Legal Notices

In case of any discrepancy or conflict between this text and the Personal Data Retention and Destruction Policies published in Turkish, the Turkish version shall prevail.

NOKTA GUARD SİBER GÜVENLİK TEKNOLOJİLERİ ANONİM ŞİRKETİ PRIVACY NOTICE FOR CUSTOMERS PURSUANT TO THE PERSONAL DATA PROTECTION LAW NO. 6698

1. IDENTITY OF THE DATA CONTROLLER AND DISTINCTION OF CAPACITIES

1.1. Data Controller Details: Pursuant to the Personal Data Protection Law No. 6698 ("KVKK") and the Communiqué on the Procedures and Principles to be Followed in Fulfilling the Obligation to Inform, your personal data is processed by the Data Controller whose identity and contact details are set out below:

Title : NOKTA GUARD SİBER GÜVENLİK TEKNOLOJİLERİ ANONİM ŞİRKETİ (the "Company")

Head Office Address : Cumhuriyet Mah. Kartepe Sk. Usta Ofis Plaza No: 4 İç Kapı No: 8 Kartal / İstanbul

Website : www.noktaguard.com

Phone : +90 216 606 16 22

E-mail Address : info@noktaguard.com

1.2. Distinction Between the Capacities and Roles of Data Controller and Data Processor: Data Controller Capacity: The Company acts as the "Data Controller" under Article 3/1-ı of the KVKK with respect to personal data processed in connection with its own corporate operations, the conclusion and performance of service and penetration testing agreements to which it is a direct party, communication processes conducted with customer representatives and contact persons, accounting and finance transactions, and the security of its own physical and electronic environments.

Data Processor Capacity: The Company acts as the "Data Processor" under Article 3/1-ğ of the KVKK with respect to personal data that it comes into contact with, temporarily ("Incidental Access") or operationally and without any direct intention to process, solely for the purpose of detecting, analysing, simulating and reporting security vulnerabilities or maintaining the system, within the processing purposes and means determined by its customers, in customers' information systems, servers, networks and applications while performing the cybersecurity consultancy, penetration testing, security operations centre (SOC), vulnerability scanning and analysis, system administration, digital forensics, IT and technical support/storage services it provides to its customers. With respect to such data, the relevant customer is the "Data Controller", and the Company complies solely with the written instructions and data security provisions set out in customer agreements.

2. CATEGORIES OF PERSONAL DATA PROCESSED, PURPOSES OF PROCESSING, LEGAL GROUNDS AND RETENTION PERIODS

Personal data belonging to our customers, customer representatives, contact persons and their employees is processed for the purposes and on the legal grounds matched below, in full compliance with the principles set out in Article 4 of the KVKK: lawfulness and fairness; accuracy and being up to date where necessary; processing for specified, explicit and legitimate purposes; being relevant, limited and proportionate to the purposes for which they are processed ("Data Minimisation"); and being retained only for the period stipulated in the relevant legislation or required for the purpose of processing:

2.1. Data of Customer Representatives and Contact Persons (Identity, Contact and Signature Data):

Data Processed: Name, surname, Turkish ID number, title, phone number, corporate e-mail address, registered e-mail (KEP) address, signature circular/authorisation document and signature data on the agreement.

Purposes of Processing: Negotiating, concluding and performing penetration testing and cybersecurity service agreements; carrying out authorised security testing permissions (Safe Harbor) and emergency contact processes under the Penetration Test Requirements Form (Annex-1); ensuring operational coordination, scope confirmations, emergency stop notifications, access information, interim updates and the secure transfer of draft and final reports; fulfilling invoicing, electronic notification, accounting and current account obligations under the Turkish Commercial Code No. 6102 and the Tax Procedure Law No. 213; and establishing evidence and exercising the right of defence in potential judicial and commercial disputes.

Legal Ground: KVKK Article 5/2-c ("Processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the conclusion or performance of the contract"), KVKK Article 5/2-ç ("Processing is mandatory for the data controller to fulfil its legal obligation") and KVKK Article 5/2-e ("Data processing is mandatory for the establishment, exercise or protection of a right").

