{"id":7359,"date":"2026-01-14T02:17:17","date_gmt":"2026-01-13T23:17:17","guid":{"rendered":"https:\/\/www.dcscustoms.com.tr\/information-security-and-data-protection-policy\/"},"modified":"2026-01-14T02:24:18","modified_gmt":"2026-01-13T23:24:18","slug":"information-security-and-data-protection-policy","status":"publish","type":"page","link":"https:\/\/www.dcscustoms.com.tr\/en\/information-security-and-data-protection-policy\/","title":{"rendered":"Information Security and Data Protection Policy"},"content":{"rendered":"

Information Security and Data Protection Policy<\/h3><\/div>
Click to Download<\/span><\/i><\/a><\/div>

Purpose<\/h4>\n

The DCS Information Security and Data Protection Policy outlines the measures and responsibilities required to protect the confidentiality, integrity, and availability of information within DCS.<\/p>\n

This policy aims to ensure full compliance with applicable data protection legislation and to create a reliable environment for the secure processing of personal, sensitive, and customer data.<\/p>\n

No provision of this policy may contradict applicable laws to which the company is subject.<\/p>\n

Scope<\/h4>\n

This policy is based on the control guidelines specified in the ISO\/IEC 27001:2022 International Information Security Management standard.<\/p>\n

It applies to all employees, contractors, consultants, third-party partners, and any other persons or organizations with access to DCS information systems or data.<\/p>\n

It covers all types of data\u2014electronic, physical, and verbal\u2014as well as all systems and processes used to manage, store, or transmit such data.<\/p>\n

All business processes and related procedures must be prepared, implemented, and audited in accordance with this policy.<\/p>\n

Definitions<\/h4>\n

Information Security: <\/strong>The practice of protecting information by reducing risks to its confidentiality, integrity, and availability.<\/p>\n

Information System: <\/strong>Includes all servers, clients, network infrastructure, data, and computing components owned or managed by the company. It also encompasses internal and external services such as internet access and email.<\/p>\n

Information Assets: <\/strong>In the context of this policy, this includes information systems, written documents, equipment, phones, portable computers, and stored data.<\/p>\n

Data Protection: <\/strong>Legal and regulatory measures to protect personal data against unauthorized access, use, disclosure, or destruction.<\/p>\n

Personal Data: <\/strong>Any information relating to an identified or identifiable individual, such as names, contact details, ID numbers, and financial information.<\/p>\n

Confidential Information: <\/strong>Proprietary information specific to DCS or its clients, including trade secrets, business strategies, and other sensitive data.<\/p>\n

Data Breach: <\/strong>A security incident resulting in unauthorized access to, disclosure, alteration, or destruction of data.<\/p>\n

Policy Statements<\/h4>\n<\/p>\n
4.1\u00a0\u00a0\u00a0 General Information Security<\/h5>\n

DCS is committed to protecting its information assets against unauthorized access, use, alteration, disclosure, or destruction. All employees are responsible for complying with information security policies and implementing necessary security measures.<\/p>\n

Information assets must be used solely for the conduct of company activities. Access to DCS information systems and data is restricted based on roles and job requirements; only authorized individuals are granted access to relevant information.<\/p>\n

Each information asset must have an owner identified in the asset inventory. The asset owner is responsible for maintaining the confidentiality, integrity, and availability of the asset. Users of information systems may only access information assets within the scope of permissions defined by the asset owner, and these permissions must be used strictly for their intended purpose.<\/p>\n

Authentication is required before access to sensitive systems or data is granted. Strong authentication methods such as multi-factor authentication (MFA) must be used.<\/p>\n

4.2\u00a0\u00a0\u00a0 Prohibited Actions<\/h5>\n<\/p>\n
User Account Restrictions:<\/h6>\n

Users may not attempt to bypass, disable, or deactivate any information security measures.<\/p>\n

Users must not directly or indirectly share their access credentials or allow others to use their access rights. For example, usernames and passwords must never be shared with third parties.<\/p>\n

Each user account is exclusive to the designated personnel, who are fully responsible for all access and actions performed using that account.<\/p>\n

Software Installation Restrictions:<\/h6>\n

Users may not install any software on company computers independently. If a user requires software installation, they must submit a formal request via their manager to the IT Department, clearly stating the need and justification.<\/p>\n

