Binding Corporate Rules
Controller Policy

CONTENTS
1.

Introduction .......................................................................................................................... 3

2.

Keywords ............................................................................................................................... 73.

Commitments as Data Controller........................................................................................ 10
Basic Principles ............................................................................................................. 10
Legal Basis For Processing Personal Data .................................................................... 10
Transparency And Information Disclosure .................................................................. 11
Rights of Individuals ..................................................................................................... 13Children’s Personal Data .............................................................................................. 14
Special Categories of Personal Data ............................................................................ 15

4.

Personal Data Transfers ...................................................................................................... 16
Transfers of Personal Data ........................................................................................... 16

5.

Practical Commitments ....................................................................................................... 17
Security and Confidentiality ......................................................................................... 17
Accountability .............................................................................................................. 18
Training Programme .................................................................................................... 19
Audit Programme ......................................................................................................... 19
Relationship Between National Laws and the BCRs .................................................... 19
Complaint Mechanisms................................................................................................ 21
Cooperation With Authorities...................................................................................... 21
Updates of the Rules .................................................................................................... 21

6.

Third Party Beneficiary Rights And Liability ........................................................................ 22
Third Party Beneficiary Rights ...................................................................................... 22
Liability and Burden of Proof ....................................................................................... 22

7.

Final provisions.................................................................................................................... 24

1

Final Provisions ............................................................................................................ 24
Appendix I

List of Kumon Group Companies ...................................................................... 25

Appendix II

Subject Access and Complaint Procedures....................................................... 26

1

Complaint to Kumon ........................................................................................................ 26

2

Rights of Individuals: Subject Access Requests ............................................................... 27

3

Rights of Individuals: Other Requests .............................................................................. 28

Appendix III

Compliance Structure ....................................................................................... 30

1

Global Data Protection Officer ........................................................................................ 30

2

Global Data Protection Team .......................................................................................... 31

3

Local Data Protection Manager ....................................................................................... 31

4Internal Communication Procedure for Employees ........................................................ 32

Appendix IV
1

Training Protocol .............................................................................................. 33

Employee Training ........................................................................................................... 33

Appendix V

Audit Protocol ................................................................................................... 34

1

Audit Principles ................................................................................................................ 34

2

Audit Structure ................................................................................................................ 34

3

Audit Process ................................................................................................................... 34

Appendix VI

Update Procedure ............................................................................................ 36

1

Changes to the BCRs ........................................................................................................ 36

2

Changes to the BCRs Not Requiring Authorization .......................................................... 36

2

1. INTRODUCTION
Who are we?
Kumon is a worldwide leading provider of individualized education, headed by Kumon Instituteof Education Co., Ltd. based in Japan. Kumon provides learning programs to students of various
ages based on its independently developed “Kumon Method”. These learning programs areprovided through Kumon’s global network of franchised and company-owned Kumon study
centres and partner licensees.

What are the BCRs?
To achieve our mission to help as many individuals discover their potential and develop theirabilities to the maximum through the Kumon Method, sometimes Kumon will share Personal
Data between Kumon Group Companies. It is important for us that we handle Personal Datawith adequate protections. Kumon adopts the underlying Binding Corporate Rules to establish
Kumon’s principles for protecting Personal Data and the rules we will follow if we share
Personal Data with Kumon Group Companies outside the EEA.
The Binding Corporate Rules consist of two sets of policies: The Binding Corporate Rules –Controller Policy and the Binding Corporate Rules – Processor Policy. This document is the
Binding Corporate Rules – Controller Policy and shall be referred to herein simply as the“BCRs”.
These BCRs describe how Kumon Group Companies will comply with data protection laws whenacting as Data Controllers.
These BCRs will be published on the relevant websites of Kumon.

3What is covered by the BCRs?
These BCRs cover the collection of, transfer between, and all other Processing by the Kumon
Group Companies (see the list in Appendix I) of Personal Data originating in the EEA. This may
include the following:Franchise Instructors
Name, address, study centre name, contact information,
Data Categories

professional and educational information, instructor experience andhistory

Transfers Outside

To Kumon Institute of Education Co., Ltd. based in Japanthe EEA

To Kumon Europe & Africa Limited, based in the UKProviding support to centre instructors/staff to ensure thequality of the service

Providing support to local Kumon Group Companies for
managing, improving and expanding Kumon study centres in the
country/region

PurposesProviding employee and instructor training

Developing and further improving the Kumon learning materials
and instructional methods locally and globallyProviding IT support and maintenance of the dedicated serverand systems used by Kumon Group Companies for managing
their region

Generating statistical information for local, regional and global
analysisCompliance with governmental rules and regulations

Students studying (or interested in studying) in the Kumon programme
Data Categories

Name, student ID, name of study centre, address, age, school grade,study progress, length of study

Transfers Outside

To Kumon Institute of Education Co., Ltd. based in Japanthe EEA

To Kumon Europe & Africa Limited, based in the UKProviding relevant services to the student under the Kumon

Purposes

MethodProviding support to centre instructors/staff to ensure thequality of the service

4

Providing support to local Kumon Group Companies for
managing, improving and expanding Kumon study centres in the
country/regionProviding employee and instructor training

Developing and further improving the Kumon learning materials
and instructional methods locally and globallyProviding IT support and maintenance of the dedicated serverand systems used by Kumon Group Companies for managing
their region

Generating statistical information for local, regional and global
analysisCompliance with governmental rules and regulations

Parents of Students
Data Categories

Name, student’s name, relationship with student, address, contact
information

Transfers Outside

To Kumon Institute of Education Co., Ltd. based in Japanthe EEA

To Kumon Europe & Africa Limited, based in the UKProviding relevant services to the student under the Kumon
Method
Purposes

Contacting the parent, including to respond to inquiries or seek
feedback or report upon the progress of the student

Providing IT support and maintenance of the dedicated serverand systems used by Kumon Group Companies for managing
their regionCompliance with governmental rules and regulations

Employees
Name, ID number, date of birth, corporate email address, company,
department/team, job title, working area, job description, employee
Data Categories

photo, years or service, employment type, evaluation, compensation(salary, bonus, allowances, fringe benefits), if applicable, termination
date and reason

Transfers Outside

To Kumon Institute of Education Co., Ltd. based in Japanthe EEA

To Kumon Europe & Africa Limited, based in the UK5Personnel and labour management of group companies,
including analysis and development of group human resource

Purposesstrategies, schemes, systems and rules

Identifying, communicating and cooperating with employees of
the Kumon Group Companies in the EEA on various projects

Compliance with governmental rules and regulations

The BCRs apply to all types of Processing, whether automated or manual, of whatever nature.

