Privacy policy based on the EU General Data Protection Regulation (GDPR)
at National University Corporation Tohoku University
November 29, 2023
Approved by the President
1. Purpose
The purpose of this Privacy Policy is to set out the University's policy on the handling and transfer of
personal data of data subjects – regardless of nationality and place of residence – located within theEuropean Economic Area (EEA) and the UK at National University Corporation Tohoku University(hereinafter referred to as “the University”).
2. Definition
The definitions of terms used in this Privacy Policy are listed in the table below.

Term

Definition

GDPR

General Data Protection Regulation: EU General Data Protection Regulation No.
2016/679 and UK GDPR No. 679 and UK GDPR

Within the EEA

Refers to the member countries of the European Economic Area (EU member
states, Iceland, Principality of Liechtenstein, and Kingdom of Norway).

Data subject

An identified or identifiable natural person. An identifiable natural person in thiscontext is an identifiable natural person by reference, in particular, to an
identifier such as a name, an identification number, location data, an online
identifier (IP address, cookie, MAC address, etc.), or a person who can be
identified, directly or indirectly, by reference to one or more factors that indicate
genetic, mental, economic, cultural, or social identity.

Personal data

Information about the data subject.

Processing

Any operation or set of operations which is performed on personal data or on setsof personal data, whether or not by automated means, such as collection,
recording, organisation, structuring, storage, adaptation or alteration, retrieval,consultation, use, disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, or erasure or destruction.
Refers to the performance of a task or the performance of a group of tasks.

Restriction ofprocessing

Marking of stored personal data with the aim of limiting their processing in the
future.

Profiling

Any form of automated processing of personal data comprising the use of
personal data to evaluate certain personal aspects relating to a natural person,
and, in particular, to analyse or predict aspects concerning that natural person's
performance at work, economic situation, health, personal preferences, interests,
reliability, behaviour, location, or movements.

Controller

The natural or legal person, public authority, agency, or other body which, alone
or jointly with others, determines the purposes and means of the processing of
personal data.

Processor

A natural or legal person, public authority, agency, or other body which processes
personal data on behalf of the controller.

Third party

A natural or legal person, public authority, agency, or body other than the data
subject, controller, processor, and persons who, under the direct authority of thecontroller or processor, are authorised to process personal data.

Consent of thedata subject

The data subject is given the freedom to choose whether or not to consent, thehandling of personal data obtained through consent is clearly specified, and thedata subject clearly expresses his or her will after receiving these explanations inadvance. That is, a data subject, by statement or clear affirmative action,
expresses consent to the processing of personal data relating to him or her.

SCC

Standard Contractual Clauses*This is a template agreement established by the European Commission
or the UK government based on the GDPR that applies to the transfer of
personal data outside the EU or the UK.

Adequacy decision A country or region determined by the European Commission to have anadequate level of data protection. *If the decision is made, personal data will beable to be transferred outside the region without any specific authorisation.

3. Name and address of controller
Name: National University Corporation Tohoku University
Address: 2-1-1 Katahira, Aoba-ku, Sendai, Miyagi
General Affairs and Planning Department Legal Affairs and Compliance Division[+81-22-217-5122]
4. Cookie
The University's web pages use cookies. Cookies are text files that are stored on your computer system via
your Internet browser. Many Internet sites and servers use cookies. A cookie consists of a character string
through which web pages and servers can be assigned to the specific Internet browser in which it wasstored. This allows visited Internet sites and servers to identify the individual browser of the data subject
from other Internet browsers that contain other cookies. A specific Internet browser can be recognised
and identified using a unique cookie ID. Cookies allow the University to provide users of this website withmore user-friendly services that would not be possible without the cookie setting.
By using cookies, the information on the University's website can be optimised with the user in mind inorder to make it easier for users to use the University's website.
The data subject may, at any time, prevent access to cookies on the website of the University by selecting
the corresponding settings on his or her Internet browser, and may thus permanently deny cookies.
Already set cookies may be deleted at any time via the Internet browser or other software programs. Thisis possible with all common Internet browsers. If the data subject deactivates the setting of cookies on theInternet browser, not all functions of the University's website may be entirely usable.
*Types of cookies(1) Classification by duration
1) Session cookies: Cookies that are deleted when the user closes the browser
2) Persistent cookies: Cookies that remain on the user's computer/device for a predefined period

