Binding Corporate Rules
Processor Policy

CONTENTS
1.

Introduction .......................................................................................................................... 3

2.

Keywords ............................................................................................................................... 6

3.

Commitments as Data Processor ........................................................................................ 10
Commitments as Data Processor ................................................................................. 10
Rights of Clients ........................................................................................................... 13

4.

Personal Data Transfers ...................................................................................................... 15
Transfers of Personal Data ........................................................................................... 15

5.

Practical Commitments ....................................................................................................... 16
Security and Confidentiality ......................................................................................... 16
Accountability .............................................................................................................. 17
Training Programme .................................................................................................... 18
Audit Programme ......................................................................................................... 18
Relationship Between National Laws and the BCRs .................................................... 18
Complaint Mechanisms................................................................................................ 19
Cooperation With Authorities...................................................................................... 19
Updates of the Rules .................................................................................................... 20

6.

Third Party Beneficiary Rights And Liability ........................................................................ 21
Third Party Beneficiary Rights ...................................................................................... 21
Liability and Burden of Proof ....................................................................................... 22

7.

Final provisions.................................................................................................................... 23
Final Provisions ............................................................................................................ 23

Appendix I

List of Kumon Group Companies ...................................................................... 24

Appendix II

Subject Access and Complaint Procedures....................................................... 25

1

Complaint to Kumon ........................................................................................................ 25

1

2

Rights of Individuals: Subject Access Requests ............................................................... 27

3

Rights of Individuals: Other Requests .............................................................................. 28

Appendix III

Compliance Structure ....................................................................................... 29

1

Global Data Protection Officer ........................................................................................ 29

2

Global Data Protection Team .......................................................................................... 30

3

Local Data Protection Manager ....................................................................................... 30

4Internal Communication Procedure for Employees ........................................................ 31

Appendix IV
1

Training Protocol .............................................................................................. 32

Employee Training ........................................................................................................... 32

Appendix V

Audit Protocol ................................................................................................... 33

1

Audit Principles ................................................................................................................ 33

2

Audit Structure ................................................................................................................ 33

3

Audit Process ................................................................................................................... 33

Appendix VI

Update Procedure ............................................................................................ 35

1

Changes to the BCRs ........................................................................................................ 35

2

Changes to the BCRs Not Requiring Authorization.......................................................... 35

2

1. INTRODUCTION
Who are we?
Kumon is a worldwide leading provider of individualized education, headed by Kumon Instituteof Education Co., Ltd. based in Japan. Kumon provides learning programs to students of various
ages based on its independently developed “Kumon Method”. These learning programs areprovided through Kumon’s global network of franchised and company-owned Kumon study
centres and partner licensees.

What are the BCRs?
To achieve our mission to help as many individuals discover their potential and develop theirabilities to the maximum through the Kumon Method, sometimes Kumon will share Personal
Data between Kumon Group Companies. It is important for us that we handle Personal Datawith adequate protections. Kumon adopts the underlying Binding Corporate Rules to establish
Kumon’s principles for protecting Personal Data and the rules we will follow if we share
Personal Data with Kumon Group Companies outside the EEA.
The Binding Corporate Rules consist of two sets of policies: The Binding Corporate Rules –Controller Policy and the Binding Corporate Rules – Processor Policy. This document is the
Binding Corporate Rules – Processor Policy and shall be referred to herein simply as the “BCRs”.
These BCRs describe how Kumon Group Companies will comply with data protection laws whenacting as Data Processors for any third party, including Franchise Instructors.
These BCRs will be published on the relevant websites of Kumon.

What is covered by the BCRs?
These BCRs cover the collection of, transfer between, and all other Processing by the Kumon
Group Companies (see the list in Appendix I) of Personal Data originating in the EEA. This may
include the following:Franchise Instructors
Name, address, study centre name, contact information,
Data Categories

professional and educational information, instructor experience andhistory, and other information maintained by the franchise3

instructor in the dedicated server and systems for operating Kumon
study centres
Transfers Outside

To Kumon Institute of Education Co., Ltd. based in Japanthe EEA

To Kumon Europe & Africa Limited, based in the UKProviding IT support and maintenance of the dedicated serverand systems used by instructors for operating Kumon study

Purposes

centresProviding office/administration support

Students studying (or interested in studying) in the Kumon programme
Name, student ID, name of study centre, address, age, school grade,
Data Categories

study progress, length of study, and other information maintainedby the franchise instructor in the dedicated server and systems for
operating Kumon study centres

Transfers Outside

To Kumon Institute of Education Co., Ltd. based in Japanthe EEA

To Kumon Europe & Africa Limited, based in the UKProviding IT support and maintenance of the dedicated serverand systems used by instructors for operating Kumon study

Purposes

centresProviding office/administration support

Parents of Students
Name, student’s name, relationship with student, address, contact
Data Categories

information, and other information maintained by the franchise
instructor in the dedicated server and systems for operating Kumon
study centres

Transfers Outside

To Kumon Institute of Education Co., Ltd. based in Japanthe EEA

To Kumon Europe & Africa Limited, based in the UKProviding IT support and maintenance of the dedicated serverand systems used by instructors for operating Kumon study

Purposes

centresProviding office/administration support

The BCRs apply to all types of Processing, whether automated or manual, of whatever nature.

4

Who must follow the BCRs?
The Kumon Group Companies listed in Appendix I and their Employees must follow the BCRs. Eachof these Kumon Group Companies is bound to the BCRs through an intercompany agreement andis obligated to take necessary steps to ensure that it and its respective Employees respect these
BCRs.
The list of Kumon Group Companies in Appendix I may be updated from time to time in accordancewith the BCRs update procedure outlined in Appendix VI.

I have a question about the BCRs. Who do I ask?
For questions or concerns regarding the BCRs and their rights regarding the data collected andprocessed by a member of the Kumon Group, Individuals can contact the Global Data Protection
Team at the following email address: bcr@kumon.co.jp

5

2. KEYWORDS
For the purpose of the BCRs, the keywords below will have the following meanings:(a) “Child” or “Children”

Any Individual(s) under the age of 16 (or any other age whichconsent of a Guardian is required under the relevant EEA Laws inorder to process the Individual’s Personal Data).

