Within its field of activity, our firm is highly careful about processing and retaining personal data in line with Law No. 6698 on the Protection of Personal Data (from this point called only the Law).

Sosyal.proandsosyal.proThe websites named above are operated by our company. The personal data of everyone who visits those websites, who becomes a member through them, who shops online through a membership or without becoming a member, who fills in any form, or who buys a product or service from the branches, are processed in line with the principles set in article 4 of the Law.

On this page, theClarification text; it clearly states, in the light of article 10 of the Law, which procedures and principles must be followed while the clarification obligation is performed. Our company, this Clarification Text'data controller'has been created in that capacity, and this text contains the provisions that apply under article 10 of the Law. The provisions stated here are binding for the natural or legal persons briefly mentioned below:

A separate clarification text has been prepared for each data subject. You may reach the relevant policies by applying to our authorized company units.

Under KVKK Law No. 6698 on the Protection of Personal Data, personal data may be processed by our company in the capacity of Data Controller as defined in article 3 of the Law.

In the face of the activities of our company, personal data are processed for the purposes stated below, in line with articles 4, 5 and 6 of the Law and the legislation related to the subject:

Information about the web page, social transaction information, password, IP address, username, hardware and software transaction information, internet access information, log records

Administrative, commercial and technical risk information

For customers and suppliers: tax office, tax identification number, invoice, bank account number, credit card information, asset information, IBAN, current-account information, bank account information, finance information notified to public institutions and organizations, and policy information. For employees and the shareholders of the company: declarations, IBAN, bank account information and other finance information

Information on education and vocational courses, diploma information, work experience, information about working life, in-service training, references, vehicle competence, certificates, driving licence, other professional information, title, duty, profession, expertise, chamber registry, diploma, education, competence and certificate information

Printed forms filled in on the internet or at branches, photographs on certificates, diplomas and shared official identity and document papers, photographs taken when required within a job application and company activities, your photographs shared and used on our social media accounts, our company web page or third-party social media, and images in camera records

Health information on job application forms, general health report examinations, health reports, laboratory tests, blood group, physical disability and personal health information, and reports given by the health board

Criminal record, judicial status and conviction information

Fingerprint within staff attendance control, in order to evaluate performance and to follow the workflow

Information needed while managing and assessing complaints and requests sent through social media accounts, the website or call services, information reached through corporate communication services, and personal data obtained by letter, email or other means of communication are also included in the personal information that is processed.

Personal data stated under this clarification text may be shared, provided they stay within the purposes notified in the second article, with branches, company shareholders/partners, employees of the relevant unit, partners of the company in Turkey and abroad, suppliers, the group company, company representatives, service providers, natural persons and private-law legal persons, and, when required, with legally authorized authorities. This is limited to the personal-data processing conditions in article 8 of the Law and to the stated purposes.

Under the principles in article 4/2 of the Law, from those whose personal data have been processed'explicit consent texts'they may be transferred if that condition is met, or, in the cases foreseen in articles 5/2 and 6/3 of the Law, without seeking explicit consent, under the rules in article 9 of the Law. The conditions that apply to the transfer of your personal data abroad within your legal activity and relationship with our company are as follows:

Personal data are collected partly or wholly by automatic means, or by manual methods as part of a data system. The following methods are used for this:

As a rule, personal data are processed on the condition that they are based on the explicit consent of the data subject. Personal data may also be processed if that is directly related to forming agreements that will be made between our company and third-party natural or legal persons, and to forming a distance sales agreement and a membership agreement on the internet. The other criteria are as follows:

Requests under article 11 of Law No. 6698 on the Protection of Personal Data, which regulates the rights of the data subject, in writing to the data controller in person or by filling in the application form on the website, under the communique on application procedures and principlessosyal.proandSosyal.PROit may be sent by sending an email to the addresses, or through a notary.

As Hero Invest Ltd., limited to the field of activity of our company, those with whom we are in a legal relationship;

Our company has taken technical and administrative measures for this purpose, as required by the decisions taken and the legal regulations.

Our country signed on 28 January 1981 Convention No. 108, which was opened for signature by the Council of Europe in Strasbourg on 28 January 1981 and put into force on 1 October 1985. It was published in Official Gazette No. 29656 on 17 March 2016 and thus became part of the domestic law of Turkey. KVKK (the Law on the Protection of Personal Data) was accordingly published in the Official Gazette on 07.04.2016 and put into force. Within the legislation of the EU (European Union) on the protection of personal data, it is regulated by the GDPR (General Data Protection Regulation).

This Personal Data Retention and Destruction Policy has been prepared to set the procedures and principles to be followed for the work and transactions of the retention and destruction activities our company will carry out. With this policy text, and in order to complete alignment with the Law on the Protection of Personal Data, the aim within the basic principles written below is to process the personal information of the relevant people above within the decisions published by the Personal Data Protection Authority, the set principles, the Constitution of the Republic of Turkey, Law No. 6698 on the Protection of Personal Data, international conventions and the related legislation, and to let the relevant people use their rights effectively. Work and transactions about retaining and destroying personal data are carried out in line with this policy.

Within the activities of our company, this policy covers the personal data of our customers who buy a product, our potential customers, our business partners, our suppliers, our company partners, our company employees, our employee candidates, our interns, our parents/guardians/representatives, our visitors, those responsible for representing authorized public institutions and organizations and private-law legal persons, and third parties related to their employees. This policy applies in every recording medium where personal information processed by our company by automatic methods or by manual means is processed, and in every company activity regarding the processing of personal data.

Consent on a specific subject, based on being informed and expressed by free will

The natural or legal person to whom personal data have been transferred by the data controller

Making personal data impossible to associate with an identified or identifiable natural person, even by matching them with different data

It covers the staff of our company.

People who apply for a job by filling in a job application form, by coming to the workplace in person or by using the web page

Environments that allow personal information to be created, read, changed and written with electronic devices

Every printed, written, visual and similar environment other than electronic environments

A legal or natural person that provides a service to the company under a specific agreement

A person who can process personal data in the organization of the data controller, or in line with the authority and instructions given by the data controller, excluding the person or unit responsible for the technical storage, safeguarding and backup of the data

Natural persons whose personal data are processed

Deleting, destroying or anonymizing personal data

Documents created by associating personal-data processing activities carried out by data controllers in line with business processes, and their processing purposes, legal reasons, data categories, data-subject person and the recipient group they are transferred to, and that explain in detail the longest retention period required for the purposes for which personal data are processed, the personal data foreseen to be transferred to foreign countries, and the measures for their security

Every environment that contains personal data processed partly or wholly by automatic means, or by manual means as part of any data recording mechanism

All information belonging to a natural person whose identity is specific or can be determined

It means obtaining, storing, recording, changing, safeguarding, disclosing, rearranging, taking over, transferring, classifying, making available or preventing the use of personal data, partly or wholly by automatic means or by non-automatic methods provided they are part of a data recording system. In short, it means every transaction made on personal data.

Making personal data impossible to associate in any way with an identified or identifiable natural person, even by matching them with different data.

Making personal data impossible to access in any way regarding the User who owns the data, and impossible to use again

Making personal data impossible for any person to access, restore or use again in any way

It is Law No. 6698 on the Protection of Personal Data.

It is the Personal Data Protection Board.

It is the Personal Data Protection Authority.

For legal and natural persons resident in our country, the natural person stated during registration in the Registry by the data controller, and for those not resident in our country by the representative of the data controller, in order to provide communication with the Authority regarding the obligations under the Law and the secondary regulations based on this Law

Data on the ethnic origin, race, philosophical belief, political opinion, religious sect or other beliefs of persons, foundation, association or trade-union membership, appearance and clothing, sexual life, health, data on security measures, criminal conviction, and genetic and biometric data

When all of the conditions for processing personal data in the Law have disappeared, the destruction, deletion or anonymization operations stated in the personal data storage and destruction policy and carried out ex officio at repeating intervals

General policy on processing, retention and destruction of personal data

Firmamız Hero Invest Ltd.

The natural or legal person responsible for processing personal data on behalf of the data controller, based on the authority given by the data controller

A recording mechanism that allows personal data to be structured and processed according to certain criteria

The natural or legal person obliged to determine the means and purposes of processing personal data and to set up and manage the data recording system

It is the information system created and managed by the Presidency, which can be accessed on the internet and which will be used by data controllers during application to the Registry and in various transactions about the Registry.

This means the Data Controllers Registry Information System.

The Regulation on the Deletion, Destruction or Anonymization of Personal Data, published in the Official Gazette as of 28 October 2017

In order to ensure, maintain and continue compliance with the legislation on the protection of personal data under KVK Law No. 6698 and the related legislation, a company Data Contact Person has been chosen to provide the required coordination inside the company, and their duties and responsibilities have been defined. The decisions taken have been notified to the relevant people. So that the administrative and technical measures taken under this policy can be applied as required, so that training given to the employees of the relevant unit and the awareness to be created can be increased, and so that audits can prevent personal data from being processed or accessed unlawfully and personal data can be retained within the rules of law, the administrative and technical measures for data security are performed by the data contact person and the responsible units everywhere personal data are processed.