Who must follow the BCRs?
The Kumon Group Companies listed in Appendix I and their Employees must follow the BCRs. Eachof these Kumon Group Companies is bound to the BCRs through an intercompany agreement andis obligated to take necessary steps to ensure that it and its respective Employees respect these
BCRs.
The list of Kumon Group Companies in Appendix I may be updated from time to time in accordancewith the BCRs update procedure outlined in Appendix VI.

I have a question about the BCRs. Who do I ask?
For questions or concerns regarding the BCRs and their rights regarding the data collected andprocessed by a member of the Kumon Group, Individuals can contact the Global Data Protection
Team at the following email address: bcr@kumon.co.jp

6

2. KEYWORDS
For the purpose of the BCRs, the keywords below will have the following meanings:(a) “Child” or “Children”

Any Individual(s) under the age of 16 (or any other age whichconsent of a Guardian is required under the relevant EEA Laws inorder to process the Individual’s Personal Data).

(b) “Data Controller”

The natural or legal person, public authority, agency or any otherbody which, alone or jointly with others, determines the purposes
and means of the Processing of Personal Data, or which has been
designated as such under the applicable law.

(c) “Data Processor”

A natural or legal person, public authority, agency or any otherbody which processes Personal Data on behalf of the Data
Controller.

(d) “EEA”

The European Economic Area. Notwithstanding the foregoing,
during the transition period where the United Kingdom is bound to
the EU laws, the term “EEA” shall be construed to include theUnited Kingdom.

(e) “EEA Laws”

The laws of the European Union and the Member State from which
the Personal Data was originally obtained or first processed within
the EEA.

(f) “EEA Lead Entity”

Kumon Europe & Africa, Ltd., a Kumon Group Company establishedand operating in the United Kingdom. Notwithstanding theforegoing, by the end of the transition period where the United
Kingdom is bound to the EU laws, Kumon Instituto de Educación deEspaña S. A., a Kumon Group Company established and operating inSpain, shall become the EEA Lead Entity.

(g) "Employee”

Any individual within a Kumon Group Company’s organization
engaged in the company’s operations under the direct or indirect
direction and supervision of the Kumon Group Company, which inaddition to employees with an employee relationship (full-time
employees, contract employees, part-time employees, etc.), shall7

include officers, directors, corporate auditors, and temporary staff,
etc. For the avoidance of doubt, “employee” shall not include
independent contractors, subcontractors, or instructors/staff ofKumon Centres.
(h) “Franchise
Instructor”

Any instructor that has been authorized to instruct students basedon the Kumon Method on account of having entered a franchise
agreement with Kumon.

(i) “GDPR”

Regulation (EU) 2016/679 of the European Parliament and of theCouncil of 27 April 2016 on the protection of natural persons withregard to the processing of personal data and on the freemovement of such data, and repealing Directive 95/46/EC (General
Data Protection Regulation), with any amendments made fromtime to time.

(j) “Guardian”

A parent or person with parental responsibility of a given Individual.

(k) “Individual”

The data subject of the given personal data that has beentransferred from a Kumon Group Company in the EEA to a Kumon
Group Company outside the EEA.

(l) “KIE”

Kumon Institute of Education Co., Ltd.

(m) “Kumon”

The relevant Kumon Group Company or all Kumon Group
Companies collectively, depending on the context.

(n) “Kumon Group
Company”

Any of the entities listed in Appendix I, which shall be updated fromtime to time in accordance with Appendix VI.

(o) “Lead Supervisory

The Spanish Data Protection Supervisory Authority (Agencia

Authority”

Española de Protección de Datos (AEPD)), or other Supervisory
Authority which is duly designated as lead supervisory authority for
the BCRs under the applicable law.

(p) “Member State”

Any country within the EEA.

(q) “Personal Data”

Any information that originates from the EEA relating to a natural
person who can be identified, directly or indirectly, in particular by8reference to an identifier such as a name, an identification number,
location data, an online identifier or to one or more factors specificto the physical, physiological, genetic, mental, economic, cultural orsocial identity of that natural person.
(r) “Processing”(of Personal Data)

Any operation or set of operations which is performed on Personal
Data or on sets of Personal Data, whether or not by automaticmeans, such as collection, recording, organization, structuring,storage, adaptation or alteration, retrieval, consultation, use,
disclosure by transmission, dissemination or otherwise making
available, alignment or combination, restriction, erasure or
destruction.

(s) “Processing Country”

The country where the given Personal Data is to be processed.

(t) “Special Categories

Personal Data revealing racial or ethnic origin, political opinions,of Personal Data”

religious or philosophical beliefs, or trade union membership, or
generic data, biometric data, or data concerning health or sex life
or sexual orientation of a natural person.

(u) “Supervisory

An independent public authority which is established by a Member

Authority”

State and is responsible for monitoring the application of the GDPR.

(v) “Third Party”

A natural or legal person, public authority, agency or body otherthan the Individual, Data Controller, or Kumon acting as Data
Processor. For the avoidance of doubt, Third Party shall not include
other Kumon Group Companies.

(w) “Third Party
Beneficiary”

The Individual that enjoys third party beneficiary rights as provided
for under Section 6.1.1.

9

3. COMMITMENTS AS DATA CONTROLLER
Basic Principles
3.1.1

Lawfulness, Fairness and Transparency: The Personal Data shall be processed lawfully, fairly
and in a transparent manner in relation to the Individual (See Section 3.2 and Section 3.3).

3.1.2

Purpose Limitation: The Personal Data shall be collected for specified, explicit and legitimate
purposes and not further processed in a manner incompatible with those purposes.

3.1.3

Data Minimization: Kumon will ensure that Personal Data are adequate, relevant andlimited to what is necessary in relation to the purposes for which they are collected,
transferred and further processed.

