Softage Yazılım Anonim Şirketi (Vega)
This policy regulates the procedures and principles for storing, destroying, and anonymizing personal data by Softage Yazılım Anonim Şirketi ("Vega") within the scope of Turkish Personal Data Protection Law No. 6698 ("KVKK") and related legislation.
This policy applies to all personal data processed by Vega in its capacity as data controller. The purpose is to prevent personal data from being retained longer than necessary, ensure compliance with statutory retention periods, and protect the rights of data subjects.
Personal data is retained for whichever is longer: the period required by the processing purpose or the statutory retention period:
| Data Category | Retention Period | Legal Basis |
|---|---|---|
| Customer contract data | 10 years | Turkish Code of Obligations |
| Financial and accounting records | 10 years | Tax Procedure Law |
| Patient records | 20 years | Patient Rights Regulation |
| Contact form data | 2 years | KVKK / Legitimate interest |
| System log records | 2 years | Law No. 5651 |
| Employee personnel files | Employment + 10 years | Labor Law |
Personal data whose retention period has expired or whose processing purpose has ceased is destroyed by one of the following methods:
Data stored in digital media is deleted in an irreversible manner. Anonymization or overwriting methods are applied in databases.
Data on physical media (paper, CD, USB, etc.) is destroyed using shredding or physical destruction methods that make recovery impossible.
Processing data in a manner that makes it impossible to identify individuals, so it can be used for statistical or analytical purposes.
Vega reviews its personal data inventory every six months and destroys data whose retention period has expired according to the established destruction schedule. Destruction operations are recorded and these records are retained for three years.
Data subjects may request the deletion or destruction of their personal data under Article 11 of KVKK. Such requests are fulfilled within thirty days, provided that the processing purpose has ceased and the statutory retention period has expired.
