Basic Policy on the Handling of Personal Information□Basic Concept
Shikoku Railway Company (hereafter referred to as the “Company”) complies with the laws, internal
rules and regulations, and other norms regarding personal information. The Company aims to earncustomers’ trust by properly acquiring, using, and managing the personal information that it handles.
□Handling of Personal Information(1)

Compliance with laws and regulations
1)

The Company complies with the laws and regulations concerning personal information.

2)

The Company has formulated the internal rules and regulations of handling personal
information, makes them known to its employees and others concerned, implements
them, and provides the necessary guidance and supervision.

(2)

Security management
1)

A manager is assigned to each operation that handles personal information.

2)

The Company takes safety control measures to prevent unauthorized access topersonal information and the loss, destruction, falsification, or leakage of personalinformation.

(3)

Collection of personal informationｄ
The Company uses legal and fair means of collecting personal information after clarifying
the following matters:
1)

The purposes of collection and use.

2)

The purposes and scope of providing personal information if the Company plans toprovide collected personal information.

(4)

Use, provision, and outsourcing of personal information
1)

The Company will use personal information, if necessary, within the scope of thepurposes for which the personal information is used.

2)

The Company may provide all or part of the personal information in its possession toa third party or may outsource the processing of such information to a third party. In
that case, the Company will properly select the party to which the information isprovided or entrusted and provide the necessary guidance and supervision to ensurethat the party properly manages the information in the same manner as the Company.

(5)

Ensuring accuracy
The Company strives to keep personal data accurate and up-to-date.

(6)

Respect for the rights of each individual
The Company respects customers’ rights regarding personal information. If requested todisclose, correct, stop using, or delete information, the Company will comply with therequests within a reasonable period and to a reasonable extent.

(7)

Continuous improvements
The Company strives to improve the handling of personal information as appropriate.

□Items Published under the Act on the Protection of Personal Information(1) Name of the business operator handling personal information
Company Name: SHIKOKU RAILWAY COMPANY
Name of Representative: President NISHIMAKI Tsuguhiro
Head office: 8-33 Hamano-cho, Takamatsu, Kagawa, Japan(2) Purposes of use
The purposes of use of personal information and data that the Company obtains and keeps
are as follows:• To be used for procedures necessary for the provision of products and services offered tocustomers• To operate various membership services• To send prizes, rewards, etc.
• To provide information related to the Company’s various business operations• To improve the Company’s products and services• To recruit and select employees• To provide the Company’s employment information• To contact each individual as necessary(3) Security control measures for personal data
I. Matters related to organizational safety management
The Company appoints personnel responsible for the handling of personal data. TheCompany also clarifies the personnel handling personal data and the scope of personal
data handled by the personnel. A reporting and liaison system is in place for reporting to
the supervising staff in charge if a fact or indication of a violation of the laws or internalrules and regulations is detected.
II. Matters related to personnel safety management measures
The Company supervises the handling of personal information within the Company at alltimes. Furthermore, the Company provides timely and appropriate guidance on
department rules and other necessary matters.
III. Matters related to physical safety management
The Company controls its employees’ access to areas where personal data is handledand restricts equipment, devices, etc., to be taken out of the areas. Furthermore, theCompany implements measures to prevent unauthorized people from viewing personaldata.
IV. Matters related to technical safety management
The Company implements access control to limit the range of personnel who handle
personal information and the range of accessible personal information databases and thelike. Furthermore, the Company has a system to protect personal information fromoutsiders’ unauthorized access or unauthorized software.