The personal data our company retains are stored in electronic environments such as the software in use, servers, tablets, phones and personal computers, other mobile devices, removable memory and optical discs. Personal data kept on paper are stored in manual data recording systems such as agreements between our company and third parties, job application forms, visitor and survey forms, and in physical, non-electronic environments such as archive rooms and unit cabinets for personal data kept in visual, printed and written environments. These data are kept in a fully secure way, in line with KVK Law No. 6698, the related legislation and international data-security principles. Personal data are obtained, recorded, stored, changed and rearranged by our company, partly or wholly, automatically or by non-automatic methods provided they are one of the parts of a data recording system, and they are subject to every transaction carried out on personal data.

This part will state the general principles on the processing of personal data.

As stated in this policy, the data of both employees and personal data subjects who are in contact with our company are kept confidential. Under these measures and this policy, except for the cases stated in the law, nobody is allowed to use, reproduce, copy, transfer to others, or process outside the purposes set by the policies, the data of persons for any purpose.

The data our company processes are processed in line with the principles set by article 4 of KVK Law No. 6698. Our company processes personal data within the procedures and principles foreseen in the law, in line with these principles, during processing, safeguarding, deletion and destruction:

All personal data our company processes are in line with article 5 of Law No. 6698. Personal data may not be processed without the explicit consent of the data subject. If one or more of the principles written below exist, personal data may be processed without seeking the explicit consent of the persons whose data will be processed:

All Special-Category Personal Data our company processes are processed in line with article 6 of Law No. 6698. These include data on the ethnic origin, race, philosophical belief, political opinions, religion, sect or other beliefs of persons, trade-union, foundation or association membership, appearance and clothing, health and sexual life, data related to security measures and criminal conviction, and genetic and biometric data.

Personal data described as special category cannot be processed without the explicit consent of the data subject. Under the article that prohibits this, processing those data without the explicit consent of the relevant people is forbidden by law. As the article states, personal data mentioned in paragraph 6/1 of the Law, other than sexual life and health, may be processed without seeking explicit consent when the cases foreseen in the laws occur.

Personal data on health and sexual life may be processed without meeting the explicit-consent condition only in the following cases:

Personal data are processed and collected in every written, verbal or electronic environment for the following purposes:

As a rule, personal data are processed based on the explicit consent of the data subject. If one or more of the personal-data conditions below occur, data may be processed without seeking the explicit consent of the data subject:

They are processed, collected and transferred, limited to the stated purposes, in line with articles 5 and 6 of Law No. 6698 on the Protection of Personal Data and article 5/1-h of the relevant Communique.

Personal data processed under this policy created by our company are retained and destroyed in line with the related legislation, procedure and law. Detailed explanations on the retention and destruction of personal data are below.

Processing of personal data is defined in article 3 of Law No. 6698. Article 4 allows personal data to be retained in a way that is relevant, proportionate and limited to the purposes of processing, and for the period foreseen in the related legislation or required by the purpose of processing. Articles 5 and 6 of Law No. 6698 state the conditions for processing personal data. Every detailed explanation of this is written in this policy text. Personal data are retained for the period foreseen in the related legislation or required by the processing purposes within company activities, provided technical and administrative measures are taken.

Personal data processed within the activities of our company under this policy are kept and retained for the periods written in the related legislation. They are retained for the written retention periods in line with the periods foreseen by the laws the persons are subject to within company activities, as mentioned above, and the secondary regulations, and for the limitation periods that apply to offences foreseen in the laws.

In line with the activities of our company, the retention and destruction period of the personal data we process has been notified by this policy as a corporate decision, taking into account the limitation periods foreseen in the legislation those data are subject to, disputes that exist or may arise with third parties our company is in legal contact with, the corporate memory, commercial activities and business of our company, and, apart from the periods foreseen in the laws, the legitimate interests of our company and the processes of forming and performing agreements made or to be made with data subjects.

