DOCUMENT OWNER: Board of Directors

DOCUMENT NO: 2023/0112

VERSION NO: 1

REVIEW DATE: 2023/12

PUBLICATION DATE: 2024/03

PURPOSE AND SCOPE The purpose of this implementation plan is to outline the general principles of the Emergency and Business Continuity Plan, which details the conditions, methods, and procedures for fulfilling Ekmob Mobile Business Systems and Technologies' ("Ekmob") obligations to its customers and third parties in emergencies and unexpected situations. The Business Continuity Plans are prepared to create a safe environment for Ekmob employees, customers, and company resources (technology, equipment), to be prepared for extraordinary situations, to define the actions to be taken during and after incidents, and to ensure the continuation of processes with minimal interruption.

Emergency: Any unforeseen situation that prevents Ekmob from performing its activities for 24 hours or longer and necessitates the decision to carry out its functions in a different office environment, such as fire, earthquake, flood, terrorist activities, or information system disruptions.

Emergency Coordinator and Assistant: The Emergency Coordinator (Company General Manager) ensures the implementation of the emergency plan and manages the emergency teams and critical process teams. The Emergency Coordinator Assistant (Company Technology Department Manager) deputizes for the Emergency Coordinator.

Emergency Management Committee: Supports the Emergency Coordinator in the coordination and decision-making process. Responsible for creating a Crisis Desk, managing customer and press relations during crisis and recovery activities, and providing communication support to personnel and customers. The committee comprises the Emergency Coordinator, Assistant Coordinator, and Finance Department Manager.

Rescue, Security, and Administrative Affairs Team: Responsible for the initial intervention in the affected environment, first aid, evacuation of the building based on the severity of the disaster, protection of all assets, administrative services, and execution of the Building Emergency Plan. This team is formed by the Emergency Management Committee to serve the Company. They also handle office renovation tasks, establishing a temporary office environment, repairing or reconstructing the damaged area, and transitioning personnel from the temporary to the newly established work environment.

Information Technology Team: Responsible for solving hardware, software, and other information system issues in the affected environment and preparing the information systems infrastructure for backup office environments. This team is formed by the Ekmob Technology Department within the scope of SLA and serves the entire company.

Critical Processes: Operational activities that must continue in the company even during an emergency.

IMPLEMENTATION

The Emergency and Business Continuity Plan is prepared to provide a management framework for events that may interrupt normal operations. The plan aims to ensure the continuation of Ekmob's activities with minimal disruption and loss in all emergency situations, from minor incidents to major disasters. Therefore, while the most comprehensive plan is prepared, only certain sections may be used when needed, and the entire plan can be activated if necessary. The plan is based on two different categories and management plans

Emergency Plan: Includes immediate measures to ensure the safety of employees, physical environment, and infrastructure in the first minutes and hours following events that hinder the company’s normal operations.

Business Continuity Plan: Activities to recover products, processes, and services that would cause significant financial, customer relationship, legal, and image loss due to the interruption of the company's normal operational activities during an emergency and unexpected situation.

Emergency and Business Continuity Management

The goal of Emergency and Business Continuity Management is to make critical operations functional at a level acceptable to the customer as quickly as possible. This plan assumes a maximum inactivity period of two days in the worst-case scenario and aims to reach the desired business continuity level within a maximum of 15 working days after the event. Following an event, the strategy will be based on the following objectives:Protecting personnel and addressing bodily losses,Identifying and assessing the risk and its extent,Evaluating the emerging issues and consequences,Activating temporary operations as quickly as possible,Mobilizing internal and external communication channels.

Business Continuity Policy

The company's Business Continuity Policy is to continue meeting customer needs under the most adverse conditions. Operations and services aim to be carried out by giving the highest value to the safety of employees, the health of the public and employees, and the protection of the environment and property. The Emergency Coordinator, appointed by the Board of Directors, is responsible for implementing, updating, testing, and coordinating all preparations of the Emergency and Business Continuity Plan. The master copy of this plan is kept by the Emergency Coordinator and made accessible to all personnel. All plans and procedures within the framework of Business Continuity, as well as other training documents and information, are shared with relevant units and teams.

Information System Backup

In an emergency, the company’s general headquarters located in Istanbul Yıldız Technopark, equipped with the necessary infrastructure, will be used as an alternative center to keep the company’s information systems infrastructure and applications operational. Additionally, the Justwork office space within Meydan AVM in Istanbul is kept ready for emergencies.

