سياسة الاحتفاظ بالبيانات وإتلافها
هذا المستند متاح بالتركية والإنجليزية؛ تُعرض النسخة الإنجليزية.
This policy explains how long personal data processed by Müsaitmi is kept and how it is deleted, destroyed or anonymised when the period ends. It is based on KVKK and the Regulation on the Deletion, Destruction or Anonymisation of Personal Data.
1. Principles
- Data is kept only for the period the purpose requires and the law prescribes.
- When the period ends or the purpose disappears, data is deleted, destroyed or anonymised.
- Deletion/destruction runs periodically (via automated jobs) and at least every six months; data subject requests are handled independently.
2. Retention periods
| Data | Retention | At the end |
|---|---|---|
| Customer account (phone, email, name, language) | Until the account is deleted | On deletion, name/email are removed and the phone number is replaced by an irreversible placeholder |
| Verification (OTP) records — code hash, IP, time | 90 days from creation | Deleted automatically |
| Session/refresh tokens, password-reset and sign-in codes | Until 30 days after expiry or revocation | Deleted automatically |
| Mobile push device tokens | Until sign-out, account deletion or invalidity | Deleted/disabled |
| Notification delivery records (SMS, email, notification content) | 12 months from creation | Recipient and message content are deleted automatically; time/type/status remain as an anonymous record |
| Booking, customer file, checkout/payment, loyalty, package and stock records (the Business’s records) | The Business’s period of activity and retention periods in the relevant law (generally 5–10 years for accounting/tax records) | Deleted/anonymised by the Business; if the account is deleted the link to the customer account is cut |
| Reviews and survey answers | While published / while the Business record exists | Removed on request or author data removed |
| Marketing consent record | Until consent is withdrawn; the withdrawal record for the statutory limitation period as evidence | Deleted |
| Administrative (audit) logs | Up to 10 years (security and legal evidence); contain no phone numbers | Deleted |
| Backups | The regular backup cycle (short-term) | Overwritten/deleted at the end of the cycle |
3. Methods
- Deletion: removing data from databases and related systems so that users can no longer access it.
- Destruction: making data unusable and inaccessible for anyone (including replacement with an irreversible placeholder).
- Anonymisation: making data impossible to link to an identified or identifiable person even if matched with other data.
4. Account deletion
A customer account can be deleted in the app or on the website (see the Account Deletion page). If you have upcoming bookings, cancel them first. After deletion, identity data of the account is removed, sessions are closed, favourites and device tokens are deleted and marketing consent is switched off. A Business’s own accounting/booking records may remain as that Business’s legal records but are detached from your account.
5. Responsibilities and updates
Applying this policy and periodic destruction are the technical and organisational responsibility of the Platform Operator. The policy is updated when law or processing activities change.
Contact
For questions or requests about this document, contact us:
- Operator: Müsaitmi (musaitmi.net)
- Email: [email protected]
- Phone: 0552 280 51 28