in accordance with these regulations.

15.1. Technical Measures

1. “ NUCLEUS GENETIC PRODUCTS INC.” provides the technical means and equipment suitable for each disposal method described in this policy.
2. “NUCLEUS GENETICS” ensures the security of the site where the disposal processes are carried out.
3. “NUCLEUS GENETICS ” access logs of the individuals who carried out the destruction process.
4. “NUCLEUS GENETİK ” employs competent and experienced personnel to perform the destruction process, or obtains services from competent third parties when necessary.

15.2. Administrative Measures

1. "NUCLEUS GENETIC PRODUCTS INC." is undertaking efforts to increase and educate its employees who will be carrying out the destruction process on information security, personal data, and the privacy of private life.
2. “NUCLEUS GENETİK” receives legal and technical consultancy services to monitor developments in the fields of information security, privacy, protection of personal data, and secure data destruction techniques, and to take the necessary actions.
3. “NUCLEUS GENETİK” signs protocols with third parties to protect personal data when it outsources data destruction due to technical or legal requirements, and takes all necessary care to ensure that these third parties comply with their obligations under these protocols.
4. “NUCLEUS GENETICS regularly monitors whether destruction procedures are carried out in accordance with the law and the conditions and obligations specified in this Personal Data Protection, Processing, Storage and Destruction Policy, and takes the necessary actions.”

All processes related to the deletion, destruction, and anonymization of personal data are recorded, and these records are kept for at least two years, excluding other legal obligations.

16. EFFECTIVE DATE

The policy will come into effect as of the date of its publication.

The Personal Data Protection Committee is responsible for announcing the policy throughout “NUCLEUS GENETİK” and making the necessary updates.

17. UPDATES AND COMPLIANCE

“NUCLEUS GENETİK ” reserves the right to make changes to its Personal Data Protection, Processing, Storage and Destruction Policy due to amendments to the law, in accordance with institutional decisions, or in line with developments in the sector or the field of information technology.

Any changes to this Personal Data Protection, Processing, Storage and Destruction Policy will be incorporated into the text without delay, and explanations regarding the changes will be provided at the end of the policy.

18. FORMS AND ATTACHMENTS

1. Application form
2. Data Inventory Table
3. Data Retention and Destruction Periods Table
4. Data Protection Law Information Security Procedures (Personnel)
5. Data Protection Law Information Security Procedures (IT)
6. Personal Data Protection Law Information Security Procedures (Administration)
7. Cookie Policy
8. Employee Explicit Consent Form for the Processing of Personal Data
9. Personal Data Protection Employee Information Notice
10. Job Applicant's Explicit Consent Form Regarding the Processing of Personal Data
11. Personal Data Protection Job Applicant Information Text
12. Visitor Explicit Consent Text Regarding the Processing of Personal Data
13. Personal Data Protection Visitor Information Text
14. Customer Explicit Consent Form for the Processing of Personal Data
15. Personal Data Protection Customer Information Text