Legal Notices

In case of any discrepancy or conflict between this text and the Personal Data Retention and Destruction Policies published in Turkish, the Turkish version shall prevail.

NOKTA GUARD SİBER GÜVENLİK TEKNOLOJİLERİ ANONİM ŞİRKETİ PERSONAL DATA RETENTION AND DESTRUCTION POLICY

1. PURPOSE AND SCOPE

1.1. This Personal Data Retention and Destruction Policy (the "Policy") has been drawn up to determine the procedures and principles regarding the personal data processing, retention and destruction activities carried out by NOKTA GUARD SİBER GÜVENLİK TEKNOLOJİLERİ ANONİM ŞİRKETİ (the "Company"), acting as data controller and/or data processor, in accordance with the Personal Data Protection Law No. 6698 ("KVKK"), the Regulation on the Deletion, Destruction or Anonymisation of Personal Data (the "Regulation") and the principles and decisions of the Personal Data Protection Board (the "Board").

1.2. This Policy covers all personal data of the Company's employees, employee candidates, interns, shareholders, board members, business partners, suppliers, customers, customer representatives and employees, parties whose systems are accessed within the scope of cybersecurity consultancy, penetration testing, security operations centre (SOC), vulnerability scanning, IT and technical support/storage services, and third parties, processed by the Company by automated means or by non-automated means provided that they form part of a data recording system.

2. DEFINITIONS AND BASIS

2.1. In this Policy;

Recipient Group: means the category of natural or legal persons to whom personal data is transferred by the data controller,

Explicit Consent: means consent relating to a specific matter, based on information and expressed with free will,

Anonymisation: means rendering personal data impossible to associate in any way with an identified or identifiable natural person, even by matching it with other data,

Incidental Access: means temporary contact, without any direct intention to process, with personal data contained in customer information systems during penetration testing, vulnerability scanning, cyber incident response and storage/technical infrastructure support services, solely for the purpose of detecting and analysing security vulnerabilities or maintaining the system,

Data Subject: means the natural person whose personal data is processed,

Destruction: means the deletion, destruction or anonymisation of personal data,

Personal Data: means any information relating to an identified or identifiable natural person,

Recording Medium: means any medium containing personal data processed by fully or partially automated means or by non-automated means provided that they form part of a data recording system,

Board: means the Personal Data Protection Board,

Special Categories of Personal Data: means data relating to persons' race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, as well as biometric and genetic data,

Periodic Destruction: means the deletion, destruction or anonymisation process to be carried out ex officio at regular intervals determined in this Policy and not exceeding 6 (six) months, where all the conditions for processing personal data set out in the legislation have ceased to exist,

Deletion: means the process of rendering personal data inaccessible and unusable in any way for the relevant users,

Data Inventory: means the inventory in which the data controller details the personal data processing activities it carries out depending on its business processes by associating them with legal grounds, purposes, data categories, recipient groups and retention periods,

Data Processor: means the natural or legal person who processes personal data on behalf of the data controller based on the authority granted by the data controller,

Data Controller: means the natural or legal person who determines the purposes and means of processing personal data and is responsible for establishing and managing the data recording system,

Destroying: means the process of rendering personal data inaccessible, unrecoverable and unusable by anyone in any way.

3. INFORMATION ON THE DATA CONTROLLER

3.1. Data Controller Details:

Title: NOKTA GUARD SİBER GÜVENLİK TEKNOLOJİLERİ ANONİM ŞİRKETİ

Head Office Address: Cumhuriyet Mah. Kartepe Sk. Usta Ofis Plaza No: 4 İç Kapı No: 8 Kartal / İstanbul

Website: www.noktaguard.com Phone: +90 216 606 16 22

3.2. Distinction of Capacities and Roles:

Data Controller Capacity: The Company is the "Data Controller" with respect to personal data processed in connection with its own corporate operations, human resources processes, shareholding and management activities, agreements to which it is a direct party, accounting-finance transactions and the security of its own physical/electronic environments.

Data Processor Capacity: The Company acts as the "Data Processor" with respect to personal data located in customers' systems that it comes into contact with incidentally or operationally, within the processing purposes and means determined by its customers, while performing the penetration testing, security operations centre (SOC), vulnerability analysis, system administration, storage and cybersecurity technical support services it provides to its customers. In this context, the Company complies exclusively with the written instructions and data security provisions set out in customer agreements.

