1. PURPOSE AND SCOPE

This policy defines the basic rules for protecting the confidentiality, integrity, and accessibility of information belonging to GMM and its stakeholders in a manner consistent with business needs and risks. The policy; This policy is implemented in accordance with the GMM Sustainability Policy and defines the framework of the relevant commitments within its own field of activity. This policy is implemented in accordance with the GMM Sustainability Policy and defines the framework of the relevant commitments within its own field of activity.

This policy is implemented in accordance with the GMM Sustainability Policy and defines the framework of the relevant commitments within its own field of activity.

2. KEY COMMITMENTS

• Granting access to information based on job needs, tasks, and the principle of minimum authority.

• Managing user accounts on a personal level; Enforce password, authentication, and authorization rules.

• Technical drawings, product trees, material lists, quotations, customer and supplier data classification and protection according to privacy requirements.

• Maintaining backup, update, malware protection, and incident response controls according to risk level.

• Processing personal data in accordance with relevant legislation and established storage rules.

• Controlling third-party access with contract, confidentiality, duration, and authorization limits.

• Respecting the intellectual property rights of customers, suppliers, and other third parties; Technical information, Using drawings and software within the scope of usage rights and contract terms.

3. IMPLEMENTATION AND MONITORING

Information assets and their custodians are identified. Access opening, modification and closure operations are carried out with approved requests. Information security incidents or suspicions are reported to the Information Technology unit and the relevant manager without delay.

Senior management determines risk appetite and resources. Information Technology conducts technical controls. Information owners approve access needs. All users are responsible for the secure use of the accounts and information provided to them.

Access reviews, backup results, security incidents, vulnerabilities and update status, awareness activities and third-party access are monitored.

The source, access permissions, changes and storage of data used in sustainability reporting are managed together with the data owners. Data accuracy, confidentiality, and sharing authorization are checked before external sharing.

The objectives within the scope of the policy are linked to the annual target plans of the relevant process owners; they are followed up with indicator, data source, responsible party, and monitoring period. Results, audit findings and improvement activities are evaluated in management review.

4. EFFECTIVE DATE AND REVIEW

This policy enters into force with the approval of the General Manager; it is communicated to employees and relevant parties. It is reviewed at least once a year and in case of significant changes, taking into account legislation, corporate priorities, risks and implementation results. Implementation details are defined in relevant procedures, instructions and records.