Information Notice

Data Controller Details

Data Controller

SİBERLOCK SİBER GÜVENLİK VE DANIŞMANLIK HİZMETLERİ LİMİTED ŞİRKETİ

MERSIS No

0770119576200001

Address

Malazgirt Mahallesi Sarayburnu Caddesi No: 46/103 Selçuklu/KONYA

Telephone & Fax No

0332 606 24 01

Email

[email protected]

Website

www.siberlock.com.tr

1. Data Controller and Its Representative

Your personal data may be processed, recorded, stored, classified and updated by SİBERLOCK, acting as the data controller, in accordance with the law and the rules of good faith, for and limited to the purposes explained below, and may be disclosed/transferred to third parties where permitted by legislation or limited to the purposes for which it is processed.

2. Purposes of Processing Your Personal Data

Your personal data is processed in accordance with the fundamental principles set out in the KVKK for the following purposes:

• Conducting job candidate application processes,
• Conducting employee satisfaction and engagement processes,
• Fulfilling obligations arising from employment contracts and legislation in relation to employees,
• Conducting employee benefits and entitlements processes,
• Conducting Information Security Processes
• Managing Access Authorisations
• Conducting training activities,
• Conducting activities in compliance with legislation,
• Conducting finance and accounting operations,
• Ensuring the security of physical premises,
• Conducting assignment processes,
• Following up and handling legal matters,
• Conducting internal audit/investigation/intelligence activities,
• Conducting communication activities,
• Planning human resources processes,
• Conducting/supervising business activities,
• Conducting occupational health/safety activities,
• Conducting goods/services purchasing processes,
• Conducting goods/services sales processes,
• Conducting Risk Management Processes
• Conducting goods/services production and operational processes,
• Conducting customer relationship management processes,
• Conducting advertising/campaign/promotion processes,
• Conducting retention and archiving activities,
• Conducting contract processes,
• Following up requests/complaints,
• Providing information to authorised persons, institutions and organisations,
• Performing management activities,
• Obtaining technical support from companies providing outsourced services,
• Preparing various reports,
• Providing cybersecurity consultancy and services, providing instant cybersecurity support through the artificial intelligence assistant (ASİLA), providing data recovery, device analysis and related technical services, conducting device receipt, tracking, return and chain of custody processes, and verifying the integrity and ensuring the secure delivery of recovered data. Your personal data is processed solely for these purposes and is securely stored in physical or electronic form for a period appropriate to the purpose of processing. In the course of these activities, our Company acts in accordance with the obligations concerning personal data protection set out in all applicable legislation, particularly the KVKK.

For detailed information about our Company's data processing policy, you may review the Siberlock Personal Data Protection and Privacy Policy available at www.siberlock.com.tr.

3. Transfer of Your Personal Data

Your personal data lawfully processed by SİBERLOCK may, for the purpose of fulfilling our obligations, be disclosed/transferred to:

business partners, public institutions, the internet service provider, the occupational health and safety company, our official accountant, our legal department, banks, shipping companies, supplier companies, companies providing support services, foreign countries as a result of transfers made through foreign websites, Google LLC (Analytics and advertising services), Cloudflare Inc (bot protection and security verification services (Turnstile), content delivery network services, and derivation of country/city-level location information from visitor IP addresses), FingerprintJS Inc (device fingerprinting and security services), hosting providers (website infrastructure and database services), multi-engine security scanning service providers, and NetGSM (SMS service provider). In addition, for the purposes of administering the Company, conducting business and implementing company policies, your personal data may be disclosed/transferred to Microsoft Office applications whose databases are located in countries with or without adequate protection, and to other third parties due to our various legal obligations.

