1.Basic Principles
Muroosystems Group (hereinafter referred to as the “Group”) operates both in Japan and overseas, conducting its business activities in accordance with the various laws and regulations of each region. In order to fulfill the trust placed in us by all stakeholders—including customers, business partners, and employees—the Group places the highest priority on ensuring data security and protecting personal information. Based on the following policy, we will promote unified efforts throughout the entire Group.
2.Scope of Application
This policy applies to all organizations, officers, and employees (including full-time employees, contract employees, part-time employees, temporary workers, etc.) who belong to the Group in Japan and overseas, as well as all individuals engaged in the Group’s business activities.
3.Compliance with Laws and Regulations
The Group respects and complies with relevant domestic and international laws and regulations (e.g., the Act on the Protection of Personal Information in Japan, GDPR), industry guidelines, and contractual obligations. We implement management measures that meet the requirements of each region. While setting common standards within the Group, we establish supplementary or additional rules and processes as needed in response to local legal requirements.
4.Basic Policies on Data Security
Protection of Information Assets
The Group develops and operates an Information Security Management System (ISMS) to ensure the confidentiality, integrity, and availability of all information assets it handles, including confidential information, critical business data, and personal information.
Based on risk assessments, we implement measures to reduce risks to an acceptable level and continuously improve these measures.
Establishment of Organizational Structure
Each site of the Group appoints an individual responsible for information security, ensuring consistent security measures throughout the Group, while also implementing supplementary measures tailored to local operational practices and legal requirements.
We conduct regular internal audits and external audits as necessary to inspect and evaluate the effectiveness of our security measures.
Education and Training
We provide regular education and training on information security to all employees to prevent incidents and accidents.
We also ensure that new hires and external service providers are informed of this policy and related regulations, requiring them to comply with these standards.
Incident Management
In the event of a security breach or violation, we promptly investigate the cause, take measures to prevent the spread of damage, and report to or notify relevant stakeholders as necessary.
We share the findings and lessons learned from any incident throughout the Group to prevent recurrence and continuously improve our security practices.
5.Basic Policies on Personal Information Protection
Acquisition, Use, and Provision
When acquiring personal information, the Group clarifies the purpose of use and obtains consent through appropriate means when necessary. The acquired personal information is used only within the scope of the obtained consent or as permitted by law.
When providing personal information to third parties, we comply with legally mandated procedures. If the individual’s consent is required, we obtain such consent in advance.
Security Control Measures
To protect personal information from risks such as unauthorized access, alteration, leakage, loss, or destruction, we implement both technical and organizational security measures.
When outsourcing operations that involve handling personal information, we enter into appropriate contracts with service providers and supervise them to ensure that personal information is adequately protected.
International Data Transfer
As the Group conducts business globally, we may share and transfer personal information across countries. Taking into account the legal standards of the destination country, we implement safeguards such as EU Standard Contractual Clauses (SCCs) or other appropriate measures to ensure a sufficient level of data protection.
Requests for Disclosure and Inquiries
We will respond sincerely and promptly to any requests from individuals regarding the personal information held by the Group—including requests for disclosure, correction, suspension of use, or complaints.
For inquiries concerning personal information protection, please contact us at hp-info@muroosystems.com.
6.Continuous Improvement
The Group will review and revise this policy and our security and personal information protection frameworks as necessary—taking into account internal and external audits, changes in societal and technological environments, and amendments to relevant laws and regulations in each country. Based on these reviews, we will improve and strengthen our rules and procedures to continuously enhance the Group’s overall security level and personal information protection standards.
October 30, 2018
Muroosystems Corporation
CEO Pan Zhongxin
