Matters to be Published Based on the Act on the Protection of Personal Information
We will publish the following matters based on the Act on the Protection of Personal Information (the ”Act”).
The matters include those that are required to be "put in a readily accessible condition for the person
themselves" and matters that are required to be "put in an accessible condition for the person themselves”(including responding without delay to the request from the person themselves).

1. Matters related to publishing the purposes of use of personal information①

Purposes of use when obtaining personal information directly through methods other than obtaining
a written document and when obtaining personal information indirectly (Article 21, Paragraph 1 of theAct)

We will specify our purposes of use every time we obtain written personal information directly from ourcustomers. (Article 21, Paragraph 2 of the Act) When we obtain personal information directly through othermethods or indirectly, we will handle the personal information within the following scope of purposes of use(Article 21, Paragraph 1 of the Act) However, ② below is excluded. (Article 27, Paragraph 5 of the Act)
Personal information items
1.

Name, age, date of birth, address, telephone number, workplace and other records of the voice/imageof the person themselves

2.

Application date, contact date, name of the product, contact amount and the number of payments
related to the trade agreement and other agreements (“Individual Agreements”) concluded with us

Purposes of use
1.

Operate the second-hand movable assets sales business and businesses associated with thesecond-hand movable assets sales business and solicit customers

2.

Send advertisement materials and printing materials of our parent company, subsidiaries, groupmember companies and partner companies by being entrusted by them3.

Respond to inquiries and requests from our customers and educate and train our employees② Matters related to sharing Personal Information (Article 27, Paragraph 5, Item 3 of the Act andArticle 27, Paragraph 6 of the Act)We may share the personal information we obtained with others. The scope of the persons sharing thepersonal information, personal information items to be shared, purposes of use of persons sharing thepersonal information and persons who are responsible for the shared personal data are as follows:Scope of the persons sharing personal information
The following our group member companies:
SBI Shinsei Bank, Limited
Showa Leasing Co., Ltd.
Eishin Kogyo Co., Ltd.
Shinsei Kobelco Leasing Co. ,Ltd.
Personal information items to be shared
1.

Name, age, date of birth, address, telephone number and workplace

2.

Application date, contract date, name of the product, contact amount and the number of payments
related to Individual Agreements

Purposes of use
1.

Advertisement and sales activities in the credit businesses including the leasing business, theinstalment sales business, second-hand movable assets sales business and the loan business

2.

Sales and solicitation of financial products and services

3.

Credit decision and credit management

Person responsible for the personal data to be shared
TOZAI BOEKI, CO., LTD.
Click here for the address and the name of the representative: https://tozaiboeki.co.jp/ja/company/

2. Owned personal data that should be put in “an accessible condition for the person
themselves” (Article 32, Paragraph 1 of the Act)【Name and address of our company and name of our representative】
https://tozaiboeki.co.jp/ja/company/
Items of owned personal data and purposes of use are as follows:【Items of owned personal data】

1.

Name, age, date of birth, address, telephone number and workplace

2.

Application date, contract date, name of the product, contact amount and the number of payments
related to Individual Agreements【Purposes of use】
1.

Operate the second-hand movable assets sales business and businesses associated with thesecond-hand movable assets sales business and solicit customers

2.

Send advertisement materials and printing materials of our parent company, subsidiaries, groupmember companies and partner companies by being entrusted by them3.

Respond to inquiries and requests from our customers and educate and train our employees【Safety management measures】
We have implemented the following measures for safety management of our personal data.
(Establishment of basic policies for protecting personal information)
We have established basic policies for a. complying with related laws, regulations and guidelines and b.
our desk for accepting inquiries and complaints to ensure appropriate handling of personal data.
(Organizing rules for personal data handling)
We have established personal information handling rules which stipulate handling methods, responsible
persons and their duties for each stage such as acquisition, use, storing, provision and deleting/discardingof personal data.
(Organizational safety management measures)
1. We have assigned responsible persons for handling personal data and have clarified employees
handling personal data and the scope of the personal data handled by the employees to organize
a reporting structure when violations of the Act or personal information handling rules are captured
or when signs of the violations are captured.
2. We conduct regular self-inspections of the status of personal data handling and conducts audits byother sections.
(Human safety management measures)
1. We implement regular employee training for matters to be noted when handling personal data.
2. We provide confidentiality of personal data in our work rules.
(Physical safety management measures)1. We control access to the office areas that handle personal data and restricts devices that can bebrought into the areas. We have also implemented measures preventing viewing of personal databy unauthorized persons.
2. We have implemented measures for preventing theft or loss of devices handling personal data andelectronic data and documents, etc. containing personal data. We have also implemented
measures for preventing easy identification of personal data when the devices and electronic media,etc. are moved within the office or brought into the office.
(Technical safety management measures)
1. We restrict responsible persons and the scope of personal information database, etc. throughaccess control.
2. We have implemented a system which protects our informational system handling personal datafrom illegal access from the outside or from illegal software.
(Provision of information related to Equivalent Measures by a third party located in a foreign country)
When we have provided personal information to a third party located in a foreign country (limited to those
who have organized the structure stipulated in Article 28, Paragraph 1 of the Act), we implement based on
the rules of the Personal Information Protection Committee measures required for ensuring continuous
implementation of Equivalent Measures. Information related to the required measures will be provided
upon request of the person themselves.