Communication

Necessary communication lines are established for all remote connections, including alternative communication channels with Ekmob's customers and employees, tested for functionality, and ensured continuity. In case customers cannot reach the General Management or Online Platforms, they can communicate via the backup phone lines established at Ekmob's Justwork office.

Communication with Customers

In case of an interruption in business continuity and activation of business continuity plans, it is the responsibility of the Sales Team and the Success Team to inform and communicate with customers. Notifications to customers will include details on how transactions will continue, access to the alternative location, contact information, etc.

Revision and Testing

The Emergency and Business Continuity Plan is kept up to date through periodic tests conducted with the participation of business units. Emergency teams conduct planned emergency tests once a year and inform the Emergency Management Committee of the results. Regular exercises are organized to test the plan.

Impact of Emergency on the Counterparty and Termination of Activities

There may be situations where communication with customers cannot be established or obligations arising from contracts with customers cannot be fulfilled due to emergency and unexpected situations. The Emergency and Business Continuity Plan aims to ensure the continuation of the company's activities with minimal disruption and loss, continuing to meet customer needs under the most adverse conditions, and conducting company operations and services with the highest value given to employee safety, health, and the protection of the environment and property. Thanks to all the measures taken and the established infrastructure, the continuity of the company’s activities is planned. However, if despite the actions taken, the Board of Directors decides that the company cannot continue its activities due to the emergency and unexpected situation, customers and employees are informed, and necessary actions are taken in collaboration with customers.

Emergency Effects and Termination of Activities

General Principles: The Emergency Plan includes immediate measures to ensure the safety of employees, physical environment, and infrastructure in the first minutes and hours following events that hinder the company’s normal operations. The following actions are taken within this scope:

• Evacuation and calling emergency services,

• Closing and securing the location,

• Damage assessment and first aid,

• Ensuring transportation,

• Communication.

Threats such as fire, earthquake, bomb threat, kidnapping and terrorist attacks, storm/flood/snow, public movement and workplace violence, building occupation, power outage, and postal attacks are reasons for activating the emergency action plan. The main purpose of the Emergency Plan is to take measures to ensure the safety of personnel in situations requiring intervention. The company keeps ready the first aid health equipment that may be needed during or after an emergency. The organization and execution of processes such as tracking emergency training (First Aid-Fire, etc.) and preparing the Emergency Risk Analysis File are the responsibility of the Board of Directors. This team is the first to assess the disaster and its impact on the company and report to the Emergency Coordinator. The Emergency Coordinator then announces the situation to company personnel through the company communication chain. Depending on the threat, personnel evacuation is ensured, and basic first aid is provided to the necessary personnel with the company’s first aid equipment until professional first aid teams arrive at the scene.

All company personnel are responsible for following the directives of the Emergency Coordinator in possible situations. After ensuring the security of the incident site, the Emergency Coordinator makes a general assessment of the situation and informs the relevant parties about whether daily operations can continue at the incident site and coordinates with the Emergency Management Committee if necessary. Senior Management may decide to continue daily operations at an Alternative Location, considering the magnitude of the incident.

IT Emergency Plan In emergencies that directly or indirectly affect the operation of Information Technology Systems and result in the decision to restore computer systems at an alternative location, causing interruption, such as fire, earthquake, flood, terrorist activities, and robbery, the Ekmob Technology Unit provides services within the scope of SLA to ensure the continuation of critical processes. Company personnel and teams must act in accordance with their specified roles and responsibilities.The Emergency Coordinator is responsible for keeping the plan and its annexes up to date. The Emergency Management Committee can meet at least once a year and whenever necessary to ensure the plan is up-to-date. After updating, the company personnel are informed.

Control of Emergency Action Process

The Emergency Coordinator is tasked with managing the intervention in incidents with the potential to turn into a crisis. This intervention is made at a tactical and strategic level. This person is responsible for making all decisions and ensuring all external communications.The Emergency Coordinator is responsible for managing crisis situations that could damage the company's image or reputation and incidents resulting in death or serious injury and representing the corporate identity. In case the main building is unusable or a central interruption occurs in the IT system, the Emergency Coordinator is responsible for conveying the incidents to Ekmob within the scope of SLA. The Emergency Coordinator:

• Approves the Business Continuity Management strategies to be followed in a crisis.

• Evaluates the importance and risk level of any incident and makes the final decision on the implementation of the company's action plan.

• Ensures the proper announcement of the prepared Business Continuity Policy.

• Approves the emergency intervention to be made by the Emergency Management Committee.

The Emergency Coordinator Assistant takes on these responsibilities in the absence of the Emergency Coordinator.