PERSONAL DATA PROTECTION AND DESTRUCTION POLICY

1. Objective

This policy aims to describe the methods adopted for the processing, protection, storage and destruction of personal data processed in all kinds of activities carried out by ZZGTECH LTD (ZZGTECH) in the capacity of data controller and to fulfil the obligation of disclosure in accordance with Article 13-14 of the European Union General Data Protection Regulation and UK Data Protection Regulation (EU GDPR and UK GDPR hereinafter referred to as GDPR). This policy includes the principles applied in the collection, use, sharing, storage and destruction of personal data by ZZGTECH. It aims to inform the relevant persons about the personal data of employees, candidate employees, relatives of employees, references, supplier employees, company partners, suppliers and candidate suppliers, prospective suppliers, prospective customers, online visitors, outsource employees, partner employees, partner company officials, customers and related persons of customers processed by ZZGTECH.

2. Scope

This policy; It covers all recording media and activities for personal data processing where personal data belonging to employees, candidate employees, employee relatives, references, supplier employees, company partners, suppliers and candidate suppliers, customer candidates, online visitors, outsource employees, partner employees, partner company officials, customers and customers' related persons owned by ZZGTECH or managed by ZZGTECH are processed.

3. Authorisations and Responsibilities

All employees, external service providers and anyone else who stores and processes personal data within the organisation are responsible for fulfilling the requirements for the storage and destruction of personal data processed within the organisation. Each business unit is obliged to store and protect the data produced in its own business processes.

The Data Protection Officer (DPO) is responsible for notifying or accepting notifications or correspondence with the ICO Authority on behalf of the data controller and for registration in the register.

The distribution of the titles, units and job descriptions of those involved in the storage and destruction of personal data is detailed below;

Data Protection Officer (DPO): On behalf of the Data Controller, to design, plan, perform the works and transactions to be carried out within the framework of the procedures and principles set out in the Law, to organise the relevant actions and to ensure audits.

Archive Officer To carry out the processes of processing, storage, deletion, editing, destruction and anonymisation of personal data stored in the archive.

Information Security Committee Member: Assists the DPO to design, plan, realise the works and transactions to be carried out within the framework of the procedures and principles set out in the Law on behalf of the Data Controller and to ensure the relevant audits and helps to maintain the processes related to personal data security by supporting the DPO. It takes part in the evaluation and response stages of personal data requests from data subjects. In addition, the Information Security Committee Member takes part in ISO 27001 Information Security Management System, ISO 27701 Personal Data Management System and ISO 9001 Quality Management System standard studies.

4. Definitions and Abbreviations

5. Personal Data Processing and Protection Policy

ZZGTECH sets out the necessary measures and the process applied for the protection and processing of personal data in a concrete manner with this policy. In cases where this policy is incompatible with the relevant laws and regulations or if the policy is outdated in line with the updated legislation, ZZGTECH agrees to comply with the applicable legislation. According to the changes in laws, regulations and legislation, this policy is updated and revised in order for ZZGTECH to fulfil the legal requirements.

5.1 Personal Data Owners and Processed Personal Data

ZZGTECH processes the following personal data:

5.2 Purposes of Processing Personal Data

ZZGTECH processes personal data for the following purposes;

5.3 Process Based Processed Personal Data

ZZGTECH processes personal data according to the following sub-processes;

5.4 Data Collection Methods

ZZGTECH methods of obtaining personal data are set out below:

5.5 Legal Reasons for Data Processing

ZZGTECH processes personal data due to legal obligations and to ensure business continuity. Your personal data; In the light of the principles stipulated in Article 5 of the GDPR, it is processed by obtaining explicit consent or in the cases specified in Article 5 of the GDPR. In data processing, it is essential to obtain explicit consent in case the requirements of the Law are not met.

5.5.1 Reason for Processing Personal Data

1. Explicitly stipulated in the laws,
2. It is necessary for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid,
3. Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract,
4. It is mandatory for the data controller to fulfil its legal obligation,
5. It has been made public by the data subject himself/herself,
6. Data processing is mandatory for the establishment, exercise or protection of a right,
7. Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

The relevant laws regarding foreseen in the law are detailed in this policy.

