Information Security Policy

The Pack Group Information Security Policy

1．Purpose

The Pack Group Information Security Policy sets forth the basic principles of information security for The Pack Group and establishes the foundation for the entire Group to appropriately protect and manage information assets based on a shared understanding of information security.

2．Basic Philosophy

The Pack Group regards information security as a key aspect of management aimed at realizing its corporate motto—Passionate and Dedicated to Our Partnerships—and the purpose of its existence—Mission to bolster social prosperity and create satisfaction through packaging. We consider ensuring information security to be a foundation that supports sustainable business activities. We aim to be a corporate group trusted by all stakeholders by appropriately protecting and managing information assets, as well as meeting both legal and regulatory requirements and society’s expectations regarding information security.

3．Definitions

The definitions of terms used in this policy are as follows:

（1）“The Pack Group” refers to THE PACK CORPORATION and consolidated subsidiary companies.
（2） “Board members and employees” refers to the directors, corporate auditors, corporate officers, advisors, consultants, and employees (including full-time employees, continuing employees, contract employees, temporary employees, part-time employees, and casual employees) of all companies within The Pack Group.

４．Scope

This policy applies to all board members and employees of The Pack Group. The Pack Group also expects its contractors, trading partners, and other business partners to understand the intent of this policy and cooperate accordingly.

５．Conduct Principles

We act in accordance with the following principles to appropriately manage and protect information assets:

（1）Protection of information assets
We implement human, organizational, physical, and technical security control measures to appropriately manage the information assets we hold and protect them from threats such as unauthorized access, information leaks, unauthorized alteration, loss, and destruction.

（2）Compliance with laws, regulations, and contracts
We comply with laws, regulations, rules, guidelines, contractual obligations, and in-house rules regarding information security and protection of personal information.

（3）Thorough risk management
We continually identify, analyze, and assess risks related to information assets and implement appropriate control measures in accordance with their importance. We also review the risk management structure in response to changes in the business environment and social conditions.

（4）Swift response to incidents
We strive to prevent information leaks, cyberattacks, and other information security incidents. We also respond swiftly and appropriately to any incidents to minimize damage and prevent their recurrence.

（5）Appropriate management of personal information and confidential information
Recognizing the importance of personal information and confidential information from our customers, trading partners, and other stakeholders, we appropriately acquire, use, store, share, and dispose of such information.

６．Information Security in the Supply Chain

We work with contractors, cloud service providers, and other business partners to reduce information security risks across the supply chain. We also conduct information security assessments and implement appropriate controls as necessary.

７．Education and Awareness

To enhance awareness of information security, we provide ongoing education and training to all board members and employees and strive to ensure that this policy and related rules are thoroughly communicated.

８．Promotion Structure and Continual Improvement

To ensure the effectiveness of this policy, we develop and maintain an information security management structure and promote information security activities across The Pack Group under the responsibility of top management. We also regularly assess the status of our information security management, verify its effectiveness, and pursue continual improvement in response to changes in the social environment and technology trends.

９．Whistleblowing System and Disciplinary Action

（1）Whistleblowing channels and protection of whistleblowers
For early detection and rectification of any actual or potential violations of this policy, The Pack Group has established its C Line internal and external (attorney-based) whistleblowing and consultation channels. These channels are intended to detect and rectify any improprieties or problems at an early stage. Furthermore, we handle all consultations in the strictest confidence and take every precaution to protect the privacy of whistleblowers so that they do not suffer any disadvantageous treatment from the Company.

（2）Disciplinary action
Board members and employees found to be in violation of this policy or related laws and regulations are subject to strict disciplinary action, including disciplinary dismissal. Furthermore, if any violation causes damage to the Company, the Company may take legal action and demand compensation for damages.

１０．Publication

This policy is communicated both internally and externally and published through the corporate website and other channels.

Naoki Nakamura, President and CEO
THE PACK CORPORATION
Date of enactment: October 1, 2026 (Ver. 1.0)