Personal Data Retention and Destruction Policy
This English text is provided for convenience; the Turkish version prevails.
This is an English translation provided for information. In case of any discrepancy, the Turkish version prevails.
Data controller: ÇET YAPI TURİZM ANONİM ŞİRKETİ
Website: insaya.com
This policy contains general explanations on the retention and destruction of personal data in the insaya.com website and the online application and contact processes carried out through it. The Company's activities outside the website are outside the scope of this policy. Since the systems in which data is actually processed and the service providers may change over time, the explanations should be read together with current practice.
Purpose and scope
This policy has been prepared to explain for which needs and criteria personal data obtained through the website is retained and the general principles of deletion, destruction or anonymisation when the purpose of retention ends.
The policy covers information obtained through the project pre-registration form, cookie preferences and application source information, data related to analytics and map services, hosting access logs, and copies of this data that may exist in e-mail, backup or service provider systems. This description does not mean that every service is currently used or that data is actually transferred to the relevant provider.
Legal framework and basic principles
Under the Personal Data Protection Law No. 6698 (KVKK), personal data is retained in a manner relevant, limited and proportionate to the purpose of processing, for the period set out in the relevant legislation or necessary for the purpose of processing. The retention period may vary according to the type of data and the purpose of use; when the relevant purpose or legal retention requirement ends, data is destroyed using the methods described in this policy.
The Company takes appropriate technical and administrative measures to ensure the security of personal data. Where personal data is transferred abroad, it is transferred under the conditions and safeguards required by the relevant legislation. The explanations are updated as the service providers used and data processing/transfer information change.
- Data is retained in a way that does not exceed the scope necessary for a specific and legitimate processing purpose.
- Unnecessary copies of the same data and records that no longer serve the purpose are identified and controlled.
- The retention period is determined per data group and purpose of use; the event that starts and ends the period is clearly defined.
- Data whose retention requirement has ended is deleted, destroyed or anonymised in line with the technical features of the system and applicable legislation.
- Backups, e-mail copies, service provider systems and access logs are also included in the destruction assessment.
- If the retention period or destruction is to be extended on grounds relating to an application, a legal obligation or an ongoing dispute, the reason, scope and end criterion are recorded; continuous and unjustified retention is avoided.
Personal data: any information relating to an identified or identifiable natural person. IP address, device/browser information, URL, time information, application source identifiers and form content may constitute personal data to the extent they can be associated with a person.
Retention period: the period or criterion set by the Company for which personal data may be kept for the relevant purpose or applicable legal requirement.
Deletion: making personal data inaccessible and unusable again for the relevant users.
Destruction: removing personal data so that it cannot be accessed, retrieved or reused by anyone.
Anonymisation: rendering personal data impossible to associate with an identified or identifiable person even when matched with other data. Removing only the direct identifiers of data does not by itself show that it has been anonymised.
Disposal: the deletion, destruction or anonymisation of personal data.
Personal data is kept to the extent that the relevant purpose of use continues or retention is required by legislation. The retention period is determined taking into account the type of data, the status of the application, applicable legal obligations and the period necessary for the establishment, exercise or protection of rights. The retention period may therefore vary by data group and circumstances; when the purpose or legal retention requirement ends, the data is deleted, destroyed or, where appropriate, anonymised.
Retention and destruction practices are updated when the processing purposes, systems used, service providers or relevant legislation change. Data is taken into the destruction process when the purpose of use and retention requirement end.
Retention and destruction table
The main data groups in the website processes, their purposes of use and retention/destruction criteria are described below. These explanations are updated if the service providers or technical configuration change.