5.5.2 Justification for Processing Sensitive (Private) Personal Data

Provided that adequate measures are taken; it is stipulated in the laws in terms of personal data of special nature other than health and sexual life, and in terms of personal data of special nature related to health and sexual life;

1. Protection of public health,
2. Preventive medicine,
3. Medical diagnosis,
4. Carrying out treatment and care services,
5. Your personal data may be transferred without obtaining explicit consent for purposes such as planning and management of health services and financing.

The legal grounds used by ZZGTECH to process data are detailed in the "Personal Data Inventory" document.

5.6 Principles for Processing Personal Data

The GDPR regulations set out principles for the processing of personal data. ZZGTECH processes personal data in accordance with the determined principles.

The processing of personal data is carried out in accordance with the following principles;

• Compliance with the law and honesty rules,
• Being accurate and up to date when necessary,
• Processing for specific, explicit and legitimate purposes,
• Being relevant, limited and proportionate to the purpose for which they are processed,
• Retention for the period stipulated in the relevant legislation or required for the purpose for which they are processed.

Transfer of Personal Data

Personal data of customers, suppliers and employees are processed in accordance with the basic principles stipulated in the GDPR, provided that public interest is observed. Within the scope of the personal data processing conditions and purposes specified in Section V of the GDPR, it may be shared with the following domestic and/or foreign related parties.

5.7.1 Transfer of Personal Data to Domestic Persons

ZZGTECH carefully complies with the conditions regulated in the Law regarding the sharing of personal data with third parties, without prejudice to the provisions of other laws. Within this framework, personal data are not transferred to third parties without the explicit consent of the data subject. However, in the presence of one of the following conditions specified in the Law, personal data may be transferred without obtaining the explicit consent of the data subject:

• Explicitly stipulated in the laws,
• It is necessary for the protection of the life or physical integrity of the person who is unable to disclose his/her consent due to actual impossibility or whose consent is not legally valid,
• Provided that it is directly related to the conclusion or performance of a contract, it is necessary to process personal data of the parties to the contract,
• It is mandatory for the data controller to fulfil its legal obligation,
• It has been made public by the data subject himself/herself,
• Data processing is mandatory for the establishment, exercise or protection of a right,
• Data processing is mandatory for the legitimate interests of the data controller, provided that it does not harm the fundamental rights and freedoms of the data subject.

Provided that adequate measures are taken; it is stipulated in the laws in terms of personal data of special nature other than health and sexual life, and in terms of personal data of special nature related to health and sexual life;

• Protection of public health,
• Preventive medicine,
• Medical diagnosis,
• Carrying out treatment and care services,
• Your personal data may be transferred without obtaining explicit consent for purposes such as planning and management of health services and financing.

In the transfer of special categories of personal data, the conditions specified in the terms of processing of such data are complied with.

Domestic parties to whom personal data are transferred are detailed below;

5.7.2 Transfer of Personal Data to Persons Abroad

ZZGTECH can process personal data on foreign servers based on the agreement made with its customers who are Data Controllers, and data transfers can be made to Advertisement Publishers.

ZZGTECH is able to carry out its operations on overseas cloud systems while managing customer accounts, application activation processes and software distribution, development and testing processes.

In cases where foreign cloud use is required; security measures determined by the cloud service provider are applied. In addition, ZZGTECH has taken all technical measures that may be needed, especially data masking, hashing and authorisation limitations. The measures taken are detailed under the heading "Technical Measures".

5.8 Personal Data of Website Visitors and Personal Data Received for Internet Access Point Service

Cookie information is received on the websites owned by ZZGTECH. Detailed information can be found in the Cookie Policy document on the website. The obligation to inform and the purposes of processing the personal data received are detailed in the Cookie Policy.

ZZGTECH uses mobile internet for internet access. ZZGTECH therefore does not process internet access logs.

System and application access logs of customers, suppliers and employees can be processed during the management of customer accounts, software distribution, application log management, remote working and software development processes. Authorisation restrictions have been made to prevent unauthorised access to logs. There is also a time stamp on the logs. In order to ensure remote access security, access is provided with VPN. In addition, static ip and mac addresses are checked. Detailed information can be found under the heading "Technical Measures".

