Information security policy

Information Security Policy

This policy is documented, announced, and understood by all employees who have access to information and information systems at Studio Kipo. The policy is approved by the Manager and applies throughout the organization and includes:

• Ensuring the confidentiality of information,
• Ensuring the integrity of information,
• Ensuring the availability of information,
• Achieving accountability of information

Scope of Information Security Management System

Objectives:

• Ensuring continuity of business processes;
• Minimizing risks to information security causing losses or damages to the company, its clients, partners, and other stakeholders;
• Minimizing the extent of losses or damages caused by breaches in information security;
• Informing employees of their responsibilities and duties regarding information security;
• Ensuring compliance with regulatory and contractual requirements.

The implementation and compliance with the information security policy aim to prohibit:

• Using the organization's information and systems without authorization or for purposes unrelated to its activities;
• Removing equipment or information from the organization's offices and production facilities without authorization;
• Unauthorized copying of information and software;
• Compromising passwords (e.g., by recording or distributing them);
• Using personal information for business purposes unless authorized;
• Falsifying evidence in the event of an incident.
• Making pornographic/inappropriate, discriminatory, or offensive statements that may be illegal (e.g., using email or the internet);
• Distributing illegal materials (e.g., with indecent or discriminatory content).

Internal Information Security Organization Policy

The management conducts a policy to coordinate all activities in the organization for implementing and maintaining protection measures.

Asset Management Policy

The policy applies to employees, contracting parties, consultants, temporary workers for the company, and others, including third-party personnel. This policy applies to all information equipment, owned or used by Studio Kipo.

The company's policy on asset use aims not to impose restrictions contrary to the established corporate culture of openness and trust, but to protect Studio Kipo's employees, partners, and the company itself from illegal and damaging actions, whether deliberate or unconscious.

Human Resource Security Policy

Studio Kipo's human resource security policy is mainly focused on recognizing the need to ensure information security by adequately defining responsibilities and training.

Policy for Developing, Implementing, and Maintaining Information Systems

Studio Kipo's policy on developing, implementing, modifying, and maintaining information systems is based on the principle of preemptive risk assessment of changes, including upgrading existing and deploying new system elements, separating the test environment from the operational information system, and planned maintenance of the entire information system.

Incident Management and Information Security Improvement Policy

In order to reduce risk and the costs arising from incidents, Studio Kipo has developed and implemented an incident management policy aimed at developing and implementing procedures and tools for effectively addressing weaknesses and breaches related to information security. The measures include continuous monitoring, response, assessment, improvement, and overall management of weaknesses and incidents.

License Policy

The organization's policy is created with the purpose of complying with all copyrights of computer software, as well as the terms of software licenses to which it is a party. The organization takes all necessary actions to prevent the copying of licensed software by users, as well as the use of associated documentation in the organization's offices or elsewhere, unless expressly permitted under the license agreement with the licensor. Employees are prohibited from using the software in a manner that does not comply with the licensing agreement, including providing or receiving software or fonts from clients, contractors, users, and others.

Copyright Protection Policy

Studio Kipo's copyright protection policy fully complies with the Copyright Law and related rights.

Personal Data Protection Policy

Studio Kipo's personal data protection policy fully complies with the Personal Data Protection Act.

Studio Kipo collects personal data solely for the purpose of regulating labor relations with its employees. The information is not reused for purposes incompatible with the original ones.

The information that Studio Kipo may collect includes data from personal documents, health records, phone and fax numbers, email addresses, etc. Explicitly prohibited is the collection of information that:

• reveals racial or ethnic origin;
• reveals political, religious, or philosophical beliefs, membership in political parties or organizations, associations with religious, philosophical, political, or trade union purposes;
• relates to health, sexual life, or the human genome.

Studio Kipo will not sell, lease, or trade any personal information obtained from its employees or subcontractors.

The designated responsible employees processing personal data are required to treat the information as confidential.

Measures have been taken for the physical and logical protection of personal data, and access rights to them have been restricted.

Every employee whose data is concerned ("data subject") has the right to access their data and request their correction.

Conclusion

The information security policy is disseminated to third parties who have access to the organization's information and systems.

The information security policy is regularly reviewed based on an established process.

The information security policy is revised to take into account changing circumstances.

Any employee who believes there is abuse of this policy in the organization must notify the Security Officer.

Any employee found to have violated this policy is subject to disciplinary action.

The Manager of Studio Kipo declares full commitment to the processes of development, maintenance, and improvement of the systems.