Data Breach Notification Policy

Purpose

This policy explains how Inflyze detects, assesses, records, mitigates, and reports personal data security breaches.

What counts as a data breach

A data breach may include unauthorized access, disclosure, alteration, loss, destruction, or exposure of personal data.

• Unauthorized access to user data, servers, or databases.
• Accidental disclosure of personal data.
• Data exposure caused by device loss, theft, malware, or ransomware.

Internal response

When a breach is suspected, the responsible team investigates scope, affected data, number of people affected, risk level, containment steps, and required notifications.

Notification obligations

Where required by GDPR, UK GDPR, KVKK, or other applicable laws, Inflyze notifies the relevant authority and affected users within the required timeframes.

Records and improvements

Incidents are recorded, reviewed, and used to improve security controls, staff training, procedures, and platform safeguards.