Basic Policy on Information Security

COPRO-HOLDINGS. Co., Ltd. and its subsidiaries (the “Group”) recognize that protecting information assets from all threats is one of their most important management priorities in earning the trust of customers and ensuring the stable and sustained growth of their business.
To achieve this, the Group has established the following Basic Policy on Information Security and declares that all employees, including members of management, will comply with and implement it.

This Policy aims to enable the Group to appropriately protect all information assets related to its business activities against all threats, including negligence, accidents, disasters, and crime, fulfill its social responsibilities, as well as maintain and strengthen the trust of its customers and business partners.

This Policy applies to all business processes, information assets, and information systems under the Group’s control, as well as to all officers, regular employees, contract employees, temporary staff, and contractors who have access to them (collectively, “All Employees and Others”).

The Group has established an information security management structure under the responsibility of senior management, with clearly defined roles and responsibilities. It also remains informed about its information security status and maintains a structure that enables swift decision-making and implementation of measures.

The Group takes organizational, personnel, physical, and technical security control measures to ensure the confidentiality, integrity, and availability of information assets and strives to prevent unauthorized access, leakage, loss, damage, and other security issues involving those assets.

All Employees and Others comply with information security-related laws and regulations, guidelines and other norms established by the Government, and security requirements under contracts with customers and business partners.

The Group regularly provides All Employees and Others with education and training to deepen their understanding of the importance of information security and enable them to handle information assets appropriately.

If an information security incident occurs or signs of an incident are detected, the Group promptly seeks to identify the cause, minimize damage, and prevent recurrence. It also takes strict action against employees who violate this Policy or related regulations in accordance with its rules of employment.

The Group regularly reviews this Policy and related regulations and continuously improves them in response to changes in social conditions and technology, fluctuations in the business environment, and other factors.