KVKK Compliance

• Data controllers established in Turkey and companies processing personal data in Turkey • Employers processing employee data (HR processes) • Businesses collecting customer/visitor data (CRM, web, camera, call center) • Organizations sharing data with third parties (cloud, outsourcing, agencies, call centers) • Companies needing KVKK–GDPR bridge in multinational structures

1) Personal data inventory and process map • Data categories, purposes, retention periods, recipient groups • Data flows (web, CRM, HR, security/camera, suppliers) 2) Privacy notices and legal basis framework • Obligation to inform texts (customer, employee, visitor, etc.) • Separation of areas requiring explicit consent • Policy sets: privacy, cookie, data security, access authorization 3) VERBIS preparation and registration process (if required) • Determination of registration scope • Alignment of inventory with VERBIS fields • Establishment of post-registration update discipline 4) Retention–destruction policy and periodic destruction • Determination of retention periods according to legislation and business needs • Destruction methods and periodic destruction schedule • Destruction records and evidence system 5) Technical and organizational data security measures • Access control, authorization, logging, backup, encryption (at applicable level) • Authority matrix, training, procedures, internal audit checklists • Supplier security assessment 6) Data breach and complaint processes • Incident response plan and internal notification flow • Risk assessment and record system • Response templates and process for complaint applications 7) Supplier/processor contracts and operations • Contract provisions for data processor relationships • Sub-processor management and responsibility matrix • Audit rights, document submission, breach notification clauses

• KVKK gap analysis and compliance roadmap • Data inventory + process map + retention periods matrix • Privacy notices and explicit consent framework (forms/templates) • VERBIS preparation and registration support (according to scope) • Retention-destruction policy + periodic destruction plan + record set • Technical-organizational measures checklist + action plan • Training & awareness + audit-ready "KVKK file"

• Data inventory and processing activities map • Privacy notices + explicit consent forms + policy set • VERBIS data set (if required) and update procedure • Retention-destruction policy + periodic destruction plan + destruction record templates • Technical-organizational measures checklists and evidence set • Breach response plan + incident record template • Supplier contract annexes and control checklists • Audit-ready KVKK compliance file