Skip to content
IWB AIStop waiting for reports. Ask how the business is doing and get answers from your own data.See how it works

Personal Data Retention and Destruction Policy

Version 2026-10-v1 · Updated October 20, 2026

This English translation is provided for convenience. The Turkish text is the governing version.

Purpose and scope

This policy explains how long we keep the personal data we process as data controller and how we destroy that data when the period ends. The data controller is:

Firmanet Yazılım ve Teknoloji A.Ş. (“Firmanet”), Büyükkayacık OSB Mahallesi, 101. Cadde, InnoPark Konya TGB, B Blok, No:4/105, 42160 Selçuklu / Konya. Phone: +90 (312) 439 3940. Email: [email protected]

The purposes of this policy are:

  • to keep personal data only for the period laid down in the relevant legislation or for as long as is necessary for the purpose of processing (Article 4(2)(d) of Law No. 6698 on the Protection of Personal Data (KVKK));
  • to delete, destroy, or anonymize data, on our own initiative or at your request, once all of the conditions for processing have ceased to exist (KVKK Article 7);
  • to set out who carries out these tasks, in which recording media, by which method, and on what schedule.

This policy covers all of the matters listed in Article 6 of the Regulation on the Deletion, Destruction or Anonymization of Personal Data (the Regulation). The periods stated here are the same as the maximum retention periods in our personal data processing inventory. If the inventory changes, this policy is updated as well.

This policy applies to the data of the following persons, for which we are the data controller:

This policy covers all of our electronic and paper records relating to the persons above. Data that we hold on behalf of IWB customers in their workspaces is governed not by this policy but by our contract with the customer (see the “Data held on behalf of customers” section). Data relating to Firmanet employees is outside the scope of this policy.

Definitions

Term Meaning
Personal data Any information relating to an identified or identifiable natural person.
Special categories of personal data The data listed in KVKK Article 6; for example, health data, criminal convictions, religion, and membership of an association or trade union.
Data subject The natural person whose personal data is processed.
Data controller The person who determines the purposes and means of processing personal data; in this policy, Firmanet.
Data processor The person who processes personal data on behalf of the data controller, based on the authority granted by the data controller.
Recording medium Any electronic or paper medium in which personal data is held.
Retention period The maximum period for which a record is kept under the table in this policy.
Destruction (imha) Deletion, destruction (yok etme), or anonymization.
Deletion Making personal data inaccessible and non-reusable in any way for the relevant users.
Destruction (yok etme) Making personal data inaccessible, irretrievable, and non-reusable in any way by anyone.
Anonymization Making personal data impossible to associate with an identified or identifiable natural person, even when it is matched with other data.
Periodic destruction Destruction, on our own initiative and at recurring intervals on the schedule in this policy, of data for which all of the conditions for processing have ceased to exist.
Personal data processing inventory An internal document that sets out our processing activities with their purpose, legal basis, data category, recipient group, data subject group, and maximum retention period.
Destruction report The record of each destruction operation.
Board, Authority The Personal Data Protection Board (the Board) and the Personal Data Protection Authority (the Authority).
TTK, TBK, VUK Turkish Commercial Code No. 6102 (TTK), Turkish Code of Obligations No. 6098 (TBK), and Tax Procedure Law No. 213 (VUK).
ETK Law No. 6563 on the Regulation of Electronic Commerce (ETK).
Commercial Messages Regulation Regulation on Commercial Communication and Commercial Electronic Messages.
Law No. 5651 Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications.

Recording media

Recording medium Records kept
Firmanet’s IWB workspace Request records (customer relationship management module); contact cards of representatives of customers, business partners, and suppliers; quote, contract, and order records; marketing consent records
Corporate mailboxes Request, support, candidate, and customer correspondence and attachments; data subject requests received by email
Temporary files of the request service Requests that could not be written to Firmanet’s IWB workspace, until they are transferred
Memory IP address for the form submission limit
Server access logs Access records for iwb.com.tr and the IWB application (app.iwb.com.tr)
Application database IWB user accounts, session records, and records of account emails sent
Support ticket system Support requests, correspondence, attachments, and screenshots
Management panel Subscription, plan, billing, and contract records; records of actions taken in the panel by Firmanet staff; operational information for installations on your own server
Accounting records Invoices, accounting documents, and payment records
Human Resources records Candidate applications, interview notes, and the candidate pool
Marketing email sending system Mailing list and records of commercial messages sent
Backups Backups of the electronic media above
Paper archive Signed contracts, paper invoices, written requests and our responses to them, and destruction reports
Old website database and uploads Records received through the contact, quote, newsletter, and careers forms on the old website

In the retention periods table, “corporate systems” refers collectively to Firmanet’s IWB workspace, the management panel, and the accounting records.