(2) Classification by attribution
1) First type cookies: Cookies set by the web server and sharing the same domain
2) Third-party cookies: Cookies stored by a domain different from the domain of the visited page. This
cookie occurs when a web page references files such as JavaScript that are located outside its domain.
5. Lawfulness of processing of personal data
The University handles personal data in the following cases.
(1) The data subject has given consent to the processing of his or her personal data for one or more
specific purposes (GDPR Article 6, Paragraph 1 (a) consent; hereinafter referred to as "(a) consent").
(2) Processing is necessary for the performance of a contract to which the data subject is a party, or inorder to take steps at the request of the data subject prior to entering into a contract (GDPR Article 6,
Paragraph 1 (b) Performance of the contract; hereinafter referred to as “(b) Performance of thecontract”).
(3) Processing is necessary for compliance with a legal obligation to which the University is subject (GDPR
Article 6, Paragraph 1 (c) Compliance with a legal obligation; hereinafter referred to as "(c) Compliancewith a legal obligation").
(4) Processing is necessary in order to protect the vital interests of the data subject or of another natural
person (GDPR Article 6, Paragraph 1 (d) Protect to vital interests; hereinafter referred to as “(d) Protect tovital interests”).
(5) When the processing is necessary for the performance of operations carried out in the public
interest or in order to exercise official authority granted to the University (GDPR Article 6, Paragraph 1(e) Exercise of official authority; hereinafter referred to as "(e) Exercise of public authority")(6) Processing is necessary for the purposes of legitimate interests pursued by the University or by a third
party (GDPR Article 6, Paragraph 1 (f) Legitimate interests; hereinafter referred to as “(f) Legitimate
interests”).
6. Purpose of processing personal data and types of personal data processed:
The University processes personal data, including the personal data listed below, from data subjects
within the EEA and the UK for the purposes set out below. In this case, we will also indicate on which legal
basis the personal data will be processed, as shown in each section of Article 5. If the legal basis is (a)consent, the data subject may withdraw that consent at any time. We will also indicate if there is a third
party to whom the information will be provided.

Data subject

Purpose of processing

Types of personal dataobtained

Reasons forlegalisation anddestination if provided
to a third party

Applicantsforadmission

Selection of new entrants,
admission procedures, preadmission education, follow-up
surveys, etc., student dormitory
move-in procedures, postadmission student support(scholarships, tuition fee
exemptions, health management,etc.), educational purposes such as
academic guidance, and tuition fee
collection; relationships, surveys
and research (improvement ofApplicantfaculty/department or
graduate school/major,
name, date of birth,
gender, nationality(region), current addressand contact information,
address and contact
information in Japan (inthe case of an agent, theperson's name andrelationship with the(b) Performance ofthe contract;(f) Legitimate
interests; improving
entrance exams andthe university's
education throughresearch and analysisof entrance exams
and applicant
behaviour, etc.

entrance exams, trace surveys, etc.,
procedures for moving into student
dormitories, student support after
enrolment (scholarships, tuition fee
exemptions, health management,etc.), educational purposes such as
academic guidance, tuition fees;
relationships with tax collection,etc., as well as surveys and research(improvement of entrance exams,
investigation and analysis ofapplicant trends, etc.)

Dissemination of appropriate
educational content and support
content of the University based on
the individual's wishes andaspirations

Guarantor
forapplicants

Payment and exemption ofentrance examination fees andadmission fees; procedures formoving into student dormitory

applicant), school
education history, scoreand examination
number of Examination
for Japanese University
Admission forInternational Students（EJU）; score andexamination date of
TOEFL, TOEIC, etc.; study
history after graduatingfrom high school,
Japanese language
learning history,
hobbies/ personality,
etc.; purpose of study
abroad, photographic
portrait, high school oruniversity graduation
prospect certificate or
graduation certificate
items to be stated, items
to be stated on thetranscript, items to bestated on the passport,
entrance examination
results
Name, address, contact
information

Contact in case of emergency, etc.
Graduates(a) Consent(b) Performance ofthe contract(d) Protect to vitalinterests

Issuance of various certificates,
sending of university publicity
materials, event information,
information on donations, etc.,
work related to improvement andpromotion of education andresearch, various
inspections/investigations/analyses, accreditation evaluation;
investigation work requests fromthe national government,
administrative agencies, and otherorganisations, etc.

Name, address, contact
information, student
registration at the timeof enrolment, other datacollected during
enrolment

Providing information on reskilling,such as recurrent education basedon the individual's wishes andaspirations, and utilisinginformation to support
employment and career for current
students.

