To Our Customers in the European Region

NOTICE(RE: Handling of Personal Data of Our Customers in the European Region)
SUBARU CORPORATION (“we”, “our company”) hereby notify you of our handling and use ofpersonal data of our customers in the European Region, for respecting our customers’ privacy andendeavor to protect our customers’ personal data in accordance with laws and regulations applicableto the handling of personal data, including the General Data Protection Regulation (GDPR). In thisNotice, the term “Europe(an)” means European Union member states, some member states ofEuropean Economic Area (Iceland, Lichtenstein and Norway) and the United Kingdom.

1.

Personal Data of Our Customers
The personal data of our customers which we collect, handle and use is as follows.
(i)Name, job title, age, user name, address, telephone number, email address;(ii)

Information connected to the products and services provided by our company;(iii)

Information concerning the type and language of the internet browser, operating
system, internet protocol address and cookies used by our customers; and(iv)2.

Other personal data separately set forth.

Purpose of Use of Personal Data of Our Customers
We use the personal data of our customers within the extent of the following purpose ofuse.
(i)

To announce products and services handled by our company and various eventsand campaigns held by our company;(ii)

To plan quality improvement, market analysis, plans and developments and sales
measures of the products and services, etc. handled by our company or toconsider plans to improve customer satisfaction, and to conduct surveys for these
purposes;(iii)

To carry out recalls, remediation measures and service campaigns, etc.;(iv)

To respond to various contacts, requests, consultations and complaints;(v)

To perform services accepted by our company;(vi)

To comply with laws and regulations, bylaws and other regulations; and(vii)

For use within the extent of the purpose of use clearly specified or notified upon
the acquisition of the personal data of our customers.

1/4

3.

Handling of Personal Data of Our Customers
We collect, handle and use (“Handling”, “Handle”) the personal data of our customers in
the following events.
(i)

When our customer consents to the Handling of its own personal data for one ormore specific purposes;(ii)

When Handling is required for the performance of an agreement to which ourcustomer is a party, or when Handling is required for the implementation ofproceedings at the request of our customer prior to the execution of anagreement;(iii)

When Handling is required for compliance with legal obligations to which weshould be subject to;(iv)

When Handling is required for the protection of the material interest of ourcustomer or any other person;(v)

When Handling is required for carrying out services for exercising public
interests or public authority entitled to our company; and(vi)When Handling is required for legitimate interests sought by our company or athird party.

4.

Handling by a Third Party
1) A third party may Handle the personal data of our customers in the following events.
(i)

We may entrust part of our services to a third party such as marketing companies
and IT service providers, and such third party may Handle the personal data ofour customers. In such case, the Handling of personal data of our customers will
be carried out in line with the purpose of use of the personal data of ourcustomers in Paragraph 2 under our instructions.

(ii)

Personal data of our customers may be Handled by dealerships, agencies andaffiliates of our company in order to promptly and smoothly respond to ourcustomers’ requests.

2) We will ensure that such third party and dealerships, etc. of our company takemeasures for safety management in Paragraph 6 even in the events of (i) and (ii) above.

5.

Disclosure and Provision to a Third PartyWe may disclose the personal data of our customers to a third party in the following
events.
(i)

If disclosure of personal data of our customers is required by laws andregulations; and2/4

(ii)

6.

If such disclosure is otherwise set forth in laws and regulation;

Measures for Safety Management of Personal Data of Our Customers
We will take appropriate technical, physical and organizational safety management
measures for the prevention of unauthorized access to personal data of our customers, loss,
destruction, falsification, divulgence, etc. of personal data of our customers and othersafety management of personal data of our customers. We will assume no liability for thesecurity of personal data of our customers in the website of other companies linked in ourwebsite. The handling of the personal data of our customers in the linked websites may
also be confirmed at such linked websites.

7.

Exercise of Rights Concerning Personal Data of Our Customers
Our customers may exercise the following rights with respect to their own personal data,
to the extent within the applicable law.
(i)

Right to object to our collecting, handling or using the personal data;(ii)

Right to receive necessary information when we collect the personal data of ourcustomers;(iii)

Right to access the personal data of our customers;(iv)

Right to request for amending the personal data of our customers;(v)

Right to request for the deletion of the personal data of our customers;(vi)

Right to request for restrictions on the handling of the personal data of ourcustomers;(vii)

Right to seek data portability of the personal data of our customers; and(viii)

Right to withdraw one’s own consent at any time.

Pease contact the following when you seek to exercise any of the rights above. We will
respond to your requests within one (1) month, in principle. We may reject your offers tothe extent permitted by laws and regulations, etc. You may file a complaint to the Data
Protection Supervisory Authority in Europe if you have any complaints against ourresponse to your requests or if you have any complaints with respect to our method ofhandling your personal data.

Customer Support Department, Customer Service Headquarters,SUBARU CORPORATIONEbisu Subaru Building, 20-8, Ebisu 1-chome, Shibuya-ku, Tokyo 150-8554

3/4

8.

Please refer to the “Contacts via the Internet” in our homepage for any contacts concerning
the Handling of the personal data of our customers.

https://www.subaru.co.jp/faq/

When we receive contact concerning the protection or handling of the personal data of ourcustomers, we shall only use the personal data of our customers for the purpose ofresponding to your contacts.

9.

Retention Period of Personal Data of Our Customers
The retention period of the personal data of our customers which we collect shall apply toeither of the following: (i) the period required for using the personal data of our customers
to the extent within the purpose of use and (ii) the period required under laws andregulations.

10.

Cookies
Part of the contents of our website uses cookies and other automated informationcollection means to improve services and to provide more appropriate services to ourcustomers. While the cookies function may be disabled by setting your browser, certain
functions of our website may not operate without cookies.

11.

Amendments to this Notice
We retain the right to amend or update this Notice, without restricting the rights set forth
herein.

This Notice was last updated on April 1, 2022.

Chief Privacy Officer
Managing Executive Officer
Katsuyuki Mizuma

4/4