Retention policy

This page shows the English summary. The full, binding text is in Turkish. Read the full Turkish text

• How long Stampul keeps each kind of personal data, and how it deletes it.
• Strictly required only for VERBIS registrants (Regulation Art. 5); Stampul is very likely exempt (fewer than 50 staff and under ₺100m balance sheet), but writes the policy anyway as good practice and because the DPA promises it.
• Key periods: customer cards are anonymised 24 months after last use or right after the customer deletes the card; marketing-consent records 3 years after consent ends; café account data 10 years after the contract ends (limitation period); invoices and books 10 years; server access logs 2 years; demo requests 1 year. ⚖️
• Periodic destruction runs every 6 months (the Regulation's maximum interval, Art. 11), plus immediate deletion for customer requests (within 30 days).
• Methods: deletion from the live database, anonymisation for statistics, backups expire on rotation (35 days).