(b) “Client”

When Kumon acts as Data Processor, the Data Controller or Data
Processor Kumon is processing Personal Data on behalf of. For the
avoidance of doubt, Client is never another Kumon Group
Company.

(c) “Client Agreement”

The agreement between Kumon and a Client which sets forth theterms for the Personal Data Processing.

(d) “Data Controller”

The natural or legal person, public authority, agency or any otherbody which, alone or jointly with others, determines the purposes
and means of the Processing of Personal Data, or which has been
designated as such under the applicable law.

(e) “Data Processor”

A natural or legal person, public authority, agency or any otherbody which processes Personal Data on behalf of the Data
Controller.

(f) “EEA”

The European Economic Area. Notwithstanding the foregoing,
during the transition period where the United Kingdom is bound to
the EU laws, the term “EEA” shall be construed to include theUnited Kingdom.

(g) “EEA Laws”

The laws of the European Union and the Member State from which
the Personal Data was originally obtained or first processed within
the EEA.

(h) “EEA Lead Entity”

Kumon Europe & Africa, Ltd., a Kumon Group Company establishedand operating in the United Kingdom. Notwithstanding theforegoing, by the end of the transition period where the United
Kingdom is bound to the EU laws, Kumon Instituto de Educación de6

España S. A., a Kumon Group Company established and operating inSpain, shall become the EEA Lead Entity.
(i) "Employee”

Any individual within a Kumon Group Company’s organization
engaged in the company’s operations under the direct or indirect
direction and supervision of the Kumon Group Company, which inaddition to employees with an employee relationship (full-time
employees, contract employees, part-time employees, etc.), shall
include officers, directors, corporate auditors, and temporary staff,
etc. For the avoidance of doubt, “employee” shall not include
independent contractors, subcontractors, or instructors/staff ofKumon Centres.

(j) “Franchise
Instructor”

Any instructor that has been authorized to instruct students basedon the Kumon Method on account of having entered a franchise
agreement with Kumon.

(k) “GDPR”

Regulation (EU) 2016/679 of the European Parliament and of theCouncil of 27 April 2016 on the protection of natural persons withregard to the processing of personal data and on the freemovement of such data, and repealing Directive 95/46/EC (General
Data Protection Regulation), with any amendments made fromtime to time.

(l) “Guardian”

A parent or person with parental responsibility of a given Individual.

(m) “Individual”

The data subject of the given personal data that has beentransferred from a Kumon Group Company in the EEA to a Kumon
Group Company outside the EEA.

(n) “KIE”

Kumon Institute of Education Co., Ltd.

(o) “Kumon”

The relevant Kumon Group Company or all Kumon Group
Companies collectively, depending on the context.

(p) “Kumon Group
Company”

Any of the entities listed in Appendix I, which shall be updated fromtime to time in accordance with Appendix VI.

7

(q) “Lead Supervisory

The Spanish Data Protection Supervisory Authority (Agencia

Authority”

Española de Protección de Datos (AEPD)), or other Supervisory
Authority which is duly designated as lead supervisory authority for
the BCRs under the applicable law.

(r) “Member State”

Any country within the EEA.

(s) “Personal Data”

Any information that originates from the EEA relating to a natural
person who can be identified, directly or indirectly, in particular byreference to an identifier such as a name, an identification number,
location data, an online identifier or to one or more factors specificto the physical, physiological, genetic, mental, economic, cultural orsocial identity of that natural person.

(t) “Processing”(of Personal Data)

Any operation or set of operations which is performed on Personal
Data or on sets of Personal Data, whether or not by automaticmeans, such as collection, recording, organization, structuring,storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or
destruction.

(u) “Processing Country”

The country where the given Personal Data is to be processed.

(v) “Special Categories

Personal Data revealing racial or ethnic origin, political opinions,of Personal Data”

religious or philosophical beliefs, or trade union membership, or
generic data, biometric data, or data concerning health or sex life
or sexual orientation of a natural person.

(w) “Supervisory

An independent public authority which is established by a Member

Authority”

State and is responsible for monitoring the application of the GDPR.

(x) “Third Party”

A natural or legal person, public authority, agency or body otherthan the Individual, Data Controller, or Kumon acting as Data
Processor. For the avoidance of doubt, Third Party shall not include
other Kumon Group Companies.

8(y) “Third Party
Beneficiary”

The Individual that enjoys third party beneficiary rights as provided
for under Section 6.1.1.

9

3. COMMITMENTS AS DATA PROCESSOR
Commitments as Data Processor
3.1.1

Basic Commitments: Where Kumon acts as Data Processor:(a)Kumon shall only process Personal Data in accordance with the documented
instructions of its Client including for data transfers to third countries, unless it isrequired to process data under applicable law to which it is subject. In such a case,
Kumon shall inform the Client of that legal requirement before Processing takes
place unless the applicable law prohibits such information on important grounds ofpublic interest. Each Kumon Group Member listed in Appendix I acting as Data
Processor and its Employees shall respect the instructions from the Client regarding
the data Processing and the security and confidentiality measures, as provided in
the Client Agreement and specified in (b) below;(b)

Kumon shall implement all appropriate technical and organizational measures toensure a level of security appropriate to the risk presented by the Processing (asfollowing from the provisions of Section 5.1), and must implement technical andorganisational measures which are specified in the Client Agreement, including any
obligations ensuring the security of the data consistent with the GDPR. In thiscontext, Kumon shall assist the Client in ensuring compliance with its obligations;(c)Kumon shall make sure that it executes any necessary measures as per the requestsof the Client in order to ensure that the Personal Data are kept up to date andadequate, corrected or deleted. Kumon shall ensure that all Kumon Group
Companies or external sub-processors to whom the data may have been disclosed
are informed of any rectification or deletion of data;(d)Kumon shall implement measures to delete or anonymize the Personal Data itprocesses on behalf of the Client according to the Client’s requests, from themoment the identification is not necessary anymore and ensure that each entity towhom the data may have been disclosed are informed of any deletion oranonymization of data;(e)Kumon shall be subject to a duty of transparency and fairness and shall thus help
and assist the Client to comply with the law, in particular its data protection
requirements, in a reasonable time and to the extent reasonably possible, including
communicating any useful information to help the Client respond to Individuals’
requests regarding the exercise of their rights, to handle their complaints and to10

assist the Client to be in a position to reply to investigation or inquiry from theSupervisory Authority;(f)Kumon will execute any necessary measures, insofar as this is possible, when asked
by the Client, for the fulfilment of the Client's obligations to respond to requests forexercising the Individual's rights, including by communicating any useful
information in order to help the Client to comply with the duty to respect the rightsof the Individuals. Kumon shall transmit without delay to the Client any request froman Individual without answering it, unless it is authorized to do so;(g)Kumon will have a duty to make available to the Client any information necessary
to demonstrate compliance with its obligations herein and allow for the Client to
conduct audits on its own account or via mandated auditor pursuant to Appendix V.
In addition, Kumon shall immediately inform the Client if in its opinion, an
instruction infringes these BCRs or other applicable laws;(h)Kumon will assist the Client in ensuring its compliance with the obligations regarding
carrying out data protection impact assessments (as outlined in Section 5.2).

(i)Kumon will assist the Client to implement appropriate technical and organizational
measures which are designed to implement data protection principles in an
effective manner and to integrate the necessary safeguards into the Processing inorder to facilitate compliance with these BCRs (as outlined in Section 5.2.5); and,(j)

Kumon will process Personal Data on behalf of the Client on the basis of the Client
Agreement concluded between them which shall be compliant with, and meet any
requirements set forth in the GDPR.

3.1.2

Inability to Fully Comply: In the event that at any time during the term of the Client
Agreement Kumon is unable to fully comply with any or all of the obligations set forth in
Section 3.1.1, including where Kumon has reason to believe that existing or future legislation
applicable to it may prevent it from fulfilling the instructions received from the Client orother obligations under the BCRs or Client Agreement, it shall promptly provide notice ofsuch to the Client. In such case, the Client shall be entitled to suspend the transfer of data
and/or to terminate the contract with immediate effect. Furthermore, Kumon shall promptly
notify the EEA Lead Entity and the Supervisory Authorities competent in relation to the Clientand in relation to Kumon.

3.1.3

Return or Destruction of Personal Data: Upon termination or expiration of the Client
Agreement, Kumon commits to return or destroy all Personal Data processed and delete
copies thereof according to the instructions of the Client, and certify to the Client that it has

11done so, unless applicable law requires it to store the Personal Data transferred. In such case,
Kumon will inform the Client and warrant that it will guarantee the confidentiality of, andwill not actively process the Personal Data transferred.
3.1.4

Information to be Provided to the Individual: Individuals are entitled to have easy access to
BCRs. Kumon undertakes to publish BCRs on the website accessible from the following URL
in order to ensure that the BCRs are easily accessible for the Individual:
https://www.kumongroup.com/eng/bcr/.

3.1.5

Legal Basis for Personal Data Processing: For the sake of clarity, Kumon is under noobligation to determine the legal basis for the Processing of Personal Data and, whereapplicable, Special Categories of Personal Data on behalf of the Client. It shall be the sole
responsibility of the Client or the ultimate Data Controller to determine the legal basis for
the Processing that Kumon performs under the Client’s instructions.

3.1.6

Appointment of a Sub-processor: Kumon will inform and seek the prior, informed written
authorization of its Client, whether specific or general, before appointing a sub-processor(whether a Third Party Data Processor or another Kumon Group Company) to carry out
Processing on Kumon’s behalf. The Client Agreement may specify a general priorauthorization at the beginning of the service, in which case Kumon will inform the Client of
the sub-processors at the time of conclusion of the contract, and subsequently, any intended
changes concerning the addition or replacement of a sub-processor in a timely manner as toenable the Client to object to the change or terminate the Client Agreement before data aretransferred to the new sub-processor. Only sub-processors who provide sufficientguarantees in respect of the commitments made by Kumon in the BCRs will be appointed,
in particular those who are able to establish and provide appropriate technical andorganisational measures that will govern their Processing of Personal Data. Kumon will
ensure this by:(a)Ensuring that the sub-processor will only act on Kumon’s instructions regarding therelevant Personal Data;(b)Concluding a written agreement which imposes on that sub-processor the samedata protection obligations as set out in the Client Agreement, in particular,
including commitments from the sub-processor regarding the security andconfidentiality of the relevant Personal Data being processed in accordance with the
BCRs and any other requirements set forth in Section 5.1.4; and,(c)

Establishing any other obligations that may be necessary to ensure that the12commitments of the sub-processor are aligned with the BCRs regarding theProcessing of relevant Personal Data (such as ensuring the sub-processor is
obligated to comply with the duties of Kumon to the Client, including, but notlimited to, those set forth in Sections 3.1.1, 3.1.3, 3.1.4 and 3.1.9).
3.1.7

Breach by a Sub-Processor: Kumon shall not be entitled to rely on a breach by a subprocessor of its obligations in order to avoid its liabilities to its Client.

3.1.8

Incorporation of BCRs in Client Agreement: When the Client Agreement entails transfers of
Personal Data falling within the scope of the BCRs, Kumon will incorporate its obligations as
Data Processor in the BCRs within the Client Agreement by including the BCRs as an annex
or including a reference to the BCRs that is accessible electronically, subject to the requestof the Client.

3.1.9

Notification of Breach/Disclosure of Audit Report to Client: Where there is a security or
confidentiality breach of Personal Data processed by Kumon for a Client, Kumon shall inform(i) the Client as a Data Controller in the event Kumon is a Data Processor, and (ii) thecontroller and the Client in the event Kumon is a sub-processor, without undue delay after
becoming aware of any breach, shall assist the Client in ensuring compliance with its
obligations in this regard and shall disclose the Audit Report prepared pursuant to Section
5.4 to the Client upon its request.

3.1.10 Disclosure Requests: In the event Kumon receives a legally binding request by a law
enforcement authority for disclosure of Personal Data processed on behalf of a Client,
Kumon shall provide notice of such to the Client unless otherwise prohibited (e.g., undercriminal law to preserve the confidentiality of a law enforcement investigation). In any event,Kumon will handle the disclosure request in the manner set forth in Section 5.5.4.

Rights of Clients
3.2.1

Responsibility Towards the Client: The Client shall have the right to enforce(a)these BCRs and the Client Agreement against any Kumon Group Company who has
caused the breach;(b)these BCRs and the Client Agreement against the EEA Lead Entity (Kumon Group
Company with delegated data protection responsibilities as outlined in Section 6.2)
in case the breach was caused by Kumon Group Company established outside the13

EEA; and/or,(c)the written agreement concluded with external sub-processors against the EEA Lead
Entity in case the breach was caused by an external sub-processor establishedoutside of the EEA.

14

4. PERSONAL DATA TRANSFERS
Transfers of Personal Data
4.1.1

Personal Data Transfers for Data Processing: Kumon will restrict transfers and onward
transfers of Personal Data to another Data Processor (regardless of whether a Third Party or
another Kumon Group Company) unless it:(a)has entered into written agreements with the Data Processor that meet any
requirements set forth in Section 3.1.6 and any requirements stipulated under the
GDPR prior to the transfer taking place; and,(b)

has otherwise taken necessary measures to ensure adequate protection under the
GDPR for the Personal Data concerned by the transfer.

4.1.2

Data Transfers and Onward Transfers: Subject to the Client’s instructions pursuant to
Section 3.1.1(a), Kumon will restrict transfers and onward transfers of Personal Data to any
entity outside of the EEA (regardless of whether a Third Party or another Kumon Group
Company), unless made in compliance with the laws and rules of the GDPR regardingtransfer of Personal Data, and specifically:(a)the transfer is to a third country or an international organisation the relevant
authority has determined to ensure an adequate level of protection;(b)

the transfer is subject to appropriate safeguards recognized under the GDPR that
ensure the enforceable rights and effective legal remedies afforded to theIndividuals;(c)the transfer satisfies a condition specified as a derogation permitted under GDPR;
or,

(d)

if the transfer is to another Kumon Group Company outside the EEA, the transfer
will take place in accordance with these BCRs.

15

5. PRACTICAL COMMITMENTS
Security and Confidentiality
5.1.1

Technical and Organizational Measures: Kumon will ensure that Personal Data is processedin a manner that ensures appropriate security of Personal Data including protection against
unauthorized or unlawful Processing and against accidental loss, destruction or damage, inparticular where the Processing involves the transmission of data over a network, andagainst all other unlawful forms of Processing. Kumon ensures this by implementing
appropriate technical and organizational measures which will be updated from time to time.

5.1.2

Level of Security: The technical and organizational measures to be implemented shall ensure
a level of security appropriate to the risk, having regard to the state of the art (as thisexpression is understood under Article 32 of the GDPR) and the cost of their implementation,and the nature, scope, context and purposes of Processing as well as the risk of varying
likelihood and severity for the rights and freedoms of natural persons.

5.1.3

Employee Compliance: Employees may only process Personal Data in accordance with the
BCRs. Any Employees who breach the BCRs may be subject to disciplinary action (up to andincluding dismissal).

5.1.4

Written Agreements with Data Processors: Kumon will ensure that any Data Processor(whether a Third Party or another Kumon Group Company) that processes Personal Data on
Kumon’s behalf will be bound by a written agreement (as outlined in Section 4.1) compliant
with and including all required elements of Article 28.3 of the GDPR, such as that it will act
only on Kumon’s instructions and shall be responsible for the implementation of adequate
security and confidentiality measures, as well as notifying a breach of Personal Data to
Kumon without undue delay.

5.1.5

Personal Data Breach: In addition to informing the Client and/or the Data Controller
pursuant to Section 3.1.9, Personal Data breaches will be documented (including the factsof the breach, the effects and the remedial action taken). Such documentation will be madeavailable to the competent Supervisory Authority upon its request.

16

Accountability
5.2.1

Kumon shall be responsible for and be able to demonstrate compliance with these BCRs.

5.2.2

Record Keeping: Kumon will ensure that clear records of all data Processing activities are
kept, including:(a)the name and contact details of:(i)the Data Processor or Data Processors and of each Data Controller on behalfof which the Data Processor is acting, and;(ii) where applicable, Data Controller’s or the Data Processor’s representative,and data protection officer;(b)categories of Individuals and Personal Data processed by, or on behalf of, the Data
Controllers;(c)descriptions of technical and organizational security measures that are in place;(d)where applicable, transfers of Personal Data to a third country or an internationalorganisation and documentation of safeguards deployed for any transfers tocountries which the Supervisory Authority of the country where the transfer
originates has not decided to ensure an adequate level of protection; and,

(e)
5.2.3

any other information which should be recorded pursuant to the GDPR.

Kumon shall maintain the record of Processing activities in writing, including in electronic
form, and when requested, shall make it available to the Supervisory Authority.

5.2.4

Data Protection Impact Assessment: Kumon shall determine the need to carry out dataprotection impact assessments for Processing operations that are likely to result in a highrisk to the rights and freedom of natural persons. If the results show that the Processing
would result in high risk in the absence of measures taken by Kumon to mitigate the risks,
Kumon shall consult the Supervisory Authority, prior to Processing.

5.2.5

Data Protection By Design and By Default: Kumon shall implement appropriate technicaland organizational measures which are designed to implement data protection principles inan effective manner and to integrate the necessary safeguards into the Processing in orderto facilitate compliance with these BCRs.

5.2.6

Kumon will appoint a Global Data Protection Officer, with the top management support, to17

oversee and ensure compliance with the BCRs in Kumon, in accordance with the protocol
described in Appendix III.

Training Programme
5.3.1

Kumon will provide appropriate training on the BCRs to its Employees in accordance withthe protocol described in Appendix IV.

5.3.2

No Employee will be permitted (i) to transfer Personal Data to a country outside of the EEA
or (ii) to handle Personal Data outside of the EEA, prior to receiving appropriate training to
do so.

Audit Programme
5.4.1

Kumon will audit its compliance with the BCRs in accordance with the protocol described inAppendix V.

Relationship Between National Laws and the BCRs
5.5.1

Where the laws of any country in which the Personal Data is processed require a higher levelof protection for Personal Data, they will take precedence over the BCRs.

5.5.2

If Kumon has reason to believe that the existing or future national legislation of theProcessing Country may prevent it from fulfilling its obligations under the BCRs, or may havesubstantial effect on the guarantees provided by the BCRs, Kumon shall promptly inform the
Global Data Protection Team (see Appendix III), the EEA Lead Entity, the Client, theSupervisory Authority competent for the Data Controller and the Supervisory Authority
competent for the Data Processor, where applicable, unless this is prohibited by a law
enforcement authority (including obligations under criminal laws to preserve theconfidentiality of a law enforcement investigation).The Client shall be entitled to suspend
the data transfer and/or terminate the Client Agreement.

5.5.3

Where there is a conflict between national law and the commitments in the BCRs, the Global
Data Protection Officer (see Appendix III) will make a responsible decision on what action totake and will consult the competent Supervisory Authorities in case of doubt.

18

5.5.4

If Kumon has reason to believe that legal requirements that it may be subject to in a third
country is likely to have a substantial adverse effect on the guarantees provided by the BCRs,
including legally binding requests for disclosure of Personal Data by a law enforcement
authority or state security body, Kumon shall promptly inform the Global Data Protection
Team (in accordance with the procedure set out in Appendix III), the competent Supervisory
Authority and the Client of:(a)the request (including the type of data requested);(b)

the requesting body; and,(c)the legal basis for the request,

unless this is prohibited by a law enforcement authority (including obligations under criminal
laws to preserve the confidentiality of a law enforcement investigation). In such case, Kumon
will use its best efforts to obtain the right to waive such obligation and communicate asmuch information to the competent Supervisory Authority as soon as possible, anddemonstrate its efforts thereto. If, despite Kumon’s best efforts, it is not in a position to
notify the competent Supervisory Authority, it will provide general information on therequests it receives once per year (including the number of disclosure requests and the typeof data requested and the requester, where possible).
5.5.5

In any event, where Kumon is obliged to provide Personal Data to a public authority, thisshall not concern a massive or disproportionate amount of Personal Data, and shall not be
indiscriminate in such a manner as to go beyond what is necessary in a democratic society.

Complaint Mechanisms
5.6.1

Individuals whose Personal Data are processed by Kumon have the right to file complaints
to Kumon using the complaint handling process described in Appendix II.

5.6.2

Where the Client has disappeared factually, has ceased to exist in law or has become
insolvent, unless the entire legal obligations of the Client are assumed by another entity,
Kumon shall handle complaints of Individuals pursuant to the terms and conditions specified
in Appendix II.

Cooperation With Authorities
5.7.1

Cooperation with Supervisory Authority: Kumon shall cooperate with the competentSupervisory Authority and assist each other to handle an investigation or inquiry by19

Supervisory Authorities.
5.7.2

Compliance with Decision of Supervisory Authority: Kumon accepts to be audited by thecompetent Supervisory Authority and will comply with the advice given by the competentSupervisory Authority on any issues regarding the interpretation of the BCRs. For the
avoidance of doubt, nothing herein shall be construed to be a waiver of Kumon’s rights toappeal a decision by the competent Supervisory Authority.

Updates of the Rules
5.8.1

Any update to the BCRs will be made, and reported to the Supervisory Authorities and to the
Client, in accordance with the procedures described in Appendix VI.

20

6. THIRD PARTY BENEFICIARY RIGHTS AND
LIABILITY
Third Party Beneficiary Rights
6.1.1

Enforcing the BCRs:

Individuals shall have the right to enforce, as Third Party Beneficiaries,

directly against Kumon those provisions of the BCRs that are specifically directed to Data
Processors and confer rights on Individuals, particularly Section 3.1.1, Section 3.1.2, Section
3.1.3, Section 3.1.4, Section 3.1.6, Section 3.1.9, Section 3.1.10, Section 5.1, Section 5.2,
Section 5.5, Section 5.6 (and by extension, Appendix II), Section 5.7, Section 6.1 and Section
6.2. Such rights cover judicial remedies for any breach of the Third Party beneficiary rights
guaranteed herein, the right to obtain redress, and where appropriate, the right to receive
compensation for any damage (material harm but also any distress).
6.1.2

Responsible Kumon Group Company: The EEA Lead Entity shall be the EEA-based Kumon
Group Company responsible to respond to Third Party Beneficiary rights.

6.1.3

Jurisdiction Provisions: Third Party Beneficiaries shall have the right to lodge a complaint, inparticular, before:(a)the competent courts of the Member State whose jurisdiction is established either
on the basis of the place where Kumon or the Client has an establishment, or where
the Third Party Beneficiary has his or her habitual residence, as the Third Party
Beneficiary may so choose; and(b)the competent Supervisory Authorities whose jurisdiction is established, inparticular, either on the basis of the place where the Third Party Beneficiary has hisor her habitual residence, or where he/she has his or her place of work, or where
the alleged infringement of the BCRs has taken place, as the Third Party Beneficiary
may so choose.

6.1.4

Rights of Individuals of Client Personal Data: In the event a Client factually disappears,
ceases to exist in law or has become insolvent, unless the entire legal obligations of the Client
are assumed by another entity, Individuals whose Personal Data is processed by Kumon on
behalf of the Client will be entitled to enforce the BCRs as Third Party Beneficiaries against
Kumon acting as a Data Processor, particularly Section 3.1.1, Section 3.1.4, Section 5.2,
Section 5.5, Section 5.6 (and by extension, Appendix II), Section 5.7, Section 6.1, Section 6.2

21

and Appendix I. Such right covers judicial remedies as well as the right to receive
compensation in accordance with Sections 6.1.1 and 6.1.3 above.

Liability and Burden of Proof
6.2.1

The EEA Lead Entity’s Responsibility Regarding Personal Data: The EEA Lead Entity agrees
that:
(a)

the EEA Lead Entity shall be responsible for and agree to take the necessary action
to remedy for the acts of other Kumon Group Companies established outside of the
EEA or for breaches caused by an external sub-processor established outside the
EEA, and to pay compensation for any material or non-material damages resulting
from the violation of the BCRs by the Kumon Group Company or any external subprocessor established outside of the EEA. The EEA Lead Entity confirms that it has
sufficient assets to pay compensation for damages resulting from such breach of the
BCRs;

(b)

the EEA Lead Entity shall accept the jurisdiction of the courts or other competentauthorities in the EU and shall accept responsibility for violations of the BCRs and,in particular, for Individuals rights and remedies that result thereof as if the violation
had been caused by the EEA Lead Entity in the Member State in which it is basedinstead of the Kumon Group Company established outside the EEA or the external
sub-processor or the Third Party Data Processor established outside the EEA; and(c)the EEA Lead Entity shall not be entitled to rely on a breach by a Third Party Data
Processor of its obligations in order to avoid its own liabilities.

6.2.2

Burden of Proof for EEA Personal Data of Third Party Beneficiaries:(a)

The EEA Lead Entity has the burden of proof to demonstrate that the Kumon Group
Company established outside of the EEA or an external sub-processor is not liable
for any violation of the BCRs which has resulted in the Individuals claiming damages.

(b)

In the event the Client can demonstrate that it has suffered damage and canestablish facts which show it is likely that the damage has occurred because of thebreach of BCRs by a Kumon Group Company or any external sub-processor
established outside the EEA, it is for the EEA Lead Entity to prove that such Kumon
Group Company or such external sub-processor is not responsible for the breach.

(c)

If the EEA Lead Entity can prove that the Kumon Group Company or external subprocessor is not responsible for the event giving rise to the damage, it may discharge
itself from any liability/ responsibility.

227. FINAL PROVISIONS
Final Provisions
7.1.1

The BCRs will be effective from the date they are approved by the Lead Supervisory Authority.

23

APPENDIX I

LIST OF KUMON GROUP COMPANIESAll queries regarding these BCRs can be made to this email address: bcr@kumon.co.jp
RegionJAPAN

Company Name
Kumon Institute of Education

Address/Website
Kumon Kyoiku-Kaikan 5-6-6 Nishinakajima Yodogawaku Osaka 532-8511 Japan

Co., Ltd.

Kumon Europe & Africa

https://www.kumon.ne.jp/
4th Floor West, Ealing Cross, 85 Uxbridge Road,
Ealing, London, W5 5TH U.K.

LimitedEUROPEAND
AFRICA

Kumon Instituto de Educación

http://www.kumon.co.uk/
Paseo de la Castellana, 131, planta baja y primera
28046 Madrid, SPAIN

de España S. A.
Kumon Deutschland GmbH

http://www.kumon.es/
Wiesenstrasse 21. 40549 Düsseldorf GERMANY
http://www.kumon.de/24

APPENDIX IISUBJECT ACCESS AND COMPLAINTPROCEDURES
1

Complaint to Kumon

1.1

Responsible Team: The Global Data Protection Officer, Global Data Protection Team, andLocal Data Protection Managers are the main competent departments in charge of ensuring
to Individuals the fulfilment of their access requests and the handling of their complaints (seeAppendix III).

1.2

Contact Window: Any Individual may bring complaints regarding the compliance with the
BCRs by contacting the Local Data Protection Manager in the country where the Individual
resides (see Appendix III). The contact details of the relevant Local Data Protection Manager
are made available in the local website of the Kumon Group Company in a particular country.

1.3

Receipt Confirmation: The Local Data Protection Manager will promptly acknowledge receiptof the complaint to the Individual, and will without undue delay and in any event within one
month from the date the complaint is received, make a substantive response.

1.4

Complaints for Personal Data of Different Jurisdictions: If the complaint relates to Personal
Data originating outside the jurisdiction of the Local Data Protection Manager, it will promptly
report the Individual’s complaint to the Global Data Protection Team, who will handle allcomplaints under the BCRs. If necessary, the Global Data Protection Team may cooperate withother Employees from relevant Kumon Group Companies, business and support units asappropriate to deal with the complaint. The Global Data Protection Team will acknowledge
receipt of a complaint to the Individual within ten working days, and make a substantive
response within one month, from the date the complaint is received.

1.5

Response Time Frame: If, due to the complexity of the complaint or the number of requests,
a substantive response cannot be given within the period prescribed in Section 1.3 or 1.4, as
the case may be, the complainant will be advised accordingly with a reasonable estimate (notexceeding two additional months) for the timescale within which a response will be provided.

1.6

If the Local Data Protection Manager or the Global Data Protection Team reaches theconclusion that the complaint has merit or is founded, it will take adequate measures in25

accordance with the nature of the complaint so as to ensure compliance with the BCRs.
1.7

If the Local Data Protection Manager or the Global Data Protection Team rejects the complaint
because it considers it without merit or unfounded, the Individual will be informed of thisfinding and will be reminded in the response given to the Individual by the Local Data
Protection Manager or the Global Data Protection Team that s/he may always address his or
her complaints or claims to the Global Data Protection Officer.

1.8

Disputing a Response: If the complainant disputes the response from the Local Data
Protection Manager or the Global Data Protection Team or any aspect of a finding and notifies
the responding party to that effect, the matter will be referred to the Global Data Protection
Officer. The Global Data Protection Officer will review the case, and advise the complainantof his/her determination either to uphold the findings of the responding party or to substitutea new finding, within one month (which may be extended by two further months dependingon the complexity and number of requests) of the receipt of the complaint from the pertinent
Data Protection Team/Manager.

1.9

If the complaint is upheld, the Global Data Protection Officer will arrange for any necessary
steps to be taken as a consequence.

1.10 If the Individual finds any action taken by Kumon to be insufficient to address his or her
complaint, the Individual may always address his or her complaints or claims to the competentSupervisory Authorities or courts of the Member States without prejudice to whether or nots/he has first complained directly to Kumon pursuant to Section 6.1.3 of the BCRs. The
Individual will be reminded of this right in the response given to the Individual by the Local
Data Protection Manager or the Global Data Protection Team or the Global Data Protection
Officer.
1.11 Complaints Regarding Client Personal Data: Where a complaint is brought with the Local Data
Protection Manager in respect of the collection and use of Personal Data where Kumon is a
Data Processor, Kumon will communicate the details of the complaint to the Client without
undue delay. If the Client requests that Kumon investigate the complaint, Kumon will further
act strictly in line with the terms of the Client Agreement.

26

2

Rights of Individuals: Subject Access Requests

2.1

The Individual may request to exercise his or her 'right to access' from Kumon as a Data
Processor when the Individual is unable to bring a claim against the Data Controller pursuant
to Section 6.1.4 of the BCRs.

2.2

The request may be made in writing or orally, which can include email, to the Local Data
Protection Manager in EEA or the Global Data Protection Team. The Local Data Protection
Manager receiving the request will report the details of the request to the Global Data
Protection Team.