Reasons for retention and destruction

Reasons requiring retention

  • Statutory retention obligations: TTK Article 82 for commercial books, documents, and commercial correspondence; VUK Article 253 for tax records; Article 13(2) of the Commercial Messages Regulation for records of consent to commercial messages and of messages sent; Article 7(3) of the Regulation for records of destruction.
  • Contract: Data required for the establishment or performance of a contract, for as long as the contract continues (KVKK Article 5(2)(c)).
  • Protection of rights and evidence: Records needed to exercise and prove our rights in a dispute, for the limitation period (TBK Article 146; KVKK Article 5(2)(e)).
  • Legitimate interest: Records needed for the security of the site and the application and for detecting misuse (KVKK Article 5(2)(f)).
  • Explicit consent: For the candidate pool and marketing emails, for as long as consent remains in effect and without exceeding the period in the table.
  • Technical reasons: Records required for the service to operate (such as session and sending records) and backups kept so that data can be restored after data loss, for the periods in the table.

Reasons requiring destruction

Data is destroyed when one of the following occurs and no other condition for processing the data remains:

  • expiry of the retention period;
  • the purpose of processing ceasing to exist, for example when a request does not lead to a contract, a candidate process is closed, or a contract ends;
  • amendment or repeal of the legislative provision on which retention is based;
  • withdrawal of explicit consent;
  • acceptance of the data subject’s request for deletion or destruction;
  • a destruction decision by the Board;
  • the data being unsolicited, for example special categories of personal data that a candidate sends in their CV.

Even after the retention period has expired, if a dispute, audit, or review by a competent authority is ongoing, the relevant records are kept until that process is concluded and are then destroyed (KVKK Article 5(2)(e)).

Measures for secure retention

While retaining data, we apply the following measures to prevent unlawful processing of and unlawful access to the data.

Technical measures

  • iwb.com.tr does not use cookies, local storage, or similar browser storage, and does not load analytics, advertising, map, video, or chat tools.
  • Form data is transferred from the server-side request service to Firmanet’s IWB workspace; the access key is not sent to the browser. The request service’s logs do not contain names, email addresses, or phone numbers.
  • The forms include measures that distinguish automated submissions: an invisible field, a signed timestamp that is obtained when the form is first used and is not stored in the browser, and a submission limit per IP address. For this limit, the IP address is held in memory only, for 10 minutes.
  • The IWB application is accessed over an encrypted connection. Permissions are set at role level and field level; confidential and masked fields are hidden on screen, in exports, and in reports.
  • Passwords are at least 8 characters long and contain uppercase and lowercase letters and a digit. After 5 failed attempts, the account is locked for 5 minutes. Two-step verification is available.
  • User passwords are stored hashed, and integration passwords and connection keys are stored encrypted.
  • In session records, the last segment of the IP address is masked, and no browser fingerprint is kept.
  • The security log records permission changes, access denials, reads of special categories of personal data, downloads of files containing personal data, and changes made from the management panel.
  • Each customer’s data is protected separately in the application and in the database.
  • Request records in Firmanet’s own workspace are not processed with IWB AI.
  • The servers are located with a hosting service provider in Turkey. Backups are not kept for longer than 30 days.

Administrative measures

  • Access to personal data is limited to what each person’s duties require. Staff give a confidentiality undertaking. Firmanet staff access customer data only from Turkey.
  • Candidate applications are evaluated only by Human Resources; the copy in the general mailbox is deleted.
  • Data subject requests are recorded and answered in writing or electronically within 30 days.
  • For transfers abroad, standard contracts have been signed and notified to the Authority.
  • Data breaches, their effects, and the measures taken are entered in the breach register.
  • The personal data processing inventory and this policy are kept up to date together.

Destruction methods

We choose the method according to the recording medium. On request, we explain the method we applied to your data, together with the reasons for it (Article 7 of the Regulation).

