[The governing language of this policy shall be Japanese.]

Privacy Policy
Cybozu, Inc. , Cybozu Labs, Inc., and Cybozu Connect.C, Inc. (“Cybozu”) appropriately handle
personal information collected in the course of providing products and services, holding events,
and conducting other business activities, in accordance with the policy described below. Unlessotherwise provided for, in this policy, "personal information," "personal data," and "retained
personal data" are used in accordance with the terminology used in the Act on the Protection of
Personal Information (Act No. 57 of 2003. Hereinafter, the "Personal Information ProtectionAct").
Please note that the handling of personal information in recruitment activities is specified
separately here.
1 Information that we CollectIn the course of conducting our business activities, Cybozu collects personal information,
including the following:Names, addresses, employers, affiliated departments, positions, telephone and fax numbers, email addresses, bank account details, credit card numbers, facial photographs, videos,shareholder numbers, and information on subscribers to products and services, etc. (including"Customer Information" set forth in the cybozu.com Terms of Use.)※ Cybozu may collect the My Number (national identification number) of individuals,
such as sole proprietors, speakers, etc., for use in the preparation of payment statements
and withholding tax certificates.
2 How we Use your Information
Cybozu uses the collected personal information to the extent necessary to achieve thepurposes described below. If Cybozu uses personal information beyond the extent necessary toachieve the purposes described below, we will do so only after obtaining the consent of theindividual concerned.
(1)

Purposes personal information of people who have purchased or used our products andservices, or who have an interest in our products and services ("Customers") is used for:① to provide a range of information on products and services (new products and services, newfeatures, feature improvements, case studies, etc.)

② to provide information on, and to run, seminars and events③ to manage customer transaction information, such as subscription applications for ourproducts and services, changes to Customer Information, subscription renewals andcancellations, etc.
④ to estimate and/or bill for products, services, and subscription fees
⑤ to send thank you letters for purchasing our products and services⑥ to advise that we are conducting a survey on products and services, as well as to notify
winners, and to send out prizes⑦ to provide information on product and service maintenance, failures, etc.
⑧ to reply to inquiries received and to provide customer support⑨ to manage certification programs, user communities, and developer communities⑩ to utilize as basic data to enhance and improve our products and services; and⑪ to measure the effectiveness of marketing and customer support initiatives.
We may analyze your inquiry history, product and service purchase history, seminar and event
participation history and other information, together with your personal information, to infer
your interests, preferences, and trends, in order to achieve the purposes described above.
(2)

Purposes personal information of people in charge at Cybozu business partners is used for:① to manage business partner information② to engage in the necessary communications to enter into contracts and carry outtransactions; and③ to carry out billing and payment operations.
(3)

Purposes personal information of people who have reported vulnerabilities in our products

and services, or information security incidents at our company ("Reporter") is used for:① to contact the Reporter② to pay a bounty if the Reporter is participating in a Bug Bounty Program, and to administer
said program; and③ if the Reporter is participating in a Bug Bounty Testing Environment Program, to provide
the vulnerability verification environment and to administer said program.
(4)

Purposes personal information of shareholders and people who are interested in becominga shareholder is used for:① to exercise Cybozu’s rights and fulfill our obligations under the Companies Act② to implement various IR (Investor Relations) measures; and③ to manage shareholders, including the preparation of shareholder data as per the prescribedstandards under the various laws and regulations.
(5)

Purposes personal information of media representatives and other individuals not includedin (1) through (4) above is used for:① to contact the person; and② to provide information on, and to run, seminars and events.
(6)

Common purposes of using personal information in (1) through (5):

① to comply with applicable laws and regulations② to exercise or defend Cybozu’s legal rights; and③ in the event of a merger, acquisition, sale, or other transaction involving the business or its
assets, to support or give effect to the transaction.
3 How we Share your Information with Third-parties
Cybozu will not provide personal data to third parties without the prior consent of theindividual, except in the following cases:

when providing your Customer Information to a partner, to the extent necessary for thepartner to provide customer support or conduct other partner activities, when you purchase aproduct or service through a partner

when providing the Customer Information, to the provider of a billing and/or payment
collection service for the payment of products and services or subscription fees

when co-hosting a seminar or event with another company, and providing the co-host withthe participants’ personal dataWhen you go against the terms of use and/or guidelines, and disclosing your information isconsidered necessary to protect the rights, property, and/or the services of other customers
and/or Cybozu

when required by law

when it is necessary for the protection of the life, body, or property of a person and it isdifficult to obtain the consent of the individual

when it is particularly necessary to improve public health or promote the sounddevelopment of children, and it is difficult to obtain the consent of the individual; and

when it is necessary to cooperate with a national government agency or a local government,
or a person entrusted by either of the aforementioned in performing duties prescribed bylaws and regulations, and obtaining the consent of the individual concerned is likely toimpede the performance of such duties.
4 Outsourcing
Cybozu may outsource some of the handling of personal data. When Cybozu outsources, wewill select a contractor on the condition that the company has secured a sufficient level of
personal data protection, and will do so only after having entered into a contract pertaining topersonal data. In addition, Cybozu will conduct the necessary and appropriate supervision inrelation to the management of said contractors.
5 Joint Use
Cybozu will jointly use personal data between Cybozu and our subsidiaries (the "CybozuGroup") only when necessary within the scope described below.
(1) Items of personal information to be jointly used
Items stated in “1 Information that we Collect”(2) Scope of joint users
The Cybozu Group(3) Purpose of use
Items stated in “2 How we Use your Information”(4) Chief Administrator
Cybozu, Inc.
6 Security Control Measures
Cybozu takes necessary and appropriate measures, including those described below, toprevent the leakage, loss of, or damage to personal data handled by the company (in thisparagraph, including personal information scheduled to be handled as retained personal data)
and to otherwise securely manage personal data.
(1)

Formulation of basic policy/Establishment of rules on handling of personal data

Cybozu has established internal regulations for each stage of collection, use, and provisionof personal data, including handling methods, responsible persons and persons in charge,
and their duties, in order to ensure the proper handling of personal data.

(2)

Systematic security control measures

Cybozu has a system in place for reporting and communicating with the person in charge
for when signs of, or actual violations of laws, or internal regulations are identified.

Cybozu conducts regular self inspections on the status of personal data handling.

(3)

Human security control measures

Cybozu conducts regular training for employees on the important points regarding thehandling of personal data.

Matters relating to maintaining the confidentiality of personal data are stated in the WorkRules.

(4)

Physical security control measuresIn areas where personal data is handled, employee access is controlled and restrictions
imposed on devices brought into the area, and measures are implemented to prevent
unauthorized persons from viewing personal data.

In addition to taking measures to prevent the theft or loss of equipment, electronic media,documents, etc., that handle personal data, Cybozu takes measures to ensure that personal
data is not easily revealed when such equipment, electronic media, etc., are transported,
including within the business premises.

(5) Technical security control measures
Cybozu implements access controls limiting the range of people in charge and extent of thepersonal information database, etc., they can handle.

Cybozu has implemented systems to protect information systems that handle personal datafrom unauthorized access from outside and from unauthorized software.

(6)

Understanding the external environment

In the case of storing personal data in a cloud service, if either, the country where the cloudservice provider of the cloud service is located, or the country where the server where thepersonal data is stored is located, is a foreign country, Cybozu takes the necessary andappropriate measures for the safe management of personal data based on an understanding ofsaid foreign country's legal systems, etc., for the protection of personal information.
7 How to request disclosure, correction, suspension of use of your Data
Cybozu will respond to requests for disclosure of your retained personal data, correction,
addition or deletion of the content of your retained personal data, cessation of use, or deletion ofyour retained personal data, or cessation of provision of your retained personal data to thirdparties ("Requests for Disclosure, etc.") to the extent permitted by the Personal Information
Protection Act. If you wish to make Requests for Disclosure, etc., or to make a complaint
regarding our handling of personal information, please contact us at the inquiries desk listed in"10 Contact Us.”
8 Use of Cookies and Similar Technologies
Cybozu may link your personal information to your browsing history, etc. on our website
which we collect using cookies and web beacons (collectively, "Cookies") to analyze visitors toour website, deliver advertisements tailored to your interests, and to measure the effectivenessof advertisements.
Please refer to our Cookie Policy for information on how we use Cookies.
Cybozu may also encrypt or hash your personal information and provide it to Google LLC toanalyze visitors to our website, deliver advertisements tailored to your interests, or to measurethe effectiveness of advertisements based on the results of matching your personal information
with information held by Google LLC.
Details of the services we use are described below.
Service nameGoogle Enhanced Conversions

Data provided

Encrypted or hashed names, addresses, email addresses, andtelephone numbers

Privacy policy

https://policies.google.com/privacy?hl=ja

How to opt-out

https://support.google.com/ads/answer/2662922?hl=jav

9 Revision of this Policy
This policy is subject to revision without notice in response to changes in laws andregulations, changes in business activities, etc. Your understanding is appreciated.
10 Contact Us
For all inquiries regarding this policy, please contact us at:
Personal Information Inquiries Desk, Cybozu, Inc.
contactus@cybozu.co.jp
Revised on February 12, 2017
Revised on July 28, 2017
Revised on March 31, 2022
Revised on July 3, 2023

Revised on June 26, 2024
Revised on July 26, 2024