Privacy Policy

ŞAH GRUP MEDİKAL İTHALAT İNŞAAT TURİZM SANAYİ VE TİC. LTD. ŞTİ. INFORMATION SECURITY POLICY

a) Purpose and Scope

This Information Security Policy (the “Policy”) is prepared by ŞAH GRUP MEDİKAL İTHALAT İNŞAAT TURİZM SANAYİ VE TİC. LTD. ŞTİ. (“Şah Grup”) to meet the information security requirements arising from national, international, or sectoral regulations, legal obligations, and standards, as well as obligations arising from agreements. The purpose of this Policy is to protect Şah Grup and its users from security threats that may endanger the integrity, confidentiality, reputation, or commercial processes of the company, ensuring compliance with legal and corporate responsibilities regarding information security.

The scope of this Policy includes the processing of personal data and information belonging to the following data subjects:

• Real Customers
• Potential Customers
• Corporate Customer Shareholders, Authorized Representatives, Employees
• Company Executives
• Shareholders
• Business Partner Shareholders, Authorized Representatives, Employees
• Suppliers, Shareholders, Authorized Representatives, Employees
• Job Candidates
• Visitors
• Third Parties

“Information” refers to any document, data (including personal data), content, or object in any environment or format (including both physical and electronic records).

b) Responsibilities Regarding Information Security

Within the scope of this Policy, Şah Grup will ensure the protection of the confidentiality, integrity, and availability of its information assets and will manage risks in a manner that maintains them at an acceptable level. Complying with the requirements of the Personal Data Protection Law (KVKK) is also one of these responsibilities. As the data controller, Şah Grup complies with the following principles under Article 4 of the KVKK regarding data processing:

• Processing in compliance with the law and fairness,
• Ensuring accuracy and, when necessary, keeping the data up to date,
• Processing for specific, explicit, and legitimate purposes,
• Ensuring that data is processed in a manner that is relevant, limited, and proportional to the purpose,
• Storing the data only for the period specified in the relevant legislation or necessary for the purpose for which it was processed.

All employees are obligated to comply with all information security procedures, including maintaining confidentiality and ensuring data integrity. Failure to comply with these procedures may result in disciplinary action against the relevant employee. Every employee is responsible for the operational security of the information systems they use. Every system user is required to adhere to applicable confidentiality requirements and ensure that the confidentiality, integrity, and accessibility of the data they use are maintained to the highest standards.

c) Method

Customer information confidentiality and security must be ensured, and maximum care should be taken to protect customer information while complying with relevant legislation.

• All legal regulations and contracts related to information security should be followed, and necessary actions should be taken promptly and without interruption.
• Information security awareness training should be included in recruitment and onboarding processes.
• Security requirements for employees should be addressed during recruitment processes, and all employment contracts should include confidentiality clauses.
• Information security expectations for employees should be included in relevant job descriptions.
• Access to information systems or restricted areas containing stored data should only be provided to the relevant and authorized personnel.
• Access to computer resources should be restricted to authorized users who require these resources for their job functions.
• All commercial assets, personal data, and information should be physically protected from any threats or environmental hazards to minimize the risk of loss or damage.
• Once information security risks are identified, action plans for mitigating these risks will be implemented.
• All information security breaches will be investigated to determine the causes and impacts, aiming to prevent similar incidents in the future.
• Şah Grup will use countermeasures such as anti-malware software and management procedures to protect against malicious software. All employees are expected to cooperate under this policy.