Information Security Policy

As Limon Bilgi Teknolojileri Anonim Şirketi, we recognize our responsibility to protect the data obtained, used, or generated during the design, implementation, and support of our private cloud, managed public cloud, and dedicated hosting services, as well as the information processing, operational, and development systems that host or manage our customers’ data within cloud computing environments. We are committed to safeguarding these assets in accordance with applicable national and international laws, regulations, and internationally recognized information security standards, and to implementing all necessary measures to ensure their protection. With this understanding, we have established the necessary legal, administrative, and technical measures and implemented Information Security Management Systems across our organization. We are committed to continuously improving our information security practices through ongoing enhancement, increasing information security awareness, ensuring the active participation of all employees and business partners, and protecting all physical and electronic data processed or maintained by our organization. Based on the core principles of Confidentiality, Integrity, and Availability, and in compliance with the Turkish Personal Data Protection Law (KVKK), including the protection of personal data and special categories of personal data, we are committed to the following: Necessary roles, responsibilities, and authorizations for information security will be defined. An Information Systems Management Strategy will be established and maintained. Compliance with information security standards and all applicable legal and regulatory requirements will be ensured. Threats, vulnerabilities, and risks affecting our information assets will be identified, assessed, and managed through comprehensive asset and data inventories. Our Information Security Management System and compliance with the Turkish Personal Data Protection Law (KVKK) will be continuously monitored, reviewed, and improved. Technical and awareness training programs will be provided to strengthen information security awareness and promote secure behavior throughout the organization. Supporting policies aligned with our overarching Information Security Policy will be established and maintained. The Plan–Do–Check–Act (PDCA) continual improvement cycle will be applied to all information security processes. All departments and responsible units will operate with a strong information security mindset and will develop and implement information security plans within their areas of responsibility. Compliance with the IT security frameworks and requirements of our customers and business partners will also be maintained. Within the scope of Personal Data Protection, we will prepare and maintain a personal data inventory, identify special categories of personal data, minimize the processing of personal data wherever possible, and ensure that all data are stored in secure environments with appropriate operational and technical safeguards. These commitments will be supported through a flexible, scalable, traceable, transparent, continuously updated, cybersecurity-focused information technology strategy, together with the employment of qualified technical professionals supported by continuous education and professional development.