Data Classification Policy
Document Control
| Document ID | HL-ISMS-POL-04 |
|---|---|
| Document Title | Data Classification Policy |
| Classification | Internal |
| Version | 2.0 |
| Status | Approved |
| Document Owner | Information Security Manager (ISM) |
| Approved by | Executive Management |
| Effective Date | 30.10.2026 |
| Next Review Date | Annually from effective date, or upon significant change |
| Applies to | Hamurlabs Elektronik Hizmetler Yazılım ve Ticaret A.Ş. (Istanbul, Türkiye) and Hamurlabs BV (Leuven, Belgium), together "Hamurlabs" |
Revision history
| Version | Date | Author | Description of Change |
|---|---|---|---|
| 1.0 | — | — | Initial template-based version (superseded) |
| 2.0 | 30.10.2026 | ISM | Full rewrite: adapted to Hamurlabs group structure (A.Ş. + BV), Google Cloud environment, KVKK/GDPR legal basis, ISO/IEC 27001 alignment; roles and contact points corrected |
1. Purpose and Scope
This policy assists Hamurlabs personnel and third parties in understanding how Hamurlabs classifies, labels and handles information. Classification determines the baseline security controls appropriate for safeguarding each category of data.
This policy covers all information received, stored, processed or transmitted by Hamurlabs in any form or medium — electronic or hardcopy — including data processed on Google Cloud, in corporate SaaS applications, on endpoints, and in physical documents. It applies to both Hamurlabs entities and to all personnel and third parties handling Hamurlabs information. The ISM facilitates and maintains this policy and ensures all personnel have reviewed it.
2. Classification Scheme
All Hamurlabs data must be assigned one of the following three classifications. Where classification is not inherently obvious, the owner must consider the impact on Hamurlabs and on Hamurlabs customers if the confidentiality, integrity or availability of the data were compromised. By default, data not explicitly classified as Confidential or Public must be treated as Internal.
| Classification | Definition | Examples | Potential impact of loss |
|---|---|---|---|
| CONFIDENTIAL | Highly valuable or sensitive information whose protection may also be dictated externally by law (KVKK, GDPR) or by contract. Access limited to named individuals with a specific business need; access to customer data and personal data additionally requires authorisation under the User Access Control Policy. | Customer production data processed in HaROS (orders, inventory, end-customer records); personal data of employees, candidates and customer contacts; credentials, keys and secrets; contracts and pricing; financial records; security configurations and vulnerability reports; source code designated as confidential. | SIGNIFICANT damage: breach of customer contracts and DPAs, administrative fines under KVKK/GDPR, loss of customers, reputational harm, identity theft risk for data subjects. |
| INTERNAL | Information originating within or owned by Hamurlabs, or entrusted to it, which may be shared with authorised personnel, contractors and business partners with a business need, but not released to the public. | Internal procedures and documentation; project plans; internal reports and metrics; general source code and architecture documentation not designated confidential; internal announcements. | MODERATE damage: reputational harm, competitive disadvantage, breach of contractual confidentiality expectations. |
| PUBLIC | Information approved for release to the general public by Executive Management or the responsible owner, freely shareable internally and externally. | Marketing materials; public website content; published product documentation; press releases. | NO material damage from disclosure; controls still required to prevent unauthorised alteration or destruction. |
Personal data within the meaning of KVKK and GDPR is always classified at least as Confidential. Special categories of personal data (e.g. health data) must not be collected or processed unless a documented legal basis exists and the ISM has been consulted.
3. Handling Controls per Classification
| Handling control | Confidential | Internal | Public |
|---|---|---|---|
| Access | Named individuals, business need, authorised per User Access Control Policy; NDA required before access by non-Hamurlabs persons; access to personal data governed by DPAs | Personnel and authorised partners with a business need; NDA recommended for third parties | No restriction on viewing |
| Transmission (internal and external) | Encryption in transit (TLS 1.2+) required; transfer only via approved corporate channels; sending via personal accounts, unapproved file-transfer or messaging tools prohibited | Encryption in transit required for external transmission; approved corporate channels only | No special requirements |
| Storage (data at rest) | Encryption at rest (AES-256 or cloud-provider managed equivalent) required; logical access controls required; storage only in approved locations (Google Cloud production projects, corporate drives); storage on personal devices or personal cloud accounts prohibited | Encryption at rest recommended; logical access controls required; approved corporate storage only | Logical access controls to prevent unauthorised alteration |
| Endpoints and mobile devices | Device encryption required; screen lock required; remote wipe enabled where available; local copies minimised and deleted when no longer needed | Device encryption required; screen lock required | No special requirements |
| Only via corporate email; encryption in transit enforced; do not forward outside Hamurlabs without owner approval; prefer links with access control over attachments | Corporate email; do not forward externally without a business reason | No special requirements | |
| Physical documents and mail | Locked storage; clear-desk; "addressee only" and tracked delivery for external mail; collect print-outs immediately | Do not leave unattended in shared spaces | No special requirements |
| Disposal | Secure deletion per retention schedule; cross-cut shredding of hardcopies; certified media disposal; deletion/return obligations under customer DPAs honoured at contract end | Secure deletion; shred hardcopies | Standard disposal |
4. Customer Data
Hamurlabs processes customer data in HaROS as a processor (or sub-processor) on behalf of its customers. In addition to the controls above: customer data may be used only for the purposes defined in the relevant contract and data processing agreement; it must not be copied into non-production environments unless anonymised or explicitly authorised; access is limited, logged and reviewed; and cross-border transfer restrictions (KVKK international transfer requirements, GDPR Chapter V) must be observed in accordance with the executed transfer instruments.
5. Labelling and Ownership
Each information asset must have an identified owner responsible for assigning its classification, reviewing it periodically, and ensuring handling in line with this policy. Documents classified as Confidential should be labelled in the header or footer where practicable; system-level labelling (drive/folder naming, repository visibility settings) is acceptable for electronic repositories.
6. Compliance
Suspected mishandling of information must be reported to [email protected] and is managed under the Incident Management Policy. Violations may result in disciplinary action in accordance with the Information Security Policy.