3. Providing Personal Information to Third Parties (Article 27, Paragraphs 2 and 3 ofthe Act)We will appropriately manage personal information we have obtained from our customers. We will notprovide obtained personal information to any third parties except in the following cases:
1.

The provision is based on laws and regulations.

2.

Handling of personal information is entrusted to a third party by concluding an entrustment agreement
within the scope required for achieving the purposes of use provided in the purposes of use of personalinformation.

3.

The personal information will be shared with a specific third party as discussed in sharing of personal
information.

4.

The provision is permitted under the Act.

4． Matters related to the procedures for responding to a request for Disclosure, etc.
(Article 37 of the Act)We respond to requests from the person themselves of the owned personal data or their agent fordisclosure, change, suspension of use of personal data and for disclosure, etc. of records of disclosure tothird parties (“Disclosure, etc.”)①

Items of owned personal data target for Disclosure, etc.

Name, age, date of birth, address, telephone number, workplace and history and details of transactions②

Designation of a request for Disclosure, etc.

Kindly send by post your request for Disclosure, etc. to the following address, attaching required
documents to the prescribed application form. It would be appreciated if you write “Disclosure, etc.
Application Form Enclosed“ in red ink on the envelope.
We are afraid we cannot respond to your request made by coming to our headquarters.
【Designation of requests for disclosure, etc.】
Management Support Division, TOZAI BOEKI, CO., LTD.
〒650-0045
15-1, Minatojima 7-chome, Chuo-ku, Kobe City, Hyogo Prefecture③ Documents required
1.

Application form prescribed by us

2.

Identification documents (a copy of driver’s license or passport)④ Request for Disclosure, etc. by your agent
Kindly send the following documents when a person other than the person themselves requests Disclosure,etc.
(A) Legal representative
1.

Application form prescribed by us

2.

Identification documents for proving the identity of the representative (a copy of driver’s license orpassport)

3.

Identification documents for proving the qualification of the representative (copies of family registerand resident card that prove the relationship with the person themselves, a copy of the court’s written
decision issued in the recent three months and a proof of custody registered)(B) Mandatary
1.

Application form prescribed by us

2.

Identification documents for proving the identity of the mandatary (a copy of driver’s license orpassport)

3.

Proxy letter (with registered seal)

4.

Seal registration certificate issued in the recent three months⑤ Fee
Kindly attach to application documents a 1,000-yen postal money order issued at post offices. We willcontact you if you have sent less than 1,000 yen or if you have not sent the fee, however, we will deemthat you have not made a request for disclosure, etc. if you have not paid the fee within a prescribed period.
⑥ Methods for responding to a request for Disclosure, etc.
In principle, personal information will be provided through provision of an electronic record or throughsending a confidential registered mail within ten business days from the date when your application form
has arrived to us. Kindly note that it may require additional several days before you receive your personal
information due to the condition of postal services. It may also take more than ten business days due toour investigation, and we will inform the requester in such a case. (Disclosure documents sent in a certified
mail but returned to us from the post office after storage period will be discarded after being stored forthree months. Kindly request Disclosure, etc. again after the termination of the storage period.)⑦ Purposes of use of the personal information obtained by responding to a request for Disclosure,etc.
The personal information obtained by responding to a request for Disclosure, etc. will be handled only
within the scope required for the request for Disclosure, etc. The documents we have received will be
stored for three years after we complete our responding to the request for Disclosure, etc. and will bediscarded thereafter.
⑧ Attention
Personal information will not be disclosed in the following cases. We will inform you with the reasons of
non-disclosure when we have decided non-disclosure of personal information. However, the prescribed
fee will be charged even in the case of non-disclosure.

1.

The person themselves cannot be confirmed due to the lack of a match of the address provided in theapplication form, the address provided in identification documents and the address registered with us

2.

The agency right of the agent who applied for disclosure cannot be confirmed.

3.

The prescribed documents have some deficiencies.

4.

The target of disclosure does not fall into “owned personal data”.

5.

The disclosure may damage the life, body, assets and other rights and interest of the personthemselves or a third party.

6.

The disclosure may affect our proper business execution seriously.

7.

The disclosure will breach other laws and regulations.

5. Matters related to the inquiry desk (Article 32, Paragraph1, Item 4 of the Act, Article
8 of the Enforcement Ordinance and Article 40 of the Act)
① Inquiry desk related to the handling of personal information
Management Support Division, TOZAI BOEKI CO., LTD
Telephone number: 078-304-7380
Business hours: 10:00 – 17:00, Monday to Friday (excluding national holidays and year-end and New Yearholidays)
We are afraid we cannot respond to your inquiries made by coming to our headquarters.