5.9 Rights of the Personal Data Owner

The rights of personal data subjects specified in Part III of the GDPR are detailed below:

• To learn whether your personal data is being processed or not. Request access to processed personal data,
• Request information if your personal data has been processed
• To learn the purpose of processing your personal data and whether they are used in accordance with their purpose,
• To know the third parties to whom your personal data is transferred domestically or abroad,
• To request correction of your personal data in case of incomplete or incorrect processing,
• Request deletion or destruction of your personal data
• In case your personal data is corrected, deleted or destroyed, to request that these transactions be notified to third parties to whom your personal data has been transferred. Request restriction of the processed personal data, request the transfer of the data,
• Object to the occurrence of a result against you by analysing your processed data exclusively through automated systems,
• In case you suffer damage due to unlawful processing of your personal data, you have the right to demand compensation for the damage.

6. Storage and Destruction of Personal Data

6.1 Data Controller Organisation and Data Environments

All employees of ZZGTECH take an active role in the implementation of the technical and administrative measures taken by the responsible units within the scope of the Policy. Measures are taken to ensure data security in all environments where personal data is processed in order to prevent unlawful processing and access of personal data by training and raising awareness of unit employees, monitoring and continuous supervision.

Personal data are securely stored by ZZGTECH in accordance with the law in the following environments;

ZZGTECH stores and destroys personal data belonging to Data Subject Main Category, employee, candidate employee, employee relative, reference, supplier employees, company partners, supplier and candidate supplier, customer candidate, online visitor, outsource employee, partner employee, partner company official, customer and customers' related persons in accordance with the Law.

Article 3 of the Law defines the concept of processing personal data. It is addressed in the GDPR that personal data should be linked, limited and proportionate to the purpose for which they are processed and should be kept for the period stipulated in the relevant legislation or required for the purpose for which they are processed. Accordingly, ZZGTECH stores personal data within the framework of its activities for the period stipulated in the relevant legislation or in accordance with our processing purposes.

6.2 Legal Grounds Requiring Retention

Your personal data are processed without the requirement of explicit consent based on the stipulation of the provisions of the law in force in the UK, legitimate interest, fulfilment of ZZGTECH's legal obligation, establishment of a right, publicisation and/or performance of the contract.

6.2.1 Reasons for Destruction

Personal data;

• Changing the provisions of the relevant legislation that constitute the basis for processing,
• Disappearance of the purpose requiring processing or storage,
• In cases where the processing of personal data is carried out only on the basis of explicit consent, the person concerned may withdraw his/her explicit consent,
• Acceptance by ZZGTECH of the application for the deletion and destruction of personal data within the framework of the rights of the data subject specified in Part III of the GDPR,
• In cases where ZZGTECH rejects the application made by the person concerned with the request for the deletion, destruction or anonymisation of his personal data, finds the answer insufficient or does not respond within the period stipulated in the Law; To make a complaint to the Board and this request is approved by the Board or the relevant authority,
• The maximum period of time required for the retention of personal data has expired and there are no circumstances that justify the retention of personal data for a longer period of time,
• In such cases, it shall be deleted, destroyed or ex officio deleted or anonymised by ZZGTECH upon the request of the person concerned.

6.3 Ensuring the Security of Personal Data

ZZGTECH takes all necessary technical and administrative measures to ensure the appropriate level of security required for the protection of personal data.

The measures taken by ZZGTECH to ensure the security of personal data are detailed in the sub-articles:

6.3.1 Technical Measures

• It is ensured that necessary infrastructure investments are made in the field of information security in accordance with the developing technology.
• It is ensured that the access authorisations of IT and other unit employees to personal data are kept under control. Access authorisations are defined to be limited to the services provided in authorisation definitions. Security layers are applied for remote access.
• ZZGTECH performs access restrictions to personal data according to the principle of minimum authorisation. Access to servers, applications and files in the digital environment are checked periodically within the scope of ISO 27001 Information Security Management System and ISO 27701 Personal Data Management System standards. In cases where privileged authorisation is required, actions are taken by limiting the time.
• ZZGTECH makes access and authorisation definitions. It checks the compliance of accesses with authorisations. The information obtained as a result of checking the security of the systems is reported. Points that pose a risk are identified and necessary technical measures are taken.
• The institution receives system and application access logs within the scope of Law No. 5651. Access requests of third party suppliers are received in writing. SSL VPN connection is provided for the received requests. SSL VPN external dual authentication security measures are taken. Access is restricted by using Mac filtering and static ip addresses.
• Access to networks containing personal data is restricted. There is no guest network. Network access logs are kept by security systems. Networks are separated between servers.
• In our institution, penetration tests are carried out periodically every year, taking into account the criteria of ISO 27001 Information Security Management System standard. Social engineering drills are carried out. Action is taken quickly according to the findings.
• Software and hardware including virus protection systems and firewalls are installed. Licensed antivirus is used in all user systems. The security of the systems in the cloud environment is ensured by using the infrastructure offered by the cloud service provider. Up-to-date versions of the systems with the necessary security measures against known vulnerabilities are used and log records of the systems are taken.
• Automatic backups are taken regularly for the environments where personal data are stored.
• In order to maintain the security of personal data, awareness is spread so that technical measures are part of the corporate culture with a model that continuously operates. Technical issues are explained in in-house trainings.
• It is ensured to be kept alive continuously with the measures and controls taken.
• User accounts are managed centrally. User accounts assigned to customers are centrally managed. User and employee passwords are set as complex.
• SSL certificate security is available in environments where web services are used and on the ZZGTECH web page.
• ZZGTECH carries out security operations by including applications and web services in the security tests it performs. Authorisation checks are carried out for access to applications. Masking measures are taken in accordance with the environments where personal data are processed. Encryption and hashing operations are performed in data transfers over the application. Development and test environments are separated and necessary controls are carried out before the applications are taken live.
• Logs of the applications sold by ZZGTECH are taken and analyses are performed. Personal data security is kept at a high level with warning systems in abnormal situations.
• Backups of systems containing personal data are taken periodically and the backups are checked.
• Personal data security is provided with firewall applications to ensure the security of the server and connected environment.
• In the processes of deletion, destruction and anonymisation of personal data, personal data are processed by taking into account customer agreements and personal data processing purposes. In cases where the purpose of processing personal data no longer exists, personal data is hashed by using the sole feature in databases. In cases where employee media and computers, which are of critical importance and contain personal data, have completed their useful life, are delivered to third parties, or are allocated to other personnel, they are wiped and formatted.

6.3.2 Administrative Measures

• ZZGTECH has created a Personal Data Inventory in order to identify, analyse and audit personal data. The Personal Data Inventory is updated in case a new personal data is obtained or the purpose of use of existing personal data changes.
• ZZGTECH employs knowledgeable and experienced people to ensure data security and provides its personnel with the necessary information and awareness training on personal data security.
• Procedures, policies and instructions have been established within the scope of ISO 27001 Information Security Management System and ISO 27701 Personal Data Management System standards regarding personal data and information security. Data security measures are taken according to the rules specified in the created documents.
• Contracts containing personal and information security issues are signed with employees and persons and institutions with whom ZZGTECH shares data due to its business. Contracts contain responsibilities specific to data confidentiality. Third parties with whom personal data is shared accept the provisions that they will take the necessary security measures to protect personal data and ensure that these measures are complied with in their own organisations. Internal audits and independent institutions check whether the contents of the contract are complied with.
• The established systems are controlled by competent personnel with the necessary internal audits. ZZGTECH takes the necessary administrative measures to ensure the security of personal data and supervises the work of employees according to these measures.
• Risk analyses are performed within the scope of ISO 27001 Information Security Management System and ISO 27701 Personal Data Management System standard. Apart from risk analyses, data classification, information security risk assessment and business impact analyses are performed and processes are operated. In line with these processes, technical measures are taken in accordance with the developments in technology.
• The contents of the employment contracts of the personnel have been updated regarding personal data security. Employees are informed that they cannot disclose the personal data they have learnt to others in violation of the provisions of the Law, cannot use them for purposes other than processing, and that this obligation will continue after they leave their duties. Necessary commitments are obtained from employees in this direction. Apart from this, ZZGTECH's disciplinary processes are carried out in accordance with the laws.
• Internal communication methods have been determined. DPO was appointed within the organisation. In addition, an Information Security Committee was established for personal data security. Job descriptions of the committee members were created and roles, authorities and responsibilities were detailed. Internal employees, external parties and organisations that need to be contacted in case of emergency have been identified.

