Information Security Policy
1. Purpose of the Policy
We consider it a social responsibility as a company to appropriately handle and protect our information assets. Therefore, our company aims to manage and operate information security by preventing the loss, theft, unauthorized use, alteration, and leakage of all information assets related to our business, recognizing the importance of information security.
2. Definition of Information Security
Information security is defined as the maintenance of the confidentiality, integrity, and availability of information assets. Information assets refer to the information owned by our customers and our company. The scope of information includes all forms of data, not limited to electronic equipment and media such as software and hardware within information systems but also encompasses audio, text, images, and video in all formats. Confidentiality of information assets means that only those with authorization to access the information assets can do so, while those without authorization cannot. Integrity of information assets means that information assets are maintained accurately and completely. Availability of information assets means that information assets are available when needed, with the assurance of authenticity, reliability, and auditability, and can be utilized through established methods.
3. Scope of Application
This policy applies to all our business activities and all officers, employees, and personnel of cooperating companies involved in these activities.
4. Organizational Structure for Information Security
To achieve information security, our company establishes an organizational structure.
We establish an Information Security Committee as the highest decision-making body for information security issues. An officer or executive officer will serve as the chairman of the Information Security Committee. We appoint an Information Security Manager responsible for establishing, introducing, operating, monitoring, reviewing, and improving the information security management system. The Information Security Manager will be appointed by the Information Security Committee. To ensure that information security is appropriately managed and operated by each department, we appoint Information Security Managers for each department. Information Security Managers will be selected by the Information Security Manager and appointed by the Information Security Committee. To monitor the proper realization, management, operation, and necessary improvements of information security, we appoint an Information Security Audit Manager as the responsible person. The Information Security Audit Manager will be appointed by the Information Security Committee.
5. Operation and Management of Information Security
To maintain proper operation and management of information security, we operate and manage information assets as follows:
Authorization for access to information assets is granted only to those who require it for their job responsibilities. Information assets are managed reasonably and appropriately in accordance with laws and contracts. Continuous monitoring is conducted to ensure that information assets are managed properly. All our officers, employees, and personnel from cooperating companies are required to regularly undergo information security training. In the event of incidents related to information security or encounters with threats that may lead to incidents, we will promptly respond, strive to maintain business continuity, analyze the situation and causes, and implement necessary measures to prevent recurrence.
6. Protection of Personal Information
To appropriately handle and protect personal information, we operate and manage personal information as follows:
Personal information is collected, used, and provided only within the scope and period necessary for business purposes, employment, and specific tasks related to personnel management. We take reasonable security measures in accordance with laws, guidelines from relevant government agencies, and standards to continuously maintain and improve the security of personal information. We promptly and sincerely respond to complaints, requests for correction, disclosure, and other requests related to personal information.
7. Awareness
This policy will be thoroughly communicated to all officers, employees, and personnel from cooperating companies. Violations of this policy or related information security provisions will be subject to disciplinary action in accordance with employment rules or contracts.
8. Maintenance
We will review and maintain this Information Security Policy annually or as necessary.
Androbo Group Representative
Yukihiro Tamura