Information Security Policy

1. Purpose

BTS Bilişim Eğitim ve Danışmanlık Hizmetleri Ticaret Ltd. Şti. (“BTS”) regards the protection of the confidentiality, integrity and availability of the information assets it owns or is responsible for — within its corporate activities and the QMex products and services provided to its customers — as one of its fundamental responsibilities.

The Information Security Management System (“ISMS”) is operated in order to manage information security risks, support business and service continuity, reduce the impact of information security incidents, and protect information belonging to customers, employees, suppliers and other interested parties.

2. Scope and certification

The BTS ISMS covers the software development activities within the organisation's defined scope, together with the related information assets, business processes, information systems, employees and the interested parties from whom services are received.

BTS's ISO/IEC 27001 certification details:

3. Our information security principles

BTS is committed to:

• protecting the confidentiality, integrity and availability of information assets,
• managing access to information on the basis of business need and authorisation,
• systematically identifying, assessing and managing information security risks with appropriate controls,
• applying the measures needed to prevent and detect information security incidents and reduce their impact,
• maintaining information security measures that support business and service continuity,
• improving employees' information security awareness.

4. Management commitment

The top management of BTS commits to:

• providing the resources needed to operate the ISMS effectively,
• setting information security aims and objectives and reviewing them regularly,
• ensuring that information security risks are managed,
• complying with applicable legal, regulatory and contractual obligations,
• monitoring the effectiveness of the ISMS and continually improving it.

5. Our approach to the environment and global climate change

When assessing the internal and external issues that may affect the organisation's activities and its Information Security Management System, BTS takes into account the risks and impacts that climate change may create, together with the needs and expectations of interested parties on this subject.

Environmental impacts on business and service continuity, information technology infrastructure, the supply chain and related operations are assessed using a risk-based approach.

In line with the nature and scope of its activities, BTS regards combating global climate change, supporting environmental sustainability and promoting the responsible use of resources as part of its corporate responsibilities.

6. Legal and contractual compliance

The BTS ISMS is operated taking into account applicable legal and regulatory requirements, obligations arising from customer and supplier agreements, relevant sector requirements and the requirements of ISO/IEC 27001:2022.

In protecting personal data, the Turkish Personal Data Protection Law No. 6698 and, to the extent applicable, related data protection regulations including the GDPR are taken into account.

For detailed information on the processing of personal data, please see the Privacy Notice (KVKK & GDPR) and the Privacy Policy.

7. Continual improvement and review

The suitability, adequacy and effectiveness of the ISMS are assessed regularly through risk assessments, information security objectives, internal audits, management reviews, incidents, non-conformities and corrective actions.

BTS commits to the continual improvement of its Information Security Management System.

This policy is reviewed at least once a year and whenever significant organisational, technological, legal or operational changes occur that may affect the ISMS.

8. Reporting information security concerns

If you identify an information security vulnerability, suspicious activity or security incident relating to QMex products, the website or systems operated by BTS, you can send your report to info@bts-tr.com.

BTS evaluates good-faith security reports and carries out the necessary actions in line with its defined information security processes.