       

Certificate
Certificate number: 2020-005
Certified by EY CertifyPoint since: March 13, 2020
Based on certification examination in conformity with defined requirements in ISO/IEC
17021-1:2015 and ISO/IEC 27006:2015/A1:2020, the Privacy Information
Management System as defined and implemented byiret, Inc.*located in Toranomon Hills Mori Tower 7F, 1-23-1 Toranomon, Minato-Ku, Tokyo 1056307, Japan is compliant with the requirements as stated in the standard:

ISO/IEC 27701:2019
Issue date of certificate: February 7, 2022
Re-issue date of certificate: February 19, 2024
Expiration date of certificate: February 10, 2025
Last certification cycle expiration date: March 12, 2022

EY CertifyPoint will, according to the certification agreement dated November 19,2021, perform surveillance audits and acknowledge the certificate until the expiration
date noted above or the expiration of the corresponding ISO/IEC 27001:2013
certification with certificate number 2019-010.
*The certification is applicable for the assets, services and locations as described in the scoping section atthe back of this certificate, with regard to the specific requirements for privacy as stated in the Statementof Applicability for PIMS, version 6.03, dated November 15, 2021.

J. Sehgal | Director, EY CertifyPoint
This certificate is not transferable and remains the property of Ernst & Young CertifyPoint B.V, located at Antonio Vivaldistraat 150, 1083 HP, Amsterdam, the Netherlands. Any dispute relating to this certificate
shall be subject to Dutch law in the exclusive jurisdiction of the court in Rotterdam. The content must not be altered and any promotion by employing this certificate or certification body quality mark must adhere
to the scope and nature of certification and to the conditions of contract. Given the nature and inherent limitations of sample-based certification assessments, this certificate is not meant to express any form ofassurance on the performance of the organization being certified to the referred ISO standard. The certificate does not grant immunity from any legal/ regulatory obligations. All rights reserved. © Copyright

Page 1 of 2Digital version

       

iret, Inc.
Scope for certificate 2020-005
The scope of this ISO/IEC 27701:2019 certification is as follows:iret as a controller for:► Client information collected as part of the service initiation► Client information collected through business cards

iret as a processor for:► System Development and Maintenance within the Cloud Computing ServiceThe Privacy Information Management System is centrally managed out of Tokyo, Japan.
The scope mentioned above applies to the following locations:
1. Headquarters: Toranomon Hills Mori Tower 7F and 24F, 1-23-1 Toranomon, Minatoku, Tokyo
2. Osaka Office: Grandfront Osaka Tower A 27F, 4-20 Ofuka cho, Kita-ku, Osaka-shi,Osaka
3. Nagoya Office: Dai Nagoya Building 18F, 3-28-12 Meieki, Nakamura-ku, Nagoya-shi,Aichi
4. Kaigan Office: Residia Shibaura Kaigan 101, 3-15-5 Kaigan, Minato-ku, Tokyo
The scope includes approximately 1066 people across 4 office locations.

The Privacy Information Management System mentioned in the above scope is restricted
as defined in“PIMS Manual” version 1.05, May 29, 2023.

This scope is only valid in connection with certificate 2020-005.
Page 2 of 2Digital version