Personal Data Protection Policy

At MECHSOFT, we:

1. Collect and process personal data in compliance with the laws of Türkiye and of the member states of the European Union, in order to protect the fundamental rights and freedoms of individuals, above all the right to privacy.
2. Apply this policy to all our personal data processing activities. These include the processing of personal data and special categories of personal data of employees, job applicants, customers and suppliers, as well as any data collected and processed from any source.
3. Prevent the unlawful processing of personal data, take the technical and administrative measures needed to ensure an appropriate level of security for safeguarding the data, and carry out, or have carried out, the necessary audits for this purpose.
4. Process personal data lawfully and in good faith; accurately and, where necessary, kept up to date; for specified, explicit and legitimate purposes; and in a manner that is relevant, limited and proportionate to those purposes.
5. Retain data for as long as required by law or by the purpose for which the personal data is processed.
6. Inform data subjects and provide the necessary information when data subjects request it.
7. Comply with the rules governing the processing of special categories of personal data and do not carry out any act or activity without explicit consent, except in cases expressly provided for by law.
8. Carry out our acts and activities in compliance with the rules laid down by law for the transfer of personal data.
9. Raise awareness of personal data protection among our internal and external stakeholders and communicate their related obligations to them.
10. Organise training to develop technical and behavioural competencies in order to increase awareness of personal data protection.
11. Manage personal data breaches, assess them under our disciplinary procedure and promptly notify the Board officials of offences and breaches that call for sanctions.
12. Continuously monitor the confidentiality and integrity of personal data, the currency of the data and the persons authorised to access personal data, through process-based asset inventories and process-based risk assessments.
13. Are committed to implementing and systematically managing the practices of the Personal Data Protection Management System, ensuring its continual improvement and allocating the resources the system requires.

We adopt these principles as the core policies of our personal data management system.