Retention Period and Destruction Method: Retained for 10 (ten) years from the termination of the contractual relationship (in accordance with Article 82 of the Turkish Commercial Code No. 6102 and the general limitation periods of the Turkish Code of Obligations No. 6098) and destroyed by Deletion / Destruction at the end of the period.

2.2. Cybersecurity / Penetration Testing Technical Data (Incidental Logs, Vulnerability Screenshots):

Data Processed: Technical log records, temporary user accounts and IP addresses incidentally encountered on target systems during the performance of the service for the purpose of detecting, analysing, simulating and reporting security vulnerabilities, and screenshots that must be taken to prove a vulnerability (personal data such as name, surname, Turkish ID number and account number in screenshots are immediately and irreversibly masked, redacted or de-identified by the test specialist; database copies/dumps, user identity lists or raw customer personal data from target systems are never downloaded to or stored in the Company's local environments).

Purposes of Processing: Performing the security testing, vulnerability analysis and reporting service in accordance with the agreement and the customer's instructions.

Legal Ground: KVKK Article 5/2-c ("Processing of personal data belonging to the parties of a contract is necessary, provided that it is directly related to the conclusion or performance of the contract").

Retention Period and Destruction Method: Irreversibly deleted and destroyed by secure software overwriting (Destruction) within 15 (fifteen) calendar days at the latest from the delivery of the final test report to the customer. Upon termination of the agreement concluded with the customer or upon the customer's written instruction, incidental data belonging to the customer is destroyed immediately and a destruction confirmation report is provided to the customer.

2.3. Final Penetration Test Reports (Corporate and Technical Findings):

Data Processed: Corporate and technical findings contained in draft and final reports prepared as a result of penetration testing work, and report delivery records.

Purposes of Processing: Documenting the performance of the service, fulfilling contractual responsibilities, and meeting defence and evidentiary obligations against claims of defect or objections.

Legal Ground: KVKK Article 5/2-c ("Performance of the contract") and KVKK Article 5/2-e ("Data processing is mandatory for the establishment, exercise or protection of a right").

Retention Period and Destruction Method: Retained in an encrypted secure archive for 10 (ten) years from the acceptance of the service and the termination of the agreement, and destroyed by Destruction at the end of the period.

2.4. Physical Premises Security and Visitor Data (Camera Recordings and Visitor Records):

Data Processed: Name-surname and entry-exit time information of customer representatives and employees visiting the Company's head office, and camera footage of physical premises entries/exits.

Purposes of Processing: Ensuring the security of the Company's workplace, employees, physical premises and information, and maintaining physical security and order.

Legal Ground: KVKK Article 5/2-f ("Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject").

Retention Period and Destruction Method: Camera and security recordings are retained for a maximum of 30 (thirty) calendar days from the recording date and destroyed by automatic overwriting (Destruction); visitor records are retained for 1 (one) year from the recording date and destroyed by Shredding / Deletion.

2.5. Internet and Network Access Logs (Logs under Law No. 5651):

Data Processed: IP address, source and destination port information, start and end time of the service provided, type of service used, amount of data transferred and access/traffic transaction logs.

Purposes of Processing: Fulfilling the statutory obligation to retain traffic information and access records under Law No. 5651 on the Regulation of Publications on the Internet and Combating Crimes Committed by Means of Such Publications, and ensuring network and system security.

Legal Ground: KVKK Article 5/2-ç ("Processing is mandatory for the data controller to fulfil its legal obligation") and being expressly provided for in Law No. 5651 (KVKK Article 5/2-a).

Retention Period and Destruction Method: Retained on secure log servers with time stamps for 2 (two) years from the transaction date and destroyed by Deletion at the end of the period.

2.6. Commercial Electronic Message and Corporate Reference Data (Optional / Subject to Explicit Consent):

Data Processed: Name-surname and contact details (phone, e-mail) of the customer representative/contact person, and the name of the Work performed for the customer (reference information).

Purposes of Processing: Sending commercial electronic messages within the scope of commercial communication and marketing activities; including the name of the Work performed for the customer in the Company's corporate reference list (under no circumstances is any technical or cost information such as the site plan of the building's surroundings, projects or images disclosed).

Legal Ground: Explicit Consent of the Data Subject under KVKK Article 5/1 (and, for corporate references, the Customer's written approval). These activities are not a mandatory precondition for concluding the agreement or providing the service; not giving explicit consent does not in any way affect the performance of the service.

