Security control measures we take in handling personal data in possession(Security control measures in this document is for Personal Information that is in ourpossession or is planned to be collected and is also for the ones that are scheduled tobe handled as Personal Data.)
Measures which

Methods

must be taken
Establishment ofDevelopment of

We have published a Privacy Policy as the basic policy to protect

basic policy

rules in handlingour customers’ information. In addition, we specify matterspersonal data

concerning

appropriate

managementofthecustomers’

information and use of it to business activities in the in-house
regulations as part of efforts in handling the customers’
information appropriately in order to put into practice thecontents specified in the basic policy and protect customers’
important information entrusted to us.
Organizational

Development of

We have the Personal Information General Management Officer

security control

organizationalin place to superintend the affairs concerning the protection ofmeasuressystempersonal information. We also appoint the Head of each Division
as the person in charge of handling the personal information to
manage the handling, etc. of security control measuresconcerning the personal information at each Division, thereby
ensuring that the personal information is handled by theemployees and officers authorized to do so, in accordance with
the in-house regulations.

Operations

inWith respect to a variety of systems handling personal data inaccordance withaccordance with the in-house regulations concerning therules

forhandling of the personal data, we have developed a mechanism

handlingof

to inspect how the personal data is handled through measurespersonal data

including appropriate management of their IDs and maintenanceof access logs.

Development ofMethods to respond to data leakage or any other incidents

framework

tooccurred are specified in the in-house regulations. These

respondtoregulations include guidelines for activities including investigation

incidents
includingof the accident, identification of the cause of the accident,
data

leakageestablishmentoftherecurrence

prevention

measures,notification to the person involved and report to the relevantauthorities.

Recognition
handlingof

We have developed a framework to inspect the handling of thepersonal data, have each Division carry out the inspection, asconditions

andrevision

ofwell as developing and implementing an inspection framework
under which a person from another department.

safetymanagement
measures
PersonalEmployment,

We conclude a non-disclosure agreement, etc. regarding thesecurity control

training, etc. ofhandling of personal data with an officer or employee when wemeasuresofficers

employandemployees

him/herandhavedeveloped

thestandards

fordisciplinary penalties in the case of a violation of the nondisclosure, agreement, etc. In addition, we have established thesafety management practical standards, clarified roles andresponsibility of the officers and employees, and ensured thatthey are well informed about, thoroughly implement, and receive
training for, the safety measures.

Physical security control measures

We apply the following physical measures to the areas,
equipment, etc. which handle the personal data:
・Limitation on entry to controlled areas
・Encryption of records
・Discarding in an irrecoverable manner and other measures

Technical security control measures

We apply the following technical measures to the information
system, etc. which handles the personal data:
・Limitation on the right to access・Establishment of system firewalls
・Update of the system security measures
・Monitoring of accesses, etc. and other measures

Recognition

ofIn the case of

We get well acquainted with legislative system, etc. for theoutside

handling

personal information protection in the foreign country and thencircumstances

personal data intake necessary and appropriate measures for safe management

aof the personal data.

country

foreign