PRIVACY POLICY

Tenchijin Inc. (the "Company") establishes this Privacy Policy (this "Policy") as follows, in order to make an organizational effort to ensure the proper handling of Personal Information and Personal Data in accordance with the Act on the Protection of Personal Information (Act No. 57 of 2003; the "APPI").

1. Name of the Company, Address and Representative

• Name: Tenchijin Inc.
• Address: Nihonbashi 1-Chome Mitsui Building, 1-4-1 Nihonbashi, Chuo-ku, Tokyo 103-0027, Japan
• Representative: CEO Yasuhito Sakuraba

2. Compliance with Laws, Regulations, and Guidelines

The Company shall comply with the APPI, other applicable laws and regulations, and the guidelines established by the Personal Information Protection Commission and other relevant authorities to ensure the proper handling of Personal Information (meaning information that can identify a specific individual or contains an individual identification code; the same shall apply hereinafter) and Personal Data (meaning personal information constituting a personal information database, etc., organized systematically so that such Personal Information can be searched; the same shall apply hereinafter).

3. Scope of Application

This Policy sets forth the basic provisions applicable to business partners, job applicants, employees, and users of the Company's corporate website (collectively referred to as the "Persons"). If there are specific privacy policies for particular services (such as Tenchijin COMPASS, Tenchijin EO Market, etc.) or tailored for individuals located in specific regions (such as the European Economic Area (the "EEA") or the United Kingdom), such specific privacy policies shall take precedence over this Policy.

4. Acquisition and Use of Personal Information

(1) Proper Acquisition

When acquiring Personal Information, the Company shall publicly disclose or notify the Person of the purpose of use (including disclosure via this Policy). Furthermore, when acquiring Personal Information directly from a Person in writing (including electromagnetic records) such as in a contract, the Company shall specify the purpose of use in advance and acquire such information by lawful and fair means.

(2) Scope of Use

The Company shall use Personal Information only to the extent necessary to achieve the specified purposes of use and in an appropriate manner. The specific items to be acquired and the detailed purposes of use shall be set forth in the specific policy for each respective service.

(3) Prohibition of Inappropriate Use

The Company shall not use Personal Information in a manner that may encourage or induce illegal or unjust acts.

5. Items of Information to be Acquired

The Company may acquire the following information:

(1) Personal Information

• Information Regarding Business Partners
  • Name, department name, job title, office address, phone number, email address, and audio or video recordings of meetings (in which individuals can be identified), etc.
• Information Regarding Shareholders
  • Name, address, number of shares held, shareholder number, and other information required by laws and regulations to prepare the shareholder registry or to send notices to shareholders, etc.
• Information Regarding Applicants for Employment/Recruitment Activities
  • Name, address, contact information, employment history, resume, qualifications, and any other information contained in documents submitted for the selection process.
• Information Regarding Employees
  • Name, address, date of birth, gender, phone number, email address, employment history, family composition, bank account information for salary payments, Specific Personal Information ("My Number"), health examination results, employment insurance and social insurance numbers, etc.
• Information Regarding Event/Seminar Attendees
  • Name, email address, phone number, name of affiliated organization, etc.
• Information Regarding Individuals Making Inquiries
  • Name, email address, phone number, details of the inquiry, etc.
• Information Regarding Residents, Customers, etc. Provided by Entrusting Parties in Connection with Entrusted Business Operations
  • Name, address, etc.

(2) Personally Referable Information (information that cannot identify a specific individual on its own)

• Information Regarding Information and Communications Terminals
  • Website browsing history such as IP addresses, Cookies, device identifiers, browser types, and location data.

6. Purposes of Use

The Company shall use the acquired information within the scope of the purposes specified below for each category:

(1) Purposes of Use for Personal Information

• Personal Information Regarding Business Partners
  • For necessary business communications, performance of contracts, and business negotiations.
  • To provide information regarding the Company's new products and services (including sending email newsletters).
  • To provide invitations to seminars, exhibitions, and events.
  • For the management of partner information, as well as payment and invoicing operations.
  • To prevent, investigate, and respond to fraud, cyberattacks, and other potentially illegal or unauthorized activities.
  • For after-sales service, maintenance of provided services and systems, and the investigation and resolution of technical glitches.
  • To create anonymized or aggregated statistical data that does not identify specific individuals.
  • To analyze the acquired browsing history and usage data in conjunction with the Person's personal information held by the Company, and to use such analysis for marketing purposes.
• Personal Information Regarding Shareholders (including officers and employees if the shareholder is a corporate entity)
  • To exercise rights and fulfill obligations under the Companies Act.
  • To manage shareholders, including the creation of records required by various laws and regulations.
  • To provide information and communicate with shareholders.
• Personal Information Regarding Applicants for Employment/Recruitment Activities
  • To communicate with and provide information to applicants.
  • To conduct recruitment and selection activities (document screening, interviews, evaluations), and reference checks.
  • To complete onboarding procedures for successful candidates and to manage human resources and labor matters following their employment.
  • To formulate future hiring plans and create and analyze statistical data to improve recruitment activities.
  • To provide information on employment opportunities and recruitment-related events.
• Personal Information Regarding Employees
  • For business communications to employees.
  • To pay compensation (wages, bonuses, allowances, etc.), perform human resources and labor management, and provide welfare benefits.
  • For health management of employees.
  • To perform administrative tasks prescribed under the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (the "Numbers Act"), such as preparing withholding tax certificates for salary income and processing notifications relating to health insurance, employees' pension insurance, and employment insurance.
• Personal Information Regarding Event/Seminar Attendees
  • To operate and manage events.
  • To respond to inquiries.
  • To provide information on upcoming events and related services.
  • To create anonymized or aggregated statistical data that does not identify specific individuals.
• Personal Information Regarding Individuals Making Inquiries
  • To respond to inquiries.
  • To verify identity.
  • To send requested materials.
• Personal Information Regarding Residents, Customers, etc. Provided by Entrusting Parties in Connection with Entrusted Business Operations
  • To perform entrusted business operations in accordance with contracts with, and instructions from, the entrusting parties.
• Purposes of Use Common to All Personal Information
  • To comply with applicable laws and regulations, protect and exercise the Company's legal rights, and defend against legal claims.

(2) Purposes of Use for Personally Referable Information

• History Information, etc. of Site Visitors
  • To improve website usability.
  • For statistical analysis of usage status.
  • To provide optimized information (personalization).
  • For security measures, including the detection of unauthorized access.
  • To deliver behaviorally targeted advertising via ad distribution partners and to measure and analyze advertising effectiveness.
  • To comply with applicable laws and regulations, protect and exercise the Company's legal rights, and defend against legal claims.

7. Provision, Entrustment, and Joint Use of Personal Information

(1) Provision to Third Parties

The Company shall not provide entrusted Personal Data to any third party without obtaining the Person's prior consent, except in the following cases. However, regarding Specific Personal Information (including the My Number), the Company shall not provide it to any third party under any circumstances unless permitted by applicable laws and regulations, regardless of whether the Person has consented or not.

• When required by laws and regulations.
• When it is necessary for the protection of human life, body, or property, and it is difficult to obtain the Person's consent.
• When it is particularly necessary for the improvement of public health or the promotion of the sound development of children, and it is difficult to obtain the Person's consent.
• When it is necessary to cooperate with national government organs, local governments, or persons entrusted thereby in executing administrative tasks prescribed by laws and regulations, and obtaining the Person's consent may hinder the execution of such tasks.

[Exceptions to Third-Party Provision]

The provision of Personal Data in the following circumstances does not constitute the provision to third parties as described above:

• When the Company entrusts all or a part of the handling of Personal Data to an external party within the scope necessary to achieve the purpose of use (please refer to (2) below).
• When Personal Data is provided to specific entities to be used jointly with those entities (please refer to (3) below).
• When Personal Data is provided as part of a business succession resulting from a merger or other reasons.

(2) Entrustment of Business Operations

• The Company may outsource the handling of Personal Data to external service providers (including cloud infrastructure providers, AI service providers, payment agency service providers, and analytics support tool providers) within the scope necessary to achieve the purpose of use.
• The Company shall exercise necessary and appropriate supervision over such service providers. If a service provider is located outside Japan, the Company shall implement necessary protective measures in accordance with applicable laws and regulations after understanding the personal information protection system of the relevant country or region.

(3) Joint Use

The Company may jointly use Personal Data for events organized by executive committees for which the Company serves as the secretariat, or for seminars co-hosted with other companies, as described below. When joint use actually takes place, the Company shall, in accordance with applicable laws and regulations, individually and clearly state the fact of joint use, the items of Personal Data to be jointly used, the scope of joint users, the purpose of use, and the name of the individual or corporate entity responsible for management in advance on the official website or application form of each event prior to the commencement of such joint use.

• Items of Personal Data to be Jointly Used: Name, workplace or company name, contact information, event attendance history, questionnaire/survey results, etc.
• Scope of Joint Users: Hosting or co-hosting organizations of the relevant event and members of the executive committee (which will be individually specified on the official website, etc. of each event).
• Purpose of Joint Use: For the operation of the relevant event and the provision of information regarding products and services offered by member companies.
• Entity Responsible for Management: Tenchijin Inc. (Representative name and address are as specified in Section 1).

