Information Security Policy

Document Control

Revision history

1. Purpose and Scope

This Information Security Policy defines the requirements for protecting the confidentiality, integrity and availability of the information systems and information assets of Hamurlabs. It is the top-level policy of the Hamurlabs Information Security Management System (ISMS) and is supported by the sub-policies, procedures and standards listed in Section 7.

Hamurlabs develops and operates HaROS (Hamurlabs Retail Operating System), a B2B SaaS platform providing WMS, OMS, PIM and Fulfillment capabilities to enterprise retail customers. Hamurlabs processes customer business data and personal data on behalf of its customers, primarily on Google Cloud infrastructure. The trust of our customers in the security of HaROS is a core business asset.

This policy is prepared taking into account:

• Law No. 6698 on the Protection of Personal Data (KVKK) and secondary regulations of the Turkish Personal Data Protection Authority, applicable to Hamurlabs A.Ş.;
• Regulation (EU) 2016/679 (GDPR), applicable to Hamurlabs BV and to processing carried out for customers established in the EU/EEA;
• ISO/IEC 27001 Information Security Management Systems standard, which Hamurlabs has adopted as its reference framework;
• Contractual security and confidentiality obligations undertaken towards Hamurlabs customers and partners.

This policy applies to both group entities — Hamurlabs Elektronik Hizmetler Yazılım ve Ticaret A.Ş. (Istanbul) and Hamurlabs BV (Leuven) — and to all locations, systems and personnel of the group, regardless of geography or business unit. It is binding on all employees, whether full-time, part-time, permanent or contractual, and on all interns and outsourced personnel. Third parties (service providers, suppliers, partners) who access Hamurlabs information must adhere to the general principles of this policy and to the security obligations set out in their contracts.

2. Policy Principles

Hamurlabs has adopted the following principles:

• Identifying risks to information assets and managing those risks systematically through a documented risk assessment and treatment process;
• Fulfilling the requirements of ISO/IEC 27001 and continually improving the ISMS;
• Complying with all legal and regulatory requirements regarding information security and data protection, including KVKK and GDPR;
• Providing the resources necessary to operate and maintain the ISMS, establishing controls, and evaluating opportunities for continuous improvement;
• Providing training that develops the technical and behavioural competencies of personnel and increases information security awareness;
• Protecting customer data entrusted to Hamurlabs at least to the standard committed in customer contracts and data processing agreements.

3. Roles and Responsibilities

3.1 Board of Directors and Executive Management

The Board of Directors approves this Information Security Policy, in which the information security strategy and roadmap are determined, and requires its implementation. Executive Management — consisting of the co-founders and, where appointed, the executives responsible for technology, finance and legal/compliance — is authorised by the Board to approve all standards, procedures and instructions prepared within the scope of this policy. Executive Management allocates the resources, authorities and responsibilities required for the establishment and operation of the ISMS, and periodically reviews the performance of the information security programme.

3.2 Information Security Manager (ISM)

The Information Security Manager owns this policy and all supporting standards, procedures and training activities, and acts as the source of advice and guidance regarding implementation throughout Hamurlabs. The ISM ensures that all personnel receive appropriate information security training, coordinates the handling of information security incidents, conducts periodic compliance audits, and reports to Executive Management on the state of the ISMS. Until a dedicated ISM is appointed, this role is performed by the executive responsible for technology.

3.3 All Personnel

All personnel are obliged to comply with all policies and procedures published under the ISMS, to report any security breaches or violations, and to protect the information assets they use. Asset and process owners are additionally required:

• To comply with the Information Security Policy and the procedures announced to them;
• To ensure compliance with information security requirements in the process documents, flow diagrams, instructions, manuals and forms they create for the management of their own processes and systems;
• To report any security breach, or any non-compliance with information security policies or procedures, to [email protected] without delay;
• Not to engage in activities that may adversely affect the operation of information systems or endanger information security;
• To notify the ISM of update or improvement requests regarding information security documents;
• To request access to information and corporate resources only within the scope of business need;
• To maintain and update the inventory of the assets they own, including assets containing personal data, and to ensure their classification and periodic review in line with the Data Classification Policy.

3.4 Third Parties

Information security requirements applicable to third parties providing goods and services to Hamurlabs, and to their personnel, are established through contracts and, where personal data is processed, data processing agreements. These include as a minimum:

• Acting in accordance with the Hamurlabs policies and security rules communicated through contracts or protocols;
• Not sharing Hamurlabs information or assets with others without Hamurlabs approval;
• Using the identities and credentials issued to them by Hamurlabs only in accordance with contracts and instructions;
• Reporting to Hamurlabs on the same day when third-party personnel working with Hamurlabs resign or are reassigned, so that their authorisations are revoked;
• Not copying data or software from Hamurlabs systems, and not recording, photographing or sharing data, without the prior approval of Hamurlabs;
• Accessing Hamurlabs systems only under the supervision and control of the Hamurlabs engineering organisation.

4. Policy Review and Maintenance

Information security policies are reviewed at least once a year, in parallel with asset and risk updates, to reflect the current risks faced by Hamurlabs information assets, and are updated as necessary to control new and changed risks. Any Hamurlabs employee may request that the ISM improve or change a policy; all such requests are evaluated by the ISM and, where they concern this top-level policy, submitted to Executive Management.

This policy is applied in conjunction with the Hamurlabs employment regulations and confidentiality undertakings signed by personnel. Hamurlabs is committed to taking the technical and organisational measures required under KVKK and GDPR for the protection of personal data.

5. Audit, Compliance and Non-Compliance

Each unit manager is primarily responsible for taking the necessary precautions and monitoring their area to ensure compliance with this policy. The ISM is responsible for periodic audits and for reporting to relevant parties on compliance with all published policies and procedures.

Violations of this policy may expose Hamurlabs to operational, contractual and reputational harm, and may result in administrative fines under KVKK or GDPR and in criminal liability under the Turkish Penal Code or applicable Belgian law. Violations also constitute a breach of the employment relationship and may result in disciplinary action up to and including termination of employment, and, where warranted, the initiation of civil or criminal proceedings.

6. Objectives

In order to sustain the reputation and reliability of Hamurlabs and the continuity of HaROS services with the least possible interruption, Hamurlabs Information Security aims to:

• Ensure the continuity and resilience of the HaROS platform and supporting information systems;
• Maximise personnel compliance through awareness and security training;
• Ensure full compliance with the security commitments in customer and supplier contracts;
• Minimise information security incidents and convert those that occur into opportunities for learning;
• Ensure that information is produced, accessed, stored and transferred in full compliance with applicable laws, including KVKK and GDPR;
• Implement current and effective technical security controls proportionate to risk.

All employees are responsible for contributing to the objectives listed in this policy.

7. Related Documents

• HL-ISMS-POL-02 Network Security Policy
• HL-ISMS-POL-03 User Access Control Policy
• HL-ISMS-POL-04 Data Classification Policy
• HL-ISMS-POL-05 Incident Management Policy
• HL-ISMS-PLN-01 Incident Response Plan