Data Retention and Destruction Policy
This policy explains how long personal data processed by karincalisans.com is retained, how it is destroyed once the retention period expires, and how the periodic destruction process works. It is based on the Turkish Regulation on the Erasure, Destruction or Anonymisation of Personal Data.
1. Grounds for Retention
Your personal data is retained for the performance of the contract, statutory retention obligations (in particular the Tax Procedure Law and the Turkish Commercial Code), for use as evidence in potential disputes, and to ensure the security of our services.
2. Retention Periods
| Data type | Retention period | Basis |
|---|---|---|
| Membership account details (name, email, phone) | For as long as the membership continues; immediately upon account deletion | Performance of contract |
| Order, invoice and payment records | 5 years for tax records, 10 years for commercial books and documents | Tax Procedure Law art. 253, Commercial Code art. 82 |
| Delivered licence/product records | Together with the order record (10 years) | Warranty and dispute processes |
| Licence key viewing records | 1 year | Legitimate interest — detecting misuse |
| Failed login records (email + IP) | 30 days | Legitimate interest — account security |
| Rate-limiting records (IP) | 7 days | Legitimate interest — abuse protection |
| IP address recorded at sign-up | 1 year | Legitimate interest — referral abuse control |
| Marketing email delivery records | 1 year | Legitimate interest — preventing duplicate sends |
| Unconfirmed newsletter records | 30 days | No ground for retention without confirmation |
| Newsletter subscription and commercial message consent | Until consent is withdrawn; for a reasonable period thereafter as proof | Law No. 6563 art. 6 — burden of proof |
| Opt-out (refusal) records for commercial messages | Indefinitely, to keep the opt-out effective | Law No. 6563 art. 8 — respecting the right to refuse |
| Product reviews | For as long as published; identity details are anonymised when the account is deleted | Legitimate interest |
| Cookie preference | In your browser's local storage until you clear it | Record of explicit consent |
3. Methods of Destruction
- Erasure: Making the data inaccessible and unusable in any way for the relevant users. Database records are permanently removed.
- Destruction: Making the data inaccessible, irretrievable and unusable by anyone in any way.
- Anonymisation: Making the data impossible to associate with an identified or identifiable natural person, even when matched with other data. This method is applied to records that cannot be erased because of a statutory retention obligation.
4. Periodic Destruction
Personal data whose retention period has expired is erased on our own initiative, without waiting for a request from the data subject. Our systems run an automated destruction job every day for this purpose; expired security records, IP data and unconfirmed marketing records are cleared by this job.
5. What Happens When You Delete Your Account?
When you delete your account from the Account Details page:
- Your name, email, phone, favourites, newsletter subscription and task requests are permanently erased,
- The content of your product reviews remains, but the name and email are anonymised,
- Karınca Points ledger records are kept for financial integrity, with the email address anonymised,
- Order and invoice records cannot be erased during the statutory retention periods stated above; their link to your account is severed,
- Your email address is removed from commercial message lists and you will receive no further marketing emails.
6. Data Security
Technical and administrative measures taken to protect your personal data include encryption of all traffic with HTTPS, storage of passwords using irreversible hash algorithms, closing external access to the database, a firewall, an authorisation matrix and access restrictions, regular backups and a content security policy (CSP). Card details are never stored on our systems at any stage.
7. Related Pages
Last updated: 3 August 2026