Name, address, contact
information, place of
employment, student
registration at the timeof enrolment, other datacollected during
enrolment(f) Legitimate
interests;
strengthening
relationships with
graduates will lead tothe development of
the University;
Tohoku University
alumni "Shuyukai"(a) Consent

Applicantsforexchange
programs
and summer
programs

Program implementation

Statistical data creation, analysis ofexchange status with overseas
partner schools

Dissemination of appropriate
educational content and support
content of the University based on
the individual's wishes andaspirations

Name, participating
program, period of
acceptance, accepting
department, accepting
faculty, name of thepartner school, name ofa person in charge of thepartner school, thecontact information of
the person in charge ofthe partner school,
nationality, gender, dateof birth, marital status,
health considerations,period of study abroad
accommodation, homeaddress, emergency
contact information,
passport number, email
address, scholarship
recipient status,
language ability(b) Performance ofthe contract(f) Legitimate
interests;
analyse the exchange
program and use it toimprove the program(a) Consent

Japan
Society forthePromotionof Science,
Research
Fellowshipfor Young
Scientists
applicantApplication for Japan Society for
the Promotion of Science Research
Fellowship for Young Scientists

Name, gender,
nationality, date of birth,
degree, type of doctoral
degree, academic
background,research/work history,
research topic, current
address, name/locationof affiliated institution,
contact information forscreening results(b) Performance ofthe contract; provided
to Japan Society for
the Promotion of
Science

Prospective
students orprospective
employees

Obtaining a Certificate of Eligibility
for Status of Residence

Affiliation at Tohoku
University, status at
Tohoku University,
period of acceptance at
Tohoku University,planned period of stay,nationality/region, dateof birth, name, email
address, gender, place ofbirth, marital status,
applicant's occupation,
place of residence in thehome country, passportnumber and expiration
date, presence orabsence ofaccompanying family
members, place ofplanned visa application,
past entry/exit history to(c) Compliance with alegal obligation;
provided to the
Immigration Bureau

Japan, whether or notthere has beenpunishment for a crime,
departure from Japandue to deportation or
departure order.
presence or absence offamily members alreadyliving in Japan, theirplace of work/school,
residence card number(special permanent
resident certificate
number), number ofyears of study, final
educational backgroundand school name,(estimated) date ofgraduation, how to pay
for expenses while
attending the University,name and phone
number of the person
who pays the expenses,
scholarship provider,research topic, addressfor receiving thecertificate of eligibility,
phone number, work
history or career,compensation from the
University, etc.; amount,address and date of
notification of marriage,
birth, or adoption

Persons
who wish tobeemployedby theUniversity(including
those whose
employment has been
decided)Recruitment selection

Faculty andstaff

Human resources

Procedures at the time ofrecruitment
Contact in case of emergency

Name, age, date of birth,
nationality/region,
current address,
telephone number,email address,
educational background,work history, degree,
license/certification,
permanent residence
status, residence status(b) Performance ofthe contract

Name, gender, date ofbirth, current address,
housing type, telephone
number, educational
background, work
history, training history,
qualifications, languagerelated study history,(f) Legitimate
interests;(d) Protect to vitalinterests

to be used forappropriate personnel
affairs within theuniversity; to ensurethat the university

English or foreign
language test results,
health status

functions as auniversity by placing
the right people in theright places andencouraging faculty
and staff todemonstrate theirabilities

Payment of salary, travel expenses,
etc.

Name, account name,bank name, bank code,
branch code, deposit
type, account number
route, commuting
method, marital status,
working hours, numberof vacation days, reason
for taking vacation(evidence materials)(b) Performance ofthe contract

Tax procedures, etc.

Name, date of birth,annual income, address,
information necessary
for year-end adjustment
related declaration
function (various
insurance premium
payment status,
existence of dependents,
mortgage payment
status, etc.)(c) Compliance with alegal obligation;
provided to the tax
officeProcedures for the Ministry of
Education, Culture, Sports, Scienceand Technology Mutual Aid
Association or Japan Health
Insurance Association

Name, date of birth,presence or absence ofdependents, current
address, workplace
before enrolment, work
history at a national
institution before
enrolment(b) Performance ofthe contract; provided
to the Education,
Culture, Sports,
Science andTechnology Mutual
Aid Association or the
National Health
Insurance Association

Labour management

Working hours, overtime
duties, reasons for leave,
reasons for leave or
absence, approval statusof leave or absence(b) Performance ofthe contract;(c) Compliance with a“legal obligation"

Health care

Results of healthexaminations (statutory
items), results of healthconsultations and healthguidance (if based onlaws), results of reexamination of healthexaminations (same aslegal items), results ofinterview guidance for
employees working longhours, results ofinterview guidance forthose who were judged
to be under high stressas a result of stresscheck(c) Compliance with alegal obligation

Results of health(a) Consent
examinations (nonstatutory items), resultsof health consultations
and health guidance (ifnot based on laws),
results of re-examinationof health examinations(excluding items that are
the same as legal items),
detailed examination ofhealth examinations
information for disease
management such as
cancer screening results,
interview guidance for
return to work, doctor's
opinion to supportbalancing treatment andwork, hospital visits, etc.
Liaison with the company to which
the employee is transferred or towhich the employee is dispatched

Name, address, working
hours and days, vacation
status (reason forvacation, proof related
to vacation), status ofbusiness trips, etc.