3.1.4

Data Quality: Kumon will ensure that Personal Data are accurate and where necessary, kept
up-to-date. For this purpose, Individuals are encouraged to inform Kumon when there is any
change in their Personal Data. Kumon will take every reasonable step to ensure that
inaccurate data, having regard to the purposes for which they are processed, are erased or
rectified without delay.

3.1.5

Retention of Personal Data: Kumon will take steps to ensure that Personal Data are not kept
in a form which permits identification of Individuals for longer than necessary for the
purposes for which they are obtained, and are processed and disposed of securely.

Legal Basis For Processing Personal Data
3.2.1

Kumon will only process Personal Data if one or more of the following grounds is satisfied:(a)

The Individual has unambiguously given his or her consent for one or more specificpurposes;(b)

The Processing is necessary for the performance of a contract to which the
Individual is party or in order to take steps at the request of the Individual prior toentering into a contract;(c)

The Processing is necessary for compliance with a legal obligation to which it issubject;(d)

The Processing is necessary in order to protect the vital interests of the Individual;

10

(e)

The Processing is necessary for the performance of a task carried out in the public
interest or in the exercise of official authority vested in it; or,(f)

The Processing is necessary for the purposes of the legitimate interests pursued byit or by the Third Party Data Processor or processors to whom the data are disclosed,
except where such interests are overridden by the interests or fundamental rights
and freedoms of the Individual.

Transparency And Information Disclosure
3.3.1

Information Disclosure: The Individual will be provided with the following information
where Personal Data are collected from the Individual or if the Personal Data was not directly
obtained from the Individual:(a)

The identity of Kumon and of its representative, if any, and their respective contact
details;(b)

Where applicable, contact details of the Global Data Protection Officer, the Global
Data Protection Team and/or the Local Data Protection Manager;(c)

The purposes of the Processing for which the data are intended as well as the legal
basis for the Processing;(d)When the Processing is based on legitimate interests, the legitimate interests
pursued by the Data Controller or the Third Party;(e)

The recipients or categories of recipients of the Personal Data, if any;(f)

The existence of the right of access to and the right to rectify, erase Personal Dataor restrict Processing of the Personal Data concerning him or her, or to object toProcessing as well as the right to data portability;(g)

Where applicable, the fact that Kumon intends to transfer Personal Data to a third
country or international organization, a reference to the BCRs or other appropriate
or suitable safeguards to carry out such transfer, and where they have been madeavailable;(h)Where applicable, the general basic principles of data processing set out in thisSection 3, Section 4 and Section 5.1, as well as the provisions regarding liability forbreaches of the BCRs and Third Party Beneficiary rights as set out in Sections 5.5,
5.6, 5.7, 6.1 and 6.2, as well as Appendix II, along with the means to exercise suchrights;(i)

The period for which Personal Data will be stored, or if that is not possible, thecriteria used to determine that period;

11

(j)

Where the Processing is based on consent or explicit consent, the existence of theright to withdraw consent at any time, without affecting the lawfulness of theProcessing based on consent before its withdrawal;(k)

The right to lodge a complaint with the Supervisory Authority;(l)Whether the provision of Personal Data is a statutory or contractual requirement,
or a requirement necessary to enter into a contract, as well as whether the
Individual is obliged to provide the Personal Data and of the possible consequencesof failure to provide such data;(m)the existence of automated decision-making, including profiling, referred to in
Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information
about the logic involved, as well as the significance and the envisaged consequencesof such Processing for the Individual; and,(n)

If the Personal Data was not obtained from the Individual directly, the Individual will
be provided also with information on the categories and sources of Personal Data
concerned.

3.3.2

Timing of Information Disclosure: The information set forth in Section 3.3.1 will be provided
to the Individual:(a)At the time when the Personal Data is obtained from the Individual;(b)

If not practicable to do so at the time of obtaining the Personal Data because the
Personal Data was not obtained from the Individual directly, as soon as practicable
thereafter, but at the latest within one month, having regard to the specificcircumstances in which the Personal Data are processed;(c)

If the Personal Data are to be used for communication with the Individual and the
Personal Data was not obtained from the Individual directly, at the latest at the timeof the first communication to that Individual; or,(d)

If a disclosure to another recipient is envisaged and the Personal Data was not
obtained from the Individual directly, at the latest when the Personal Data are first
disclosed.

3.3.3

Grounds for Non-Disclosure: Notwithstanding Sections 3.3.1 and 3.3.2, Kumon will not be
obligated to disclose the information to the Individual set forth in Section 3.3.1, if:(a)

The Individual already has the information;(b)

The data have not been obtained from the Individual directly and the disclosure isexpressly regulated by the EEA Laws to which the Data Controller is subject and12which provides appropriate measures to protect the Individual's legitimate interest;(c)

The data have not been obtained from the Individual directly and the provision of
the information proves impossible or would involve disproportionate effort in linewith Article 14(5)(b) GDPR;(d)

The data have not been obtained from the Individual directly and the Personal Data
must remain confidential subject to an obligation of professional secrecy regulatedby the EEA Laws; or,(e)

The European Union or Member States law to which the Data Controller or Data
Processor is subject restricts the rights of Individuals concerning transparency
pursuant to Article 23 of the GDPR, provided that the restrictions under such law
respect the essence of the fundamental rights and freedoms and are necessary andproportionate measures in a democratic society to safeguard the interests provided
for under Article 23 of the GDPR, such as the protection of the data subject or therights and freedoms of others.

3.3.4

Disclosure of the BCRs: The BCRs will be made available to every Individual upon request.
Individuals have the right to have easy access to BCRs. Kumon undertakes to publish the
BCRs on the website accessible from the following URL in order to ensure that the BCRs areeasily accessible for the Individual: https://www.kumongroup.com/eng/bcr/.

3.3.5

Disclosure of Personal Data Transfer/Processing: Individuals will be informed of the transfer
and other Processing of their Personal Data pursuant to the procedure described inAppendix II.

Rights of Individuals
3.4.1

Every Individual has the right, in accordance with the procedure described in Appendix II:(a)to obtain confirmation as to whether or not Personal Data concerning the Individual
are being processed, access to information stipulated in Section 3.3.1, and a copy of
all Personal Data relating to them that are collected, processed or transferred by amember of the Kumon Group, without constraint, at reasonable intervals, without
excessive delay and free of charge or subject to a reasonable fee where the request
is manifestly unfounded or excessive (e.g. Individual requests several copies);(b)

to obtain the rectification of Personal Data in particular because they are
incomplete or inaccurate;(c)

the right to obtain the erasure of Personal Data concerning him or her without

13

undue delay, where the Personal Data is no longer necessary to the purposes forwhich they were collected or processed, where there is no longer a legal basis for
the Processing, or for any other grounds prescribed under the GDPR;(d)the right to obtain restriction of Processing to a certain extent, if the Individual
demonstrates that he or she has a legitimate interest in such restriction;(e)

to object, at any time on compelling legitimate grounds relating to his/her particularsituation, to the collection, Processing or transfer of their Personal Data, unless thatcollection, Processing or transfer is required by law (where the objection is justified,the collection, Processing or transfer must cease);(f)

to object, on request and free of charge, to the Processing of Personal Data relating
to him/her for the purposes of direct marketing; and,(g)

the right not to be subject to a decision based solely on automated processing,including profiling, which produces legal effects concerning or significantly affecting
the Individual, unless permitted under the GDPR.

3.4.2

Identity Confirmation: Prior to complying with requests pursuant to Section 3.4.1, should
Kumon have reasonable doubts concerning the identity of the person making the request,
Kumon may ask for information that it reasonably requires to confirm the identity of theperson making the request and to locate the relevant information to which the request
relates. Kumon will adhere to national legal requirements when conducting theidentification process.

3.4.3

The procedure followed for the exercise of the rights of Individuals as well as the specifictimelines of response are specified in Appendix II.

Children’s Personal Data
3.5.1

Guardian’s Consent: Unless Kumon otherwise has a legitimate legal basis under the GDPR,
Kumon will not collect, use or transfer the Personal Data of Children without his or her
Guardian’s consent.

3.5.2

Processing Children’s Data Based on Legitimate Interests: Special consideration will begiven to the interests and rights of Children prior to Processing their Personal Data, if theProcessing is performed based on the grounds set forth in Section 3.2.1 (f).

14

Special Categories of Personal Data
3.6.1

Unless Kumon otherwise has a legitimate legal basis under the GDPR, Kumon will process
Special Categories of Personal Data only if it is absolutely necessary and where Kumon has
obtained express consent which must be genuine and freely given.

3.6.2

Access to any Special Categories of Personal Data will be strictly limited to the appropriate
staff.

3.6.3

Kumon will ensure that Special Categories of Personal Data are processed with enhanced
security measures as necessary.

15

4. PERSONAL DATA TRANSFERS
Transfers of Personal Data
4.1.1

Personal Data Transfers for Data Processing: Kumon will restrict transfers and onward
transfers of Personal Data to a Data Processor (regardless of whether a Third Party or
another Kumon Group Company), unless it:(a)has entered into written agreements with the Data Processor that meet therequirements set forth in Section 5.1.4 and any requirements stipulated under the
GDPR prior to the transfer taking place; and,(b)

has otherwise taken necessary measures to ensure adequate protection under the
GDPR for the Personal Data concerned by the transfer.

4.1.2

Data Transfers and Onward Transfers: Kumon will restrict transfers and onward transfersof Personal Data to any entity outside of the EEA (regardless of whether a Third Party or
another Kumon Group Company), unless the transfer is made in compliance with the GDPR
regarding transfer of Personal Data, and specifically:(a)the transfer is to a third country or an international organisation the relevant
authority has determined to ensure an adequate level of protection;(b)

the transfer is subject to appropriate safeguards recognized under the GDPR that
ensure the enforceable rights and effective legal remedies afforded to theIndividuals;(c)the transfer satisfies a condition specified as a derogation permitted under the
GDPR; or,(d)

if the transfer is to another Kumon Group Company outside the EEA, the transfer
will take place in accordance with these BCRs.

16

5. PRACTICAL COMMITMENTS
Security and Confidentiality
5.1.1

Technical and Organizational Measures: Kumon will ensure that Personal Data is processedin a manner that ensures appropriate security of Personal Data including protection against
unauthorized or unlawful Processing and against accidental loss, destruction or damage, inparticular where the Processing involves the transmission of data over a network, andagainst all other unlawful forms of Processing. Kumon ensures this by implementing
appropriate technical and organizational measures which will be updated from time to time.

5.1.2

Level of Security: The technical and organizational measures to be implemented shall ensure
a level of security appropriate to the risk, having regard to the state of the art (as thisexpression is understood under Article 32 of GDPR) and the cost of their implementation,and the nature, scope, context and purposes of Processing as well as the risk of varying
likelihood and severity for the rights and freedoms of natural persons.

5.1.3

Employee Compliance: Employees may only process Personal Data in accordance with the
BCRs. Any Employees who breach the BCRs may be subject to disciplinary action (up to andincluding dismissal).

5.1.4

Written Agreements with Data Processors: Kumon will ensure that any Data Processor(whether a Third Party or another Kumon Group Company) that processes Personal Data on
Kumon’s behalf will be bound by a written agreement (as outlined in Section 4.1) compliant
with and including all required elements of Article 28.3 of GDPR, such as that it will act only
on Kumon’s instructions and shall be responsible for the implementation of adequate
security and confidentiality measures, as well as notifying a breach of Personal Data to
Kumon without undue delay.

5.1.5

Personal Data Breach: Where there is a security or confidentiality breach that affects the
Personal Data of Individuals:(a)Kumon will report the breach to the competent Supervisory Authority without
undue delay taking into account the requirements of the GDPR of the affected
Personal Data, unless such breach is unlikely to result in a risk to the rights andfreedoms of natural persons. The notification to the competent Supervisory

17Authority shall be made within 72 hours after becoming aware of the Personal Databreach. Where the notification to the Supervisory Authority is not made within 72
hours, it shall be accompanied by reasons for the delay.
(b)

When any such breach is likely to result in a high risk to the rights and freedoms of
the Individuals, without undue delay Kumon will communicate that breach to theIndividuals concerned.

(c)Furthermore, Kumon shall notify any Personal Data breaches to the Global Data
Protection Team and the EEA Lead Entity without undue delay.

(d)Personal Data breaches will be documented (including the facts of the breach, theeffects and the remedial action taken). Such documentation will be made available
to the competent Supervisory Authority upon its request.

Accountability
5.2.1

Kumon shall be responsible for and be able to demonstrate compliance with these BCRs.

