This policy explains the periods for which personal data processed by Akbrella Semsiye Sanayi ve Ticaret Anonim Sirketi is retained and how it is destroyed at the end of those periods. It is based on the Turkish Personal Data Protection Law No. 6698 (KVKK) and the Regulation on the Deletion, Destruction or Anonymization of Personal Data.
1. Reasons requiring retention
- Establishment and performance of the contract (ordering, delivery, warranty, returns),
- Legal obligations: Tax Procedure Law, Turkish Commercial Code, Law No. 6563, Law No. 6502 and related regulations,
- Proof in legal disputes (for the duration of statute of limitations periods),
- Marketing activities based on explicit consent (until consent is withdrawn).
2. Retention periods
| Data / record | Retention period | Basis |
|---|---|---|
| Orders, invoices, contracts and payment records | 10 years | TPL art. 253, TCC art. 82, TCO statute of limitations |
| Distance contract and preliminary information approval records | 3 years | Regulation on Distance Contracts art. 20 |
| Membership account information | Duration of membership + 10 years (commercial records) | Contract performance, proof |
| Commercial electronic message consent / refusal records | 3 years from the end of consent | Regulation on Commercial Communication art. 13 |
| Support requests, contact form messages | 3 years | Service quality, proof |
| Website access (log) records | 2 years | Law No. 5651 |
| Cookie data | 1 day – 2 years depending on cookie type | Cookie Policy |
| Job application (CV) information | 1 year from application | Explicit consent |
| Camera recordings (workplace) | 30 days | Legitimate interest, security |
3. Destruction methods
- Deletion: Removing the record from databases and backups in a way that it cannot be recovered; personal fields are masked when a user account is closed.
- Destruction: Shredding of paper documents and secure destruction of physical disks.
- Anonymization: Removing identifying fields from order / visit data kept for statistical purposes.
4. Periodic destruction and destruction upon application
Data whose retention period has expired is deleted through periodic destruction carried out once every 6 months. Upon an application by the data subject, data for which there is no legal retention obligation is destroyed within 30 days at the latest; where a legal obligation exists, the data is retained until the end of that period with access restricted, and the person is informed. Application: Data Subject Application Form.
5. Technical and administrative measures
- Encrypted communication via SSL/TLS, one-way hashing of passwords, encrypted storage of sensitive settings,
- Role-based access, logging of administrator actions, two-step verification,
- Regular backups and storage of backups in an environment with restricted access,
- Card information is never stored in our system at any stage (payment institution / bank infrastructure),
- Confidentiality commitments and KVKK awareness training for employees, and data processing agreements with suppliers.
Policy controller: Akbrella Semsiye Sanayi ve Ticaret Anonim Sirketi · Yıldırım Beyazıt Cad. No: 16F, Mimarsinan Merkez Mah. 34535 Büyükçekmece / İstanbul / TR · . Update: the policy is updated when necessary, and the current version is published on this page.