Information Security Policy

1. Purpose

Through advertising production, promotional support, media booking, online advertising management, consulting, and other work, the Company handles diverse information including customers' business information, advertising copy, production data, personal information, and transaction information. We consider appropriate protection of these information assets an important responsibility in maintaining customers' trust and providing stable services. This policy sets out the Company's fundamental information-security initiatives.

2. Scope

This policy applies to information assets handled by Company officers, employees, contractors, and others involved in Company business.

Information assets include paper documents, electronic data, email, data on cloud services, creative work, submission files, and information concerning contracts, quotes, and invoices.

3. Information Security Management Structure

The Company establishes an internal management structure and clarifies information-security responsibilities and roles to manage information assets appropriately.

For information needed for business, the Company appropriately manages responsible personnel, purposes of use, storage locations, and sharing methods, striving to prevent unnecessary viewing, sharing, or removal.

4. Internal Regulations and Operational Rules

The Company establishes rules for acquiring, using, storing, sharing, and disposing of information assets and applies them in a manner suited to actual operations.

The Company reviews these rules as working environments and services change, striving to maintain and improve its information-security standards.

5. Appropriate Handling of Information Assets

The Company handles information supplied by customers and information created or acquired through its work appropriately within the scope of business purposes.

• Customers' unpublished information, advertising copy, production data, and media information
• Information concerning inquiries, quotes, contracts, invoices, and related matters
• Information concerning online advertising management, access analytics, improvement proposals, and related matters
• Personal information and information relating to individuals

6. Access Permission Management

The Company strives to limit access to information assets to what is necessary for business. For cloud services, shared folders, advertising accounts, production data, and similar assets, permissions are reviewed or removed as necessary when personnel change or work ends.

7. Technical and Physical Security Measures

Necessary security measures are implemented to prevent unauthorized access, loss, leakage, alteration, destruction, and similar incidents involving information assets.

• Appropriate management of business devices, accounts, passwords, and related assets
• Antivirus measures and operating-system and software updates
• Permission management for cloud services and shared data
• Storage and disposal management for paper documents, recording media, and production data

8. Education and Awareness

The Company strives to educate and inform officers and employees so they understand the importance of information security and manage information appropriately.

The Company continually raises awareness of risks common in daily work, such as misdirected email, file-sharing settings, external service use, and password management.

9. Management of Contractors and Partners

The Company may share information with external contractors and partners, including designers, writers, photographers, printing companies, media companies, and advertising management partners, to the extent necessary for business.

In doing so, the Company strives to prevent information leakage and similar incidents by limiting shared information to the minimum necessary and requiring contractors to manage it appropriately.

10. Checks When Using External Services

When using external services such as cloud storage, advertising management tools, analytics tools, and communication tools, the Company considers business necessity and security. Service use and permission settings are reviewed as necessary.

11. Incident Response

If an information-security problem occurs, such as leakage, unauthorized access, loss, misdirected transmission, or alteration, the Company promptly assesses the situation and strives to prevent further damage and identify the cause. As necessary, the Company reports to and contacts customers, relevant parties, and supervisory authorities, and implements measures to prevent recurrence.

12. Compliance with Legal and Contractual Obligations

The Company complies with the Act on the Protection of Personal Information, the Act on Prohibition of Unauthorized Computer Access, the Copyright Act, other information-security laws and guidelines, and contractual confidentiality obligations. Information learned through business is managed appropriately according to customer contracts and nondisclosure agreements.

13. Continuous Improvement

The Company continually reviews this policy and its information-security initiatives and strives to improve them in response to changes in business activities, working environments, technology trends, and social expectations.

14. Contact

For inquiries concerning this policy and information security, please contact the following: