サステナビリティ

SUSTAIN-
ABILITY

Basic Policy for Personal Information Protection

As an entertainment company that contributes to society, the Company recognizes the importance of appropriate handling and protection of personal information and has established a personal information protection policy. Our executive officers and employees will work together to comply with this and will do everything possible to protect personal information and the rights and interests of individuals.
Specifically, we collect and use personal information in an appropriate manner according to the Act on the Protection of Personal Information, Japan Industrial Standards (JIS)Personal Information Protection Management System―Requirements, and other relevant laws and regulations.

Management Method of Personal Information

In order to manage personal information appropriately, the Company manages personal information at data centers (collective term for buildings specialized for the installation and operation of Internet servers and equipment for data communication, land, mobile, and IP phones, etc.) in Japan.

Registration in the PrivacyMark System

The Company was granted the right to display “PrivacyMark” by JIPDEC, which means the Company is a business entity with an established system of taking appropriate protection measures for personal information according to the JIS Q 15001:2017 Personal Information Protection Management System.

Formulation of Basic Policies for Information Security

The Company has formulated basic policies for information security measures for the purpose of ensuring the safety of the Company’s internal information assets and contributing to smooth business execution.
Specifically, a manager for control and management of information security was assigned, and under the manager’s instructions, we formulated the basic policy for information handling, established information security regulations, created a system to respond to problems and accidents with information security, and formulated a basic policy for the provision of education on information security measures to each employee.

Network Security Management System

The Company has established a management system and stipulated implementation procedures to appropriately manage the internal network and protect internal information resources from security breaches such as unauthorized access from outside of the Company and virus infections. And under management of the information control manager, the Company engages in design, operation, and management to secure the safety of the internal network.

Management System of Technology Security

Under management of the information control manager, the Company implements the measures listed below for security of the programs to operate internal information by use of all computers, mobile devices including tablet terminals and smartphones, and cellular phones used at the Company (hereinafter, referred to as “Information System”) as well as for the security of the Information System to manage internal information resources and storage media.

1. Setting of access authority to internal information resources in consideration of the confidentiality classification of information set forth based on internal standards at the Company and carrying out audits, etc. of access authority setting information
2. In regards to access to internal information resources stored in the Information System or storage media, creation of an access authorization system, ensuring the control of access by using individual IDs, passwords, an entry and exit control system, locks, and keys, and implementation of periodic inspections and monitoring to confirm appropriate access control
3. Selection of an appropriate contractor to protect the Information System from virus infections, creation of a protection system, and implementation of anti-virus measures for information terminals used by executive officers and employees
4. Establishment of an emergency response policy in case of emergencies such as the discovery of unauthorized access to information terminals and occurrence of problems such as virus infections

Physical Security Measures

For the purpose of protecting information terminals and network devices that comprise the information network system primarily from damage or theft and protecting internal information assets of the Company by this means, the Company has built a management system and implements physical security measures for the introduction, installation, and operation method of information devices such as entry and exit management.

Thorough Provision of Security Education

The Company provides e-learning for security on a regular basis to allow all employees including temporary staff members to acquire knowledge for information security at the necessary level for work, to raise the security awareness of employees, and to increase the information security level of the Company as a whole.

Policy for the Handling of Connections with External Networks

In order to prevent leaks of and unauthorized access from outside of the Company to internal information, the Company has stipulated a handling method when connecting the internal network to an external network system comprised of external personal computers, mobile devices, servers, cloud servers, etc. Under management of the information control manager, the network is designed in detail and operated for connecting with external networks according to the following rules.

1. Security measures such as the use of firewalls must be implemented. When a standalone computer of the Company is connected to an external network, measures to prevent unauthorized access from the outside by using the standalone computer as a security hole must be implemented.
2. Executive officers and employees authorized to access the internal network from outside of the Company must be limited. More advanced identity authentication such as the use of one-time passwords must be used in particular when executive officers and employees connect to the internal network by remote access and when those who are not executive officers or employees of the Company access the Company’s internal network with permission due to participation in a Company project.
3. Access authority granted to those who are not executive officers or employees of the Company due to the need to access the internal network of the Company for reasons such as participation in Company projects must be limited to the absolute necessary level for work.
4. Response when a problem occurs to the network such as unauthorized access to the network from inside or outside of the Company must be decided.

Comprehending Factors Related to the External Environment

The Company will execute appropriate security and safety protocols when storing personal information in foreign countries, in accordance with the regulations provided by legal administrations of the relevant country, such as the Personal Information Protection Commission in Japan, after having comprehended the system for the protection of personal information in the country where such information is retained.