PERSONAL INFORMATION PROTECTION POLICY
Rakuten STAY, Inc. (hereinafter referred to as "us," "we," "our" or the "Company") sets the following
policy on the handling of personal information concerning customers (hereinafter referred to as the"Policy") in relation to the lines of services, among the services offered by the Company, that consistof "Vacation STAY," a minpaku (private-home stay) booking service, and other services incidental
thereto (hereinafter referred to as the "Minpaku Services"). Please note that the policy applicable inrelation to services other than the Minpaku Services can be found athttps://corp.stay.rakuten.co.jp/privacy-en.html.

1. Purposes of use and retention of personal information(1) Purpose of use of personal information
The purposes for use of personal information concerning customers are for the following
purposes and purposes related to followings:(i) To supply, maintain, protect and improve the Minpaku Services, including but not limited toregistering with, and receiving bookings and performing personal identification for, privatehome lodgings and other lodging establishments (hereinafter each referred to as "lodgingestablishment");(ii) To supply personal information concerning a customer to the provider of lodging services
at a lodging establishment (hereinafter referred to as "lodging services") to the extent necessary
for said provider of the lodging services to provide the customer with the lodging services on
the basis of a booking received by the Company through the Minpaku Services;(iii) To give notifications to customers and address inquiries, etc., from customers;(iv) To address any act that violates our rules associated with the Minpaku Services;(v) To give notifications of products and services offered by the Company and of campaign
information, etc., and other advertisement, promotion and marketing content;* We may analyse the information we collected above in “2. Information to be collected andhow it is collected” (including but not limited to the profile information and information
related to your use of the Services) using artificial intelligence (hereinafter referred to as“Analysis” in this Policy). Analysis may include your past and current information, and it may
also be conducted by combining your information with other individuals’ information(personal, aggregated or inferences). We may infer your preferences, purchase trends, profileand credibility, and provide you with marketing contents and display advertising based on suchanalysis and inferences.
(vi) To give notice of a change, etc., of rules associated with the Minpaku Services;(vii) To exercise any rights, and perform any obligations, pursuant to an agreement with acustomer or to a law, etc.;(viii) To undertake service improvement, research and development;* we may conduct analysis for service improvement and R&D activities using yourinformation collected in Section 2 (“Information to be collected and how it is collected”(profile information and information related to your use of the Services)).

(ix) To prevent and mitigate fraudulent or illegal activities;(x) To provide your personal information to third parties according with Section 4 (“Thirdparty supply of personal information”); and(xi) To serve a purpose of use related to any purpose of use stated hereinabove.
(2) Retention of Your Information
We will keep your personal information necessary to fulfil our contractual obligations for as
long as we have a relationship with you, and for a period of 10 years thereafter. Otherinformation, such as Device information and information obtained using Cookie
Technologies, will used and retained at maximum for 2 years after the collection. We will
only retain your personal information after this time if we are required to do so to comply
with the applicable laws, or if there are outstanding claims or complaints that will reasonably
require your personal information to be retained.

2. Information to be collected and how it is collected(1) Information that customers are asked to supply
We collect from customers their name, telephone number, address, e-mail address, andinformation on the lodging establishment that the customer has registered with, as well as
information on the lodging services, and any such other information as may be necessary in thecourse of providing the Minpaku Services, to the extent necessary for providing the Minpaku
Services.
(2) Information to be collected by the Company in the course of use by customers of the Minpaku
Services
In relation to the Minpaku Services, we may from time to time acquire the following information
with respect to the status of the customer's access to our website, etc., and how the customer usedthe same:(i) Information on the identity of information and communication devices, such as device ID;(ii) OS information on information and communication devices, and information on thecustomer's connection to the Internet;(iii) Referrer;(iv) IP address;(v) URL accessed, and time stamp for the time at which the access was made;(vi) Server log information other than the above; and(vii) Information on the establishments or services, etc., displayed or retrieved.
3. Cookies
Our website is configured so that the following three types of cookie are used thereon:(1) Cookies essential for the website's actions

This type of cookie is one that is essential for the purposes of use of the website's functions, suchas moving between pages of the website and accessing secure pages. If a user refuses this type ofcookie, the action desired by the user may not function as requested.
(2) Cookies for effectiveness measurement purposes
This type of cookie is used for the purpose of collecting information as to how users use thewebsite, such as the number of visitors and which page is viewed the most frequently. Informationcollected with this type of cookie is used for the purpose of making improvements in theperformance of the website, such as giving users an easy means to find the information theyrequire.
More specifically, we use Google Analytics cookies as described below:
Cookie's role
Cookie's time to expiry
Cookies used for the purpose of distinguishing users.
2 years
Cookies used for the purpose of throttling the request rate.
10 minutes
If you do not wish to allow Google Analytics cookies, they can be refused by installing an opt-out
plug-in offered by Google:
https://tools.google.com/dlpage/gaoptout?hl=ja(3) Cookies for advertising purposes
In addition to what is stated in items (1) and (2), we also use cookies issued by our partner
indicated below for the purposes of online advertisements, report creation and service and website
improvements. If you do not wish to allow cookies for advertising purposes, they can be disabled(you can opt out) from the website of our partner indicated below:
Googlehttps://www.google.com/settings/u/0/ads/authenticated

4. Third-party supply of personal information
As stated in Section 1, item (1), we supply personal information concerning a customer to theprovider of lodging services to the extent necessary for said provider of the lodging services toprovide the customer with the lodging services on the basis of a booking received by the Company
through the Minpaku Services.

