Privacy and personal data protection policy

Information Security Policy

1. Purpose: The purpose of this policy is to define the approach and objectives of the top management and to communicate these objectives to all employees and related parties to prevent violations of the law, regulatory or contractual obligations and any security requirements.

2. Scope: This policy covers the information security processes used for the protection of electronic information assets obtained from logistics, storage, accounting, finance, quality assurance, purchasing, human resources, legal, sales, marketing, internal audit and information processing activities related to the commercial activities within the Company as well as those used to process, store, protect and preserve the confidentiality and integrity of personal data pursuant to the law.

2.1. Internal Scope Administration, organizational structure, roles and obligations cover:
2.1.1. Departments as part of the Company's Senior Management; Financial and Administrative Affairs, Purchasing, Finance, IT, Corporate Communications and Business Development, Human Resources, Quality, Export, Import, Logistics, Legal, Internal Audit, Sales, Marketing
2.1.2. The roles and responsibilities in the job descriptions specified in the General Management Organization Chart.
2.1.3. Policies, procedures, objectives and strategies to be implemented;
2.1.3.1. Information Security Management System Policy,
2.1.3.2. All Information Security management systems procedures,
2.1.3.3. Annual Information Security management systems targets determined by the management,
2.1.3.4. Capabilities in terms of resources and knowledge (for example, capital, time, people, processes, systems and technologies);
2.1.3.5. Management Representatives and Information Security Management System team assigned by the management for the set-up, operation and maintenance of the Information Security Management System,
2.1.3.6. Relationships with internal stakeholders and their perceptions and values, the culture of the organization, the standards, guidelines and models adapted by the organization, the form and scope of contractual relations.
2.2. External Scope
2.2.1. The external scope includes the social and cultural, political, legal, regulatory, financial, technological, economic, natural and competitive environment be it international, national, regional or local,
2.2.2. Global Competition Law, Policies and Procedures,
2.2.3. Confidentiality of supplier and customer data,
2.2.4. Quality Orientation,
2.2.5. Relationships with stakeholders and their perceptions and values that have an impact on the organization's goals;
2.2.6. All Company employees, including the Senior Management responsible for ensuring customer satisfaction,
2.2.7. All relevant legislative, regulatory, contractual conditions and standards,
2.2.8. Product certifications from TSE and other organizations.

3. Definitions

3.1. ISMS: Information Security Management System.
3.2. Inventory: All kinds of information assets important to the company.
3.3. Senior Management: Company Senior Management.
3.4. Know-How: The capability to do something.
3.5. Information Security: Information, like all other corporate and commercial assets, has value to a business and therefore, it must be protected appropriately. Know-how, processes, formula, techniques and methods, customer records, marketing and sales information, personnel information, commercial, industrial and technological information and secrets are considered CONFIDENTIAL INFORMATION within the Company.
3.6. Confidentiality: It means restricting the ability to view the information content to the access of only those who are allowed to view the information/data. (Example: Unauthorized persons can be prevented from reading emails with encrypted email delivery even if they capture them - Registered electronic mail - KEP)
3.7. Integrity: It is the ability to detect unauthorized or accidental changes, erasure or additions and removals of information and ensuring its detectability. (Example: Storing the data in the database together with summary information - electronic signature - mobile signature)
3.8. Accessibility/Availability: It means that the asset is ready to use at any time that it is needed. In other words, the systems are constantly available and the information in the systems is not lost but constantly accessible. (Example: Uninterruptible power supply, UPS, and use of redundant power supply in their chassis to prevent servers from being affected by power line fluctuations and outages. It will be used as “Accessibility” in this policy.
3.9.7. Services or products provided by third parties.

4. Responsibilities The qualifications and competencies of the tasks with assigned responsibilities and authorities are defined in the job descriptions. The IT Team and Management Representative are responsible for maintaining and developing information security-related activities. ISMS Team and Management Representatives are assigned by the Senior Management. ISMS representatives were determined from the included departments. They were personally assigned as ISMS team members.

4.1. Management Responsibility

4.1.4. The Senior Management shall create the budget needed for information security projects.

4.2. Responsibility of Management Representative

4.2.1. Planning of the Information Security Management System (ISMS), identifying acceptable risk level, determining the risk assessment methodology,
4.2.2. Providing the necessary resources for supporting and complementary activities in the establishment of ISMS, providing/improving user capabilities and creating awareness, conducting trainings, conducting communication, satisfying documentation requirements,
4.2.3. Execution and management of ISMS practices, ensuring continuous evaluations, improvements and risk assessments,
4.2.4. Evaluation of ISMS and controls through internal audits, targets and management review meetings,
4.2.5. Maintaining the existing ISMS structure and ensuring continuous improvements.

4.3. Responsibility of ISMS Team Members

4.3.1. Carrying out department-related asset inventory and risk analysis activities,
4.3.2. Notifying the Management Representative of a risk assessment when there is a change in the information assets under their responsibility that will affect the information security risks,
4.3.3. Ensuring that department employees work in accordance with policies and procedures,
4.3.4. Creating ISMS awareness in relation to their departments, ensuring communication, fulfilling documentation requirements,
4.3.5. Maintaining the existing ISMS structure and ensuring continuous improvements.

