AICHI CORPORATIONEEA CUSTOMERS' PRIVACY POLICY

PLEASE READ THIS PRIVACY POLICY CAREFULLY
1. OUR PRIVACY STATEMENT
The protection of your personal data is of great importance to Aichi Corporation (“Company” or"We"). This privacy policy (the “Privacy Policy”) therefore intends to inform you about how theCompany, acting as data controller, collects and processes your personal data that you submit ordisclose to us. We also act as data controller when we process your personal data received or
obtained through third-parties. We process these personal data in accordance with the applicable EUand Member State laws and regulations on data protection in particular, the General Data Protection
Regulation No 2016/679 (the “GDPR”).
We encourage you to read this Privacy Policy carefully. If you do not wish your personal data to be
used by us as set out in this Privacy Policy, please do not provide us with your personal data. Please
note that, in that case, we may not be able to provide you with our services.
If you have any queries or comments relating to this Privacy Policy, please contact
info_kikaku@aichi-corp.com or visit https://www.aichi-cop.co.jp/cgi-bin/contact/general/form.cgi

2. HOW DO WE USE YOUR PERSONAL DATA?
For the purposes specified in this Privacy Policy, we process the personal data obtained from you
directly (when you decide to communicate such data to us, (i.e., when you contact us)) or indirectly(data provided to us by a third-party). We ensure that the personal data processed are adequate,relevant and limited to what is necessary in relation to the purposes for which they are processed. We
will always process your personal data based on one of the legal basis provided for in the GDPR
(Articles 6 and 7).
We may collect and process your personal data based on the following legal grounds for the following
purposes:

I.

General Purpose: Performance of our business operations

Specific Purpose

Data Subjects

Legal Basis

Legitimate interest (ifapplicable)

To issue invoices toCustomers

customers

Contractual

N/Aperformance

To process

Customers/emplo

Contractual

The smooth functioning of thecustomers' orders,

yees of theperformance/Legiti

Company's business operations

inquiries andcustomer

mate interestand the provision of therequests

Company's services to customers

To inspection andCustomers/emplo

Contractual

The smooth functioning of therepair of workyees of theperformance/

Company's business operations

platforms / vehicles

customer

Legitimate interestand the provision of thecustomers'

Company's services to customers

purchased
To sell of parts or

Customers/emplo

Contractual

The smooth functioning of therepair parts

yees of theperformance/

Company's business operations

customer

Legitimate interestand the provision of theCompany's services to customers

To purchase or sell

Customers/emplo

Contractual

The smooth functioning of theused workyees of theperformance/Company's business operations

platforms/vehicles

customer

Legitimate interestand the provision of theCompany's services to customers

To operate ourWebsite visitors

Legitimate interest

websiteThe promotion of our products
and services

We will process your data for these specified, explicit and legitimate purposes, and will not further
process the data in a way that is incompatible with these purposes. If we intend to process personal
data originally collected for one purpose in order to attain other objectives or purposes, we will ensurethat you are informed of this.
We will keep your personal data only for as long as it is necessary for us to comply with our legal
obligations to ensure that we provide an adequate service, and to support our business activities(Article 5 and 25(2) GDPR).

2

3. HOW DO WE SHARE YOUR PERSONAL DATA?
As a Company based in Japan, we receive personal data of EEA individuals in Japan which has anadequate level of protection of personal data based on the adequacy decision of the EU Commission.
We may also share your personal data with third parties in accordance with the GDPR in thefollowing ways and for the following purposes:-To data controllers within Japan:Your personal data may be transferred to, stored and further processed by our partners that work with
us to provide our products and services or help us conduct business with customers. We may currently
share your personal data with the following categories of partners:-To service providers (data processors) within Japan:

We share your personal data with companies which provide services on our behalf and are located inJapan, such as Cloud service for storing email data. Where we share your personal data with a dataprocessor, we will put the appropriate legal framework in place in order to cover such transfer andprocessing (Articles 28 and 29 GDPR).
-To Corporate Affiliates and Corporate Business Transactions:

In the event of a merger, reorganization, acquisition, joint venture, assignment, spin-off, transfer, or
sale or disposition of all or any portion of our business (including in connection with any bankruptcy
or similar proceedings), we may transfer any and all personal data to the relevant third party.
-To other data controllers and data processors in third countries:

We may transfer personal data to partners and service providers outside Japan, where the third
countries may not provide an adequate level of protection of personal data. Such data transfer is asfollows:
・Our Affiliates or Our Subsidiary (in China)
For each of these transfers, we make sure that we provide an adequate level of protection to the datatransferred, in particular by entering into standard contract clauses as defined by the European3

Commission decisions 2004/915/EC and 2010/87/EU, or by any standard data protection clauses
adopted by the European Commission pursuant to Article 46(2)(c) of the GDPR. You may obtain a
non-confidential standard contractual clauses copy of the mentioned safeguards of transfers we carryout by contacting us.
-Other disclosures:

It may be necessary for us – by law, legal process, litigation, and/or requests from public andgovernmental authorities within or outside your country of residence – to disclose your personal data.
We may also disclose your personal data if we determine that, due to purposes of national security,
law enforcement, or other issues of public importance, the disclosure is necessary or appropriate.
We may also disclose your personal data if we determine in good faith that the disclosure isreasonably necessary to protect our rights and pursue available remedies, enforce our terms andconditions, investigate fraud, or protect our operations or uses.

