Personal Data Retention & Destruction Policy
This policy explains how long personal data processed by Rüya Preschool is retained, which destruction methods are used when the purpose or legal basis ends, and how the process is managed.
Purpose and Scope
The policy covers retention and destruction processes involving school departments, employees, third-party processors and natural persons whose personal data is processed. Data that is not personal data is outside the scope.
Retention and Destruction Principles
- Acting in accordance with the general principles of KVKK and relevant regulations.
- Keeping data only for as long as necessary for legal or operational purposes.
- Deleting, destroying or anonymizing data when all processing conditions cease to apply.
- Recording destruction processes and ensuring they are auditable.
Storage Media
Personal data may be stored in physical documents, electronic systems, servers, backup media and other record systems used in school activities. Appropriate access and security controls are applied to each environment.
Reasons Requiring Destruction
The destruction process begins in situations such as changes in applicable law, the end of the processing purpose, expiration of the retention period, a valid request by the data subject or complete termination of processing conditions.
Destruction Methods
Making data inaccessible and unusable by relevant users.
Eliminating data so that it cannot be restored by any person.
Making data impossible to associate with an identified or identifiable person even when combined with other information.
Periodic Destruction
The official policy provides for periodic review of personal data and destruction of data for which processing conditions have ended using an appropriate method.
Data Subject Requests
Requests for deletion, destruction or anonymization are evaluated under the procedures and time limits set by KVKK and applicable law; where data has been transferred to third parties, required notifications and actions are also carried out.