2.3

The Global Data Protection Team, whether directly or through the Local Data Protection
Manager receiving the request, will respond to a valid request with information on the action
taken on the request, without undue delay, and in any event, within one month (or any shorter
period as may be stipulated under local law) of receipt of that request. The response
timeframe may be extended by an additional two months subject to the conditions stipulated
in Section 1.5 of Appendix II of the BCRs.

2.4

Kumon is not obliged to comply with a subject access request where Kumon has reasonable
doubts concerning the identity of the person making the request and is not supplied with theinformation it reasonably required in order to confirm the identity of the Individual making
the request and to locate the data which that Individual seeks. Kumon will adhere to national
legal requirements when conducting the identification process.

2.5

The Global Data Protection Team will make an initial assessment of the request to decide
whether it is a valid request and whether confirmation of identity, or any further information,is required. It will also engage appropriate Employees for support with handling the subject
access, as required or appropriate.

2.6

The Global Data Protection Team will then contact the Individual in writing to confirm receiptof the subject access request, seek confirmation of identity or further information, if required,or decline the request if one of the exemptions to subject access applies.

2.7

Valid requests may be refused only if the requests are manifestly unfounded or excessive.

27

3

Rights of Individuals: Other Requests

3.1

The Individual may request to exercise other rights afforded to it under the GDPR. Such arequest must be considered and dealt with as appropriate by the Local Data Protection
Manager of country where the Personal Data originates, upon consultation with the Global
Data Protection Team as necessary. The response timeframes stipulated in Section 2.3 ofAppendix II of the BCRs should apply mutatis mutandis.

3.2

If a request is received advising of a change in an Individual’s Personal Data where Kumon is
the Data Controller for that Personal Data, such information must be rectified or updated
accordingly if Kumon is satisfied that there is a legitimate basis for doing so.

3.3

When Kumon deletes, anonymizes, updates, or corrects Personal Data, on instruction of a
Client, Kumon will notify other Kumon Group Companies or any sub-processor to whom the
Personal Data has been disclosed accordingly so that they can also update their records.

28

APPENDIX III COMPLIANCE STRUCTURE
1Global Data Protection Officer

1.1

The Global Data Protection Officer appointed by Kumon will be responsible for executive-level
oversight of and responsibility for ensuring Kumon’s compliance with the BCRs as well as
applicable data protection laws. It will not be subject to any conflict of interest, will report
directly to KIE’s Board of Directors/CEO, and its appointment, role and performance will be
carried out in accordance with the GDPR and the European Data Protection Board Guidelines
on Data Protection Officers, as updated from time to time. The Global Data Protection Officer
shall not receive any instructions regarding the exercise of his/her tasks and shall have thesupport of KIE’s executives.

1.2

The Global Data Protection Officer’s key responsibilities include:(a)Ensuring that the BCRs and other rules related to data protection, objectives andstandards are defined and communicated;(b)

Providing clear and visible senior management support and resources for the BCRs andfor privacy objectives and initiatives in general;(c)

Evaluating, approving and prioritizing remedial actions consistent with therequirements of the BCRs, strategic plans, business objectives and regulatory
requirements;(d)Periodically assessing privacy initiatives, accomplishments, and resources to ensure
continued effectiveness and improvement;(e)Ensuring that Kumon's business objectives align with the BCRs and related dataprotection strategies, policies and practices;(f)Coordinating communication on the BCRs and data protection issues during the audit;(g)

Dealing with any complaints escalated to him/her in accordance with the BCRs’ Subject
Access and Complaint Procedures; and,(h)Acting as the point of contact for dealing with Supervisory Authorities (or delegatingsuch role to Local Data Protection Managers with respect to matters exclusive to a given
region).

29

2

Global Data Protection Team

2.1

The Global Data Protection Team consists of personnel appointed by KIE and fulfils such
responsibilities as follows under the direction of the Global Data Protection Officer:(a)Providing guidance about the Processing of Personal Data in accordance with the BCRs;(b)

Responding to inquiries and compliance relating to the BCRs from Employees,
customers and other Third Parties;(c)

Providing input on audits of the BCRs, coordinating responses to audit findings andresponding to inquiries of the Supervisory Authorities;(d)Monitoring changes to global data protection laws and ensuring that appropriatechanges are made to the BCRs and Kumon's related policies and practices;(e)

Arranging for training of Employees on the BCRs and data protection laws;(f)Promoting the awareness on data protection across business units and functional areas
through communications and initiatives;(g)

Evaluating data protection processes and procedures to ensure that they aresustainable and effective;(h)Reporting periodically on the status of the BCRs to the Global Data Protection Officer
and other organizations as appropriate;(i)Ensuring that any matters relating to compliance with the BCRs are brought to theattention of the Global Data Protection Team and the Global Data Protection Officer,
as appropriate, and that any corrective actions are determined and implemented
within a reasonable time; and(j)

Ensuring that any changes to the BCRs are made in accordance with the Update
Procedures (see Appendix VI).

3

Local Data Protection Manager

3.1

Each Kumon Group Company will have a Local Data Protection Manager, who is responsiblefor day-to-day data protection compliance in the company.

3.2

When the Global Data Protection Officer deems it appropriate, the Local Data Protection
Manager for the regional headquarters in the Kumon Group may coordinate the activities of
the Local Data Protection Managers for the headquarters’ subsidiaries. Furthermore, where
delegated to do so by the Global Data Protection Officer, the Local Data Protection Manager
shall be the point of contact for dealing with Supervisory Authorities for exclusively local

30

personal data matters.
3.3

The Local Data Protection Manager shall cooperate with the Global Data Protection Officer
and Global Data Protection Team, by such means as:(a)Updating them on the applicable law on the personal data protection;(b)

Providing training on the personal data protection in the company; and(c)Providing information about the status of personal data protection in the company.

4Internal Communication Procedure for Employees

4.1

Kumon makes available to all Employees a hotline to communicate any inquiry related topersonal data protection issues outlined in the BCRs.

4.2

Alternatively, an Employee may communicate any inquiry related to personal data protection
issues outlined in the BCRs to the Local Data Protection Manager, who will review and respondto it within one month from receipt of the inquiry. If the inquiry concerns matters that are notpurely local, the Local Data Protection Manager will consult the Global Data Protection Team.

