We, the senior management of AISTUDIO YAZILIM DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ (the “Company”), hereby declare the following:

The primary objective of the systems established in accordance with the ISO/IEC 27001:2022 Information Security Management System (ISMS) Standard within the scope of the Company’s services is to demonstrate that information security is effectively managed across people, infrastructure, software, hardware, customer information, corporate information, all business activities and transactions, information belonging to third parties, and financial resources.

These systems also aim to ensure effective quality and risk management, measure the performance of quality and information security management processes, and govern relationships with third parties concerning quality, information security, and customer satisfaction.

Accordingly, the objectives of our ISMS Policy are to:

• Protect the Company’s information assets against all internal and external threats, whether deliberate or accidental; ensure that information is available to business processes as required; comply with applicable legal and regulatory requirements; and continually improve the Information Security Management System.

  
  

• Ensure the continued application of the three fundamental principles of information security throughout all activities:

  Confidentiality: Preventing unauthorized access to sensitive and valuable information.

  Integrity: Safeguarding and demonstrating the accuracy, completeness, and integrity of information.

  Availability: Ensuring that authorized persons can access information whenever required.

  
  

• Demonstrate leadership and commitment. The Company’s senior management leads the establishment and implementation of the ISMS and actively participates in ISMS activities at the highest level.

  
  

• Protect all information, regardless of whether it is stored or communicated electronically, in writing, in print, verbally, or through any other medium.

  
  

• Raise awareness by providing information security management training to all personnel.

  
  

• Ensure that all actual or suspected information security vulnerabilities and incidents are reported to the ISMS Team and duly investigated.

  
  

• Prepare, maintain, and regularly test business continuity plans.

  
  

• Conduct periodic information security assessments to identify existing risks and, based on the assessment results, review, monitor, and follow up on the relevant action plans

  
  

• Prevent disputes and conflicts of interest that may arise from contractual obligations.

  
  

• Meet business requirements relating to information availability and information systems.

  
  

The senior management of AISTUDIO YAZILIM DANIŞMANLIK TİCARET LİMİTED ŞİRKETİ hereby commits to implementing, maintaining, and continually improving this Policy.