Retention Period and Destruction Method: Commercial electronic message consent and sending records are retained for 3 (three) years from the date the consent is withdrawn and destroyed by Deletion at the end of the period.

3. METHOD OF COLLECTING PERSONAL DATA

Your personal data is collected, by fully or partially automated means or by non-automated means provided that they form part of a data recording system (in electronic and physical environments), during the negotiation, signing and performance of penetration testing and cybersecurity service agreements, through the Penetration Test Requirements Form (Annex-1), corporate e-mail correspondence, agreements and delivery records signed with wet or electronic signatures, invoices and commercial book records, physical visitor logs and security cameras at the Company's head office, and firewalls, SIEM/SOC systems and encrypted VPN/network management devices.

4. RECIPIENT GROUPS TO WHICH PERSONAL DATA MAY BE TRANSFERRED AND PURPOSES OF TRANSFER

4.1. Principle of Confidentiality and Prohibition of Transfer to Third Parties: The Company limits personal data and confidential information obtained or generated by reason of the agreement only to its assigned and authorised personnel on a "need-to-know" basis; it does not disclose such data to third-party natural and/or legal persons, institutions or organisations, and does not share, publish or copy it in visual, written, audio or electronic media or in the press.

4.2. Limited Transfers Based on Legal Obligation and Legal Grounds: Your personal data may be transferred only to the following recipient groups and only for the stated purposes, in accordance with the personal data processing conditions and purposes set out in Article 8 of the KVKK:

Authorised Public Institutions and Organisations and Judicial/Administrative Authorities: To the Ministry of Treasury and Finance and the Revenue Administration/Tax Offices for the purpose of fulfilling notification, electronic notification and audit obligations under the Tax Procedure Law No. 213 and tax legislation; to the Information and Communication Technologies Authority and the Cybersecurity Directorate for the purpose of fulfilling legal obligations under Law No. 5651; and to competent courts, enforcement offices and Chief Public Prosecutor's Offices in cases where disclosure is mandatory under the legislation or with respect to information and documents the Company is required to submit to legal authorities within the scope of its legitimate right of defence (Legal Ground: legal obligation under KVKK Article 5/2-ç and establishment, exercise or protection of a right under Article 5/2-e, by reference to Article 8/2-a).

Banks and Financial Institutions: To the banks the Company works with for the purpose of collecting the contractual service fee, down payments/balance payments and carrying out financial reconciliation transactions (Legal Ground: performance of the contract under KVKK Article 5/2-c, by reference to Article 8/2-a).

Registered Electronic Mail (KEP) Service Providers and Notaries: To notaries and authorised KEP service providers for the purpose of delivering official notifications, invoice notifications and delivery records under Articles 18/3 and 21/2 of the Turkish Commercial Code No. 6102 (Legal Ground: KVKK Articles 5/2-ç and 5/2-e, by reference to Article 8/2-a).

5. ENVIRONMENTS WHERE PERSONAL DATA IS STORED, SECURITY MEASURES AND PERIODIC DESTRUCTION

5.1. Storage Environments and Security Measures: Your personal data is kept, in the electronic environment, on local servers, backup units, databases, firewall log systems, SIEM and SOC systems, corporate computers and encrypted portable storage units located at the Company's head office and, in the physical environment, in locked archive cabinets at the Company's head office. In accordance with Article 12 of the KVKK, the Company fully implements state-of-the-art cryptographic protection, an access authorisation matrix based on job descriptions, encrypted VPN and at least two-factor authentication (MFA), time-stamped secure logging, intrusion detection and prevention systems (IDS/IPS), indefinite confidentiality undertakings and periodic internal audit measures carried out by the Personal Data Committee.

5.2. Periodic Destruction Schedule: Personal data for which all processing conditions have ceased to exist or whose retention period has expired is deleted, destroyed or anonymised ex officio at periodic destruction intervals of 6 (six) months (on the last business days of June and December each year) in accordance with Article 11 of the Regulation on the Deletion, Destruction or Anonymisation of Personal Data, recorded with a "Personal Data Destruction Report" and kept for at least 3 (three) years.

