Data Destruction and Retention Policy
Document Control
| Document ID | HL-ISMS-POL-10 |
|---|---|
| Document Title | Data Destruction and Retention Policy |
| Classification | Internal |
| Version | 2.0 |
| Status | Approved |
| Document Owner | Information Security Manager (ISM) |
| Approved by | Executive Management |
| Effective Date | 30.10.2026 |
| Next Review Date | Annually from effective date, or upon significant change |
| Applies to | Hamurlabs Elektronik Hizmetler Yazılım ve Ticaret A.Ş. (Istanbul, Türkiye) and Hamurlabs BV (Leuven, Belgium), together "Hamurlabs" |
1. Purpose and Scope
This policy defines how long Hamurlabs retains the categories of data it processes and how data is securely destroyed when retention ends. It implements the storage-limitation principle of GDPR Art. 5(1)(e) and KVKK Art. 4, and the deletion obligations of GDPR Art. 17 and 28(3)(g) and KVKK Art. 7. It applies to all data processed by both Hamurlabs entities, in all systems and media. For Hamurlabs A.Ş., this policy is supplemented by the Turkish-language Kişisel Veri Saklama ve İmha Politikası (HL-KVKK-POL-01), which is the authoritative document for KVKK purposes.
2. Principles
- Data is retained only as long as necessary for the purpose for which it was collected, for the duration required by law, or for the duration required to establish, exercise or defend legal claims.
- When retention ends, data is deleted, destroyed or anonymised; deletion at the end of a customer relationship is an obligation of Hamurlabs as processor, not a discretionary right.
- Where different retention grounds apply to the same data, the longest applicable lawful period prevails, and the data is restricted to that purpose for the remainder of the period.
- Retention periods and destruction events are documented to provide an audit trail.
3. Customer Data Processed in HaROS (Hamurlabs as Processor)
- Customer data is retained for as long as the customer account is active under the applicable contract.
- Upon voluntary account closure or contract termination, the data enters an "expired" state and is retained for 60 days to allow the customer to export data and to protect against accidental termination. Customers are advised to export their data before closure; export assistance is provided on request.
- At the end of the 60-day period, Hamurlabs deletes the expired customer data from production systems, except where a longer retention of specific records is required by applicable law. Deleted data cannot be recovered.
- Residual copies in encrypted backups are overwritten through the ordinary backup rotation cycle following production deletion and are not restored to production except for lawful recovery purposes.
- Written certification of deletion is provided upon the customer’s request.
- Where the customer’s data processing agreement stipulates a different deletion period or a return-then-delete sequence, the contractual terms prevail for that customer.
4. Retention Schedule (Corporate Data)
The following default periods apply to Hamurlabs corporate records. Statutory bases are indicative; the Turkish policy (HL-KVKK-POL-01) contains the authoritative KVKK table for Hamurlabs A.Ş., and Belgian statutory periods apply to Hamurlabs BV records.
| Data category | Retention period | Basis |
|---|---|---|
| Accounting records, invoices, ledgers (TR) | 10 years | Turkish Commercial Code Art. 82; Tax Procedure Law 5-year minimum |
| Accounting records, invoices (BE) | 10 years from end of financial year | Belgian Code of Economic Law / VAT rules |
| Customer and supplier contracts | 10 years after termination | Limitation periods for contractual claims (TR & BE) |
| Employee personnel files (TR) | 10 years after employment ends | Labour, social security and occupational health legislation |
| Employee records (BE) | 5 years after employment ends (social documents); payroll per statutory rules | Belgian social documentation legislation |
| Job applications (unsuccessful candidates) | 1 year after the decision, then deleted | Legitimate interest; consent where extended pooling is offered |
| Security, access and system logs | 2 years, unless a specific incident requires longer preservation as evidence | Security operations; legal defence |
| Incident records and breach documentation | 5 years after closure | Accountability (GDPR Art. 5(2), 33(5)); legal defence |
| Marketing and business contact data | While the relationship or consent is active; reviewed annually | Consent / legitimate interest |
5. Destruction Methods
- Deletion (electronic): removal via application/database deletion functions and cloud deletion commands so that data is no longer accessible or usable by any user, followed by expiry of backup copies in the rotation cycle.
- Destruction (physical media): shredding, incineration or certified media destruction; cryptographic erasure (destruction of encryption keys) is an approved method for encrypted volumes and devices.
- Anonymisation: irreversible removal of identifiers (masking, aggregation, generalisation) such that data can no longer be associated with an identified or identifiable person; anonymised data may be retained for analytics.
- Paper records: cross-cut shredding; confidential documents are never disposed of in general waste.
- Each destruction of records subject to this policy is logged (what, when, method, who performed and who approved), and third-party disposal services provide destruction certificates.
6. Responsibilities and Review
The ISM maintains this policy, coordinates the periodic review of stored data against the schedule, and maintains the destruction log. Asset and data owners implement retention and destruction for the data under their ownership. Data identified as expired is destroyed in the next periodic destruction cycle, conducted at least every 6 months, in alignment with the periodic destruction requirement applicable to Hamurlabs A.Ş. under KVKK. Compliance is assessed in the annual ISMS review.