(b) Performance ofthe contract; provided
to the company towhich the employee istransferred or towhich the employee isdispatched

Procedures at the time ofretirement

Name, address, accountname, financial
institution name,account number(b) Performance ofthe contract

Contact in case of emergency

Name, address, phone
number, email address(d) Protect to vitalinterests

Confirmation of conflicts of interest

Department, affiliation,
job title, employee(f) Legitimate
interests; toname, employee
number, number ofaffiliated corporations,
corporate name,relationship of financial
interests (category,timing/period, amount),
details of industryacademia
collaboration/concurrent employment (category,
period, amount),characteristics of thecorporation (corporate
form, involvement),
response status (forsome executives andemployees involved inorganisational decisionmaking and those
conducting researchusing Ministry of Health,
Labor and Welfare
research funds/AMED
research funds, spouses
and others who makethe same living as theindividual; also record
first-degree relatives)

understand thesituation of conflictsof interest in theactivities of industry–
academia–
government
collaboration activities
and other social
contribution activities
by executives,
employees, and theuniversity/department as an organisation;
to appropriately
manage conflicts ofinterest at ouruniversity

Publication of faculty information
under the provisions of the School
Education Act and other laws andregulations

Name, educational
background, work
history, degree(c) Compliance with alegal obligation

Management of the campus
information network, identity
verification when using eachsystem, and response in the eventof a security incident.

Tohoku University（TU） ID, staff number,staff identification cardID, user classification,
password, certificate
information, start dateof use, end date of use,
sub ID, sub ID password,
Kanji name, Kana name,English name, maiden
name Kanji name,maiden name in kana,date of birth, gender,
telephone number, fax
number, university-wideemail address, otheremail address, student
email address, contact
email address, alias
address,
appointment/exit(b) Performance ofthe contract

classification code,
appointment/exemption
classification, officialname code, job typecode, affiliation code,
department code,charge code, extension
code, Google Cloud
Directory Sync
ID(GCDSID), employee
ID, Google Workspace
initial password,
Microsoft 365 initial
password, Google
Workspace name, past
university email address,
past alias address
Contact in case of emergency

Name, address, contact
information(d) Protect to vitalinterests

Faculty andstaff
families

Tax matters

Name, date of birth,
relationship, annual
income, address, andstatus of disability, if any(c) Compliance with alegal obligation;
provided to tax officeDonor

To manage donations, issue
receipts, etc., and express
gratitude; to respond to requests
and inquiries regarding the Tohoku
University Fund and to sendmaterials; to publicise and provide
information regarding the Tohoku
University Fund; to operate the
Tohoku University Fund and otheractivities related to its operation(survey, analysis, implementationof operational plans, etc.)

Name, gender, date of(a) Consent
birth, address, telephone
number, fax, e-mail;relationship with the
University, affiliation,
position, TU ID,
company/organisation
name,affiliation/position, yearof joining, year of leaving
the company

Researchers
conducting
joint
researchwith Tohoku
University,
employeesofcompanies,
etc.

Contracts related to joint research,
procedures and management
related to inviting researchers

Name, affiliation, role injoint research(b) Performance ofthe contract

Participantsin events
sponsoredby theUniversity

Procedures for participating in
events held by the University;
providing services and information
related to events, etc. held by the
University

Name, gender,
country/region,
company/school name,position, email address(b) Performance ofthe contract

Work related to improving and(f) Legitimate

promoting education and research(including various questionnaires)interests;

Providing information about the
University that the person desiresin connection with the event(a) Consent

improvements toevents, etc. held by
the university

Visitors totheUniversity's
websiteDisplaying the appropriate
information for each website visitor

Cookie data(f) Legitimate
interests; to display
appropriate
information for eachwebsite visitor

Invitees totheUniversity

Travel expense payment
procedures, etc.

Name, affiliation, title,
nationality, date of birth,address (residence),
affiliation address, email(b) performance ofthe contract;

The information to beobtained will differ
depending on theindividual research, andwill be notified
separately by the
research representative.

(a) Consent

Subjects ofacademic
research
conducted
by theUniversity

Promotion of academic research

Provided to travel
agencies, etc.