4. BASIC PRINCIPLES IN THE RETENTION AND DESTRUCTION OF PERSONAL DATA

The Company fully and unconditionally complies with the following principles in the retention and destruction of personal data:

4.1. Lawfulness and fairness: Data is processed and retained in good faith, transparently and in accordance with a legal basis.

4.2. Accuracy and being up to date where necessary: It is ensured that retained data reflects the truth; data is updated in line with the data subject's statement or official documents, and data whose accuracy cannot be verified or which has become outdated even though the business relationship has ended is removed from active systems.

4.3. Processing for specified, explicit and legitimate purposes: The legitimate purpose for which personal data is processed and retained is clearly determined; data may not be retained for vague or hypothetical requirements that may arise in the future.

4.4. Being relevant, limited and proportionate to the purposes for which they are processed (Data Minimisation): No personal data that is not necessary to achieve the purpose is collected or retained. Where the same purpose can be achieved with less data or without data, alternative methods are applied.

4.5. Retention for the period stipulated in the relevant legislation or required for the purpose of processing: Where a period is expressly stipulated by law, data is retained for that period; otherwise, it is retained only for the maximum period required by the purpose of processing. When all processing conditions cease to exist, data may not be kept indefinitely; it is destroyed immediately ex officio or upon request.

5. ENVIRONMENTS WHERE PERSONAL DATA IS STORED

5.1. Personal data is stored in the following secured physical and electronic environments at the Company:

Electronic Environments: Local servers, backup units, databases, firewall log systems, SIEM and SOC systems, network management devices, corporate e-mail accounts, corporate laptop/desktop computers, encrypted portable storage units at the Company's head office, and secure cloud/hosting infrastructures allocated on behalf of the Company.

Physical Environments: Locked archive cabinets, personnel file folders, accounting/finance folders, physical visitor logs and security checkpoints at the Company's head office.

6. TECHNICAL AND ADMINISTRATIVE MEASURES TO BE APPLIED IN RETENTION AND DESTRUCTION PROCESSES

In accordance with Article 12 of the KVKK and Board decisions, the Company fully implements the following measures to prevent the unlawful processing of and access to personal data and to ensure its safekeeping:

6.1. Technical Measures:

Cryptographic Protection: All data stored electronically, databases and portable media are encrypted with encryption algorithms compliant with current standards. Cryptographic keys are kept in secure and separate environments. Encryption and hashing operations alone are not considered anonymisation; such data is protected with the status of personal data.

Access and Authorisation: An authorisation matrix has been established. Employees are granted access only on a "need-to-know" basis as required by their job descriptions. In the event of a change of duty or departure from employment, access rights are revoked immediately on the same day.

Remote Access and Security: Remote access to Company systems and customer test networks is provided via encrypted VPN and at least two-factor authentication (MFA - Multi-Factor Authentication).

Logging and Record Security: Network, system, server and user transaction logs (access, deletion, modification, transfer, etc.) are kept on secure log servers in a non-repudiable, unalterable and time-stamped manner.

Cybersecurity Tests and Updates: Penetration tests, vulnerability assessments and antivirus/firewall updates relating to the Company's IT infrastructure are performed and reported periodically.

Network Security: Intrusion detection and prevention systems (IDS/IPS), network segmentation and web application firewalls (WAF) are actively operated.

6.2. Administrative Measures:

Corporate Policies and Undertakings: Confidentiality agreements are concluded with employees, suppliers and customers. All personnel are required to sign a confidentiality and data security undertaking when starting work; this obligation continues indefinitely after the employment contract ends.

Training and Awareness: Employees regularly receive training on information security, cyber threats and KVKK legislation.

Internal Audit: The effectiveness of the Company's technical and administrative measures is subject to unannounced or planned internal audit by the established Personal Data Committee at least once a year.

Data Minimisation and Clean Desk/Screen: Physical documents are kept in locked cabinets, and documents containing personal data may not be left exposed on desks or screens.

7. SPECIAL RETENTION AND DESTRUCTION RULES FOR CYBERSECURITY AND PENETRATION TESTING SERVICES

7.1. Exercise of the Data Processor Role: Within the scope of penetration testing, vulnerability scanning, security audit, SOC monitoring and digital forensics activities carried out by the Company, personal data in customer systems is contacted solely for the purpose of detecting, analysing, simulating and reporting security vulnerabilities and within the scope of "Incidental Access".

