Data Retention and Destruction Policy

Effective Date: October 1, 2025

1. Purpose and Scope

This policy has been prepared in accordance with Law No. 6698 on the Protection of Personal Data (KVKK) and other relevant legislation to ensure the secure storage, retention, and destruction of personal data collected through www.hkteknolojix.com.

The policy applies to all personal data collected from customers, visitors, members, and business partners.

2. Legal Basis

• Law No. 6698 on the Protection of Personal Data (KVKK)
• Regulation on the Deletion, Destruction or Anonymization of Personal Data
• Law on the Regulation of Electronic Commerce
• Tax Procedure Law, Turkish Commercial Code, and other applicable legislation

3. Personal Data Retention Periods

Personal data is retained only for as long as necessary to fulfill the purpose for which it was collected or as required by applicable laws. Once this period expires, data is destroyed.

4. Storage Methods

Data is stored securely in electronic environments such as servers, databases, backup systems, and email software. Physical data (e.g., printed invoices) is kept in locked cabinets.

Key measures for data security include:

• Encrypted connections (SSL)
• Access controls and user authorization
• Periodic data backups
• Antivirus and firewall systems
• Logging and record keeping

5. Destruction Methods

Personal data whose retention period has expired is destroyed using the following methods:

5.1 Physical Destruction

Paper documents are shredded using shredders to ensure they cannot be recovered.

5.2 Digital Deletion

Data is deleted from systems irreversibly using specialized data erasure software.

5.3 Anonymization

Some data may be anonymized for statistical purposes, removing any personally identifiable elements.

6. Destruction Timing

• Expired personal data is destroyed during scheduled review periods in June and December each year.
• If a data subject requests deletion and there is no legal retention obligation, the data is destroyed within 30 days.

7. Authority and Responsibility

The Data Controller, Hüseyin KARAGÖZ, is responsible for storing, deleting, destroying, and anonymizing personal data.
Personnel and technical staff may access data only within the scope of authorized permissions.

8. Your Rights

Under Article 11 of KVKK, data subjects have the right to:

• Learn whether their personal data is being processed
• Request deletion or destruction of personal data
• Request correction if the data is incomplete or inaccurate
• Learn how long the records are stored

Requests can be sent to: destek@hkteknolojix.com

9. Updates

This policy may be updated as needed. The latest version is always available at www.hkteknolojix.com