1. Purpose
This policy sets out the principles under which personal data processing activities carried out by Yachtio are managed in accordance with the KVKK and related legislation.
2. Core Principles
- Processing lawfully and in good faith
- Keeping data accurate and up to date
- Processing for specified, explicit and legitimate purposes
- Being relevant, limited and proportionate to the purpose
- Retaining data only for the period set out in legislation
3. Technical and Organisational Measures
- Company-level data isolation and authorisation
- Role and module-based access control
- Parameterised queries and application security controls
- Access and change logging in sensitive modules
- Regular backups and access reviews
4. Retention and Destruction
Data is retained for a period limited to its purpose. When that period ends or the conditions for processing cease to exist, the appropriate method of deletion, destruction or anonymisation is applied.
5. Review
This policy is reviewed regularly in line with legislative changes and developments in business processes.