Our company retains the personal data it processes for the purposes below, in line with articles 5 and 6 of the Law, limited to the activities of the company and also in line with the related legislation. Accordingly, the processing purposes that require retention of personal data can be classified as follows:

Upon the requests of the relevant people for the reasons stated in this policy, and by filling in the application form, personal data are deleted, destroyed or anonymized by our company in line with the procedures and principles foreseen in the policy, the laws and the regulations. In this context personal data are deleted, destroyed or anonymized in the following cases:

Within the rules set by this policy, and in order to retain personal data properly and securely, to prevent them from being processed or accessed unlawfully, to prevent data leaks, and to destroy personal data lawfully, our company, in the capacity of data controller, takes the technical and administrative measures written below within the adequate measures set and announced by the Personal Data Protection Board. This is under article 6/4 of Law No. 6698 on the Protection of Personal Data, which states that adequate measures set by the Board must also be taken when special-category personal data are processed, and under article 12 of the same law on ensuring the security of personal data.

of the Personal Data Protection Authorityhttps://www.kvkk.gov.trOur company, in the capacity of data controller, has taken the necessary measures related to the technical measures announced by the Personal Data Protection Authority at that address. The KVKK Technical Measures Analysis Report of the Information Technology Unit has been prepared. Findings on the required technical measures have been decided. Real-time and on-site analyses related to information security have been made, and threats and risks that would harm the continuity of the information systems have been identified and are monitored continuously. The measures required to provide the physical security of the hardware, software and data of the information systems our company owns have been taken. In this context, the technical measures taken are as written below:

There are administrative measures our company has taken as data controller, related to the necessary administrative measures announced by the Personal Data Protection Board.

Our company has taken the necessary corporate decisions within alignment with Law No. 6698 on the Protection of Personal Data, has fulfilled the obligations under the law, and has created and announced the policies that must be published. In this context;

As written in the policies created by our company and in the personal data processing inventory, when the period foreseen in the legislation for the personal data that are processed, or the retention period required by the processing purposes, has ended, those personal data are destroyed by the authorized units of our company on their own, or upon an application the personal data subjects make to our company, using the methods and techniques stated below, provided this complies with KVK Law No. 6698 and the related legislation:

For personal data on the servers whose required retention period has ended, the system administrator removes the access powers of the relevant users and a deletion operation is applied.

Personal data in the electronic environment whose period that requires retention has ended are made impossible to reach in any way and impossible to use again for employees other than the database administrator (the relevant users).

Personal data kept in the physical environment that no longer need to be retained are, after the retention period ends, made impossible for any employee other than the responsible unit manager to reach from the document archive and impossible to use again. They are also blacked out by being erased, painted or crossed out so that they cannot be read.

Personal data protected in flash-based storage whose period that requires retention has ended are encrypted by the system administrator, access is given only to the system administrator, and the encryption keys are kept in secure environments.

Personal data on paper whose period required for retention has ended are destroyed in paper shredders in a way that cannot be reversed.

Those of these data that no longer need to be retained because the period has ended are physically destroyed by being turned into dust, burned or melted. The magnetic medium is also passed through a special device and exposed to a high magnetic field. The data on it are thus made impossible to read.

Anonymizing personal data means making them impossible to contact a real person in any respect, so that the identity of the relevant people will not be specific or cannot be determined even if these data are matched with data belonging to other third parties.

In order to make personal data anonymous, these data are made impossible to associate or contact with an identified or identifiable natural person, even by using techniques suitable for the field of activity and the recording medium, such as matching these data with other data, and in a way that cannot be reversed by third parties or by the data controller.

For the personal data processed within company activities, retention periods on a personal-data basis for all personal data within the activities carried out in line with the processes have been set in the Personal Data Processing Inventory. Periods for retention on a data-category basis have been set in the VERBIS registration. Retention periods on a process basis have been set by the Personal Data Retention and Destruction Policy.

The Data Contact Person makes the updates needed from time to time regarding those retention periods. Deletion, anonymization and destruction of personal data whose retention period has ended are also carried out ex officio by the Data Contact Person within the set duties and powers.

The periods required for retaining and destroying personal data on a process basis are in the table in the annex.

Under article 10 of the Law, the obligations of the data controller are as follows:

For this purpose, the required policies and clarification texts have been prepared so as to cover the personal data of potential customers, customers who buy a product, business partners, suppliers, company partners, employees, interns, employee candidates, visitors, parents/guardians/representatives, employees and representatives of private-law legal persons, authorized public institutions and organizations, and third parties.

As required by that clarification obligation, all information the personal data subjects must know, as mentioned in the law, is as follows:

Under article 11 of Law No. 6698 on the Protection of Personal Data, on regulating the rights of the data subject, and based on the communique on the procedures and principles of an application to the data controller, our company in the capacity of data controller has fully carried out the drawing up of the APPLICATION FORM. The application form can be reviewed on the website of our company.

