Information Security Policy

1. Purpose

As Ulmet Construction Machinery Industry and Trade Limited Company, we consider the protection of the confidentiality, integrity, and availability of all our information assets to be our fundamental responsibility. This policy has been established to ensure the reliability of the services we provide to our customers, safeguard business continuity, minimize information security risks, and ensure compliance with national and international standards.

2. Scope

This policy applies to all information assets within Ulmet Construction Equipment. Within this scope:

• All data located in digital and physical environments,
• Employees, managers, suppliers, and business partners,
• Servers, databases, network infrastructure, and cloud systems,
• All information processed in written, oral, visual, and electronic formats

falls within the scope of the information security policy.

3. Basic Principles

At Ulmet Construction Equipment, our approach to information security is based on the following fundamental principles:

• Confidentiality: Ensuring that information is accessible only to authorized individuals,
• Integrity: To ensure the accuracy of data and prevent unauthorized modifications,
• Accessibility: Ensuring that authorized users have timely access to the information they need,
• Risk Management: Identifying potential threats in advance and taking proactive security measures

4. Responsibilities

Information security is a shared responsibility across the organization:

• All Employees: Are required to comply with information security policies, report suspicious activity, and protect data security.
• Management: Is responsible for ensuring the effective implementation of information security processes, allocating the necessary resources, and monitoring the system’s continuity.
• IT and Security Units: They are responsible for establishing the security infrastructure, conducting risk analyses, and implementing the necessary technical measures.
• Suppliers and Business Partners: They are responsible for complying with the company’s information security policies.

5. Information Security Practices

Ulmet Construction Equipment implements the following measures to ensure data security:

• All systems use up-to-date security software and antivirus solutions,
• Data access is controlled through authorization mechanisms,
• Critical data is regularly backed up and stored in secure environments,
• Firewalls and intrusion detection and prevention systems are used for network security,
• Solutions to prevent data breaches are implemented,
• Employee awareness is enhanced through regular information security training

6. Legal Compliance and Standards

Ulmet Construction Machinery is committed to complying with all applicable legal regulations and international standards regarding information security processes. In this regard;

• The principles of the ISO 27001 Information Security Management System,
• The Law on the Protection of Personal Data No. 6698 (KVKK),
• Law No. 5651

activities are carried out in accordance with this.

7. Incident Management

In the event of an information security breach, a swift and effective response is essential. In this regard;

• Violations are immediately identified and reported to the relevant departments,
• The necessary emergency response procedures are initiated,
• Affected systems are isolated and security is ensured,
• The source of the violation is analyzed, and measures are implemented to prevent its recurrence,
• Legal notices are issued when necessary

8. Review and Continuity

This policy is regularly reviewed and updated in light of technological advancements, emerging threats, and legal regulations. Ulmet Construction Equipment is committed to continuously improving its information security processes and establishing a sustainable security infrastructure.