Information Security Policy
This is an English translation provided for convenience. In case of any discrepancy, the Turkish text prevails.
İmacyu Teknoloji San. ve Tic. Ltd. Şti.
Last updated: 14 October 2026
1. Purpose
İmacyu Teknoloji San. ve Tic. Ltd. Şti. adopts as one of its fundamental objectives the protection of the confidentiality, integrity and availability of information assets in the software and information technology services it provides.
This policy sets out İmacyu's general principles relating to information security.
2. Scope
The information security approach is applied, according to the nature of the relevant service, in respect of:
- The corporate website,
- ERP and CRM software,
- Cloud-based applications,
- Workflow management systems,
- e-transformation (e-documents) integrations,
- Software maintenance and support services,
- Technical access to customer systems,
- Activities carried out with business partners and authorised service providers
as set out above.
3. Fundamental Information Security Principles
Confidentiality: Information being accessible only to authorised persons.
Integrity: Data being protected against unauthorised alteration and corruption.
Availability: Authorised users being able to access the systems in accordance with the service and contractual terms.
Authorisation: System access being determined in line with duties and service needs.
Traceability: Security-related operations being capable of being tracked within the scope of the applicable technical and legal requirements.
4. Software and Application Security
In the software it develops, İmacyu aims to reduce the risks associated with unauthorised access, breaches of data integrity and security vulnerabilities.
The controls applied may vary in line with the software architecture, the operating environment, the technical infrastructure and the service agreement.
5. Security of Cloud Services
In software services provided in a cloud environment, the security of the application and of the hosting infrastructure is assessed according to the scope of the service.
The specific responsibilities relating to access management, maintenance, backup, data recovery and service continuity are determined in the relevant contracts.
6. Security of On-Premises Installations
In systems running on a server or in a data centre belonging to the customer, the responsibilities for infrastructure, network, operating system and physical security are assessed according to the parties' areas of control.
Where İmacyu additionally provides a system management or maintenance service, the obligations within the scope of that service apply.
7. Security of Technical Support
Remote or on-site technical support operations on customer systems are kept limited to authorised personnel and to the access required by the service.
The management of access permissions, personnel changes and, where necessary, the updating of access credentials form part of the information security processes.
8. Confidentiality of Customer Information
İmacyu makes it a principle to protect the confidentiality of the customer, employee, finance, production, sales, technical system and other commercial information it learns in its service relationships.
Confidential information is not disclosed to third parties other than under applicable legal obligations and contractual authorisations.
9. Backup and Data Recovery
The scope of backup and data recovery services is determined by the relevant product, infrastructure and service agreement.
Undertakings relating to backup frequency, retention period, restoration method and service continuity may be separately regulated in customer contracts.
10. Management of Security Incidents
The aim is to detect and assess information security incidents and to carry out the necessary response processes.
In personal data security breaches, the notification obligations in the relevant legislation and the requirements for cooperation between the parties are taken into account.
11. Third-Party Service Providers
İmacyu may make use of authorised third-party providers for the purpose of carrying out the relevant services.
In this context, confidentiality, information security, data access and the relevant contractual obligations are assessed.
12. Continuous Improvement
The measures relating to information security may be reviewed taking into account technological developments, risks, customer needs and changes in legislation.
13. Updating of the Policy
This policy may be updated according to changes in service and security needs.
14. Contact
İmacyu Teknoloji San. ve Tic. Ltd. Şti.
Web: www.imacyu.com
E-mail: [email protected]