6.3.3 Audits for the Sustainability of Personal Data Protection

ZZGTECH carries out or has the necessary audits carried out to ensure personal data security. It ensures that internal audits are carried out to ensure the sustainability of personal data security. ZZGTECH provides controls according to ISO 27001 Information Security Management System and ISO 27701 Personal Data Management System standards to increase the efficiency of internal audits. It regularly performs penetration tests for technical vulnerabilities that may occur in the systems. The systems are regularly monitored by IT. When unlawful access or processing of personal data is detected in the audits, the DPO is informed.

6.3.4 Measures Implemented to Ensure Protection of Personal Data by Third Parties

ZZGTECH, in its contracts with third parties; It includes the necessary sanction clauses to prevent unlawful processing of personal data, to prevent unlawful access to data and to ensure the preservation of data. Confidentiality agreements are signed before sharing information with third parties. Necessary information is provided to third parties to raise awareness. In cases where third parties need to access the systems, audit trails related to access are kept.

6.3.5 Measures Implemented for the Protection of Sensitive Personal Data

Adequate measures must be taken for personal data of special nature both due to their nature and because they may lead to victimisation or discrimination. In Article 6 of the Law, personal data that have the risk of causing victimisation or discrimination when processed unlawfully are defined as "Special Categories".

These data include data on race, ethnic origin, political opinion, philosophical belief, religion, sect or other beliefs, appearance and dress, membership of associations, foundations or trade unions, health, sexual life, criminal convictions and security measures, and biometric and genetic data.

ZZGTECH takes the necessary measures to protect personal data of special nature, which are determined as "special quality" by the Law and processed in accordance with the law. Sensitivity is shown for special quality personal data in technical and administrative measures taken to protect personal data.

Employees are informed about the use of special categories of personal data through policies and procedures. Sensitive personal data are not processed in the absence of the consent of the person. In cases where sensitive personal data may be processed, it is not shared with anyone other than 3rd party persons / organisations that have been informed and whose explicit consent has been obtained.

6.3.6 Raising Awareness to Ensure Protection of Personal Data

Necessary information is provided to employees in order to raise awareness to prevent unlawful processing of personal data, unlawful access to data and to ensure the preservation of data. Trainings are organised and their effectiveness is measured.

In case of changes in the relevant laws, regulations or legislation, the policies are revised and the relevant changes are re-announced to the personnel.

6.4 Personal Data Destruction Techniques

ZZGTECH destroys the personal data it obtains in line with the request of the personal data owners, if it is not mandatory to use it due to legal obligations, due to legal obligations or for the protection of public order and provided that it does not affect business processes. Personal data belonging to data owners are destroyed based on the decision to be taken by the organisation when the retention periods determined by the relevant laws expire or when the requirements for planning disappear in the event that the condition for the use of the relevant data disappears. Personal data that do not need to be stored on the dates determined by the DPO every year are destroyed by the following techniques in accordance with the legislation. Destruction operations are carried out in three different methods as deletion, destruction and anonymisation.

6.4.1 Deletion of Personal Data

The methods of deletion of personal data are specified in the table below;

6.4.2 Destruction of Personal Data

Destruction of personal data is specified in the table below;

6.4.3 Anonymisation of Personal Data

Anonymisation of personal data means making personal data impossible to be associated with an identified or identifiable natural person under any circumstances, even if the personal data is matched with other data.

In order for personal data to be anonymised; personal data must be rendered unassociable with an identified or identifiable natural person, even through the use of appropriate techniques for the recording medium and the relevant field of activity, such as the return of personal data by the data controller or third parties and / or matching the data with other data.

6.5 Storage and Destruction Periods

The retention periods for personal data processed by ZZGTECH within the scope of its activities, all personal data within the scope of the activities carried out depending on the processes are detailed in the Data Inventory document.

Retention periods have been determined by taking into account the laws to which ZZGTECH is subject, the provisions of the contract with the relevant parties and the periods required for ZZGTECH's operational activities.

Such retention periods are updated by the Personal Data Contact Person if necessary.

Personal data whose retention periods have expired are destroyed ex officio. The category-based maximum retention periods of personal data are as follows;

7. Application Methods

You can realise your rights regarding your personal data within the scope of GDPR by using the following methods;

Data Controller: ZZGTECH LTD

Data Protection Officer (DPO): Rugül ÇINAR- [email protected]

You can make your personal data applications by filling out the Personal Data Application Form document. Clarification application methods are as follows;

Personal data applications will be accepted following the identity verification to be made by us, and the relevant persons will be answered in writing or electronically within the legal periods.