DATA RETENTION & DISPOSAL POLICY

VELTORI CATERING LİMİTED ŞİRKETİ ("VELTORI" or the "Company") governs the retention and disposal of personal data in accordance with Turkish Personal Data Protection Law No. 6698 ("KVKK") and the Regulation on the Deletion, Destruction or Anonymization of Personal Data.

This Policy establishes the criteria used to determine personal data retention periods and the principles governing the secure deletion, destruction or anonymization of personal data when the applicable processing purpose or lawful processing condition ceases to exist.

1. Data Retention Criteria & Schedules

VELTORI does not apply one uniform retention period to all personal data. Retention periods are determined according to the nature of the data, processing purpose, lawful basis, mandatory statutory requirements, applicable limitation periods and other legal obligations.

2. Legal Hold & Suspension of Disposal

Where litigation, a legal dispute, regulatory review, administrative investigation, enforcement proceeding, audit or binding request from a competent public authority is ongoing or reasonably anticipated, disposal of relevant records may be suspended for as long as the applicable legal or statutory retention requirement remains in force.

A Legal Hold applies only to records relevant and necessary to the underlying matter. Once the applicable legal or statutory retention requirement ceases, the affected data will return to the applicable disposal process under this Policy and applicable law.

3. Data Disposal Methodologies

Where the lawful processing conditions or applicable retention requirements have ceased, personal data is disposed of using an appropriate method.

• Deletion: Rendering personal data inaccessible and unusable to relevant users through appropriate technical and organizational measures.
• Destruction: Rendering personal data inaccessible, irretrievable and unusable by any person through appropriate physical or technical destruction methods.
• Anonymization: Irreversibly transforming data so that it cannot be associated with an identified or identifiable natural person, including through combination with other data.

4. Periodic Disposal Governance

VELTORI has established a 6-month periodic disposal interval. Where the obligation to dispose of personal data has arisen and no applicable legal or operational retention requirement remains, the relevant data is disposed of during the first periodic disposal process following the occurrence of that obligation.

Periodic disposal is scheduled for June and December of each calendar year. Where legally or operationally appropriate, data may also be disposed of outside the scheduled periodic cycle.

5. Data Subject Requests

Data subjects may request the deletion or destruction of their personal data in accordance with their rights under KVKK. Where all lawful processing conditions have ceased, the relevant data will be deleted, destroyed or anonymized in accordance with applicable legislation.

Requests are assessed and concluded within the periods prescribed by applicable legislation. Where a lawful processing condition or mandatory statutory retention obligation remains in force, the request may be handled or refused with the applicable legal grounds being communicated to the data subject.

6. Technical & Organizational Measures

VELTORI implements appropriate technical and organizational measures designed to prevent unlawful processing, unauthorized access, loss, alteration or unauthorized disclosure of personal data.

Depending on the nature of the disposal operation, applicable controls may include access authorization, secure deletion, physical destruction, access management, audit trails and other appropriate security measures.