5.2.2

Record Keeping: Kumon will ensure that clear records of all data Processing activities are
kept, including:(a)the name, contact details of the Data Controller and, where applicable, the joint
Data Controller, the Data Controller`s representative and the data protection
officer;(b)categories of Individuals and Personal Data processed by, or on behalf of, the Data
Controllers;(c)the purposes for which the Personal Data are being processed;(d)categories of the recipients to whom the Personal Data have been or will be
disclosed (including recipients in third countries or international organizations);(e)

descriptions of technical and organizational security measures that are in place;(f)where possible, the envisaged time limits for erasure of the different categories of
data;

(g)

where applicable, transfers of Personal Data to a third country or an internationalorganisation and documentation of safeguards deployed for any transfers tocountries which the Supervisory Authority of the country where the transfer
originates has not decided to ensure an adequate level of protection; and,(h)any other information which should be recorded pursuant to the GDPR.

18

5.2.3

Kumon shall maintain the record of Processing activities in writing, including in electronic
form, and when requested, shall make it available to the Supervisory Authority.

5.2.4

Data Protection Impact Assessment: Kumon shall determine the need to carry out dataprotection impact assessments for Processing operations that are likely to result in a highrisk to the rights and freedom of natural persons. If the results show that the Processing
would result in high risk in the absence of measures taken by Kumon to mitigate the risks,
Kumon shall consult the Supervisory Authority, prior to Processing.

5.2.5

Data Protection By Design and By Default: Kumon shall implement appropriate technicaland organizational measures which are designed to implement data protection principles inan effective manner and to integrate the necessary safeguards into the Processing in orderto facilitate compliance with these BCRs.

5.2.6

Kumon will appoint a Global Data Protection Officer, with the top management support, tooversee and ensure compliance with the BCRs in Kumon, in accordance with the protocol
described in Appendix III.

Training Programme
5.3.1

Kumon will provide appropriate training on the BCRs to its Employees in accordance withthe protocol described in Appendix IV.

5.3.2

No Employee will be permitted (i) to transfer Personal Data to a country outside of the EEA
or (ii) to handle Personal Data outside of the EEA, prior to receiving appropriate training to
do so.

Audit Programme
5.4.1

Kumon will audit its compliance with the BCRs in accordance with the protocol described inAppendix V.

Relationship Between National Laws and the BCRs
5.5.1

Where the laws of any country in which the Personal Data is processed require a higher levelof protection for Personal Data, they will take precedence over the BCRs.

19

5.5.2

If Kumon has reason to believe that the existing or future national legislation of theProcessing Country may prevent it from fulfilling its obligations under the BCRs, or may havesubstantial effect on the guarantees provided by the BCRs, Kumon shall promptly inform the
Global Data Protection Team (see Appendix III), the EEA Lead Entity and the competentSupervisory Authority, where applicable, unless this is prohibited by a law enforcement
authority (including obligations under criminal laws to preserve the confidentiality of a law
enforcement investigation).

5.5.3

Where there is a conflict between national law and the commitments in the BCRs, the Global
Data Protection Officer (see Appendix III) will make a responsible decision on what action totake and will consult the competent Supervisory Authorities in case of doubt.

5.5.4

If Kumon has reason to believe that legal requirements that it may be subject to in a third
country is likely to have a substantial adverse effect on the guarantees provided by the BCRs,
including legally binding requests for disclosure of Personal Data by a law enforcement
authority or state security body, Kumon shall promptly inform the Global Data Protection
Team (in accordance with the procedure set out in Appendix III) and the competentSupervisory Authority of:(a)the request (including the type of data requested);(b)

the requesting body; and,(c)the legal basis for the request,

unless this is prohibited by a law enforcement authority (including obligations under criminal
laws to preserve the confidentiality of a law enforcement investigation). In such case, Kumon
will use its best efforts to obtain the right to waive such obligation and communicate asmuch information to the competent Supervisory Authority as soon as possible, anddemonstrate its efforts thereto. If, despite Kumon’s best efforts, it is not in a position to
notify the competent Supervisory Authority, it will provide general information on therequests it receives once per year (including the number of disclosure requests and the typeof data requested and the requester, where possible).
5.5.5

In any event, where Kumon is obliged to provide Personal Data to a public authority, thisshall not concern a massive or disproportionate amount of Personal Data, and shall not be
indiscriminate in such a manner as to go beyond what is necessary in a democratic society.

20Complaint Mechanisms
5.6.1

Individuals whose Personal Data are processed by Kumon have the right to file complaints
to Kumon using the complaint handling process described in Appendix II.

Cooperation With Authorities
5.7.1

Cooperation with Supervisory Authority: Kumon shall cooperate with the competentSupervisory Authority and assist each other to handle an investigation or inquiry bySupervisory Authorities.

5.7.2

Compliance with Decision of Supervisory Authority: Kumon accepts to be audited by thecompetent Supervisory Authority and will comply with the advice given by the competentSupervisory Authority on any issues regarding the interpretation of the BCRs. For the
avoidance of doubt, nothing herein shall be construed to be a waiver of Kumon’s rights toappeal a decision by the competent Supervisory Authority.

Updates of the Rules
5.8.1

Any update to the BCRs will be made and reported to the Supervisory Authorities inaccordance with the procedures described in Appendix VI.

21

6. THIRD PARTY BENEFICIARY RIGHTS AND
LIABILITY
Third Party Beneficiary Rights
6.1.1

Enforcing the BCRs: Individuals shall have rights, as Third Party Beneficiaries, to judicial
remedies and to obtain redress and, where appropriate, compensation for any material or
non-material damages in case of the breach of the provisions of the BCRs by a Kumon Group
Company, in particular in case of the breach of those provisions conferring rights on
Individuals (Section 3, Section 4, Section 5.1, Section 5.2, Section 5.5, Section 5.6, Section
5.7, and Section 6.2, as well as Appendix II and this Section 6.1). Such right covers judicial
remedies as well as the right to receive compensation.

6.1.2

Responsible Kumon Group Company: The EEA Lead Entity shall be the EEA-based Kumon
Group Company responsible to respond to Third Party Beneficiary rights.

