Special Information For EU Users
In order to strictly protect customers' information (hereinafter referred to as "EUPersonal Data"),TOBU TOP TOURS CO., LTD.(hereinafter referred to as "theCompany")is implementing the following measures.

1. Measures for protecting customers' EU Personal Data
(1) The Company will manage customers’ EU Personal Data appropriately.
(2) The Company has a security manager for each department that manages customer's
EU Personal Data, and the manager properly manages the customer's EU PersonalData.
(3) The data the Company acquires from customers is as follows:customer's name;e-mail address;

telephone number;address; and

credit card information
Each of the customer's EU Personal Data above is necessary for providing theservices
The Company may ask other questions for the purpose of providing customers withthe desired services. This shall be offered by the customer voluntarily including
the minimum necessary items.

(4) <For inquiries and consultation >Depending on the contents of inquiry and consultation (hereinafter referred to as"consultation"), the Company may notify third parties, such as transportation /accommodation facilities, of EU Personal Data of customers in advance with consent.
(5) <For application>
Depending on the type of service, the Company may notify third parties, such astransportation / accommodation facilities, of EU Personal Data of customers; forexample, when notifying the customer's name and other information needed forshipping and accommodation agencies.
(6) In order to strictly store customers' EU Personal Data, the Company has establishedinternal rules and has been conducting education for employees and audit related tothe protection of EU Personal Data on the regular basis.
(7) In the case where customers wish to inquire or modify their own EU Personal Data,
the Company will respond immediately upon confirming the customers' identification.
(8) On the Company's website, the Company may use "cookie" to provide better service.
"Cookie" is a function to store on the computer of the person who viewed the website.
Although it is possible to refuse receipt according to the settings of the browser, someof the services may not be available by this.
(9) The Company will comply with the laws and regulations applicable to customer's EU
Personal Data, and the Company will review and improve these efforts as necessary.
In connection with the occurrence of incidents, the Company may cooperate in thepublication of EU Personal Data due to the provision of data at the time of police
investigation and requests from relevant organizations.

2. The purpose of processing EU Personal Data acquired from customers< For inquiries and consultation >The Company will use EU Personal Data provided during inquiries and consultation forcontacting with customers. In addition, in the content of customer's inquiries andconsultation, the Company may use it within the necessary range for contact andconfirmation with the related organizations.
<For application>
For EU Personal Data provided at the time of travel application, in addition to using it
for contacting customers, the Company will use it within the range necessary for thearrangement and receipt of services provided by transportation and accommodation
organizations on customer's travel.
In addition, the Company may use customer's EU Personal Data at the Company anddealers in order to develop better travel products and inform customers about theinformation on travel products, as well as the damage insurance of each company whichis entrusted by each insurance company, and to provide incidental and related services.
Providing EU Personal Data is essential for fulfillment of the contract, and if customers
cannot provide EU Personal Data on their own judgment, provision of service tocustomers and so forth may be interfered and it may cause damage or loss.

3. For the conditions of handling of EU Personal Data
The Company shall deal with EU Personal Data only if the Company obtains consent
from the customer and in any one of the following cases.
(1) When handling is necessary for the performance of the contract where thecustomer is a party concerned (e.g., in the case where to notify customer’s informationsuch as address to the hotel to arrange a hotel designated by customer).
Or when handling is necessary according to customer's request before the contract isconcluded.
(2) When handling is necessary to comply with the legal obligation that the Company
shall abide by (When following information disclosure orders based on laws fromgovernment agencies, etc.).
(3) When handling is necessary to protect the serious interests of customers or otherindividuals(e.g., in the event that the life of customer or accompanying person falls
into a serious crisis due to an accident during the trip, provide customer’s oraccompanying person’s data to relevant organizations such as police and hospitals).
(4) When it is deemed appropriate to investigate, prevent, or take measures against
illegal acts or suspicious acts.

4. For the special categories of EU Personal Data
In order to provide services concerning customers' travels, and to manage the itinerary
for participation in special tours (extreme tour such as Antarctica, and climbing tours),
in principle, the Company shall obtain consent from the customer in advance, and collect,use, transfer customers’ special categories of EU Personal Data (health condition,physical characteristics, etc.) within the necessary scope of purpose for performing travel
agreement. The EU Personal Data shall not be processed other than for this purpose.
The customer may cancel such consent at any time. Even if the customer cancels theconsent, the Company may continue to proceed the customer’s data within the scopepermitted by GDPR, including but not limited to, the case necessary for the protecting
the customer’s life, body, and other significant interests,

5. For international transfer of EU Personal Data EU Personal Data may be stored inservers after they are transferred to the Company and outsourcing contractors, etc. inJapan.

6. For safety management measures
In order to properly manage the EU Personal Data of customers, and prevent fromleakage, loss or damage of EU Personal Data and so forth, the Company shall implement
technical and physical / organizational / personal safety management measures for them.
7. EU Personal Data provided by customers will be transferred only for the following

purposes based on consent of each customer. The customer may cancel such consent atany time.

If the customer cancels the consent, the customer cannot use the service

necessary for the information that the Company has collected or has used.
<For inquiries and consultation >In order to respond to customer inquiries and consultation, the Company may transfer
customer’s EU Personal Data to transportation and accommodation organizations(including organizations overseas) within the range necessary.
<For application>
The Company will transfer customer’s EU Personal Data to transportation andaccommodation organizations (including organizations overseas) within the range
necessary.
In addition, for the convenience of customers' shopping at the travel destination, etc., theCompany will transfer the customer's EU Personal Data to the organizations such as theduty free shop of the destination. In this case, the Company will relocate EU Personal
Data related to customer's name, and passport number sent by electronic method, etc.
The Company shall transfer customer's EU Personal Data to group companies andoutsourcing contractors, etc. that have subcontracted. The Company shall request proper
handling of the transferred EU Personal Data to the corresponding outsourcing
contractor, and the Company also shall properly manage it accordingly.
8. Customer's EU Personal Data will be kept for 2 years and then properly erased anddiscarded.
9. For the customer's rights Customers have the following rights regarding EU Personal
Data concerning themselves. Provided, however, even if the customer exercises one of
the following rights, the Company may continue to proceed the customer’s data within
the scope permitted by GDPR:(1) Right to request explanation of customer's EU Personal Data and relevant
information that the Company holds, and to request explanation of how to use such data;(2) Right to correct the incorrect EU Personal Data concerning customers withoutundue delay(3) Right to request deletion of EU Personal Data on customers without undue delay(4) Right to restrict handling of EU Personal Data concerning customers(5) Right to receive EU Personal Data provided by customers in a general format thatcomputer is readable, and the right to relocate (shift) the EU Personal Data to themanagement of other organizations without disturbing

(6) Right to object to public interest or handling for the interests of the Company or
third parties and handling for direct marketing for EU Personal Data of thecustomers(7) Pleases note that the customer may exercise the right to not undergo assessment /decisions that have serious impact including legal effects on individuals throughautomatic processing such as profiling etc. The Company does not perform profiling.
10. Contact
For inquiries regarding this matter, please contact the inquiry desk below.
TOBU TOP TOURS CO., LTD.
Compliance Office
Address:

1-1-2 Oshiage, Sumida-ku, Tokyo

E-mail: pd_contact@tobutoptours.co.jp