4.4. Responsibility of Internal Auditor Carrying out and reporting audit activities in assigned internal audits in line with the internal audit plan.

4.5. Responsibility of Department Managers Implementing the Information Security Policy and ensuring that employees comply with the principles, ensuring that third parties are aware of the policy,and reporting security breaches to information systems as they notice.

4.6. Responsibility of All Employees

4.6.1. Carrying out their activities in accordance with the information security objectives, policies and information security management system documents,
4.6.2. Monitoring the information security objectives of their own unit and ensuring their completion.
4.6.3. Paying attention to and reporting any observed or suspected information security vulnerability in systems or services,
4.6.4. Making confidentiality agreements and meeting information security requirements in addition to service agreements (consultancy, etc.) with third parties that are not under the responsibility of Purchasing.

4.7. Responsibility of Third Parties Knowing and implementing the information security policy and complying with the behaviors determined set out in ISMS.

5. Information Security Objectives Information Security Policy aims to guide the Company employees to act in accordance with the Company's security requirements, to increase their awareness, and thus, ensure that the Company's basic and supportive business activities continue with minimum interruption, to protect its credibility and image, and to protect the physical and electronic information assets that affect the entire operation of the Company in order to ensure compliance with the contracts entered into with third parties. The objectives set by the Management are monitored at specified periods and reviewed at the Management Review meetings.

6. Risk Management Framework The Company's risk management framework covers the identification, assessment and processing of information security risks. The Risk Analysis, feasibility declaration and risk processing plan define how information security risks are checked. ISMS Executive and Management Committee is responsible for the management and completion of the risk processing plan. All these activities are explained in detail in the asset inventory and risk assessment instruction.

7. General Principles of Information Security

7.1. Details regarding the information security requirements and rules outlined by this policy. Company employees and third parties are obliged to know these policies and procedures and to carry out their activities in accordance with these rules.
7.2. Unless otherwise stated, these rules and policies must be taken into account for all information stored and processed in printed or electronic media and for the use of all information systems.
7.3. The Information Security Management System is configured and operated on the basis of the TS ISO/IEC 27001 "Information Technology Security Techniques and Information Security Management Systems Requirements" standard.
7.4. ISMS is implemented, operated and improved with with the contribution of the relevant parties. The ISMS Management Representative is responsible for updating the ISMS documents when necessary.
7.5. Information systems and infrastructure provided by the Company to employees or third parties, and all kinds of information, documents and products generated using these systems belong to the company unless there are provisions of law or contracts that require the contrary.
7.6. Confidentiality agreements are made with employees, consultancy, service procurement firms (security, service, catering, cleaning company, etc.), suppliers and interns.
7.7. Information security checks for recruitment, change of position and end of employment processes are determined and implemented.
7.8. Trainings are given regularly to existing and newly recruited Company employees to increase their information security awareness and enable them to contribute to the system’s operation.
7.9. All actual or suspected information security breaches are reported to identify non-conformities causing violations and root causes, and measures are taken to prevent their recurrence.
7.10. An inventory of information assets is generated in line with information security management needs and asset ownership is assigned.
7.11. Corporate data is classified and the security needs and usage rules of the data are determined in each class.
7.12. Physical security checks are applied in parallel with the needs of the assets stored in secure areas.
7.13. Necessary checks and policies are developed and implemented for the Company’s information assets against the physical threats they may be exposed to inside and outside the Company.
7.14. Procedures and instructions are developed and implemented regarding capacity management, relations with third parties, backup, system acceptance and other security processes.
7.15. Audit record generation configurations for network devices, operating systems, servers and applications are adjusted in line with the security needs of the relevant systems. It ensures audit records are protected from unauthorized access.
7.16. Access rights are assigned according to need. The safest possible technology and techniques are used for access control.
7.17. Security requirements are set in system procurement and development to check whether security requirements are met during system acceptance or tests.
7.18. Continuity plans are prepared, maintained and implemented for critical infrastructure.
7.19. Necessary processes are designed for compliance with laws, internal policies and procedures, technical security standards. Compliance assurance is ensured through continuous and periodic surveillance and audit activities.

8. Violation of the Policy and Sanctions In case of non-compliance with the Information Security Policy and Standards, the sanctions specified in the relevant articles of the contracts, which also apply to the third Parties according to the Disciplinary Directive and Procedure, are applied to the employees responsible for such violation.

9. Management Review Management review meetings are arranged by ISMS Quality Management Representative with the participation of Senior Management and Department managers. Held at least once annually, these meetings evaluate the suitability and effectiveness of the Information Security Management System.

10. Updating and Reviewing the Information Security Policy Document ISMS Management Representatives are responsible for maintaining and reviewing the policy document. Policies and procedures should be reviewed at least once annually. Also, it should be reviewed after any change that will affect the system structure or risk assessment and be approved by the senior management and registered as a new version if any changes are necessary. Each revision should be published so that all users can access it.

Personal Data Storage and Destruction Policy

Download

Privacy and personal data protection policy

Information Security Policy

PDPL

About Cookies