Data Breach Incident Response Policy

This Data Breach Incident Response Policy defines how NEBULONS AI detects, responds to, contains, investigates, and communicates a security incident affecting Customer Data or the NEBULONS AI Studio platform. It is incorporated into the Data Processing Agreement and satisfies the processor obligations of Article 33 of the GDPR and corresponding requirements under Turkey's KVKK.

A "Data Breach" is a security incident leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Customer Data or personal data processed by NEBULONS AI. Events affecting only NEBULONS AI's own internal data, or availability incidents with no data exposure, are handled under the same response machinery but do not trigger Customer breach notification unless legally required.

Detection operates continuously through centralised logging, automated alerting, and anomaly monitoring across infrastructure, network, and application layers. Any suspected incident is triaged immediately by the on-call security responder and escalated to the incident response team, which includes security engineering, infrastructure, legal, and executive representation. NEBULONS AI personnel are trained and contractually obliged to report suspected incidents immediately.

The first priority of response is containment: isolating affected systems, revoking compromised credentials or access, preserving forensic evidence, and preventing further exposure. Containment actions are chosen to protect Customer Data first; where containment and forensic completeness conflict, protecting Customer Data prevails. Root-cause investigation proceeds in parallel once exposure is stopped.

NEBULONS AI notifies the affected Customer of any confirmed Data Breach affecting that Customer's data without undue delay, and in any event within seventy-two (72) hours after NEBULONS AI becomes aware of the breach. The notification includes, to the extent known at the time: the nature of the breach, the categories and approximate volume of data and data subjects affected, the likely consequences, the measures taken or proposed to address the breach, and a contact point for further information. Where full details are not yet available, NEBULONS AI provides information in phases as the investigation progresses.

Where the breach is likely to result in a high risk to the rights and freedoms of natural persons, NEBULONS AI supports the Customer in notifying affected data subjects and supervisory authorities as required by law, providing the technical detail the Customer needs to meet its own regulatory deadlines. NEBULONS AI does not communicate publicly about a Customer-specific breach without coordinating with the Customer, except where legally compelled.

After containment, NEBULONS AI completes a documented investigation establishing the root cause, the full scope of affected data, and the effectiveness of the response, and implements corrective and preventive actions with owners and deadlines. Affected Customers receive a written post-incident summary for any breach affecting their data, including confirmation of deletion of any exposed copies under the timelines of the Data Retention and Deletion Policy.

NEBULONS AI runs tabletop exercises of this policy at least annually, measures response performance against these timelines, and updates the policy after every material incident and at least annually. The notification and cooperation obligations in this policy apply irrespective of the cause of the breach and survive termination of the Services for any incident discovered within the statutory notification window.