6.1.3

Jurisdiction Provisions: Third Party Beneficiaries shall have the right to lodge a complaint, inparticular, before:(a)the competent courts of the Member State whose jurisdiction is established either
on the basis of the place where the Data Controller has an establishment, or where
the Third Party Beneficiary has their habitual residence, as the Third Party
Beneficiary may so choose; and(b)the competent Supervisory Authorities whose jurisdiction is established, inparticular, either on the basis of the place where the Third Party Beneficiary has hisor her habitual residence, or where he/she has his or her place of work, or where
the alleged infringement of the BCRs has taken place, as the Third Party Beneficiary
may so choose.

Liability and Burden of Proof
6.2.1

The EEA Lead Entity’s Responsibility Regarding Personal Data: The EEA Lead Entity agrees
that:
(a)

the EEA Lead Entity shall be responsible for and agree to take the necessary action
to remedy for the acts of other Kumon Group Companies established outside of the22

EEA, and to pay compensation for any material or non-material damages resulting
from the violation of the BCRs by the Kumon Group Company established outsideof the EEA. The EEA Lead Entity confirms that it has sufficient assets to pay
compensation for damages resulting from such breach of the BCRs;(b)

The EEA Lead Entity shall accept the jurisdiction of the courts or other competentauthorities in the EU and shall accept responsibility for violations of the BCRs and,in particular, for Individuals rights and remedies that result thereof as if the violation
had been caused by the EEA Lead Entity in the Member State in which it is basedinstead of the Kumon Group Company established outside the EEA; and(c)

The EEA Lead Entity shall not be entitled to rely on a breach by a Third Party Data
Processor of its obligations in order to avoid its own liabilities.

6.2.2

Burden of Proof for EEA Personal Data of Third Party Beneficiaries:(a)

The EEA Lead Entity has the burden of proof to demonstrate that the Kumon Group
Company established outside of the EEA is not liable for any violation of the BCRs
which has resulted in the Individuals claiming damages.

(b)

If the EEA Lead Entity can prove that the Kumon Group Company is not responsible
for the event giving rise to the damage, it may discharge itself from any liability/
responsibility.

23

7. FINAL PROVISIONS
Final Provisions
7.1.1

The BCRs will be effective from the date they are approved by the Supervisory Authority.

24

APPENDIX I

LIST OF KUMON GROUP COMPANIESAll queries regarding these BCRs can be made to this email address: bcr@kumon.co.jp
RegionJAPAN

Company Name
Kumon Institute of Education

Address/Website
Kumon Kyoiku-Kaikan 5-6-6 Nishinakajima Yodogawaku Osaka 532-8511 Japan

Co., Ltd.

Kumon Europe & Africa

https://www.kumon.ne.jp/
4th Floor West, Ealing Cross, 85 Uxbridge Road,
Ealing, London, W5 5TH U.K.

LimitedEUROPEAND
AFRICA

Kumon Instituto de Educación

http://www.kumon.co.uk/
Paseo de la Castellana, 131, planta baja y primera
28046 Madrid, SPAIN

de España S. A.
Kumon Deutschland GmbH

http://www.kumon.es/
Wiesenstrasse 21. 40549 Düsseldorf GERMANY
http://www.kumon.de/25

APPENDIX IISUBJECT ACCESS AND COMPLAINTPROCEDURES
1

Complaint to Kumon

1.1

Responsible Team: The Global Data Protection Officer, Global Data Protection Team, andLocal Data Protection Managers are the main competent departments in charge of ensuring
to Individuals the fulfilment of their access requests and the handling of their complaints (seeAppendix III).

1.2

Contact Window: Any Individual may bring complaints regarding the compliance with the
BCRs by contacting the Local Data Protection Manager in the country where the Individual
resides (see Appendix III). The contact details of the relevant Local Data Protection Manager
are made available in the local website of the Kumon Group Company in a particular country.

1.3

Receipt Confirmation: The Local Data Protection Manager will promptly acknowledge receiptof the complaint to the Individual, and will without undue delay and in any event within one
month from the date the complaint is received, make a substantive response.

1.4

Complaints for Personal Data of Different Jurisdictions: If the complaint relates to Personal
Data originating outside the jurisdiction of the Local Data Protection Manager, it will promptly
report the Individual’s complaint to the Global Data Protection Team, who will handle allcomplaints under the BCRs. If necessary, the Global Data Protection Team may cooperate withother Employees from relevant Kumon Group Companies, business and support units asappropriate to deal with the complaint. The Global Data Protection Team will acknowledge
receipt of a complaint to the Individual within ten working days, and make a substantive
response within one month, from the date the complaint is received.

1.5

Response Time Frame: If, due to the complexity of the complaint or the number of requests,
a substantive response cannot be given within the period prescribed in Section 1.3 or 1.4, as
the case may be, the complainant will be advised accordingly with a reasonable estimate (notexceeding two additional months) for the timescale within which a response will be provided.

1.6

If the Local Data Protection Manager or the Global Data Protection Team reaches theconclusion that the complaint has merit or is founded, it will take adequate measures inaccordance with the nature of the complaint so as to ensure compliance with the BCRs.
1.7

If the Local Data Protection Manager or the Global Data Protection Team rejects the complaint
because it considers it without merit or unfounded, the Individual will be informed of thisfinding and will be reminded in the response given to the Individual by the Local Data
Protection Manager or the Global Data Protection Team that s/he may always address his or
her complaints or claims to the Global Data Protection Officer.

1.8

Disputing a Response: If the complainant disputes the response from the Local Data
Protection Manager or the Global Data Protection Team or any aspect of a finding and notifies
the responding party to that effect, the matter will be referred to the Global Data Protection
Officer. The Global Data Protection Officer will review the case, and advise the complainantof his/her determination either to uphold the findings of the responding party or to substitutea new finding, within one month (which may be extended by two further months dependingon the complexity and number of requests) of the receipt of the complaint from the pertinent
Data Protection Team/Manager.

1.9

If the complaint is upheld, the Global Data Protection Officer will arrange for any necessary
steps to be taken as a consequence.

1.10 If the Individual finds any action taken by Kumon to be insufficient to address his or her
complaint, the Individual may always address his or her complaints or claims to the competentSupervisory Authorities or courts of the Member States without prejudice to whether or nots/he has first complained directly to Kumon pursuant to Section 6.1.3 of the BCRs. The
Individual will be reminded of this right in the response given to the Individual by the Local
Data Protection Manager or the Global Data Protection Team or the Global Data Protection
Officer.

