Policy on Processing Sensitive Personal Data

1. OBJECTIVE

This policy is created to establish processes related to the processing and security of Special Personal Data, as defined in Law No. 6698 on the Protection of Personal Data.

2. SCOPE

This policy covers the obligation for data controllers to take "adequate measures" in the processing of special personal data, as stipulated in Article 6, Paragraph 4 of the Law, and the processes related to the processing and security of special personal data according to the decision of the Personal Data Protection Board published in the Official Gazette dated 07.03.2018 and numbered 30353.

3. PRACTICAL PRINCIPLES OF PROCESSING SPECIAL CATEGORY DATA

Article 6 of the Law designates certain personal data as "special category personal data," which, when processed unlawfully, poses a risk of harm or discrimination to individuals.

Special category personal data in the Law includes information about race, ethnicity, political opinion, philosophical belief, religion, sect or other beliefs, dress and clothing, association, foundation or union membership, health, sexual life, criminal conviction, and security measures, as well as biometric and genetic data.

3.1. PROCESSING OF SPECIAL CATEGORY PERSONAL DATA

The processing of personal data designated as "special category" in the Law is conducted by our Company in compliance with the regulations stipulated in the Law. Special category personal data is processed under the following conditions:

• Special category personal data related to health and sexual life is processed only with the explicit consent of the data subject.
• Special category personal data other than health and sexual life can be processed if required by laws or with the explicit consent of the data subject.

Conditions for Processing Special Category Personal Data are outlined below:

In our Company, special category personal data of our employees is processed by the unit responsible for Human Resources services. This data includes special category personal data found in the identity documents of individuals with whom our Company has contractual or commercial relationships or their employees/representatives. This data is processed for the following purposes:

• Execution of processes related to obtaining health reports,
• Making position changes based on the identified health condition and thus providing positions suitable for the health of employees,
• Immediate intervention in case of situations that may affect the health of other employees,
• Compliance with data retention, reporting, and information obligations stipulated by legislation, relevant regulatory authorities, and other authorities,
• Establishment of personnel files,
• Fulfillment of other purposes compatible with these.

The processed data includes, but is not limited to:

• Special category personal data in identity documents,
• Laboratory Analysis Reports,
• Birth report,
• Rest and incapacity reports,
• Psychotechnical report,
• Disability report,
• Social Security Institution (SSI) Report,
• SSI Permission Documents,
• Blood Type Document,
• Health Report for Employment,
• Civil Society Organization Membership Certificate,
• Additional Health Screening Test Reports (Laboratory Findings, Physical Examination Results, Medical History, etc.),
• Personal Health Information,
• Criminal Conviction Data (Criminal Record).

This data is recorded and stored by the unit responsible for Human Resources activities.

3.2. ENSURING THE SECURITY OF SPECIAL CATEGORY PERSONAL DATA

Our Company, in its capacity as the data controller for special category personal data, is obliged to take the following measures:

A. This Policy is established for the security of special category personal data.

B. For the processes of processing special category personal data:

• Regular training is provided to Employees involved in the processes related to the processing of special category personal data on the subjects of Law and regulations related to the security of Special Category Personal Data,
• Confidentiality agreements are signed,
• Authorization scopes and periods for users with access to data are defined,
• Periodic authorization checks are performed,
• The powers of Employees who undergo a change of duty or leave the Company are immediately revoked.

C. If the environment where special category personal data is processed, stored, and/or accessed is in electronic form:

• Personal data is stored using cryptographic methods,
• Cryptographic keys are kept secure and in different environments,
• Transaction records of all actions on personal data are securely logged,
• Security updates for the environments where personal data is located are continuously monitored, necessary security tests are regularly conducted, and test results are recorded,
• If personal data is accessed through software, user authorizations for this software are defined, and security tests of these software are regularly conducted, and test results are recorded,
• If personal data is accessed remotely, a two-step authentication system is provided.

D. If the environment where special category personal data is processed, stored, and/or accessed is physical:

• Adequate security measures are taken according to the nature of the environment where Special Category Personal Data is located (against risks such as electric shock, fire, water flooding, theft, etc.),
• Unauthorized entries and exits are prevented by ensuring the physical security of these environments.

E. If special category personal data is to be transferred:

• If personal data needs to be transferred by e-mail, it is transferred encrypted with a password through the corporate e-mail address,
• If transfer is required via media such as Portable Memory, CD, DVD, it is encrypted with cryptographic methods and cryptographic keys are kept in a different environment,
• If transfer is carried out between servers in different physical environments, a VPN is established between the servers or data transfer is performed via FTP,
• If personal data needs to be accessed remotely, at least a two-step authentication system is provided.

F. In addition to the measures mentioned above, technical and administrative measures specified in our general policy on the protection of personal data are also implemented.

RUNITAS INFORMATION TECHNOLOGY INDUSTRY AND TRADE JOINT STOCK COMPANY