Data Retention and Disposal Policy

1. Purpose and Scope

This policy is prepared under the Turkish Regulation on the Deletion, Destruction or Anonymisation of Personal Data. It sets out retention periods, disposal methods and the periodic disposal schedule for personal data processed by Joykek.

We delete, destroy or anonymise personal data once the purpose has ceased and the minimum statutory periods have expired.

2. Retention Periods

• Contact and quote form records: 3 years from last contact.
• Customer data under a service agreement: 10 years from termination.
• Invoices, accounting and financial records: 10 years.
• Marketing consent records: 3 years from withdrawal of consent.
• Web server access/traffic logs: 2 years (Law No. 5651).
• AI assistant conversation logs: 1 year.
• Cookie and analytics data: for the life of the cookie; at most 24 months.
• Data subject request records: 3 years from completion.

Where data falls into more than one category, the longest period applies. If a dispute is ongoing, data is retained until it is resolved even if the period has expired.

3. Disposal Methods

• Deletion: removing the record so that it can no longer be linked to the individual and closing all access.
• Destruction: irreversibly removing the data including from backups; secure destruction of physical media.
• Anonymisation: rendering data impossible to associate with an identified person even when combined with other data (used for aggregate statistics).

4. Periodic Disposal

Data whose retention period has expired is disposed of every 6 months, in June and December. Deletions requested by a data subject do not wait for this cycle and are completed within 30 days at the latest.

5. Backups

Deleted data may persist in backups for a period. Backups are used only for disaster recovery, access is restricted, and the data leaves them once the backup rotation completes (within 90 days).

6. Responsibility

Company management is responsible for applying this policy. Contact: kvkk@joykek.com