Requests will be evaluated by the IT Department and senior management. If approved, necessary licenses will be acquired, and software will be installed only by a System Support Specialist.<\/p>\n

Users are required to submit a list of all software installed (beyond the operating system) on their assigned devices to the IT Department annually for approval.<\/p>\n

4.3\u00a0\u00a0\u00a0 Data Protection Compliance<\/h5>\n

DCS commits to full compliance with ISO\/IEC 27001:2022 Information Security Management System Standard, the General Data Protection Regulation (GDPR) of the European Union, the Turkish Personal Data Protection Law (KVKK), and all relevant local legislation. Accordingly, personal data must be processed lawfully, fairly, and transparently.<\/p>\n

Personal data may only be collected and processed for clearly defined and legitimate purposes and must not be used in ways incompatible with those purposes.<\/p>\n

DCS will implement appropriate technical and organizational measures to ensure a level of security appropriate to the risks associated with processing personal data. All processes involving personal data must comply with this policy, the “Personal Data Protection and Processing Policy,” and the “Personal Data Deletion, Destruction, and Anonymization Policy.”<\/p>\n

4.4\u00a0\u00a0\u00a0 Data Collection and Use<\/h5>\n

DCS will collect personal data solely for legitimate business purposes or in compliance with legal obligations. Data subjects will be informed clearly and transparently about the purpose of data collection and how their data will be processed.<\/p>\n

Collected personal data must be accurate, complete, and up-to-date. Incorrect or outdated data must be promptly corrected or deleted.<\/p>\n

Personal data will be retained only for the duration necessary to fulfill the intended purpose or as required by relevant legislation.<\/p>\n

Details on the principles and procedures for processing personal data are further specified in the Personal Data Protection and Processing Policy.<\/p>\n

4.5\u00a0\u00a0\u00a0 Data Storage and Security<\/h5>\n

All data stored electronically or physically must be protected against unauthorized access, loss, corruption, or destruction using appropriate methods. This includes encryption, access controls, and secure physical storage.<\/p>\n

Personal data, confidential information, and other sensitive data types must be stored in compliance with security policies to ensure confidentiality, integrity, and availability. Encrypted storage methods are preferred for such data.<\/p>\n

To maintain data availability in case of data loss, system failure, or similar incidents, critical data must be backed up regularly. Backup procedures must be tested and configured to allow for rapid recovery.<\/p>\n

4.6\u00a0\u00a0\u00a0 Data Access and Confidentiality<\/h5>\n

Access to personal data and confidential information must be restricted to authorized individuals who require access for their job responsibilities. Role-based access control and necessary technical measures will be implemented.<\/p>\n

All employees are required to sign confidentiality agreements as part of their employment, acknowledging their responsibility to protect DCS\u2019s information assets.<\/p>\n

Employees must not share personal data or confidential information within or outside the company with unauthorized individuals under any circumstances. This obligation remains in effect even after termination of employment.<\/p>\n

4.7\u00a0\u00a0\u00a0 Data Sharing and Transfer<\/h5>\n

When sharing company data, personal data, or confidential information with third parties, data processing agreements, confidentiality clauses, and other suitable safeguards must be in place.<\/p>\n

International data transfers must fully comply with applicable data protection legislation. Appropriate technical and administrative measures must be implemented to ensure data security, and data should be transferred only to countries with an adequate level of protection.<\/p>\n

Principles and procedures related to the sharing and transfer of personal data are outlined in the Personal Data Protection and Processing Policy.<\/p>\n

4.8\u00a0\u00a0\u00a0 Data Disposal<\/h5>\n

Company data, personal data, or confidential information must be destroyed using appropriate methods once retention periods have expired or processing purposes are no longer valid. Destruction methods such as physical shredding, digital wiping, or data masking must ensure permanent irreversibility.<\/p>\n

Where data must be anonymized, identity-related information must be irreversibly separated, and the anonymization process must be carried out in accordance with legal requirements.<\/p>\n

Details regarding the disposal and anonymization of personal data are defined in the Personal Data Deletion, Destruction, and Anonymization Policy.<\/p>\n

4.9\u00a0\u00a0\u00a0 Password Security Measures<\/h5>\n<\/p>\n
Users are required to comply with the following password guidelines:<\/h6>\n<\/p>\n