7. Sources of personal data
The University acquires personal data from the following sources in order to conduct the businessdescribed in the preceding paragraph:(1) Data subjects located in the EEA and the UK (or the holder of parental responsibility
over the child if the data subject is under the age of 16 [or under the age, stipulated by the domestic lawof a country where GDPR applies] when personal data are being handled) can prove that they have given
their consent);(2) Academic research institutions located within the EEA and the UK with which the University has a joint
research project;(3) Public information (e.g., information on the Internet);(4) Information via social media (e.g. Twitter, Facebook, etc.).
8. Retention period of personal data
Personal data recorded in corporate documents owned by the University will be retained for the period
specified by Article 21 of the Regulations on Management of Corporate Documents at National University
Corporation Tohoku University, depending on the type of corporate document recorded.
Personal data acquired for academic research purposes will be stored for a period determined by theheads of each department as part of their responsibility as set forth in Article 4 of the Regulations for the
Promotion of Fair Research Activities at Tohoku University.

9. The rights of the data subject
Data subjects have the following rights:(1) Right of access
The data subjects shall have the right to access their personal data and other information as defined in the
GDPR.
(2) Right to rectification
The data subjects shall have the right to obtain from the controller without undue delay the rectificationof inaccurate personal data concerning him or her.
(3) Right to erasure (right to be forgotten)
A data subject shall notify the controller if his or her personal data fall under any of the matters stipulated
below. You may request that such personal data be deleted without undue delay.
(a) The personal data are no longer necessary in relation to the purpose for which it was collected orotherwise processed;(b) The data subject withdraws consent on which the processing and there is no other legal ground for theprocessing;(c) The data subject objects to the processing pursuant to Article 21(1) of the GDPR and there are nooverriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to
Article 21(2) of the GDPR;(d) The personal data have been unlawfully processed;(e) The personal data have to be erased for compliance with a legal obligation in EU or Member
State law to which the controller is subject;(f) The personal data have been collected in relation to the offer of information society services referred
to in Article 8(1) of the GDPR.
(4) Right to restriction of processing
The data subject shall have the right to obtain from the controller restriction of processing any personal
data that fall under Article 18(1) of the GDPR.
(5) Right to data portability
Where Article 20(1) of the GDPR applies, the data subject shall have the right to receive the personal data
concerning him or her which he or she has provided to a controller, in a structured, commonly used, andmachine-readable format. In addition, the data subject shall have the right to transmit those data to
another controller without hindrance from the controller to which the personal data have been provided.
(6) Right to object
The data subject shall have the right to object, on grounds relating to his or her particular situation, at any
time to processing of personal data concerning him or her which is based on the provisions of Article 5(5) or(6), in the case of profiling pursuant to said provisions. You can object at any time. For details, please refer to"10. Right to object to processing" below.
(7) Right not to be subject to a decision based solely on automated processing, including profiling
The data subjects have the right not to be subject to a decision based solely on automated processing,including profiling, which produces legal effects concerning him or her or similarly significantly affects him

or her.
(8) Right to lodge a complaint with a supervisory authority
Every data subject shall have the right to lodge a complaint at any time with the national supervisory
authority in the EEA and UK where the data subject is located.
10. Right to object to processing
The data subject has the right to object at any time to processing of his or her personal data pursuant to
Article 5(5) or (6). The handling of personal data here includes profiling. The data subject shall have theright to object at any time to processing of personal data concerning him or her for direct marketing
purposes.
11. Providing personal data
The University may provide personal data to third parties listed in Article 6 for the purposes of handling as
stipulated in Article 6. However, as a general rule, the special types of data stipulated in Article 9, Paragraph 1 of
the GDPR can only be processed with the consent of the data subject.
12. Transfers of personal data
Personal data of data subjects may be transferred to Japan based on an adequacy decision for transferfrom the EEA or the UK to Japan, or based on the SCC.
13. Security management measures
Regarding the protection of personal data, the University has taken security management measures at thelevel stipulated in the Act on the Protection of Personal Information and other related laws andregulations, as appropriate technical and organisational security control measures stipulated in Article 32of the GDPR.
14. Relationship with the basic policy (privacy policy) regarding personal information protection at
National University Corporation Tohoku University of the University
In addition to this Privacy Policy, the basic policy (privacy policy) regarding personal information
protection at National University Corporation Tohoku University (hereinafter referred to as the "Basic
Policy") applies to personal data. However, if the provisions of the Basic Policy conflict with this Privacy
Policy, the provisions of this Privacy Policy shall take precedence.
15. General provision
The University may change this Privacy Policy based on laws and regulations or in accordance with the
University's policy. However, personal data collected based on the data subject's consent will not be used
for the changed purpose without the consent of the data subject.