4. Your Rights Under Article 11 of the KVKK

By applying to our Company, you have the right to:

• Request information as to whether your personal data has been processed and, if it has been processed, information relating to such processing,
• Learn the purpose of processing your personal data and whether it is used in accordance with that purpose,
• Know the third parties to whom your personal data is transferred within the country or abroad,
• Request rectification of your personal data if it has been processed incompletely or inaccurately,
• Request erasure or destruction of your personal data when the conditions for processing no longer exist, and, if it has been transferred, request that the third parties to whom it was transferred also be notified,
• Request compensation for damage suffered as a result of the unlawful processing of your personal data.

5. Methods and Legal Grounds for Collecting Personal Data

Your personal data is processed for the purposes listed above pursuant to the Turkish Code of Obligations No. 6098, the Turkish Commercial Code No. 6102, various tax legislation, social security legislation, the Consumer Protection Law No. 6502, the Labour Law No. 4857, the Law on the Regulation of Electronic Commerce No. 6563, the Law on the Regulation of Publications on the Internet and Combating Crimes Committed through Such Publications No. 5651, Law No. 6331, the Customs Law No. 4458, the regulations and communiqués issued pursuant to these Laws, and all other applicable legislation, or in the course of establishing a contractual relationship or on the basis of your explicit consent.

Processing of personal data means any operation performed on such data, such as obtaining, collecting, recording, storing, retaining, altering, rearranging, disclosing, transferring, taking over, making available, classifying or preventing the use of data, by wholly or partly automated means or by non-automated means provided that the data forms part of a data recording system.

Within our Company, personal data may be obtained and collected for the purposes set out above, including but not limited to those specified below, by wholly or partly automated means or by non-automated means provided that the data forms part of a data recording system, orally, in writing or electronically, through the Company's workplaces, departments, website and social media channels, and through cameras and other similar means. For example,

• Receiving and responding to contact requests,
• Providing cybersecurity consultancy and services,
• AI-assisted evaluation of submissions through the "I Am Under Attack" form,
• Processing requests for quotations and providing services,
• Ensuring website security (bot protection, abuse prevention),
• Analysing website performance and improving the user experience,
• First-party measurement of website visits,
• Fulfilling legal obligations (keeping logs pursuant to Law No. 5651),
• Providing instant cybersecurity support through the artificial intelligence assistant (ASİLA),
• Detecting and preventing malicious behaviour through ASİLA chat history and IP/visitor analyses,
• Detecting malicious/suspicious software, reporting, preventing misuse and quotas, and diagnosing information security through the Free File Analysis Tool,
• Providing expanded threat intelligence and relational analyses upon your request (within the framework of technical and service policies),
• Performing data recovery services; receiving devices/media, conducting preliminary analysis and recovery operations, maintaining chain of custody records, and conducting device/data return and delivery processes,
• Through security camera recordings at our workplace,
• Through the completion of the complaints and suggestions form on our website by customers acting as consumers,
• Through the preparation of personnel files,
• Through the receipt of orders and the conclusion of contracts,
• Data is collected through emails sent to our Company or to the corporate email addresses of our employees, and through written messages sent to our employees' mobile phones.

Pursuant to paragraph 1 of Article 13 of the Personal Data Protection Law, you may submit your request to exercise the rights specified above to our Company in writing or through other methods determined by the Personal Data Protection Board. Since the Personal Data Protection Board has not determined any method at this stage, you are required to submit your application to our Company in writing pursuant to the Personal Data Protection Law. In this context, the channels and procedures for submitting written applications to our Company within the scope of Article 11 of the Personal Data Protection Law are explained below.

To exercise the rights specified above, you may deliver your request in person to our address below, in the form of a petition containing the information necessary to establish your identity and your explanations regarding the right you wish to exercise under Article 11 of the Personal Data Protection Law, together with documents establishing your identity, or send it through a notary public or by other methods specified in the Personal Data Protection Law.

SİBERLOCK will conclude your request free of charge as soon as possible, depending on its nature, and in any event within no more than thirty (30) days. However, if the procedures required to examine and conclude your application entail an additional cost, you will be charged the fees set out in the tariff determined by the Board.