Information Security Policy

Last updated: 10 November 2026

1. Purpose

This policy sets out how Evreka protects the confidentiality, integrity and availability of the information it handles: its own, and that of its customers, employees and partners. It gives direction to Evreka’s Information Security Management System (ISMS), which is aligned with ISO/IEC 27001, and provides the framework for setting information security objectives.

2. Scope

The policy applies to all employees, contractors, interns and third parties with access to Evreka information or systems. It covers information in any form (digital, paper, spoken), the Evreka360 and WasteDashboard platforms, mobile and field applications, internal systems, offices and remote work, and the people, processes and suppliers that support them.

3. Management commitment

Evreka’s management is committed to:

• protecting information assets in line with business objectives and customer expectations;
• satisfying applicable requirements, including legal, regulatory and contractual obligations;
• providing the resources, roles and competence the ISMS needs;
• continually improving the ISMS and its effectiveness;
• communicating this policy to all personnel and making it available to interested parties.

4. Information security objectives

Objectives are set and reviewed at least annually by management, are measurable where practicable and are consistent with this policy. They cover the protection of customer and personal data, the availability of the platforms Evreka provides, the timely handling of security incidents and the security awareness of all personnel.

5. Principles

• Confidentiality: information is accessible only to those authorized to use it.
• Integrity: information and systems are accurate, complete and protected from unauthorized change.
• Availability: information and services are available when authorized users need them.
• Least privilege and need-to-know: access is granted only as far as the role requires.
• Risk-based approach: controls are chosen according to assessed risk.
• Security by design: security and privacy are considered from the start of every product, change and supplier relationship.

6. Roles and responsibilities

• Top management approves this policy, ensures resources and reviews the ISMS at planned intervals.
• The Information Security Manager maintains the ISMS, reports on its performance and coordinates risk assessment, incidents and audits.
• The data protection lead advises on and monitors personal data protection (KVKK, GDPR).
• Managers and team leads apply the policy in their teams and ensure personnel complete training.
• All personnel and contractors follow this policy and related procedures, protect assets, and report incidents and weaknesses immediately.
• Suppliers and partners meet the security and confidentiality requirements in their contracts.

7. Risk management

Evreka identifies, analyzes and evaluates information security risks through a documented risk assessment, applies a risk treatment plan and records the risk owners’ acceptance of residual risk. Assessments are repeated at planned intervals and after significant changes.

8. Controls

Controls are selected on the basis of risk, using ISO/IEC 27001:2022 Annex A as a reference, and are implemented through topic-specific policies and procedures. The main areas are:

• Organizational: defined roles, segregation of duties, asset inventory and classification, information transfer rules, supplier security, cloud services, project security, legal and contractual compliance and business continuity.
• People: screening, confidentiality and security terms in employment and contractor agreements, awareness and training, a disciplinary process, remote working and incident reporting.
• Physical: secured offices and access control, clear desk and clear screen, equipment protection, and secure disposal and media handling.
• Technological: access control and strong authentication, privileged access management, encryption, secure development and change management, vulnerability and patch management, malware protection, logging and monitoring, backup, and network security.

9. Legal, regulatory and contractual compliance

Evreka complies with the laws and contractual requirements that apply to it, including the Turkish Personal Data Protection Law (KVKK, Law No. 6698), the EU General Data Protection Regulation (GDPR) and customer contracts. Details on personal data are in our Privacy Policy and related notices.

10. Awareness and training

All personnel receive information security awareness training when they join and at least annually, supplemented by role-specific training where needed.

11. Incident management

All personnel and suppliers must report suspected or actual security incidents, personal data breaches and security weaknesses immediately. Incidents are logged, assessed, contained, resolved and reviewed for lessons learned. Where personal data is affected, Evreka notifies the competent authorities and affected parties within the legal deadlines. To report a security concern to Evreka, please use our contact page.

12. Business continuity and supplier management

Evreka maintains backup, recovery and business continuity arrangements for critical services and tests them at planned intervals. Suppliers with access to information or systems are assessed before engagement, bound by confidentiality and security requirements in their contracts, and reviewed periodically.

13. Compliance, audit and review

Compliance with this policy is checked through internal audits, management reviews and technical reviews. Violations may lead to disciplinary action or contractual consequences, in line with applicable law. Nonconformities are corrected and recorded, and the ISMS is improved continually. This policy is reviewed at least annually and after significant changes.