(4) Provision to Third Parties in Foreign Countries

When providing Personal Data to a third party in a foreign country (including provision associated with the entrustment or joint use described in the preceding sections), the Company shall comply with applicable laws and regulations and take necessary measures, such as obtaining the Person's prior consent after providing information regarding the name of the foreign country, the existence and nature of personal information protection laws and systems in that country, and the Personal Data protection measures implemented by the relevant third party, or verifying that the third party has established a system that complies with the standards based on the Act on the Protection of Personal Information. Furthermore, upon request from the Person, the Company shall provide information regarding the measures implemented by such third parties.

(5) Handling of Personally Referable Information

In the event that the Company acquires Personally Referable Information (such as cookies, user preferences, and browsing histories) from a third party and links it to Personal Data held by the Company, thereby acquiring it as Personal Data, the Company shall take procedures required by laws and regulations, such as obtaining the Person's prior consent.

In the event that the Company provides Personally Referable Information to a third party, and it is anticipated that the receiving third party will acquire it as Personal Data, the Company shall provide such information only after verifying that the relevant third party has obtained the Person's consent.

8. Cookies and External Transmission

A Cookie is a small text data file sent to the Person's browser when accessing a website. By using Cookies to record information about the Person's access, the website makes the next visit easier and more convenient. Similar technologies, such as pixel tags and unique identifiers used for local storage, are also utilized for the same purposes as Cookies in this section.

(1) Mechanism of Use

The Company's website utilizes Cookies and similar technologies to improve services, fix errors, analyze usage trends, and deliver advertisements. For these purposes, certain information is transmitted to the external services listed below (including management tools such as Google Tag Manager).

(2) Tools Used, Recipients, Transmitted Information, Purposes, and Opt-Out (Disabling Cookies)

The Person can choose to disable the use of Cookies through browser settings or by visiting the opt-out pages provided by each respective provider. The opt-out methods for primary services are as follows:

Name of External Recipient: Google LLC (Service Name: Google Analytics)

• Recipient Location: United States
• Purpose: Website analysis, advertising, and tag management via Google Tag Manager.
• Examples of Transmitted Information:
  • IP address
  • User ID within this Service (anonymous identifier that cannot identify individuals)
  • Data regarding viewed pages
  • User identifiers (cookies, device IDs, etc.)
  • Browser information, device information, browsing history, and viewed content
• Rules: Privacy Policy / Terms of Service
• Opt-Out: https://tools.google.com/dlpage/gaoptout?hl=en (Data collection can be disabled by using the Google Analytics Opt-Out browser add-on at the URL to the left or by disabling cookies through browser settings.)

Name of External Recipient: Google LLC (Service Name: Google Tag Manager)

• Recipient Location: United States
• Purpose: Centralized management and deployment of website tags implemented on the website.
• Examples of Transmitted Information:
  • IP address
• Rules: Privacy Policy / Terms of Service
• Opt-Out: This can be stopped by disabling cookies in browser settings.

Name of External Recipient: Microsoft Corporation (Service Name: Microsoft Clarity)

• Recipient Location: United States
• Purpose: Analysis of operating logs
• Examples of Transmitted Information:
  • Web browser, application, and device types and versions
  • Language settings
  • IP address
  • User identifier (an anonymous identifier that does not identify a specific individual)
  • Operating system
  • URLs of viewed pages
  • Interaction history (clicks, scrolls, mouse movements, etc.)
  • Date and time of browsing the Company's website
  • URL of the website visited immediately before the Company's website
  • Cookie information (tracking cookies, etc.)
• Rules: Privacy Statement / Services Agreement
• Opt-Out: https://account.microsoft.com/privacy/ad-settings/signedout (This can be stopped from the Microsoft opt-out settings at the URL to the left.)

9. Matters Concerning Security Control Measures

• The Company shall implement necessary and appropriate security control measures to prevent the leakage, loss, or damage of Personal Data and to ensure its proper management. Furthermore, the Company shall exercise necessary and appropriate supervision over employees and service providers (including subcontractors) who handle Personal Data.
• Specific details regarding security control measures for Personal Data are established internally in the Company's "Personal Information Protection Regulations" and "Specific Personal Information Handling Regulations." The primary aspects of these measures are outlined below:

Formulation of Personal Information Protection Regulations

• To ensure the proper handling of Personal Data, the Company has established internal regulations addressing compliance with applicable laws, regulations, and guidelines, as well as contact points for questions and complaints.

Preparation of Rules Governing the Handling of Personal Data

• The Company has formulated internal regulations that define handling methods, responsible managers, persons in charge, and their respective duties at each stage of the data lifecycle, including collection, use, storage, provision, and deletion/disposal.