Under article 11 of the Law, everyone may apply to the data controller and request the following information about themselves:

Under article 13/1 of KVK Law No. 6698, the applications of people who want to use the rights stated above and who make a written application for this, or who send it to our company by the methods set by the Personal Data Protection Authority, are taken into assessment at once. Our company will conclude the application free of charge as soon as possible and at the latest within 30 (thirty) days, taking into account the nature of the request. If the transaction requires a separate cost, the fees in the tariff set by the Board are requested from the applicant. If the situation that is the subject of the application arises from a fault of the data controller, the fee collected is refunded to the relevant person.

If the application is rejected, if the answer given is found insufficient, or if no answer is given in time, the data subject may complain to the Board within 30 days after learning the answer from the data controller and, in any case, within 60 days from the date of the application. Under article 13 of the Law, the complaint path may not be used before the application paths are used.

 (Exceptional cases)

Under article 28/1 of KVK Law No. 6698, the cases notified below are exceptional cases kept outside the scope of the law, and personal data subjects cannot assert the rights listed in the article above in these cases.

The periods foreseen for the ex officio deletion, destruction or anonymization of personal data are regulated by article 11 of the Regulation, as written below. Accordingly, a data controller that has prepared a policy on the retention and destruction of personal data will delete, destroy or anonymize the personal data during the first periodic destruction after the date the obligations to delete, destroy or anonymize those personal data arise.

The time interval in which periodic destruction will be carried out is set by the data controller in the personal data retention and destruction policy. This period cannot be more than 6 months in any case. Data controllers who are not obliged to prepare a policy on the retention and destruction of personal data must delete, destroy or anonymize the personal data within 6 months after the date the obligations to delete, destroy or anonymize them arise. Audits that are required must also be made by the data controller and the personal data protection unit, provided they do not exceed 6 months. Where the Personal Data Protection Board finds damage that is hard or impossible to remedy, or a clear breach of the law, the periods stated in the regulation may be shortened.

Upon an application by the data subject, the periods for deleting personal data and destroying data are regulated in article 12 of the Regulation as follows.

In this scope, if the conditions for processing personal data have completely disappeared, data controllers are obliged to delete, destroy or anonymize the personal data that are the subject of the request. The data controller must conclude the requests sent by the relevant people within 30 days at the latest and inform the relevant person. If the conditions that require processing of personal data do not exist at all and the personal data that are the subject of the request have been transferred to third parties, the data controller must inform the relevant person of this. It is also the obligation of the data controller to ensure that the necessary operations are carried out before the third party under this regulation.

Where the conditions for processing personal data have not completely disappeared, the data controller may reject this request under paragraph 3 of article 13 of the Law, provided the reason is explained. This answer must be notified to the relevant person or persons in writing or electronically within 30 days at the latest.

This policy has been prepared by our company, both on printed paper (with a wet signature) and in the electronic environment, of our companysosyal.proandSosyal.PROit is published on the internet pages named above. The Policy is deemed offered to the public after it is published on the web page. The Data Contact Person keeps the printed paper copy in the KVK file. This policy is reviewed by the chosen data contact person, within the responsibilities and powers, at the end of every year from the publication date, once a year, and the relevant sections are updated as needed.

This policy is written in articles above. Of our company,sosyal.proandSosyal.PROit will be deemed to have entered into force after it is published on the websites. If the policy is repealed upon a decision of the personal data contact person and the approval of the data controller, the data contact person cancels the old wet-signed copies of the policy (by applying a cancellation stamp or writing cancelled) and signs them. The personal data contact person keeps this policy in the relevant unit for at least 5 years.

| Column1 | Column2 | Column3
| Process | Retention period | Destruction period
| Receiving application information of employee candidates | For 2 years from the date the request was received, and for 30 days if the request is assessed as negative or is withdrawn | Within the first audit period after the retention period ends, and at the latest within 180 days
| Carrying out human resources processes | For 20 years | Within the first periodic destruction process after the retention process ends, and at most within 6 months
| Camera recordings | For 12 days | Within 30 days if requested, in the first audit process after the retention period ends, and at the latest within 180 days
| Transactions of customers, suppliers and service providers | For 20 years | Within the first audit period after the retention period ends, and at most within 180 days
| Potential customer transactions | For at least 2 years and at most 20 years | Within the first audit period after the retention period ends (provided it does not exceed 180 days)
| Company communication activities | For 20 years | In the first audit process after the retention period ends, and at most within 180 days
| Agreement transactions | For 20 years | In the first audit process after the retention period ends, and at most within 180 days
| Financial transactions and accounting transactions | For 20 years | In the first audit process after the retention period ends, and at most within 180 days
| Processes related to occupational health and safety | For 20 years | In the first audit process after the retention period ends, and at most within 180 days
| Network and internet access processes, log records | For 2 years | In the first audit process after the retention period ends, and at most within 180 days