Handling of Personal Information

■Disclosure of Matters Concerning Retained Personal Data, etc.

ａ）Name of the business operator handling personal information

Vitabrid Japan Inc.
5-3-1 Akasaka, Minato-ku, Tokyo
Representative Director, CEO

b) Purpose of use of all retained personal data

Category	Purpose of Use
Personal information regarding private customers	For operations (including login management and communication and announcements to customers) necessary for the services provided by the Company to its customers (the "Company's Services") For the settlement and billing of the fees for the Company's Services, and the credit decision of customers and collection of receivables Assisting in data entry and otherwise enabling customers to smoothly use the Company's Services To respond to inquiries regarding the Company's Services and the Company To provide information on services and products suitable for customers To take measures against illegal or unjust use of the Company's Services (including acts that violate the terms of the Company) To provide information on the Company's Services and other products, services, events, or campaigns, etc., provided by the Company, affiliates of the Company, and business partners (implementation of methods such as calls, emails, mailing of catalogs and leaflets, and advertising (including advertising that is optimized for customers), etc.) and to conduct sales activities To conduct questionnaire and marketing surveys and analyses To utilize for the improvement of the Company's Services, and research and development, etc., of new products and services To publish reviews, experiences, and other comments from customers regarding the Company's Services on websites, email magazines, and advertising media, etc. To provide information to administrative organs, etc., in accordance with the relevant laws and regulations o provide the customer's personal information to third parties for the purposes listed in (1) through (11) above in accordance with the provisions in the c) below For other purposes ancillary to the purposes of use above
Personal information regarding business partners	To confirm the details of an order (communication record, etc.) and carry out other procedures necessary for a transaction
Personal information regarding the Company's shareholders	(1)To implement the procedures required by the Companies Act and other laws, regulations, and guidelines, etc. (2)For the operation of the Company's business
Personal information regarding the Company's employees	For personnel and labor management, and management of operations, health, and security of employees
Personal information regarding job applicants for the Company	To contact job applicants and manage the Company's recruitment operations
Specific personal information	To use as prescribed in the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (Act No. 27 of 2013)

The Company will not collect sensitive personal information of an individual without prior consent of the individual.

ｃ）Transfer of personal data to third parties

The Company will not transfer personal data to third parties without the prior consent of the individual who is the subject of such data, except in the following cases. The Company may transfer information including personal data to third party advertisement distributors for the purpose of delivery of advertisements by such distributors. Please confirm the details in "Cookies, Access Logs and Delivery of Advertisements by Third Party Advertisement Distributors."

• • If the transfer to a third party is made in accordance with the relevant laws and regulations;
• • If the transfer to a third party is necessary for the protection of the life, body, or property of an individual, and it is difficult to obtain the individual's consent;
• • If the transfer to a third party is particularly necessary for the improvement of public health or the promotion of sound growth of children and it is difficult to obtain the individual's consent;
• • f the transfer to a third party is necessary for the Company to cooperate with a national government organ, local government, or persons entrusted by such organs or governments to perform the duties prescribed by the relevant laws and regulations, and the Company determines that obtaining the individual's consent is likely to interfere with the performance of those duties
• • If a court, public prosecutor's office, police, bar association, consumer affairs bureau, or a similar organization requires the disclosure of the personal information; or
• • If the transfer to a third party is otherwise permitted by the relevant laws and regulations.

ｄ）Contact information for inquiries or complaints regarding the handling of retained personal data:

Contact for personal information at Vitabrid Japan Inc.
5-3-1 Akasaka, Minato-ku, Tokyo 107-6337
Email address: privacy@vitabrid.co.jp

ｅ）Certified personal information protection organizations

Currently, there are no certified personal information protection organizations of which the Company is a member.

ｆ）Procedures for responding to requests for disclosure of retained personal data or records provided by third parties

With respect to the retained personal data held by the Company, the Company will respond to requests from the person who is the subject of the personal data or their agent for requests regarding the notification of the purpose of use, disclosure (including disclosure of records regarding transfer to third parties), correction, addition, or deletion of details, suspension of use, erasure, and suspension of any transfer to third parties ("Requests regarding Disclosures") as follows.

1） Contact information for Requests regarding Disclosures

For Requests regarding Disclosures, please contact the inquiry desk for personal information indicated above.
*If you wish to make a request for disclosures by electronical means, please let us know. We will comply with your request in principle.

2） Procedures for Requests regarding Disclosures

• After receiving your request, we will send you the prescribed request form from the Company, titled "Request regarding Disclosures of Retained Personal Data."
• Please send the completed request form, a document confirming the agent's status if the request is to be made by an agent, and a postal money order equivalent to the specified fee (only in the case of a notice of the purpose of use or a request for disclosure) to the inquiry desk for personal information indicated above.
• Upon receipt of the above request form, we will inquire into approximately two items (e.g. telephone number and date of birth) of the data subject’s personal information registered with the Company for identity verification.
• Our response shall, in principle, be made in writing (sealed mail) to you.

*Please note that we may not be able to comply with your request due to restrictions imposed by relevant laws, regulations, and guidelines.

3） Materials confirming the agent's status upon requests via agents

If the person requesting disclosure is an agent, please enclose materials proving the agent's status and the identity of the agent. The registered domicile information included in each item of proof must include identificatory information up to the level of the prefecture of the agent’s domicile, and subsequent information must be anonymized. Please also send each material without any personal identification numbers, or anonymize all applicable numbers.

• Materials proving the status of an agent

  ＜For an agent who is authorized by an individual to make a request regarding disclosure on their behalf＞
  ・Power of attorney from such person (original document)
  For a legal representative of a mino
  ＜For a legal representative of a minor＞Any one of the below:
  ・Certified copy of the family register
  ・Certificate of residence (indicating the relationship with the minor)
  ・Other official documents through which the authority to legally represent such minor can be confirmed
  ＜For a legal representative of an adult ward＞Either of the below:
  ・Certificate of registered matters concerning guardianship registration
  ・Other official documents through which the authority to legally represent such adult ward can be confirmed

• Materials proving the identity of the agent

  ・Driver's license
  ・Passport
  ・Insurance certificate for a health insurance (with the identification numbers for the insured blacked out upon submission)
  ・Certificate of residence

4） Fees for requests for notification of purposes of use, and disclosure of retained personal data or records regarding transfer to third parties

JPY 1,000 per request
(If you are sending your request in paper form, please enclose a postal money order with the request form. If you would like to make a request through other means, we will consult the payment method with you upon such request. The prescribed fee will also be charged for non-disclosure and non-notification of the purpose of use.)

ｇ）System for the handling of personal information and details of the measures taken

1） Formulation of basic policy

To ensure the proper handling of retained personal data, the Company has formulated its Personal Information Protection Policy with regard to "compliance with relevant laws, regulations, and guidelines" and "inquiry desk for of inquiries and complaints."

2） Establishment of rules relating to the handling of personal data

The Company has established regulations for personal information protection concerning handling methods, responsible persons or persons in charge and their duties, etc., for each stage of collection, use, retainment, transfer, and deletion and disposal of personal information.

3） Measures for organizational security management

• In addition to appointing a person responsible for the handling of retained personal data, the Company specifies the employees handling retained personal data as well as clarifying the scope and status thereof, and maintains a system for the escalation of facts or signs of violation of laws or regulations concerning handling of information to the person in charge.
• The Company conducts periodic self-inspections of the handling status of retained personal data as well as audits conducted by other departments and external parties.

4） Measures for personal security management

• The Company provides regular training to its employees on matters requiring attention with regard to the handling of retained personal data
• The Company stipulates matters concerning confidentiality of retained personal data in the rules of employment.

5） Measures for physical security management

• The Company controls the entry and exit of employees and restricts devices to be brought into areas where retained personal data is handled, and takes measures to prevent unauthorized persons from viewing the retained personal data.
• The Company takes measures to prevent theft or loss of devices, electronic media, and documents that are used in handling retained personal data, and also takes measures to prevent easy identification of the retained personal data when transporting such devices or electronic media including upon transfer within the Company's premises.

6） Measures for technical security managemen

• Access controls are implemented to limit the number of persons in charge and the scope of personal information database, etc., to be handled.
• We have introduced a mechanism to protect the information systems that handle retained personal data from unauthorized external access or software

7） Understanding the external environment

The Company uses a cloud service for the management of personal data. Since personal data may be managed in the State of California, the United States, the Company has implemented security management measures with an understanding of the system for the protection of personal information in the State. For an overview of the relevant foreign country's personal information protection system, please visit the following website.

Results of a survey on foreign legal systems by the Personal Information Protection Commission:
https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/?fbclid=IwAR3un2kuCi9gSFQXeJrOCYFuaZkPKmcSez4MyslJM1hZlTtc-Z1ApfqpRPA

Systems for protection of personal information in the United States:
https://www.ppc.go.jp/files/pdf/USA_report.pdf

Systems for protection of personal information in the State of California, United States:
https://www.ppc.go.jp/files/pdf/california_report.pdf

■Cookies, Access Logs and Delivery of Advertisements by Third Party Advertisement Distributors

ａ）Use of cookies

Cookies help us to store the usage history and input data sent between the browser and the server as a file on the customer's computer when a web page is viewed. The websites provided by the Company (the "Company Websites") may use cookies to enhance the information and services provided and to make the Company Websites more convenient to use.
The Company Websites do not obtain information enabling the identification of individuals through cookies. Customers can reject cookies by changing the browser settings, but in such cases, the Company Websites may not be fully utilized.

The Company Websites use cookies for the purposes below.

• To provide customized services for each customer by referring to the stored customer registration information when the customer logs in to the authentication service.
• To provide customized services for each customer based on the customer's interest and usage status on the Company Websites.
• To display the most appropriate advertisement on another company's website based on the customer's interest and usage status on the Company Websites.
  

The Company Websites may send the cookie information of the following customers to third party companies that provide advertising services. With regard to the third party services to which information are transmitted, the names and services of the service provider, the contents of the user information to be transmitted, and the purpose of use of the information to be transmitted, etc., are as follows. Details about the use of these cookies, information obtained by cookies, procedures for opt-out (right to refuse the use of cookies) and the privacy policies of respective companies can be found at the following URLs.

ｂ）Access log

The Company records information about the customer's access to the Company Websites in the form of access logs. The Company uses these logs for aggregation and analysis for the purpose of service improvement, as well as for investigating the cause of problems that may occur.

ｃ）Delivery of advertisements by third party advertisement distributors

The Company uses advertising distribution services provided by third parties. The Company Websites may provide part of a customer's attribute information (which may include personal information such as email addresses and telephone numbers) to the following third party advertisement distributors in order to display more appropriate advertisements to customers in the said advertisement distribution services. The information obtained by these third party advertisement distributors, the details regarding the handling of the information, and the procedures for disabling the distribution of advertisement can be found at the following URLs.