Organizational Security Control Measures

• The Company appoints a manager responsible for the handling of Personal Data and clearly defines the scope of employees authorized to handle Personal Data and the specific data they may access. Additionally, the Company has established a reporting and communication system to notify the responsible manager immediately upon discovering any facts or signs of violations of the Act on the Protection of Personal Information or internal regulations.
• The Company regularly conducts self-assessments of Personal Data handling practices, and conducts audits by other departments or external experts.

Personnel Security Control Measures

• The Company provides regular training to employees regarding critical matters and precautions to observe when handling Personal Data.
• Provisions regarding the confidentiality of Personal Data are expressly incorporated into employment regulations and work rules.

Physical Security Control Measures

• In areas where Personal Data is handled, the Company manages employee access, restricts the bringing of electronic devices into designated areas, and implements strict measures to prevent unauthorized individuals from viewing Personal Data.
• The Company takes comprehensive measures to prevent the theft or loss of devices, electronic media, and documents containing Personal Data. Furthermore, when carrying such devices or media—including movement within offices—the Company implements measures to ensure that Personal Data cannot be easily deciphered.

Technical Security Control Measures

• The Company implements strict access controls to limit the scope of authorized personnel and the specific personal information databases they can handle.
• The Company introduces mechanisms to protect information systems handling Personal Data from unauthorized external access or malicious software.

Understanding the External Environment

• When storing Personal Data on cloud servers located in foreign countries (such as the United States), the Company implements appropriate security control measures based on an understanding of the personal information protection systems in that foreign country.
• Please note that for certain cloud services, the country where the data storage servers are located may not be publicly disclosed or identifiable.

10. Requests for Disclosure, Correction, Suspension of Use, etc., of Retained Personal Data

When the Company receives any of the following requests from a Person regarding Personal Data that the Company is authorized to disclose or modify (hereinafter referred to as "Retained Personal Data") in accordance with the APPI, the Company shall verify the identity of the requester and respond without delay.

(1) Requests for Disclosure

Scope:

Notification of the purpose of use, disclosure of Retained Personal Data, or disclosure of records relating to third-party provision.

Response:

The Company will disclose such information by delivering a written document or providing an electromagnetic record (by the method designated by the Person). If the relevant data does not exist, the Company will notify the Person to that effect.

(2) Requests for Correction, Addition, or Deletion ("Correction, etc.")

Scope:

When the content of the Retained Personal Data is inaccurate.

Response:

The Company shall conduct the necessary investigation and, based on the results, correct, etc., the Retained Personal Data as required.

(3) Requests for Cessation of Use, Erasure, or Cessation of Third-Party Provision ("Cessation of Use, etc.")

Scope:

When the data is handled beyond the scope of the publicly disclosed purposes of use; obtained through fraudulent means; handled in violation of the prohibition against inappropriate use; when the Company no longer needs to use the data; when a serious data breach has occurred; or when there is a risk that the rights and interests of the Person may otherwise be harmed.

Response:

The Company shall suspend the use, etc., of the data to the extent necessary to rectify the violation. However, if executing the request requires unreasonable costs or is otherwise extremely difficult to implement, and alternative measures can be taken to protect the rights and interests of the Person, the Company shall implement such alternative measures.

[Important Notes Regarding Requests]

• The Company may not be able to fulfill requests if the Company is not obligated to do so under the APPI or other applicable laws and regulations. In such cases, the Company shall notify the Person of the decision along with the specific reasons.
• A processing fee of JPY 1,000 (including tax) per request will be charged for requests regarding the disclosure of Retained Personal Data, notification of the purpose of use, or disclosure of third-party provision records. (Payment must be made via bank transfer to the Company's designated account, and any transfer fees shall be borne by the Person).
• For detailed procedures or any questions regarding requests under this Section, please contact the inquiry contact specified in Section 12 below.

11. Additional Jurisdiction-Specific Provisions

For specific jurisdictions, such as residents in Europe (EEA and the United Kingdom) (GDPR), individual policies (e.g., GDPR Privacy Policy) shall take precedence.

12. Contact Information for Inquiries

If you have any questions, concerns, or complaints regarding the Company's handling of Personal Information and Personal Data, please contact the point of contact below:

Department in Charge:

Personal Information Protection Desk, Tenchijin Inc.

Address:

Nihonbashi 1-Chome Mitsui Building, 1-4-1 Nihonbashi, Chuo-ku, Tokyo 103-0027, Japan

Contact:

privacy@tenchijin.co.jp

Reception Hours:

Monday through Friday, 10:00 AM–12:00 PM and 1:00 PM–7:00 PM (JST, Japan Standard Time), excluding public holidays and the year-end/New Year holiday period.