7.2. Prohibition on Keeping Unnecessary Copies: During testing activities, database copies (dumps), user identity lists or raw customer personal data from target systems are never downloaded to or stored on the Company's local environments or employee computers. Where it is mandatory to take a screenshot or log to prove a vulnerability, the personal data in the image (name, surname, Turkish ID number, account number, etc.) is immediately and irreversibly masked, redacted or de-identified by the test specialist.

7.3. Destruction of Test Data and Reports: Following the completion of penetration testing activities and the delivery of the final report to the customer, temporary user accounts, test scripts, temporary log records and raw technical evidence created during the test are irreversibly deleted and destroyed within 15 (fifteen) calendar days at the latest. The final penetration test report is stored in a secure, encrypted and access-restricted environment, limited to the limitation periods of the Turkish Code of Obligations and the Turkish Commercial Code, as required by contractual responsibilities, potential legal disputes and evidentiary obligations. Upon termination of the agreement concluded with the customer or upon the customer's written instruction, incidental data belonging to the customer is destroyed immediately and a destruction confirmation report is provided to the customer.

8. ADDITIONAL MEASURES TO BE TAKEN IN THE RETENTION AND DESTRUCTION OF SPECIAL CATEGORIES OF PERSONAL DATA

8.1. The Company manages criminal record data, health data or special categories of personal data processed where permitted by law relating to its employees or third parties in full compliance with the Board's decision dated 31.01.2018 and numbered 2018/10.

8.2. Special categories of personal data are kept in environments isolated from the general corporate network, encrypted with asymmetric encryption methods, and accessible only to personnel expressly authorised by the Board of Directors.

8.3. Biometric data (fingerprint, face/hand geometry, etc.) may under no circumstances be processed or stored at building or room entrances as long as the purpose can be achieved by alternative and less intrusive methods (card access, password, etc.). Special categories of personal data are transferred only via KEP, encrypted corporate e-mail or cryptographic sFTP protocols. Special categories of data for which the reason for retention has ceased are destroyed without delay by secure methods.

9. PROCEDURES AND METHODS FOR THE DESTRUCTION OF PERSONAL DATA

When the conditions for processing personal data cease to exist, the Company carries out the destruction by choosing one of the following methods appropriate to the nature of the data and the environment in which it is stored. The Company clearly states the justification for the chosen method in the destruction report.

9.1. Deletion of Personal Data:

Data in Cloud and Server Environments: The access rights of the relevant users are removed and the data is irreversibly deleted from the central database via the command line or database management tools; it is made inaccessible and unusable for users other than the system administrator.

Physical Documents: Personal data on the document is blacked out, painted over, cut out or rendered illegible by technological or physical means in an irreversible manner.

9.2. Destruction of Personal Data:

Electronic and Magnetic Media: Magnetic disks, hard drives, SSDs or portable memory devices on which data is stored are destroyed by degaussing, secure software data overwriting (overwriting at least 7 times by writing zeros and random data in accordance with at least DoD 5220.22-M or Gutmann standards), or by physically shredding, burning, melting or pulverising the hardware in a mechanical crusher.

Physical Environments (Paper/Cartridge): Documents, files and paper media containing personal data are destroyed by being divided into small pieces that cannot be reassembled in industrial paper shredders (cross-cut shredders at least at level P-4 of the DIN 66399 standard).

9.3. Anonymisation of Personal Data:

For data to be considered anonymised, it is not sufficient to remove direct identifiers from the data; it must be impossible to associate it with an identified or identifiable natural person even through combination with other data, record matching, separation or reverse engineering methods.

Noise addition, masking, aggregation, generalisation or K-Anonymity/L-Diversity techniques are used in anonymisation. Encrypted or hashed data is not considered anonymous data as long as the decryption key or algorithm exists.

10. PERSONAL DATA RETENTION AND DESTRUCTION PERIODS TABLE

Personal data processed within the Company is retained for the periods based on the legal grounds set out in the table below and destroyed in the first periodic destruction period following the end of the period:

11. PERIODIC DESTRUCTION AND EX OFFICIO DESTRUCTION SCHEDULE

11.1. Pursuant to Article 11 of the Regulation, the Company has set the periodic destruction interval at 6 (six) months in line with this Policy.

11.2. Periodic destruction is carried out by the Personal Data Committee within the Company on the last business days of June and December each year.

