Information Security and Protection of Personal Data

This policy sets out the managerial and technical measures adopted to protect the confidentiality, integrity and availability of all information assets processed, stored and transmitted within MRT Havacılık AVIATION & DEFENCE TECHNOLOGIES. It covers company personnel, subcontractors, suppliers and all third parties with access to client data. Its scope includes technical documentation, design data and client information specific to the defence and aerospace sectors.

Information processed within the company is classified at four levels: "Public", "Company Confidential", "Confidential" and "Strictly Confidential". Client technical specifications, design files and documents relating to defence industry projects are handled at a minimum "Confidential" level. The classification level determines the access, storage, transfer and disposal conditions applicable to the data; these conditions are applied in alignment with the asset management (A.8) controls of the ISO/IEC 27001 standard.

Access to information systems is defined on a need-to-know basis. Every user account is tied to individual authentication; shared accounts are prohibited. Administrative privileges are exercised through separate accounts and reviewed periodically. Remote access is granted solely via corporate VPN infrastructure with multi-factor authentication. Access logs are retained for a minimum of twelve months for post-incident review.

Data classified as Confidential and Strictly Confidential is protected with industry-standard encryption algorithms both at rest and in transit. Unencrypted corporate data may not be held on portable storage media. Client technical drawings and design files are kept in segregated file areas accessible only to authorised project teams. Backup processes are executed in encrypted form and backup integrity is verified regularly.

No working relationship is initiated with suppliers or subcontractors having access to information before a confidentiality agreement is signed. The information security capacity of critical suppliers is assessed prior to contract and audited periodically throughout its term. Data transfers to third parties are made solely within the purpose and scope defined in the contract; upon termination of the transfer, destruction or return of the relevant data is required as a contractual provision.

Any event constituting suspicious access, data leakage or system breach is reported to the information security officer the moment it is detected, and the incident response procedure is activated. Events amounting to a personal data breach are notified without delay to the Personal Data Protection Board and, as required, to the affected data subjects pursuant to Article 12 of Law No. 6698. Every incident is concluded with a root cause analysis and the measures taken are recorded.

Every member of personnel with access to information systems signs a confidentiality undertaking upon commencement of employment and completes information security awareness training. Training is repeated annually and covers social engineering, phishing and data classification. In the event of a change of duty or termination of employment, access privileges are revoked the same day.

This policy is reviewed at least once a year, or whenever a significant change occurs in legislation, in the threat environment or in the organisation of the company. Updates enter into force upon management approval and are communicated to all relevant personnel.

Under Personal Data Protection Law No. 6698 ("the Law"), the data controller is MRT Havacılık AVIATION & DEFENCE TECHNOLOGIES. Pursuant to Article 10 of the Law, the information below is provided to inform you regarding the processing of your personal data.

Depending on the channel through which you contact us, we process your name and surname, telephone number, e-mail address, company and title, together with any personal data contained in the request or technical documentation you send us. In the case of partnership or supplier applications, professional experience and contact details may also fall within the scope of processing.

Your personal data is processed for the purposes of evaluating and responding to your request, conducting pre-contractual negotiations, establishing an existing or prospective business relationship, monitoring service quality, fulfilling legal obligations and meeting regulatory requirements specific to the defence and aerospace sector.

Your personal data is collected through the contact channels on the website, by telephone, e-mail or face-to-face meetings, on the legal grounds set out in Article 5 of the Law — namely being "directly related to the conclusion or performance of a contract", "the legitimate interest of the data controller" and, depending on the nature of your request, "explicit consent".

Your personal data may be transferred, only to the extent strictly necessary for the performance of the service, to our information technology infrastructure service providers, to authorised public institutions where required by our legal obligations, and to the relevant public authorities within the scope of contracts to which we are party in defence industry projects, in accordance with the conditions set out in Articles 8 and 9 of the Law. Your data is not transferred abroad in the absence of your explicit consent or a statutory basis.

Your personal data is retained only for as long as the purpose of processing requires and with regard to the limitation periods prescribed by the applicable legislation. Data forming the subject of a contractual relationship is retained for the statutory retention periods following the end of the commercial relationship; at the end of that period it is erased, destroyed or anonymised.

Pursuant to Article 11 of the Law you have the right to: learn whether your personal data is being processed; request information if it has been processed; learn the purpose of processing and whether the data is used in accordance with that purpose; know the third parties to whom the data is transferred domestically or abroad; request correction where the data is incomplete or inaccurate; request erasure or destruction where the grounds for processing cease to exist; request that correction and erasure operations be notified to the third parties to whom the data was transferred; object to an adverse outcome arising from analysis of the data exclusively by automated systems; and claim compensation where you suffer loss due to unlawful processing.

To exercise the rights listed above, you may submit your request to the data controller in writing, together with information and documents verifying your identity, or by such other methods as the Personal Data Protection Board may determine. Your application will be concluded free of charge as soon as possible and in any event within thirty days; where the process entails an additional cost, the fee set out in the Board's tariff may be charged.