Recording medium Destruction method
Firmanet’s IWB workspace Deletion of the record, or anonymization of the record by clearing the fields that identify the person, such as name, email, and phone number
Corporate mailboxes Deletion of the message and its attachments, and emptying of the deleted items folder as well
Temporary files of the request service Deletion of the file from the server
Memory Automatic deletion when the period expires
Server access logs Automatic rotation and deletion of log files whose period has expired
Application database Automatic deletion of session and sending records; anonymization of the user account; permanent deletion of a closed workspace
Support ticket system Deletion of attachments, screenshots, and records whose period has expired
Management panel Deletion of the record
Accounting records Deletion of the electronic record; destruction of the paper document
Human Resources records Deletion of application files, messages, and notes
Marketing email sending system Removal of the person from the mailing list; deletion of sending records whose period has expired
Backups Deletion through the backup cycle: an expired backup is deleted
Paper archive Destruction of the document by shredding it so that it cannot be read or put back together
Old website database and uploads Deletion of the records and uploaded files

A deleted record remains in backups for at most 30 more days and is deleted through the backup cycle. Anonymized data is no longer personal data and is not subject to this policy.

Responsible staff

Responsible staff are designated by title and unit. Each unit is responsible for compliance with retention periods and for destruction in its own recording media.

Unit Title Duties
Management Board of Directors Approves the policy and its updates, puts them into effect, and appoints the responsible staff. Approves periodic destruction reports and ensures that destruction reports are kept for 3 years. Oversees the recording and retention of data subject requests (S21, S22).
Sales Sales unit manager Monitors the periods for request records, commercial correspondence, and contact cards; deletes or anonymizes records whose period has expired (S05, S06, S08).
Marketing Marketing unit manager Manages marketing consent records, the mailing list, and sending records; applies opt-outs within 3 business days (S09, S10, S11).
Human Resources Human Resources unit manager Manages candidate applications and the candidate pool, and deletes those whose period has expired and unsolicited special categories of personal data; destroys career applications left over from the old website (S19, S20, S25).
Accounting Accounting unit manager Ensures that invoices and accounting documents are kept for the statutory period and destroyed when the period ends (S07).
Software Support Software Support unit manager Monitors the periods for support records and their attachments; deletes attachments 6 months after the request is closed (S15, S16).
System operations System operations officer Carries out the technical destruction of access logs, temporary files, automatic deletions within the application, management panel records, backups, and old website data; checks that the automatic deletion routines are working (S01-S04, S12-S14, S17, S18, S23-S25).

Retention and destruction periods

If a record falls under more than one row, the longer period applies. For example, a request that leads to a contract leaves S05 and becomes subject to S06. For periods that start from “the end of the calendar year”, the period runs from December 31 of the relevant year.

No. Record Period Starts from Basis Medium and destruction
S01 iwb.com.tr access log 6 months Time of recording KVKK Article 4(2)(d) Server; automatic rotation and deletion
S02 Application access logs (app.iwb.com.tr) 1 year Time of recording Lower limit under Article 5(3) of Law No. 5651, applied as a precaution Server; automatic deletion
S03 IP address for the form rate limit 10 minutes Time of request Proportionality, KVKK Article 4(2)(ç) Memory only; automatic
S04 Temporary file of the request service (a request that could not be written to the customer relationship management module in Firmanet’s IWB workspace) Deleted after the transfer; no later than 7 days after it is created Creation of the file KVKK Article 4(2)(ç) Server; deletion
S05 Requests that do not lead to a contract, and related correspondence 24 months Last contact KVKK Article 4(2)(d) Customer relationship management module and email; anonymization or deletion
S06 Quotes, contracts, orders, and commercial correspondence 10 years End of the calendar year in which the relationship ended TTK Article 82; TBK Article 146 Corporate systems, email, paper; deletion, destruction
S07 Invoices and accounting documents 10 years End of the calendar year to which the document relates TTK Article 82 (longer than the 5 years under VUK Article 253) Corporate systems, email, paper; deletion, destruction
S08 Contact card of a representative whose relationship has ended (other than S06) 2 years End of the relationship KVKK Article 4(2)(d) Corporate systems; deletion
S09 Marketing consent record 3 years End of consent (withdrawal) Commercial Messages Regulation Article 13(2) Customer relationship management module; deletion
S10 Name, email, and company on the marketing mailing list While consent remains in effect; opt-out applied within 3 business days Opt-out ETK Article 8 Removal from the list
S11 Records of commercial messages sent 3 years Time of recording Commercial Messages Regulation Article 13(2) Sending system
S12 Product user account Until the account is anonymized or the workspace is permanently deleted – KVKK Article 5(2)(c) and (f) Application; anonymization, deletion
S13 Session records 90 days End of the session Product rule Application; automatic deletion
S14 Records of account emails sent Delivered: 90 days; failed: 365 days Time of sending Product default Application; automatic deletion
S15 Support record (subject, correspondence) 10 years End of the calendar year in which the contract ended TTK Article 82 Support ticket system
S16 Support attachments and screenshots 6 months Closing of the request KVKK Article 4(2)(ç) Support ticket system; deletion
S17 Management panel action records (Firmanet staff) 2 years Time of recording KVKK Article 5(2)(f); evidence Management panel; deletion
S18 Operational information for installations on your own server 1 year Time of recording KVKK Article 4(2)(d) Management panel; deletion
S19 Unsuccessful candidate application 6 months Notification of the outcome or closing of the process KVKK Article 4(2)(d); Board Decision No. 2021/670 Email, Human Resources records; deletion
S20 Candidate pool 12 months; if consent is withdrawn, deletion within 30 days Date of consent Explicit consent Email, Human Resources records; deletion
S21 Data subject request and the response to it 3 years Date of the response Evidence; consistent with Article 7(3) of the Regulation Request records
S22 Destruction reports 3 years Date of the report Article 7(3) of the Regulation Paper or electronic
S23 Backups 30 days Creation of the backup KVKK Article 4(2)(d) Backup environment; deletion through the cycle
S24 Closed workspace (data held on behalf of the customer) 30 days during which it can be restored, then permanent deletion; if the retention period for financial documents is still running, a written decision with the customer Closure Product rule; VUK, TTK Application
S25 Form records left over from the old website (contact, quote, newsletter, CV) CV: S19 rule; contact and quote: S05 rule; newsletter: immediately if there is no proof of consent Launch of the new website KVKK Article 4(2)(d) and Article 7 Old website database and uploads