4. OUR RECORDS OF PERSONAL DATA PROCESSES
We keep records of all processing activities of personal data in accordance with the obligations
established by the GDPR (Article 30). In these records, we reflect all the information necessary inorder to comply with the GDPR and cooperate with the supervisory authorities as required (Article31).

5. SECURITY MEASURESWe process your personal data in a manner that ensures their appropriate security, including
protection against unauthorised or unlawful processing, accidental loss, destruction or damage. We
use appropriate technical and organisational measures to achieve this level of protection (Article 25(1)and 32 GDPR).

4

6. NOTIFICATION OF PERSONAL DATA BREACHES TO THE COMPETENT
SUPERVISORY AUTHORITIESIn case of breach of security leading to the accidental or unlawful destruction, loss, alteration,
unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed, we
have the mechanisms and policies in place in order to identify it and assess it promptly. Dependingon the outcome of our assessment, we will make the requisite notifications to the supervisory
authorities and communications to the affected data subjects, which might include you (Articles 33and 34 GDPR).

7. PROCESSING LIKELY TO RESULT IN HIGH RISK TO YOUR RIGHTS AND
FREEDOMS
We have mechanisms and policies in place in order to identify data processing activities that may
result in high risk to your rights and freedoms (Article 35 of the GDPR). If any such data processing
activity is identified, we will assess it internally and either stop it or ensure that the processing iscompliant with the GDPR or that appropriate technical and organisational safeguards are in place inorder to proceed with it.
In case of doubt, we will contact the competent Data Protection Supervisory Authority in order toobtain their advice and recommendations (Article 36 GDPR).

8. YOUR RIGHTS
You have the following rights regarding personal data collected and processed by us.
–Right to be informed: You may have the right to obtain from us all the requisite information
regarding our data processing activities that concern you (Articles 13 and 14 GDPR).

–

Access to personal data: You may have the right to obtain from us confirmation as to whether
or not personal data concerning you are being processed, and, where that is the case, access tothe personal data and certain related information (Article 15 GDPR).

5

–

Rectification of personal data: You may have the right to obtain from us the rectification of
inaccurate personal data concerning you without undue delay, and to complete any
incomplete personal data (Article 16 GDPR).

–

Right to erase your personal data: You may have the right to obtain from us the erasure ofpersonal data concerning you without undue delay, when certain legal conditions apply(Article 17 GDPR).

–

Restriction of processing of personal data: You may have the right to obtain from us therestriction of processing of personal data, when certain legal conditions apply (Article 18GDPR).

–

Object to processing of personal data: You may have the right to object, on grounds relating
to your particular situation, at any time to processing of personal data concerning you, when
the processing is based on the legitimate interests of the Company (Article 21 GDPR).

–

Data portability of personal data: You may have the right to receive your personal data in astructured, commonly used and machine-readable format, and have the right to transmit thosedata to another controller without our hindrance, when our legal basis for the processing ofyour personal data is the performance of a contract between us (Article 20 GDPR).

–

Not to be subject to automated decision-making: You may have the right not to be subject toautomated decision-making (including profiling) based on the processing of your personaldata, insofar as this produces legal or similar effects on you, when certain conditions apply(Article 22 GDPR). We inform you that we do not carry out currently automated decision
making, including profiling as defined by Article 22 GDPR.

If you intend to exercise such rights, please refer to the contact section below.
If you are not satisfied with the way in which we have proceeded with any request, or if you have any
complaint regarding the way in which we process your personal data, you may lodge a complaint witha Supervisory Authority.

69. LINKS TO OTHER SITES
We may propose hypertext links from the Website to third-party websites or Internet sources. We do
not control and cannot be held liable for third parties’ data protection practices and content. Please
read carefully their privacy policies to find out how they collect and process your personal data.

10. UPDATES TO PRIVACY POLICY
We may revise or update this Privacy Policy from time to time. Any changes to this Privacy Policy
will become effective upon posting of the revised Privacy Policy via our website.

CONTACTFor any questions or requests relating to this Privacy Policy, you can contact us at:
Personal Information Management, Corporate Planning Department, Aichi Corporation
Address: 1152-10 Aza Yamashita, Oaza Ryoke, Ageo-shi, Saitama-ken 362-8550, Japan
Phone number: 81-(0)48-781-1111
E-mail: info_kikaku@aichi-corp.com“Contact Us” page at website: https: //www.aichi-corp.co.jp/cgi-bin/contact/general/form.cgi* *7