4.3

If the Employee disputes the response from the Local Data Protection Manager or the Global
Data Protection Team or any aspect of a finding and notifies the responding party to that effect,
the matter will be referred to the Global Data Protection Officer. The Global Data Protection
Officer will review the case, and advise the Employee of his/her determination either touphold the findings of the responding party or to substitute a new finding, within one month(which may be extended by two further months depending on the complexity and number ofrequests) of the receipt of the inquiry from the pertinent Data Protection Team/Manager.

4.4

Complaints by Employees regarding the handling of their data by the Kumon Group
Companies under these BCRs can be made as detailed in Appendix II of the BCRs.

31

APPENDIX IV TRAINING PROTOCOL
1

Employee Training

1.1

All Employees involved in the transfer, handling and collecting of Personal Data will be
required to be trained on personal data protection, including summary of the BCRs andapplicable data protection laws (i) as part of their induction program and (ii) at least once
every year.

Such training shall be provided by E-training, on-site seminars or other manneras deemed suitable under the circumstances.
1.2

The Global Data Protection Team will prepare the training materials and provide them to the
Local Data Protection Manager. The Local Data Protection Manager will then conduct thetraining for the Employees in the company, and record and report of the outcome of the
training to the Global Data Protection Team.

1.3

The purpose of these trainings is that the Employees be trained on the basic principles ofprotection, confidentiality and security of Personal Data and all information systems that
contain Personal Data.

1.4

Kumon will provide such additional training opportunities as it deems appropriate, such as:-Special E-training designed for managerial Employees;-

Training designed for specific departments (e.g., HR, IT, field offices); and-Global training opportunities, such as e-training via global intranet and intragroupconferences.

1.5

The training will be provided on the following subjects:-

The substance of the local law on personal data protection;-

The substance of and any changes to the BCRs; and-How the personal data protection law affects Kumon (including best practices forcomplying with the BCRs).

32

APPENDIX V

AUDIT PROTOCOL

1

Audit Principles

1.1

Kumon agrees to be subject to a duty to undergo data protection audits on a regular basis, tobe performed either by internal or accredited external auditors, or on specific request fromthe Global Data Protection Officer.

2

Audit Structure

2.1

The Global Data Protection Officer will arrange for Kumon’s internal or accredited external
auditor (the “Audit Team”), as it deems appropriate, to effect independent audits ofcompliance with all aspects of the BCRs, including methods of ensuring that corrective actions
will be adopted and implemented.

2.2

The Audit Team will be responsible for performing and/or overseeing independent audits ofcompliance with the BCRs and will ensure that such audits address all aspects of the BCRs. In
addition, the Audit Team is responsible for ensuring that any issues or instances ofnoncompliance are brought to the attention of the Global Data Protection Team and therelevant Local Data Protection Managers.

2.3

Kumon will accept, at the request of the Client, to submit its data processing facilities for auditof the processing activities relating to that Client, in which case the audit shall be carried out
by such Client, or by independent auditors in possession of the required qualifications,selected by that Client and bound by a duty of confidentiality, as stipulated in the Client
Agreement. Where applicable, Kumon will ensure that sub-processors will also comply withthe above audit requests.

3

Audit Process

3.1

Audits shall cover all aspects of the BCRs and shall identify methods of corrective actions thatmight be required as a result of the audit.

3.2

Audits of compliance with the BCRs are conducted:(a)

at least annually in accordance with Kumon's audit procedures;

33

(b)

at the request of the Global Data Protection Officer and/or KIE’s Board of Directors;(c)

as determined necessary by the Global Data Protection Team (for example, in response
to a specific incident); and/or,

(d)
3.3

when Kumon acts as Data Processor, as required by the terms of Client Agreement.

The Audit Team will conduct a risk-based analysis to determine the scope of the audit, which
will consider relevant issues such as: new or specific risk for the audited company’s business;changes to the security systems or procedures; the subject matter of any previous audit orcomplaints; nature and location of the Personal Data, as well as the manner of Processing.

3.4

The audit shall be conducted by on-site inspection, interview with concerned personnel,
questionnaires, document review, or other method as deemed appropriate by the Audit Team.

3.5

The results of all audits will be communicated to the Global Data Protection Officer and to
KIE’s Board of Directors, and will also be made available to the relevant Client.

3.6

A copy of the result of audits will be provided to the Supervisory Authorities upon their request.

3.7

Any Kumon Group Company accepts to be audited by the Supervisory Authorities and willcomply with the advice of the Supervisory Authorities on any issue related to those rules.

34

APPENDIX VI UPDATE PROCEDURE
1Changes to the BCRs

1.1

Kumon will communicate any changes to the BCRs without undue delay to the relevantSupervisory Authorities via the competent Supervisory Authorities as well as to all Kumon
Group Companies.

1.2

Kumon will also report changes made to the BCRs to the Client. If the changes to the BCRs
affect the conditions under which Kumon processes Personal Data as Data Processor, Kumon
will inform the proposed change to the affected Client in advance, in a timely fashion so that
the Client has the possibility to object to the change to or to terminate the Client Agreementwith Kumon, before the modification is made.

2

Changes to the BCRs Not Requiring Authorization

2.1

Updates to the BCRs or to the list of Kumon Group Companies are possible without having to
re-apply for an authorization provided that:(a)

The Global Data Protection Officer maintains an up to date list of the Kumon Group
Companies bound by the BCRs and of the sub-processors appointed by Kumon toprocess Personal Data. Such list shall be made accessible to the Clients, Individuals andSupervisory Authorities upon their valid request.

(b)

The Global Data Protection Officer will maintain the record of changes to the BCRs,
including the date the changes become effective and the details of the changes made,and will provide the necessary information upon request to the Individual,
systematically to the Client, and upon request to Supervisory Authorities.

(c)

No transfer is made to a new member until the new member is effectively bound by
the BCRs and can deliver compliance.

(d)

Any changes to the BCRs or to the list of Kumon Group Companies shall be reported
once a year to the Supervisory Authorities granting the authorizations with a brief
explanation of the reasons justifying the update.

(e)

Any changes to the BCRs that could affect the level of the protection offered by the
BCRs or significantly affect the BCRs will be promptly communicated to the relevantSupervisory Authorities, via the competent Supervisory Authority.

35