TAŞIMACIM SOFTWARE TECHNOLOGIES INC.
PROCESSING AND SECURITY POLICY OF SPECIAL NATURE PERSONAL DATA

INTRODUCTION

Purpose of Policy

As Taşımacım Yazılım Teknolojileri Anonim Şirketi (hereinafter referred to as “Taşımacım” or “Company”), we process special personal data and ensure the security of these data in accordance with the Personal Data Protection Law No. 6698 and the relevant legislation.

This Policy on Processing and Security of Special Personal Data ("Policy") has been prepared to determine the measures we, as the data controller, take for the processing of special personal data in accordance with the decision numbered 2018/10 dated 31/01/2018 of the Personal Data Protection Board regarding the "Adequate Measures to be Taken by Data Controllers in the Processing of Special Personal Data" ("Board Decision").

This Policy and Taşımacım's Personal Data Security Policy ("Security Policy") are complementary to each other, and the Security Policy should be reviewed for matters not mentioned in this Policy.

Taşımacım, as the data controller, will act in accordance with this Policy when processing special personal data in its possession, sharing it with third parties and storing it in data recording media.

Scope of the Policy

This Policy covers our activities to ensure the appropriate level of security for the special personal data we have obtained or may obtain belonging to the following persons:

• Our company's employees, candidate employees, former employees and interns,
• Representatives, attorneys and shareholders of our company and our group companies,
• Employees, representatives and attorneys of our business partners,
• Healthcare professionals with whom we collaborate,
• Employees, representatives and attorneys of our suppliers,
• Our customers and potential customers,
• Employees of public/private institutions and organizations,
• Members and managers of the associations we cooperate with,
• Other real persons.

Changes and Updates to the Policy

Within the framework of this Policy, Taşımacım will process the special personal data of the individuals mentioned in Article 2 in accordance with personal data protection legislation and will take the necessary administrative and technical measures to ensure the security of this data. This Policy may be amended and updated by the relevant departments at any time in response to changes in the law, relevant legislation, or Taşımacım's activities.

PROCESSING OF SPECIAL NATURE PERSONAL DATA

General Principles Regarding the Processing of Special Personal Data

Taşımacım is obligated to comply with the general principles set forth in the Personal Data Protection Law regarding the processing of personal data. In this context, Taşımacım will act in accordance with the following principles when processing sensitive personal data:

• Processing personal data in accordance with the law and the rule of honesty,
• Ensuring that personal data is accurate and up-to-date when necessary,
• Processing personal data for specific, clear and legitimate purposes,
• Processing personal data in a way that is relevant, limited and proportionate to the purpose for which they are processed,
• Preservation for the period required by the relevant legislation or for the purpose for which they are processed.

Conditions for Processing Special Personal Data

Taşımacım is obligated to process special personal data in accordance with the general principles mentioned above, as well as the conditions set forth in Article 6 of the Personal Data Protection Law. In this context, Taşımacım may process special personal data based on one of the following conditions:

• Obtaining the explicit consent of the relevant person for the processing of special personal data, or
• The processing of special personal data, excluding personal data related to health and sexual life, is prescribed by law.

Transfer of Special Personal Data

Taşımacım may share special personal data with third parties in accordance with the data processing conditions set forth in Articles 8 and 9 of the Personal Data Protection Law. When transferring special personal data to third parties, Taşımacım will take the security measures specified in the Board Decision. In this context, Taşımacım will process special personal data:

• In cases where information is transferred via e-mail, it uses an encrypted corporate e-mail address or Registered Electronic Mail (KEP) account,
• In cases where data is transferred between servers in different physical environments, it transfers data by establishing a VPN between the servers or using the sFTP method,
• In cases where the document is transferred via paper, the necessary precautions are taken against risks such as theft, loss or access by authorized persons and the document is sent in the format of "confidential documents".

Storage of Special Personal Data

Taşımacım stores special personal data in accordance with the general principles and processing conditions detailed above. Taşımacım will take the security measures specified in the Board Decision regarding the environments where special personal data is stored and/or accessed. In this context, Taşımacım:

• It protects sensitive personal data using cryptographic methods and keeps cryptographic keys in safe and separate environments,
• Transaction records of all transactions performed on sensitive personal data are securely logged,
• Continuously monitors security updates for environments containing sensitive personal data, regularly conducts necessary security tests, and records the test results.
• In cases where special personal data is accessed through software, user authorizations for this software are made,
• If remote access to sensitive personal data is required, at least a two-stage authentication system is provided.
• The physical environment, where sensitive personal data is processed, stored and/or accessed, takes precautions against electrical leakage, fire, flood, theft, etc. The physical security of these environments is ensured and unauthorized entry and exit is prevented.

EMPLOYEES' PROCESSING OF SPECIAL NATURE PERSONAL DATA

Taşımacım takes the following measures specified in the Board Decision for its employees who process special categories of personal data:

• Necessary training and awareness activities are carried out for the personnel regarding ensuring the security of personal data and preventing it from being disclosed or shared unlawfully.
• A confidentiality agreement is signed with employees.
• Employees are authorized to access servers containing personal data based on their department and job role. The scope and duration of these authorizations are clearly defined.
• Authorization checks are carried out periodically.
• If employees change duties or leave their jobs, their access rights to data are revoked and the inventory given to them is taken back.

PERSONAL DATA SECURITY POLICY

Taşımacım has established its Personal Data Security Policy in accordance with the technical and administrative measures specified in the Personal Data Security Guide published by the Authority on its website to ensure the security of all personal data it processes, including sensitive personal data. This Special Data Security Policy outlines the technical and administrative measures the Company has implemented to ensure the legality of processed personal data, to prevent unlawful access, and to maintain an appropriate level of security to ensure its safekeeping.