6. RIGHTS OF THE DATA SUBJECT UNDER ARTICLE 11 OF THE KVKK AND APPLICATION PROCEDURE

6.1. Rights of the Data Subject: Natural persons whose personal data is processed have the right, by applying to our Company in accordance with Article 11 of the KVKK, to: a) learn whether personal data is processed, b) request information if personal data has been processed, c) learn the purpose of processing personal data and whether it is used in accordance with its purpose, ç) know the third parties to whom personal data is transferred domestically or abroad, d) request the correction of personal data if it is incomplete or incorrectly processed, e) request the deletion or destruction of personal data within the framework of the conditions set out in Article 7 of the KVKK, f) request that the transactions carried out under paragraphs (d) and (e) be notified to third parties to whom the personal data has been transferred, g) object to the emergence of a result against the person by analysing the processed data exclusively through automated systems, ğ) request compensation for damages in case of damage due to unlawful processing of personal data.

6.2. You May Submit Your Applications Regarding Your Personal Data under the Personal Data Protection Law No. 6698;

6.2.1. with your secure electronic or mobile signature to our Company's e-mail address info@noktaguard.com, or;

6.2.2. with your wet-signed application document containing your request for information or regarding your other rights listed in the Law, together with identity information identifying you, by registered mail with return receipt to Cumhuriyet Mah. Kartepe Sk. Usta Ofis Plaza No: 4 İç Kapı No: 8 Kartal / İstanbul, or;

6.2.3. by other methods specified in the Law and the relevant legislation, provided that your identity is verified.

6.3. The Information and Documents That Must Be Included in Your Application Pursuant to Paragraph 2 of Article 5 of the Law Are as Follows;

6.3.1. Name, surname and, if the application is in writing, a signature are mandatory.

6.3.2. For citizens of the Republic of Türkiye, the Turkish ID number; for foreigners, nationality, passport number or, if any, identity number are mandatory.

6.3.3. A residential or workplace address for notification is mandatory.

6.3.4. If any, the e-mail address, telephone and fax number for notification are mandatory.

6.3.5. The subject of the request is mandatory.

If any of the above information is missing, or if the Data Subject's request cannot be understood by the Company, the Data Subject's application may be rejected by our Company.

6.4. The Application Date Is Defined in Paragraphs 4 and 5 of Article 5 of the Law as Follows:

6.4.1. In written applications, the date on which the document is served to the data controller or its representative is the application date.

6.4.2. In applications made by other methods, the date on which the application reaches the data controller is the application date.

6.5. Is There Any Fee for the Application?

No fee other than the fees stipulated by law below may be charged for responding to your applications.

According to Paragraph 1 of Article 7 of the Communiqué on the Procedures and Principles of Application to the Data Controller, "If the response to the data subject's application is to be given in writing, no fee is charged for up to ten pages. A transaction fee of 1 (one) Turkish Lira may be charged for each page above ten pages."

According to Paragraph 2 of Article 7 of the Communiqué on the Procedures and Principles of Application to the Data Controller, if the response to your application is given on a recording medium such as a CD or flash drive, the cost of the recording medium may be requested from you by the data controller.

6.6. Response Time

In accordance with Article 13 of Law No. 6698, our Company will conclude application requests within 30 (thirty) days at the latest, provided that the request is clear and contains the necessary elements. If your request is rejected, the reason(s) for rejection will be justified in writing and sent to you by post or e-mail.

9. WHAT HAPPENS IF I READ THIS DOCUMENT ON NOKTA GUARD WEBSITES OR THROUGH SOCIAL MEDIA AND PLATFORMS?

If you approve this document on the internet or in a digital environment, by ticking the box that provides the link to open this text, you are deemed to have accepted that this document will have the same legal effect as if it had been signed by you with a wet signature and that the Company's records will be taken as the basis.

10. RECORD OF RECEIPT OF THE PRIVACY NOTICE

This notice has been prepared to document that the obligation to inform has been fulfilled pursuant to Article 10 of Law No. 6698; it does not contain any declaration of explicit consent and does not replace explicit consent.

I Have Read the Privacy Notice and Have Been Informed:

Name - Surname of the Data Subject (Customer Representative / Contact Person):

Name of the Customer Individual/Company Represented:

Title / Position:

Date: ....../…..../20….

Signature: