GDPR Privacy Policy of Toyotsu Syscom Corporation
Introduced date:1 April 2019A)Purpose of this policy, etc.
1.Purpose of this privacy policy
This privacy policy aims to give you information on the way of processing (including, but not limited
to, collection, use, storage, disclosure by transmission) by Toyotsu Syscom Corporation (the“Company”, "we", "us" or "our" in this privacy policy) of personal data relating to an identified oridentifiable natural person in the European Economic Area (“EEA”, and such natural person shallbe “Data Subject” and such personal data shall be “Personal Data”) as a data controller (or a dataprocessor, if applicable).
Consistent with our Global Code of Conduct & Ethics, we will respect the rights to privacy of individuals
and comply with data protection and privacy related laws and regulations including EU General Data
Protection Regulation 2016/679 (“GDPR”).
2. Contact details
If you have any questions about this privacy policy, please contact ENTERPRISE RISK MANAGEMENT& GENERAL AFFAIRS Department of the Company at: Symphony Toyota Building, 4-11-27, Meieki,Nakamura-ku, Nagoya 450-0002, Japan3. Third-party links
This website may include links to third-party websites. Clicking on those links or enabling thoseconnections may allow third parties to collect or share personal data about you. We do not control
these third-party websites and are not responsible for their privacy statements. Accordingly, when you
leave our website, we encourage you to read the privacy policy of every website you visit.

B) Personal Data we collect about Data Subject
Personal Data means any information relating to Data Subject. It does not include data where thedata subject is not or no longer identifiable (anonymous data)
We may process (including collect) Personal Data for various purposes including, but not limited to:⚫

“For Identification” (including, first name, maiden name, last name, username or similar
identifier, marital status, title, date of birth and gender);1⚫

“For Contact” (including, billing address, delivery address, email address and telephonenumbers);⚫

“For Marketing and Communications” (including Data Subject’s preferences in marketingfrom us and our third parties and Data Subject’s communication preferences);⚫

“For Confirmation of Personal History” (including Data Subject’s skills, qualifications, job
history and any other information that might be necessary to judge Data Subject’s suitability tothe role); and⚫

“For internal Control” (including Data Subject’s names, titles, contact details, job descriptions
and scopes of work, etc. necessary for monitoring (e.g. by way of external and/or internal audit).

Personal Data may be converted into statistical or aggregated data in such a way that Data Subject
will not be identified or identifiable from it and may be used for analytical and research purposes.

C) How is Personal Data collected?
We collect Personal Data including through the following ways:• Direct collection:
We may collect Personal Data directly from Data Subject by filling in a designated form and/or bycorresponding with us by post, email or otherwise when Data Subject:• requests information on our products or services;• provides us with your business cards;• gives us feedback or contact us; or• applies to job roles and further take interview• Indirect collection:
We may collect Personal Data about Data Subject from third parties (including, but not limited to,the organisation to which the Data Subject belongs) and/or public sources.

D) How we use Personal Data
1. Legal grounds for lawful processing of Personal Data
We will use Personal Data only when relevant laws and/or regulations (in particular, GDPR) allows us
to do so.
When we process Personal Data, we will rely on at least one of the legal grounds for lawful processing(including, but not limited to the following applies):•“Consent” by Data Subject” (Processing Personal Data in the case where Data Subject has given
consent to such processing for one or more specific purposes);•“Performance of Contract” (Processing Personal Data in the case where it is necessary for the2

performance of a contract to which Data Subject is a party is the contract, or for taking steps at
Data Subject’s request before entering into such a contract)•“Compliance” (Processing Personal Data in the case where it is necessary for our compliancewith a legal obligation)•“Legitimate Interests” (Processing Personal Data in the case where it will be in the legitimate
interest of the Company to carry out its operation and management of its business for provisionof most suitable services and/or products).
Before processing Personal Data, we will assess potential impacts (both positive and negative)on Data Subject and his/her rights and further make comparison between such impacts on Data
Subject and the Company’s legitimate Interests. We do not use Personal Data if the adverse effecton Data Subjects and his/her rights exceeds the Company's legitimate interest. (Except for thecase where we have obtained consent of Data Subject to such processing or where suchprocessing is required or permitted by relevant laws and/or regulations).

2. Purposes for using Personal Data
We have set out below, in a table format, a description of typical (i) purposes for using Personal Data,(ii) types of Personal Data and (iii) legal grounds for lawful processing (including use) of PersonalData. (We may process Personal Data for more than one legal ground depending on the specificpurpose for using Personal Data.)(i) Purposes for using Personal Data(ii) Types of Personal Data(iii) Legal grounds for lawful processing

1. To register a new customer(a) For Identification(a) Consent by Data Subject(b) For Contact(b) Performance of Contract(c) Legitimate Interests(for administration purpose)

2. To implement relating to(a) For Identification(a) Consent by Data Subject

supply of goods or services(b) For Contact(b) Performance of Contract

including:(c) Legitimate Interest(a) placing (or receiving) order(for debt collection)(b) delivery (or take delivery)(c) payment for fees, etc.
(d) administration of debts andcredits

33. To manage contact details(a) For Identification(a) Consent by Data Subject

including:(b) For Contact(b) Performance of Contract(a) advising changes to relevant(c) Complianceinformation on the Company(d) Legitimate Interest(b) asking for participation in a(for updating customer’s contact

market survey

details and for investigation onproducts and/or services)

4. To administer and protect our(a) For Identification(a) Consent by Data Subject

business(b) For Contact(b) Legitimate Interest

andthiswebsite(including troubleshooting, data(for management and provision

analysis,of IT services, network security

testing,systemmaintenance, support, reportingand for prevention of fraud)and hosting of data)(c) Compliance

5. To recruit new members of(a) For Identification(a) Consent by Data Subject

staff(b) For Contacts(b) Legitimate Interest(includingcollection,

storage and use of Personal Data(c) For Confirmation of(for recruiting individuals to our

obtained through job application,

Personal History

company and to make sure thereetc.)

is no miss-matching of the job
requirement and the applicant)(c) Compliance

6. To conduct assessment on our(a) For Identification(a) Consent by Data Subject

internaland(b) For Confirmation of(b) Complianceof

Personal History

controlmonitoring

over,

(e.g.

byway

external and internal audit) of:(c) For Internal Control(a) effectiveness and efficiencyof(for prevention of fraud andprotectionof business operations;(b) reliability(c) Legitimate Interestoforganisation’s

resources, both physical andfinancialintangible)

reporting;(c) compliance with applicablelaws
relevant

andregulations
tobusinessactivities; and(d) safeguarding of assets.

3. Change to purpose, etc.
We will only use Personal Data for the purposes for which we collected it, unless we reasonably
4consider that we need to use it for another purpose and such purpose is compatible with the original
purpose.
If we need to use Personal Data for a purpose apparently irrelevant to the original purpose, we will try
to obtain Data Subject’s consent by notifying applicable legal basis.
Notwithstanding the above, we may process Personal Data, without Data Subject’s knowledge orconsent, if to do so is required or permitted by relevant laws and/or regulations.

E) Disclosure of Personal Data
We may disclose Personal Data to the following third parties, subject to availability of safety measurefor protection of Personal Data and compliance with the relevant laws and regulations by such thirdparties:⚫
⚫
⚫

“Internal Third Parties”“External Third Parties”“Third parties, to whom we may choose to sell and transfer out business (or vice versa) orwith whom merge”

When we ask External Third Parties to process Personal Data on our behalf, we will not allow them touse Personal Data for their own purposes. We will permit them to process Personal Data only within
the scope of our instructions and applicable relevant laws and regulations.
New owner of our business will be able to process (including use) relevant Personal Data to the same
extent permitted by this policy.
For the purposes of interpretation of this part:“Internal Third Parties” shall include the Company’s shareholder, Toyota Tsusho Corporation, andthe Company’s subsidiaries and affiliates in Japan and/or other countries in which the Company holds
majority of its shares or interests.
“External Third Parties” shall include the following third parties:(a) service providers of Internal Third Parties in Japan and/or any other relevant countries (actingas their commissioned processors or joint controllers, etc. of Personal Data);(b) professional advisers of Internal Third Parties in Japan and/or any other relevant countries(acting as their lawyers, accountants, auditors, financiers, insurers based and consultants,etc.; and(c) any regulator and/or authority of personal data/ information/ privacy protection in Japan5and/or any other relevant countries, which has authority to require reporting of processing
activities, etc. in certain circumstances.