| Data group and purpose of use | Retention and destruction criterion |
|---|---|
| Pre-registration form data (name-surname, phone, e-mail, project and apartment type of interest, purchase purpose, contact preference, note and other information provided in the form) is used to receive the request, provide information about the project and communicate during the sales process. | The data is retained for the period necessary to conclude the request and, where applicable, to comply with legal obligations or protect rights; when this requirement ends, data in active systems and e-mail copies is deleted, destroyed or, where appropriate, anonymised. Copies in e-mail, CRM and backups are also included in the destruction assessment. |
| Application source and session information (first entry and form submission pages, referring site, campaign tags, ad click identifiers where present, date-time and site language) may be used to understand through which channel the application came. | Information kept in the browser session is removed when the session ends; information added to the application is retained according to the retention criteria applicable to application data and is deleted, destroyed or, where appropriate, anonymised when the requirement ends. |
| The cookie preference record (“Accept” or “Reject”) may be kept in the browser to remember the preference. | How long the preference is kept in the browser depends on the settings used; the record is updated or deleted when the preference is changed or browser storage is cleared. |
| If Google Analytics 4 is used, page views, device and browser type, approximate location (city), referral source, button clicks, form steps and submission information, the project and apartment type selected in the pre-registration form may be processed. The inventory states that name, phone and e-mail information are not sent to Analytics. | Data subject to Analytics retention settings is kept for the period necessary for analysis and relevant legal requirements; preferences and identifiers are deleted or, where appropriate, anonymised through the relevant tools and settings. This data is not regarded as anonymous. |
| When Google Maps is used, the IP address and browser information may be sent to Google after interaction with the map. | The map service and this data are processed to the extent necessary to provide the map function; retention and deletion are carried out within the settings of the relevant service provider and applicable legislation. The way the map service is loaded is assessed together with the explanations on the visitor's preferences and interactions. |
| During hosting of the website, technical logs such as IP address, browser information, page or address (URL) accessed and access time may be kept. | These logs are retained to the extent necessary to operate and secure the site; they are deleted or destroyed when this purpose and any retention requirement under legislation end. The retention period of technical logs may vary according to the relevant service and applicable requirements. |
| Form applications may be kept in e-mail systems for forwarding the application to the relevant unit. | Copies in e-mail and attachments are kept for the period necessary for the application process and any legal retention requirement; they are deleted or destroyed when the requirement ends. Copies at the e-mail provider and in backups are also considered in the destruction process. |
| If an application tracking system or similar system is used, application information is retained for the period necessary to track and conclude the application. | When the purpose or legal retention requirement ends, copies in the system and exported copies are deleted, destroyed or, where appropriate, anonymised. |
| Copies of form, e-mail and system records in backups | They are deleted or become inaccessible according to the backup system's cycle. If individual records cannot be deleted from backups immediately, routine access to and use of backups is restricted; when a backup is restored, previously taken destruction decisions are re-applied. The retention and deletion time of backups may vary depending on the system used. |
| Limited records of destruction operations may be kept for traceability. These records may include information such as the date of destruction, the data group and system concerned and the method applied; the content of personal data is not unnecessarily recorded again. | These records are kept only for the period needed for traceability or legal requirements and are destroyed when the requirement ends. |
Carrying out destruction
When the retention criterion ends or it is determined that data should no longer be kept, the responsible role identifies the systems and copies containing the relevant data record. Destruction is planned to cover the copies linked to the record:
- Web form and any CRM records, active databases and exports are reviewed.
- E-mail copies of form applications are assessed, including inbox, sent, drafts, archive, deleted items and attachments.
- Data that the Company can control at analytics and map providers is reviewed through account settings and provider tools; confirmation is obtained from the provider on the scope of deletion and sub-copies.
- Hosting access logs and other log copies are handled in line with the relevant criterion and retention settings.
- Copies in backups are deleted after the backup cycle and technical possibilities are verified, or become inaccessible after normal rotation. If backups are restored, previous destruction decisions are re-applied.
- The destruction method is chosen according to the nature of the data and the system. If an operation is to be recorded as “deleted”, it is verified that the relevant users can no longer access or use the data. If anonymisation is chosen, it is checked that the person cannot be identified by matching with other data.
If destruction cannot be carried out directly for technical reasons, the reason, affected systems/copies, access restrictions, alternative method to be followed and completion criterion are recorded. This record does not justify keeping data indefinitely; technical possibilities and provider conditions are reassessed.
The Company reviews its retention and destruction practices in light of the purpose of use of data, relevant legal requirements and the current status of the systems used. When the retention purpose or legal requirement ends, data is taken into the destruction process.
Destruction records are also kept only for the period needed for traceability or legal requirements; when this requirement ends, they are deleted, destroyed or, where appropriate, anonymised.
Data subject applications
You can submit your requests regarding the processing of your personal data to the Company using the current application channels on the insaya.com website.
Your applications are evaluated within the applicable legislation and the result is notified to you within the procedures and periods set out in the legislation.
If your request for deletion or destruction is accepted, the operation is applied to the systems and accessible copies containing the relevant data. Copies in backup and service provider systems are handled within technical possibilities and applicable legislation.
Managing data breaches and policy violations
If there is a suspicion that personal data has been lost, accessed without authorisation, sent to the wrong person, used for other purposes, or that the retention/destruction process has not been operated properly, the employee or supplier who notices the situation notifies the Company without delay.
In the event of an incident affecting personal data security, the Company assesses the scope and effects of the incident, takes the necessary measures and makes the notifications required by applicable legislation.
This policy applies to personal data processing carried out through the insaya.com website.
The current version of the policy is published on the insaya.com website.
ÇET YAPI TURİZM ANONİM ŞİRKETİ