Personal Data Protection Policy

4. GENERAL PRINCIPLES

ASEN checks the compliance of the data to be processed in the preparation phase of each workflow
that requires new personal data processing with the following principles. Workflows that are not eligible will not be implemented.

While ASEN processes personal data;

1. It obeys the law and the rules of honesty.
2. It makes sure that personal data is accurate and up-to-date when necessary.
3. It pays attention to the fact that the purpose of processing is specific, clear and legitimate.
4. It checks that the processed data is related to the purpose of processing, that it is processed as
   limited to the extent that it should be processed, and that it is proportionate.
5. It retains the data only as long as it is stipulated in the relevant legislation or necessary for the
   purpose of processing, and destroys it when the purpose of processing disappears.

5. DUTIES AND RESPONSIBILITIES

The Personal Data Protection Commission has been established within ASEN in order to manage this
Policy and other related procedures regarding the processing of personal data and to ensure the
enforcement of the Policy. The General Manager represents the Commission as the chairman and the
members are department managers. In addition, ASEN also receives KVKK consultancy support in order
to comply with the Personal Data Protection Law No. 6698 when necessary. If the commission deems it
necessary, it may also invite KVKK consultants and professional experts to its meetings.

The duties and responsibilities of the Commission are stated below.

1. It convenes annually under normal circumstances. If conditions require it, extraordinary meetings
   can be held (for example, in the event of a possible data breach).
2. Discusses the issues that need to be changed/improved in the Policy.
3. It determines the issues that can be fulfilled in order to process and protect personal data in accordance with the law.
4. The Commission determines the steps that can be taken to increase KVKK awareness within the company and among its business partners.
5. It identifies the risks that may be encountered in the processing and protection of personal data
   and takes the necessary administrative and technical measures.
6. It provides contact with the institution and manages the relations.
7. It evaluates the requests from the data subject.
8. It follows the periodic destruction processes.
9. Updates the Data Inventory.
10. It makes assignments regarding the above-mentioned issues.

6. MEASURES TAKEN FOR DATA SECURITY

ASEN takes all necessary technical and administrative measures to ensure the appropriate
level of security in order to prevent the unlawful processing of personal data, to prevent unlawful access
to personal data, and to ensure the protection of personal data.

6.1. Within the scope of the technical measures recommended by the Personal Data Protection Authority;

a) Ensuring Cybersecurity

• Priority measures that can be taken to protect information technology systems containing personal
  data against unauthorized access threats over the internet,
• Ensuring that access to systems containing personal data is also limited, Employees are given
  limited access authority and access to the relevant systems by using username and
  password,
• To protect against malware, it is also necessary to use products such as antivirus, antispam, which
  regularly scan the information system network and detect dangers.

b) Monitoring Personal Data Security

• In order to prevent and prevent information processing systems from being exposed to both internal
  and external attacks and cybercrime or malware;
• Checking which software and services are running in information networks.
• Determining whether there is infiltration in information networks.
• Keeping a record of all users' transaction transactions (such as log records).
• Reporting security issues as quickly as possible.

c) Ensuring the Security of Environments Containing Personal Data

• Ensuring the physical security of devices containing personal data (laptop, mobile phone, flash disk,
  etc.) that may experience personal data security breaches,
• Sending personal data to be transferred by e-mail or mail by taking adequate precautions.
• In order to ensure the security of personal data, the protection of devices such as paper
  documents, servers, backup devices, CDs, DVDs and USBs containing personal data in sections/rooms
  with access authorization restrictions with additional security measures.
• Taking measures such as keeping these areas under lock and key when not in use and keeping
  entry and exit records.

d) Storage of Personal Data in the Cloud

• Managing the risks associated with the processing of personal data by cloud storage service providers.
• Evaluation and approval by the data controller whether the security measures taken by the cloud
  storage service provider are sufficient and appropriate.
• In this context, knowing in detail what personal data is stored in the cloud, backing it up, ensuring
  synchronization and practicing authentication control.

e) Backup of Personal Data

• Ensuring that backed-up personal data is only accessible to the system administrator.
• Data set backups must be kept out of the network.
• Taking measures against the use of malware on data set backups.
• Ensuring the physical security of all backups.