2

Rights of Individuals: Subject Access Requests

2.1

The Individual may request to exercise his or her 'right to access' from Kumon when Kumon isa Data Controller.

2.2

The request may be made in writing or orally, which can include email, to the Local Data
Protection Manager in EEA or the Global Data Protection Team. The Local Data Protection
Manager receiving the request will report the details of the request to the Global Data

27

Protection Team.
2.3

The Global Data Protection Team, whether directly or through the Local Data Protection
Manager receiving the request, will respond to a valid request with information on the action
taken on the request, without undue delay, and in any event, within one month (or any shorter
period as may be stipulated under local law) of receipt of that request. The response
timeframe may be extended by an additional two months subject to the conditions stipulated
in Section 1.5 of Appendix II of the BCRs.

2.4

Kumon is not obliged to comply with a subject access request where Kumon has reasonable
doubts concerning the identity of the person making the request and is not supplied with theinformation it reasonably required in order to confirm the identity of the Individual making
the request and to locate the data which that Individual seeks. Kumon will adhere to national
legal requirements when conducting the identification process.

2.5

The Global Data Protection Team will make an initial assessment of the request to decide
whether it is a valid request and whether confirmation of identity, or any further information,is required. It will also engage appropriate Employees for support with handling the subject
access, as required or appropriate.

2.6

The Global Data Protection Team will then contact the Individual in writing to confirm receiptof the subject access request, seek confirmation of identity or further information, if required,or decline the request if one of the exemptions to subject access applies.

2.7

Valid requests may be refused only if the requests are manifestly unfounded or excessive.

3

Rights of Individuals: Other Requests

3.1

The Individual may request to exercise other rights detailed in Section 3.4 of the BCRs. Such arequest must be considered and dealt with as appropriate by the Local Data Protection
Manager of country where the Personal Data originates, upon consultation with the Global
Data Protection Team as necessary. The response timeframes stipulated in Section 2.3 ofAppendix II of the BCRs should apply mutatis mutandis.

3.2

If a request is received advising of a change in an Individual’s Personal Data where Kumon is
the Data Controller for that Personal Data, such information must be rectified or updated

28

accordingly if Kumon is satisfied that there is a legitimate basis for doing so.
3.3

When Kumon deletes, anonymizes, updates, or corrects Personal Data in its capacity as Data
Controller, Kumon will notify other Kumon Group Companies or any sub-processor to whom
the Personal Data has been disclosed accordingly so that they can also update their records.

3.4

If the request made to Kumon as Data Controller is to cease processing the Individual’s
Personal Data because the rights and freedoms of the Individual are prejudiced by virtue ofsuch Processing by Kumon, or on the basis of other compelling legitimate grounds, the matter
will be referred to the Global Data Protection Team to assess. Where the Processing
undertaken by Kumon is required by law, the request will not be regarded as valid.

29

APPENDIX III COMPLIANCE STRUCTURE
1Global Data Protection Officer

1.1

The Global Data Protection Officer appointed by Kumon will be responsible for executive-level
oversight of and responsibility for ensuring Kumon’s compliance with the BCRs as well as
applicable data protection laws. It will not be subject to any conflict of interest, will report
directly to KIE’s Board of Directors/CEO, and its appointment, role and performance will be
carried out in accordance with the GDPR and the European Data Protection Board Guidelines
on Data Protection Officers, as updated from time to time. The Global Data Protection Officer
shall not receive any instructions regarding the exercise of his/her tasks and shall have thesupport of KIE’s executives.

1.2

The Global Data Protection Officer’s key responsibilities include:(a)Ensuring that the BCRs and other rules related to data protection, objectives andstandards are defined and communicated;(b)

Providing clear and visible senior management support and resources for the BCRs andfor privacy objectives and initiatives in general;(c)

Evaluating, approving and prioritizing remedial actions consistent with therequirements of the BCRs, strategic plans, business objectives and regulatory
requirements;(d)Periodically assessing privacy initiatives, accomplishments, and resources to ensure
continued effectiveness and improvement;(e)Ensuring that Kumon's business objectives align with the BCRs and related dataprotection strategies, policies and practices;(f)Coordinating communication on the BCRs and data protection issues during the audit;(g)

Dealing with any complaints escalated to him/her in accordance with the BCRs’ Subject
Access and Complaint Procedures; and,(h)Acting as the point of contact for dealing with Supervisory Authorities (or delegatingsuch role to Local Data Protection Managers with respect to matters exclusive to a given
region).

30

2Global Data Protection Team

2.1

The Global Data Protection Team consists of personnel appointed by KIE and fulfils such
responsibilities as follows under the direction of the Global Data Protection Officer:(a)Providing guidance about the Processing of Personal Data in accordance with the BCRs;(b)

Responding to inquiries and compliance relating to the BCRs from Employees,
customers and other Third Parties;(c)

Providing input on audits of the BCRs, coordinating responses to audit findings andresponding to inquiries of the Supervisory Authorities;(d)Monitoring changes to global data protection laws and ensuring that appropriatechanges are made to the BCRs and Kumon's related policies and practices;(e)

Arranging for training of Employees on the BCRs and data protection laws;(f)Promoting the awareness on data protection across business units and functional areas
through communications and initiatives;(g)

Evaluating data protection processes and procedures to ensure that they aresustainable and effective;(h)Reporting periodically on the status of the BCRs to the Global Data Protection Officer
and other organizations as appropriate;(i)Ensuring that any matters relating to compliance with the BCRs are brought to theattention of the Global Data Protection Team and the Global Data Protection Officer,
as appropriate, and that any corrective actions are determined and implemented
within a reasonable time; and(j)

Ensuring that any changes to the BCRs are made in accordance with the Update
Procedures (see Appendix VI).

3

Local Data Protection Manager

3.1

Each Kumon Group Company will have a Local Data Protection Manager, who is responsiblefor day-to-day data protection compliance in the company.