F) Transfer of Personal Data from EEA to Non-EEA
Disclosure of Personal Data mentioned in E) (Disclosure of Personal Data) above may include
transfer of Personal Data from EEA to Non-EEA.
We transfer Personal Data from EEA to Non-EEA only if at least one of the following applies:(a) transfer of Personal Data from EEA to a Non-EEA country where the European Commission
confirms an adequate level of protection for Personal Data;(b) transfer of Personal Data from EEA to a Non-EEA party to a data transfer (or, if appropriate, ofprocessing) agreement with us, which includes standard contractual clauses designated by theEuropean Commission (to give the same effect of protection as that of EEA); or(c) at least one of the derogations set out in Article 49 (Derogations for specific situations) -1) ofGDPR applies.

G) Data security
We limit access to Personal Data only to employees, agents, contractors and other persons who havea business need to know Personal Data of the Company and third parties mentioned in E) (Disclosureof Personal Data) above. They will be allowed to process Personal Data only within the scope of ourinstructions and be subject to a duty of confidentiality.

H) Retention period of Personal Data
We will retain Personal Data only to the reasonable extent necessary to achieve the purposes forcollection of the same, e.g. for satisfaction of any legal, tax, accounting or other requirements.
We may retain Personal Data for a longer period in the event of complaint by Data Subject, or, if we
reasonably believe, there is a prospect of litigation with Data Subject.
To determine the appropriate retention period of Personal Data, we will consider the amount, natureand sensitivity of the Personal Data; the potential risk of harm from unauthorised use or disclosure of
Personal Data; purposes for processing Personal Data; prospect of achieving such purposes throughother means, as well as the applicable legal, tax, accounting or other requirements.

I) Legal rights of Data Subject
1. Legal rights
6Under certain circumstances, in relation to his/her Personal Data, Data Subject may have thefollowing rights:(a) to request access to Personal Data: (This enables relevant Data Subject to receive a copy ofhis/her Personal Data hold by us and to check the status of lawful processing of such PersonalData.)(b) to request correction of Personal Data: (This enables relevant Data Subject to correct
incomplete or inaccurate relevant Personal Data, though we may need to verify the accuracyof new data provided to us.)(c) to request deletion of Personal Data: (This enables relevant Data Subject to ask us to delete
relevant Personal Data if there is no good reason for us continuing to process it. However, wemay not always be able to comply with Data Subject’s request to delete his/her Personal Datafor specific legal reasons.)(d) to object to inappropriate processing of Personal Data: (This enables relevant Data Subject
to have an opportunity to check whether processing of relevant Personal Data is appropriate.)(e) to request restriction on processing of Personal Data: (This enables relevant Data Subject
to ask us to suspend the processing of his/her Personal Data in the following scenarios:(i)

if relevant Data Subject wants to confirm the accuracy of his/her Personal Data.

(ii)

if relevant Data Subject wants to confirm the legal grounds for lawful processing of
his/her Personal Data.

(f) to request the transfer of Personal Data to relevant Data Subject (or to a third party
designated by him/her):(g) to withdraw consent by Data Subject to process Personal Data: (This will not affect thelawfulness of any processing carried out before such withdraw. If Data Subject withdraws
his/her consent, we may not be able to provide certain products or services to him/her. We
will advise him/her if this is the case at the time of such withdrawal by Data Subject.)
Data Subject has the right to make a complaint to relevant supervisory authority in charge of dataprotection issues having competent jurisdiction. However, we would appreciate if Data Subject could
give us chance to deal with Data Subject’s concerns in the first instance before Data Subject
approaching such supervisory authority.
2. Cost, etc.
Basically, Data Subject does not have to pay any cost for exercising any of said rights.
However, we may ask Data Subject to bear reasonable cost if his/her request is clearly unfounded,repetitive or excessive. Alternatively, we may refuse to respond to Data Subject’s request in thesecircumstances.
3. Provision of additional information
We may need to request specific information from Data Subject to help us confirm his/her identity
7

and secure Data Subject’s rights. This is a security measure to ensure that Personal Data will not be
disclosed to any person who has no right to receive it.
We may also Data Subject to ask for further information in relation to his/her specific request to speed
up our response.
4. Updates to this policy
This policy may be updated from time to time. You can find the latest version on our website.
[End of this policy]

8