Periodic destruction

We carry out periodic destruction every six months, in January and July. The interval does not exceed six months in any case (Article 11 of the Regulation).

  • Each unit reviews its own recording media against the retention periods table. It destroys records whose period has expired and for which no other condition for processing remains, using the method in the table.
  • Records that are deleted automatically (S01, S02, S03, S13, S14, S23) are deleted in their own cycle. During periodic destruction, the system operations officer checks that these deletions are working.
  • Each destruction operation is documented in a destruction report. The report states the date of destruction, the recording medium, the record type and data category, the number of records, the method applied, and the unit that carried out the operation. Reports are kept for 3 years after approval by Management (S22).

Destruction on request

You can request the deletion or destruction of your data through the channels described on the Data subject requests page.

  • If all of the conditions for processing have ceased to exist, we destroy your data without waiting for periodic destruction, within 30 days at the latest, and notify you.
  • If we have previously transferred your data to a recipient, we also notify that recipient of your request and ask it to destroy the data.
  • If one of the conditions for processing still applies (for example, if a statutory retention period has not expired), we reject your request with reasons and notify you of this in writing or electronically within 30 days. This data is destroyed once the condition ceases to exist.
  • If you withdraw your consent to marketing emails, you are removed from the mailing list within 3 business days (S10). If you withdraw your consent for the candidate pool, your data is deleted within 30 days (S20).

Data held on behalf of customers

For data in the workspaces of IWB customers, the customer is the data controller; we are the data processor acting on the customer’s behalf. The customer decides the retention period for this data. We retain and delete this data in accordance with the customer’s instructions and the Data Processing Agreement. The retention periods within IWB are also set out in Annex 1 to that agreement.

  • A closed workspace can be restored for 30 days and is then permanently deleted. If it contains financial documents whose retention period has not expired, it is not deleted automatically; in that case, a written decision is made with the customer (S24).
  • IWB provides customers with the following tools for their own destruction tasks: anonymization of users, contacts who are natural persons, and contact persons; anonymization of HR personnel file data through an HR action once its period has expired; and a flag for marking custom fields as sensitive.
  • If we receive a deletion request that concerns data in a customer’s workspace, we forward it to that customer within 5 business days and notify you.

Updates

We review this policy at each periodic destruction and whenever a recording medium, a retention period, or the relevant legislation changes. Each update is entered in the table below.

Version Date Change
2026-10-v1 October 20, 2026 First publication

The version and the update date are shown at the top of the page. When we change the text, we publish the new version at this address; the change applies from the date it is published.