Grounded in a foundation of compliance and ethical values, Olive Young establishes internal standards and strengthens its voluntary compliance system.

OLIVE YOUNG Code of Conduct

Olive Young has established a Code of Conduct to guide proper behavior and ethical decisions in its relationships with customers, shareholders, partners, and the global community, and to play a vital role in social and economic progress. We will actively carry out ethical management, based on the Code of Conduct which reflects CJ's management philosophy, to ensure sustainable growth in the global market and become a respected and trusted company.

• 

  Our promise to customers

  We are committed to delivering ethical and honest ONLYONE products and services to our customers and ensuring secure protection of their personal information.

• 

  Our promise to shareholders and investors

  We adhere to disclosure principles, strictly manage insider information and comply with and protect policies regarding confidential business information.

• 

  Our promise to CJ employees

  We seek to create a healthy and safe workplace, striving for a balance between respect for colleagues and protection of privacy.

• 

  Our promise to partners

  We compete fairly to reinforce trade order and deal with partners honestly for a mutually beneficial industrial ecosystem.

• 

  Our promise to global community

  We strive to realize social values through respecting human rights and protecting the environment, while respecting the international trade order and the relevant laws of each country.

Compliance Management Committee

In July 2019, Olive Young enacted and enforced the Compliance Management Committee regulations, and in August 2019, the CEO publicly expressed the company's commitment to compliance through a declaration to reinforce compliance management. The Compliance Management Committee holds an annual meeting to review and approve major matters in regards to compliance management.

ISO 37301 (Compliance Management Systems)

Olive Young acquired the ISO 37301 certification to internalize a culture of compliance throughout the company and build a compliance management system adhering to global standards. We continue to monitor changes in domestic and international regulations and advance our compliance management system by appointing compliance coordinators in each organizational unit.

OLIVE YOUNG Compliance Program

To promote ethical management and prevent legal risks, Olive Young operates a Compliance Program (CP) — a system designed to voluntarily ensure adherence to fair trade and related laws.

Manual and Training for Compliance

Olive Young has a compliance manual based on the applicable business laws, which is readily accessible to all employees at all times. Moreover, through the compliance training held periodically across the company within each department, we are striving to raise awareness of compliance and foster a right sense of compliance among employees.

Internal Monitoring System

The dedicated compliance team conducts continuous or periodic monitoring on departments and areas prone to ethical violations. In the event of an issue, the team responds promptly, analyzing the causes and results thoroughly and taking steps to prevent recurrence. The Compliance Management Committee reviews and approves disciplinary actions for violators, as identified by Internal Monitoring System, and also determines future plans and strategies of the compliance program.

Data Security and Privacy Policy

CJ Olive Young complies with both domestic and international data privacy regulations and has established Data Security and Privacy Policy that aligns with its business practices and corporate culture. It contains data security rules and 13 specific guidelines for practical use and is reviewed and revised regularly, at least once a year. Furthermore, the company makes the privacy policy readily accessible on each service website, enabling customers to review it any time. CJ Olive Young protects customers' personal data with the highest priority in accordance with its privacy protection principles.

Information Security Committee

Olive Young holds an Information Security Committee meeting once a year. Olive Young is enhancing its information security management system under the leadership of the Chief Information Security Officer (CISO) and the Chief Privacy Officer (CPO) within the Information Security Center.

ISMS-P Certification

Olive Young has obtained ISMS-P (Information Security Management System & Personal Information Protection) certification, a national standard in South Korea for information and privacy protection. Through the operation of its online platforms — including Olive Young Online Mall, Global Mall, and D.PLOT — the company continues to elevate its security posture and strengthen personal data protection efforts.

Scope Online shopping malls
(Olive Young Online Mall, Global Mall)

Validity period Until December 5, 2026

Simulated Training for Data Leak Incidents

To reinforce its cybersecurity response capabilities across the company, we conduct simulated training based on various security threat scenarios, at least once a year. Simulations raise awareness of security incidents among all employees and help them experience how to respond promptly in real-life situations.

Regular Simulation-Based Training

• 
  Simulated leak incident

  Various threat, scenarios are applied

• 
  Response training

  Relevant departments participate to experience the necessary response procedures

• 
  Training result analysis

  Areas for improvement are identified and integrated into future trainings

Incident Response Manual

We take thorough preventive and corrective security measures, develop and distribute internal incident response manuals for various types of incidents, such as intrusions, data leaks, and ransomware infections. The Response Manual for Personal Data Leak provides detailed procedures based on laws, and also remediation procedures to minimize the impact of data breaches, helping employees respond promptly and effectively.

Personal Data Breach Response Procedures

• 
  Security incident identification

  Identifying and reporting a security incident

• 
  Security incident response

  Reporting to regulatory bodies, analyzing the risks and taking corrective actions promptly

• 
  Follow-up measures

  Analyzing the cause and establishing measures to prevent recurrence

Data Security Trainings for Employees

We require all employees, including executives, to sign an information security pledge and conduct information protection training at least once a year. Additionally, personal information handlers receive specialized training that covers legal updates and personal information protection measures.