Personal Data Retention and Destruction Policy

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Purpose, scope and legal basis of the policy, and definitions.

• Raw images and videos captured during identity verification (document images, selfie, liveness video) and the face-comparison and profile-photo crops derived from them: automatically deleted 7 days after submission.
• Data in the biometric security pool (biometric face template, one facial photograph, ID number and, if provided, username): automatically deleted 90 days after the record is created. Deletion of its own record by the Brand does not affect this period; if explicit consent is withdrawn, the data is deleted before the period expires.
• Files uploaded through the document collection flow are automatically deleted from both of the platform’s stores 7 days after delivery to the Brand (8 days after processing completes if no delivery takes place).
• The verification decision (approved/rejected) and the explicit consent record are retained for audit purposes. Personal data such as the fields read from the document, form answers, contact details (e-mail, telephone) and IP address is deleted at the same time as the files (7 days after the decision for standalone identity verification); for records still under review, this period starts at the decision. Only transaction information that contains no personal data (time, status, fee) is kept.
• Files that could not be safely processed (rejected) or could not be processed are kept for at most 7 days for manual review; files held unprocessed because the Brand’s balance was insufficient or its account was suspended are held for at most 7 days. In both cases they are deleted at the end of the period.
• Brand account and billing data: kept for the duration of the contractual relationship and for the statutory retention periods required by commercial and tax legislation.

These periods are the same for all Brands and cannot be extended by a Brand. Data whose period has expired is deleted, destroyed or anonymised.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] Methods of deletion, destruction and anonymisation, the periodic destruction interval and the keeping of destruction records.

[AVUKAT METNİ BEKLENİYOR — lawyer text pending] The units/persons involved in retention and destruction processes and their responsibilities.