Information Security

Date of establishment: February 28, 2008
Date of revision: September 25, 2026

We believe that a corporation is supported by three elements: "its customers", "stakeholders including shareholders", and "its employees (all employees)." We conduct our business based on the belief that it is important to pursue the satisfaction of these stakeholders, avoid antisocial behavior, and stably maintain and sustain corporate activities while securing appropriate profits. 

Our top priority in any business area is to provide services that satisfy our customers, and our business goal is to provide these services on an ongoing basis. To achieve the goal, we recognize that an important role of security management is to prevent and reduce security risks and threats that impede the continued provision of our services. 

Based on this understanding, we have established an information security policy. By reliably implementing information security management, we will remain a company that earns greater customer satisfaction and trust from our customers, and further ensure the continuous and stable provision of our services.

We will establish a security management framework with clearly defined responsibilities and roles under the leadership of our executives, and strive to maintain and improve information security on an ongoing basis in line with actual circumstances, including advances in information technology, the development and maintenance of information systems, and the handling of information.

We will comply with laws, regulations, contractual requirements, and internal regulations related to information security.

We will provide officers and employees with ongoing education and training to enhance their awareness and knowledge of information security, and strive to ensure that they are fully aware of information security management.

We will strive to prevent information security incidents and, should any incident occur, will promptly prevent the damage from spreading, investigate the cause, and take necessary corrective measures, and strive to prevent recurrence.

We will take necessary actions, against officers and employees found to be in violation of our information security policy and/or internal information security regulations, in accordance with work rules and other internal regulation.

To address information security risks, including information leaks, unauthorized use, cyberattacks, and other information security risks, in addition to implementing technical measures, we continuously develop regulations and rules on information security, provide education and training officers and employees, and conduct regular inspections, and are working to raise security awareness.

In addition, we have been granted the PrivacyMark to strengthen our framework for protecting personal information, and undertake our continuous improvement activities. For the applicable operations and systems that handle credit card information, we conduct appropriate management and operation in accordance with Payment Card Industry Data Security Standard (PCI DSS), an international security standard.

In using new technologies such as generative AI, we give due consideration to confidential information, personal information, intellectual property rights, and others, and strive to use and manage these technologies appropriately by establishing usage rules, building an environment that takes security into account, and conducting education and awareness-raising activities.
Furthermore, to address threats such as cyberattacks and unauthorized access, we implement risk-based monitoring of systems and networks, vulnerability countermeasures and other security measures, and are working to protect our information assets. 

To promote these activities, we have established an internal Security Committee to evaluate the implementation status of information security measures and promote continuous improvement.
In addition, by reporting important matters related to information security to the Risk Management Committee and conducting the necessary deliberations, we strive to maintain and enhance information security under the company-wide risk management framework.