Privacy Policy

Policy for European Union member countries, Iceland, Liechtenstein, Norway, and United Kingdom

This Policy applies to the Processing of the Personal Information of the data subject(s) who is located or resides in European Union member countries, Iceland, Liechtenstein, Norway, and the United Kingdom that relates to the provision of goods or services to such data subject, or the monitoring of activities by such data subject in European Union member countries, Iceland, Liechtenstein, Norway, and the United Kingdom. Please refer to these Principles for matters relating to the Processing of any Personal Information not described in this Policy. The Company is the Data Controller relating to the obligations set out in these Principles and this Policy.

1. Legal Basis for Processing

The legal bases for the Company’s Processing of the Personal Information (in this Policy, “Personal Information” means the information defined as Personal Data in the GDPR (the General Data Protection Regulation ((EU) 2016/679) or the UK GDPR (the GDPR incorporated into the laws of England under the European Union (Withdrawal) Act 2018 and revised under the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) (the GDPR and the UK GDPR are hereinafter collectively referred to as the “GDPR”)) under the GDPR are as set out in the following table.

Purpose of Use	Legal Basis
Invitation and/or communication of the services including events, seminars and surveys	● In the case of direct marketing using email or other methods that are determined to require consent: Consent ● If the above is not applicable: It is necessary to perform Processing for pursuing legitimate interests (such as causing customers to know the Company’s products, services or market strategies).
Delivery of newsletters, publications, newspapers, seasonal greetings, etc.
Improvement of the Company’s website	● In the case of the collection of data from customer’s terminals through cookies other than strictly necessary cookies, or other similar technologies: Consent ● If the above is not applicable: It is necessary to perform Processing for pursuing legitimate interests (such as improving the Company’s websites and keeping them in optimal condition).
Notification of arrival of the visitor at the Company’s Offices to the person visited and gatekeeping at office entrances	It is necessary to perform Processing for pursuing legitimate interests (such as managing information of a visitor at the Company’s Office for the safety of such visitor or security of the Company).
Handling of the exercise of shareholders’ rights, implementation of various measures for shareholders, and other shareholder management	It is necessary to perform Processing for pursuing legitimate interests (such as shareholder management under the Japanese Corporation Act and other various laws and regulations including handling of the exercise of shareholders’ rights).
Operation and communication of job posting, recruitment and screening. Survey for the purpose of future recruitment activities. Personnel database after enrollment. Use as personnel database after enrollment.	It is necessary to perform Processing for pursuing legitimate interests (such as smooth recruitment and securement of better human resources).
Handling of inquiries, requests, complaints, etc.	It is necessary to perform Processing for pursuing legitimate interests (such as appropriate handling of inquiries, requests, and complaints for the provision of better products and services).
Other use that is deemed to be reasonably necessary for the Company’s business	It is necessary to perform Processing for performing contracts, or it is necessary to perform Processing for pursuing legitimate interests (if it is determined that consent is required, the Company will obtain consent by otherwise indicating that the legal basis for Processing is consent).

The Company sometimes obtains consent from the data subject for his or her Personal Information. In this case, unless it is clearly indicated in the above table that the legal basis for Processing is “consent” (Article 6, paragraph 1.(a) of GDPR),the legal basis for Processing is “it is necessary to perform Processing for performing contracts” (Article 6, paragraph 1.(b) of GDPR), or “it is necessary to perform Processing for pursuing legitimate interests” (Article 6, paragraph 1.(f) of GDPR. Please contact the contact information of the Data Protection Officer described below for the details of the balancing test of legitimate interests).

The data subject has the right to withdraw his or her consent at any time by the method separately designated by the Company when the Company obtains his or her consent. However, even if the data subject withdraws his or her consent, the withdrawal of consent will be effective prospectively, and does not affect the lawfulness of Processing performed based on his or her consent before the withdrawal of consent. If the data subject objects to direct marketing, he or she can refuse any communication sent by using electronic messages in accordance with the instructions indicated in the electronic messages.

2. Transfer of Personal Information to Foreign Countries

If the Company transfers Personal Information to areas other than European Union member countries, Iceland, Liechtenstein, Norway, or the United Kingdom, the Company will take appropriate protection measures, except for transfers made by a method separately notified to the data subject(s), by relying on the adequacy decision in the countries where an adequacy decision is adopted (Article 45 of GDPR), or by executing the standard data protection clauses approved by the European Commission (Article 46, paragraphs 2.(c) and 5 of GDPR) with the party receiving the Personal Information in other countries. Please contact the contact information of the Data Protection Officer described below if the data subject wishes to receive a copy of the documents relating to those protection measures.

3. Rights of Data subject

The data subject has the following rights.

-
To acquire information regarding the Processing of the Personal Information: The data subject(s) has the right to acquire all necessary information regarding the acts of Processing of his or her Personal Information performed by the Company from the Company (Articles 13 and 14 of GDPR).
-
To access the Personal Information: The data subject has the right to acquire confirmation on whether his or her Personal Information is Processed or not from the Company, and if such Processing is performed, he or she has the right to access the Personal Information and certain related information (Article 15 of GDPR).
-
– To correct or delete the Personal Information: The data subject has the right to cause the Company to correct his or her inaccurate Personal Information without undue delay, and the right to cause the Company to complete his or her incomplete Personal Information (Article 16 of GDPR). If certain conditions are satisfied, the data subject has the right to cause the Company to delete his or her Personal Information without undue delay (Article 17 of GDPR).
-
To restrict the Processing of the Personal Information: If certain conditions are satisfied, the data subject(s) has the right to cause the Company to restrict the Processing of his or her Personal Information (Article 18 of GDPR).
-
Data portability of the Personal Information: If certain conditions are satisfied, the data subject has the right to receive the data of his or her Personal Information in a structured, generally available and machine-readable form, and the right to transfer such data to another Data Controller without interference from the Company (Article 20 of GDPR).
-
– To object to the Processing of the Personal Information: The data subject has the right to object to the fact that the Company will rely on the legitimate interests of the Company (or a third party) as the legal basis for Processing his or her Personal Information that affects his or her right (Article 21, paragraph 1 of GDPR) . Specifically, the data subject has the right to opt out of direct marketing or profiling performed by the Company for direct marketing at any time (paragraphs 2 and 3 of the same Article).
-
Not to be a target for automated decision-making: If certain conditions are satisfied, the data subject has the right not to become a target for automated decision-making (decision-making in which no human is involved) that legally affects or materially affects such data subject (Article 22 of GDPR).
-
The data subject has the right to lodge a complaint about the Processing of his or her Personal Information by the Company with the data protection supervisory agency in the member country where he or she resides or works, or an alleged infringement occurs (Article 77 of GDPR).

Please contact the contact information of the Data Protection Officer described below if a data subject exercises the rights described above. For the purpose of verifying the identity of the data subject, it may be necessary to obtain specific information from the data subject. The Company may contact the data subject to obtain further information relating to his or her requests to expedite the measures to be taken by the Company.

4. Contact Information of Agent and Data Protection Officer

The contact information of the Company’s agents and the Data Protection Officer is as follows.

Agent in European Union member countries, Iceland, Liechtenstein, and Norway
mailplanit.legal
PLANIT // LEGAL
Jungfernstieg 1, 20095 Hamburg, Germany
Agent in the United Kingdom
londontmi.gr.jp
TMI Associates London LLP
Citypoint, One Ropemaker Street, London, EC2Y 9SS
Data Protection Officer
dpofficedentsu.co.jp

Last updated: May 31, 2023