5. Disclosure to Other Third Parties
we may also disclose your personal information to certain trusted third party service providers,
including those located outside of Japan, where necessary to carry out our business operations.
Please be assured that we will only disclose your personal information in compliance with theapplicable law, and with the appropriate management and supervision of the relevant third parties.
On occasion, judicial or regulatory authorities may request access to or disclosure of information
about you for law enforcement purposes. Such requests typically pertain to criminal investigations
or other legal proceedings. Where they are necessary and legitimate, we will respond to such
requests in accordance with our internal policies and applicable law.

We may disclose any types your information in Section 2 (“Information to be collected and how itis collected”) to the minimum necessity in order to achieve the purpose of the disclosure.
We will not use or disclose your information for purposes not set forth in this Policy without
informing you and taking any necessary steps in advance as required under applicable law.

6. Personal Information Matching Analysis and How We Use it to Display Advertisements
We conduct analysis by matching your personal information and information we got
entrusted from third parties (Rakuten Group companies and partners that have concluded
contracts with us). For example, we may receive your personal information such as
advertising identifier, and by matching it to other personal information including advertisingidentifiers that we manage, we are able to display advertisements more customized for you.
Also, we may conduct matching analysis of your personal information and other personal
information we manage, aggregate the result of such analysis in a way it cannot identify
individuals, and provide such aggregated results to third parties so that the third parties canuse the results for their service improvement and R&D etc.
Furthermore, we may provide your personal information that we manage to third parties(partners that have concluded advertising and other service agreements with us [※]) in order
to displaying advertising. For instance, we may provide your personal information we
manage such as advertising identifiers to third parties, so that the third party may match andanalyze its personal information with the information they receive from us and provide youwith customized advertising contents. In such case, the third party uses your personal
information for displaying advertising as instructed from us.
※For more information on advertising and other service partners’ list and countries outside ofJapan that these partners are located, please refer to this page.

7. Disclosure of personal information
If we are requested by a customer to disclose personal information on the basis of a provision of
the Personal Information Protection Act, we will, after verifying that the same is a request fromthe customer which the personal information concerns, without delay disclose the same to thecustomer (if no such personal information exists, we will notify the customer thereof). This will
not apply, however, if we are subject to a non-disclosure obligation by virtue of the Personal
Information Protection Act or any other law or regulation. If you wish to have personal
information disclosed, please let us know through the point of contact indicated in Section 8 sothat we can inform you of the specific procedures.

8. Correction, etc., or suspension of use, etc., of personal information
If we are requested by a customer to (1) perform a correction, addition or removal of the content
of any personal information (hereinafter referred to as "correction, etc."), on the grounds that thesame is not true, pursuant to a provision of the Personal Information Protection Act or (2) suspend
the use of, or erase, any personal information (hereinafter referred to as "suspension of use, etc."),on the grounds that the same is handled beyond the scope of the purpose of use that has been madepublic in advance, or on the grounds that the same was collected by deceit or any other illicit
means, pursuant to a provision of the Personal Information Protection Act, we will, after verifying

that the same is a request from the customer which the personal information concerns, without
delay conduct any necessary investigation, and on the basis of the results thereof, perform thecorrection, etc., of the content, or the suspension of use, etc., of the personal information and thennotify the customer thereof. If we decide not to perform the correction, etc., or the suspension ofuse, etc., pursuant to the Personal Protection Information Act or any other law or regulation, wewill inform the customer thereof.

9. Security and overseas transfer
We comply with applicable laws and regulations, and also strive for the handling of personal
information at high information security levels, with the aim of preventing unauthorized access to,or the divulgence of, personal information concerning customers, maintaining the accuracy of
personal information, and where necessary, effecting appropriate disposal. When acquiring ortransferring any personal information, we have communications encrypted, as well as set
restrictions on privileges for access to personal information stored with us and have the personal
information handled only by the personnel required for the execution of tasks. In addition, we
conduct regular reviews so as to ensure that our actions described hereinabove are effectively
taken in an appropriate fashion and kept at a proper level.
Please refer to this page for more details about our security practices.
Because of the global nature of our business, the information that we collect from you may betransferred to countries whose data protection laws are not as comprehensive as those from where
you are based. The countries to which we may transfer your personal information to includes, butis not limited to Singapore, U.S.A., Cambodia etc. When transferring personal information
globally, we research the data protection regulations in the destination countries and regions, andwe have put in place appropriate safeguards (such as contractual commitments) in accordance withapplicable legal requirements to ensure that your data is adequately protected. For more
information on the appropriate safeguards in place, please contact us at the details in accordancewith Section 9(“Contact Us”). For global data processing within us, we put in place adequate
measures including Binding Corporate Rules we implemented, a recognized European dataprotection standard. Binding Corporate Rules (the “BCRs”) provide for an appropriate level ofprotection. Our rules have been approved by the relevant European Union Authorities and these
are also a strong commitment to protect your privacy around the world. Rakuten's BCRs areavailable here: https://corp.rakuten.co.jp/privacy/en/bcr.html

10. Point of contact
If you have a comment or question or wish to file a complaint or otherwise make an inquiry inconnection with the handling of personal information, please contact us at the following point ofcontact:
Rakuten STAY, Inc. Customer Personal Information Consultation Counter
https://corp.stay.rakuten.co.jp/inquiry/

11. Procedures for changing the PolicyWe may from time to time change or amend the Policy as required, according to the need toaddress the change of a law or regulation or for business reasons, in which case we postinformation on said change, etc., on this website. Customers are kindly advised to adequately
check the latest content of the Policy subsequent to any such change, etc., as may be posted on thiswebsite.

If there is any discrepancy or conflict between the English version and the Japanese version of theagreement herein, the Japanese version shall take precedence.
Enactment Date：15th June, 2018
Revision Date：12th May, 2021
Revision Date：1st Dec, 2021
Revision Date：1st Apr, 2022
Revision Date：1st Nov, 2022