3.2

When the Global Data Protection Officer deems it appropriate, the Local Data Protection
Manager for the regional headquarters in the Kumon Group may coordinate the activities of
the Local Data Protection Managers for the headquarters’ subsidiaries. Furthermore, where
delegated to do so by the Global Data Protection Officer, the Local Data Protection Manager
shall be the point of contact for dealing with Supervisory Authorities for exclusively local

31personal data matters.
3.3

The Local Data Protection Manager shall cooperate with the Global Data Protection Officer
and Global Data Protection Team, by such means as:(a)Updating them on the applicable law on the personal data protection;(b)

Providing training on the personal data protection in the company; and(c)Providing information about the status of personal data protection in the company.

4Internal Communication Procedure for Employees

4.1

Kumon makes available to all Employees a hotline to communicate any inquiry related topersonal data protection issues outlined in the BCRs.

4.2

Alternatively, an Employee may communicate any inquiry related to personal data protection
issues outlined in the BCRs to the Local Data Protection Manager, who will review and respondto it within one month from receipt of the inquiry. If the inquiry concerns matters that are notpurely local, the Local Data Protection Manager will consult the Global Data Protection Team.

4.3

If the Employee disputes the response from the Local Data Protection Manager or the Global
Data Protection Team or any aspect of a finding and notifies the responding party to that effect,
the matter will be referred to the Global Data Protection Officer. The Global Data Protection
Officer will review the case, and advise the Employee of his/her determination either touphold the findings of the responding party or to substitute a new finding, within one month(which may be extended by two further months depending on the complexity and number ofrequests) of the receipt of the inquiry from the pertinent Data Protection Team/Manager.

4.4

Complaints by Employees regarding the handling of their data by the Kumon Group
Companies under these BCRs can be made as detailed in Appendix II of the BCRs.

32

APPENDIX IV TRAINING PROTOCOL
1

Employee Training

1.1

All Employees involved in the transfer, handling and collecting of Personal Data will be
required to be trained on personal data protection, including summary of the BCRs andapplicable data protection laws (i) as part of their induction program and (ii) at least once
every year.

Such training shall be provided by E-training, on-site seminars or other manneras deemed suitable under the circumstances.
1.2

The Global Data Protection Team will prepare the training materials and provide them to the
Local Data Protection Manager. The Local Data Protection Manager will then conduct thetraining for the Employees in the company, and record and report of the outcome of the
training to the Global Data Protection Team.

1.3

The purpose of these trainings is that the Employees be trained on the basic principles ofprotection, confidentiality and security of Personal Data and all information systems that
contain Personal Data.

1.4

Kumon will provide such additional training opportunities as it deems appropriate, such as:-Special E-training designed for managerial Employees;-

Training designed for specific departments (e.g., HR, IT, field offices); and-Global training opportunities, such as e-training via global intranet and intragroupconferences.

1.5

The training will be provided on the following subjects:-

The substance of the local law on personal data protection;-

The substance of and any changes to the BCRs; and-How the personal data protection law affects Kumon (including best practices forcomplying with the BCRs).

33

APPENDIX V

AUDIT PROTOCOL

1

Audit Principles

1.1

Kumon agrees to be subject to a duty to undergo data protection audits on a regular basis, tobe performed either by internal or accredited external auditors, or on specific request fromthe Global Data Protection Officer.

2

Audit Structure

2.1

The Global Data Protection Officer will arrange for Kumon’s internal or accredited external
auditor (the “Audit Team”), as it deems appropriate, to effect independent audits ofcompliance with all aspects of the BCRs, including methods of ensuring that corrective actions
will be adopted and implemented.

2.2

The Audit Team will be responsible for performing and/or overseeing independent audits ofcompliance with the BCRs and will ensure that such audits address all aspects of the BCRs. In
addition, the Audit Team is responsible for ensuring that any issues or instances ofnoncompliance are brought to the attention of the Global Data Protection Team and therelevant Local Data Protection Managers.

3

Audit Process

3.1

Audits shall cover all aspects of the BCRs and shall identify methods of corrective actions thatmight be required as a result of the audit.

3.2

Audits of compliance with the BCRs are conducted:(a)

at least annually in accordance with Kumon's audit procedures;(b)at the request of the Global Data Protection Officer and/or KIE’s Board of Directors;
and/or,(c)

as determined necessary by the Global Data Protection Team (for example, in response
to a specific incident).

3.3

The Audit Team will conduct a risk-based analysis to determine the scope of the audit, which
will consider relevant issues such as: new or specific risk for the audited company’s business;

34

changes to the security systems or procedures; the subject matter of any previous audit orcomplaints; nature and location of the Personal Data, as well as the manner of Processing.
3.4

The audit shall be conducted by on-site inspection, interview with concerned personnel,
questionnaires, document review, or other method as deemed appropriate by the Audit Team.

3.5

The results of all audits will be communicated to the Global Data Protection Officer and to
KIE’s Board of Directors.

3.6

A copy of the result of audits will be provided to the Supervisory Authorities upon their request.

3.7

Any Kumon Group Company accepts to be audited by the Supervisory Authorities and willcomply with the advice of the Supervisory Authorities on any issue related to those rules.

35

APPENDIX VI UPDATE PROCEDURE
1Changes to the BCRs

1.1

Kumon will communicate any changes to the BCRs without undue delay to the relevantSupervisory Authorities via the competent Supervisory Authorities as well as to all Kumon
Group Companies.

2

Changes to the BCRs Not Requiring Authorization

2.1

Updates to the BCRs or to the list of Kumon Group Companies are possible without having to
re-apply for an authorization provided that:(a)

The Global Data Protection Officer maintains an up to date list of the Kumon Group
Companies bound by the BCRs and of the sub-processors appointed by Kumon toprocess Personal Data. Such list shall be made accessible to Individuals and Supervisory
Authorities upon their valid request.

(b)

The Global Data Protection Officer will maintain the record of changes to the BCRs,
including the date the changes become effective and the details of the changes made,and will provide the necessary information upon request to the Individual or theSupervisory Authorities.

(c)

No transfer is made to a new member until the new member is effectively bound by
the BCRs and can deliver compliance.

(d)

Any changes to the BCRs or to the list of Kumon Group Companies shall be reported
once a year to the Supervisory Authorities granting the authorizations with a brief
explanation of the reasons justifying the update.

(e)

Any changes to the BCRs that could affect the level of the protection offered by the
BCRs or significantly affect the BCRs will be promptly communicated to the relevantSupervisory Authorities, via the competent Supervisory Authority.

36