11.3. Personal data whose retention period has expired or for which all processing conditions have ceased to exist is destroyed ex officio on the first periodic destruction date without the need for any further notice or request. The team carrying out the destruction records the justification for the destruction and the method applied.

12. DESTRUCTION PROCESS UPON THE DATA SUBJECT'S REQUEST AND NOTIFICATION TO TRANSFEREES

12.1. Where the data subject applies to the Company under Articles 11 and 13 of the KVKK and requests the deletion or destruction of their personal data:

If All Conditions Have Ceased to Exist: The Company concludes the request within 30 (thirty) days at the latest without waiting for the periodic destruction schedule. Unless there is a Law, judicial Decision, Agreement, Undertaking, Board Decision, Regulation or Decree to the contrary, the data subject to the request is immediately deleted, destroyed or anonymised, and the result of the transaction is notified to the data subject in writing or via KEP or e-mail.

If All Conditions Have Not Ceased to Exist: If the legal retention conditions under Articles 5 and 6 of the KVKK, statutory limitation periods or ongoing judicial/administrative proceedings continue, the Company rejects the request in writing or electronically within 30 (thirty) days at the latest, explaining its justification with concrete facts.

12.2. Obligation to Notify Third Parties: Where data is destroyed upon the data subject's request or ex officio, if such personal data has previously been transferred to suppliers, business partners or subcontractors, the Company immediately notifies the third parties to whom the transfer was made of the destruction and ensures that the data is also deleted/destroyed by such third parties.

13. RECORDING AND RETENTION OF DESTRUCTION TRANSACTIONS

13.1. All deletion, destruction and anonymisation transactions carried out are recorded with a "Personal Data Destruction Report" drawn up to include the destruction date, method, category of destroyed data, the legal justification for the transaction and the signature of the authorised personnel carrying out the transaction.

13.2. Pursuant to Article 7 of the Regulation, such reports, log records and audit trails relating to the destruction of personal data are kept securely and in a non-repudiable manner for at least 3 (three) years, without prejudice to other legal obligations and statutory limitation periods.

14. MANAGEMENT OF THE POLICY, RESPONSIBILITIES AND INTERNAL AUDIT

14.1. Personal Data Committee: A Personal Data Committee has been established within the Company by a Board of Directors resolution (the sole signature of the Chairperson is sufficient) for the purpose of implementing this Policy, monitoring periodic destructions, updating the inventory and auditing data security measures.

14.2. Distribution of Duties and Roles:

Board of Directors: Responsible for approving the Policy, putting it into effect and deciding on final administrative sanctions in case of violations.

Chairperson of the Personal Data Committee: Ensures coordination between Company operations and KVKK compliance; directs and manages the response to data subject applications within the statutory period and the destruction processes.

Information Technologies and Cybersecurity Unit: Directly responsible for implementing technical security measures in electronic recording environments, encryption mechanisms, access authorisation matrices and deletion/destruction software.

Human Resources and Administrative Affairs Unit: Responsible for the physical security of personnel files, drawing up agreements and confidentiality undertakings, and carrying out the authorisation/inventory return processes of departing personnel.

14.3. The provisions of the Company's Disciplinary Procedure are applied to employees who act contrary to the provisions of the Policy; depending on the severity of the act, termination of the employment contract for just cause and filing a criminal complaint with judicial authorities may be decided.

15. ENTRY INTO FORCE, UPDATE AND PUBLICATION

15.1. This Policy enters into force on the date it is adopted by the Board of Directors of NOKTA GUARD SİBER GÜVENLİK TEKNOLOJİLERİ ANONİM ŞİRKETİ.

15.2. The Policy is regularly reviewed and updated when necessary in line with legislative changes, Board principle decisions or technical requirements in the Company's cybersecurity fields of activity.

15.3. The current copy of the Policy is published in the corporate intranet/shared network environment accessible to Company employees and, where necessary, on the Company's website (www.noktaguard.com). If it is decided to repeal the Policy, the old wet-signed copies of the Policy are cancelled (by stamping or writing "cancelled") and signed by the Human Resources Unit upon a resolution of our Company's Board of Directors, and are kept by our Company's Human Resources Unit for at least 5 years.

NOKTA GUARD SİBER GÜVENLİK TEKNOLOJİLERİ ANONİM ŞİRKETİ

Date:….../…../20…..

Signature: