Basic Policy on Handling Personal Information
1. Basic Policy
JR East Building Co., Ltd. (hereinafter referred to as the “Company”) willcomply with laws, regulations, and internal rules regarding the protectionof personal information (information about a living individual who can be
identified by name, date of birth, or other description contained in said
information), and will protect such information by acquiring and using
personal information appropriately handled by the Company, managing
personal information in a safe and up-to-date manner, and appropriately
disposing of personal information.

2. Organizational Activities(1) We will comply with laws and regulations regarding the protection ofpersonal information.
(2) We will establish and comply with internal rules for handling personalinformation.
(3) We regularly check to ensure that personal information is handledappropriately and make improvements if any problems arise.
(4) We will request cooperation from our Group companies, organizations
and individuals with whom we do business, etc., to achieve the objectivesof the internal rules.
(5) This Basic Policy shall be made available for viewing at any time, forexample, by posting it on the Company’s website (URL:https://www.jebl.co.jp).

3. Handling of Personal Information
We shall handle personal information as follows, except in cases wherelaws and regulations permit exceptions.
(1) Establishment of internal systems
We will assign a manager to each personal information and manage itappropriately.

(2) Obtaining personal information
When obtaining personal information, we will clarify the purpose for which
the information will be used and obtain it in an appropriate manner.
(3) Use of personal information
We strongly recognize the importance of protecting personal information
and will use it appropriately within the scope of the intended purpose ofuse.
(4) Appropriate management of personal information
We will implement the necessary security measures for the managementof personal information.
(5) Handling of personally-related information provided by third parties
When handling personally-related information provided by a third party,
we will not cross-reference it with other information that identifies or may
identify an individual, unless we have obtained the individual’s consent.
(6) Respecting individual rights
We respect the individuals’ rights regarding their personal information. We
will respond to requests for disclosure, correction, suspension of use,etc., of such information within a reasonable period and to the extent
required by laws and regulations.
(7) Continuous improvement of the handling of personal information
We will continuously strive to improve our handling of personal
information.
*Personal information in this Basic Policy includes specified personalinformation.
April 2024
JR East Building Co., Ltd.

Specific Items Regarding the Handling of Personal Information (Items tobe Published in Accordance with the “Act on the Protection of PersonalInformation”)

JR East Japan Building Co., Ltd. (hereinafter referred to as the“Company”) obtains personal information that is necessary for the smooth
operation of our business, and this personal information will be handled
as follows in addition to the “Basic Policy on the Handling of PersonalInformation.”
In cases where the terms and conditions of each business operated by
the Company individually stipulate handling personal information related
to customers, such stipulations shall take precedence over the “SpecificMatters Concerning the Handling of Personal Information” herein.

1. Name and Address of the Business Operator Handling
Personal Information and Name of its Representativei
JR East Japan Building Co., Ltd.
5-33-8 Sendagaya, Shibuya-ku, Tokyo 151-0051, SOUTH GATE Shinjuku
8F
Akihiko Ishikawa, Representative Director

2. Purposes of Use of Personal Information
The purposes of using personal information obtained by the Company are
as follows.
We may entrust your personal information to a third party to the extent
necessary to achieve the purpose of use specified to you. However, insuch cases, we will confirm the security level of such third parties andenter into a confidentiality agreement with them before entrusting suchinformation to such third parties.
(1) Purposes of use of personal information obtained from customers
a. To make necessary contact for the provision of products and services(including when requesting delivery of products, etc. to courier

companies, etc.)
b. To provide information on products and services and other information
related to the Company’s business activities
c. To examine and develop new products and services, as well assoftware, systems, facilities, equipment, etc. to provide these products
and services
d. To charge and collect fees for products and services and to protect
receivables (including when requesting credit card payment proceduresfrom a consumer credit company, etc.)
e. To conduct market research and other surveys and studies
f. For business analysis.
g. To conduct sweepstakes, campaigns, etc.
h. To enter into and fulfill contracts with customers and to manage thecontracts after they have been entered into
i. To exercise the Company’s rights and to respond to various matters
incidental thereto
j. For CSR (corporate social responsibility) related activities
k. To receive and respond to inquiries and opinions from customers
l. To ensure the security of customers and employees
m. To study and develop software, systems, facilities, and equipment forensuring securityn. To maintain and manage facilities, equipment, and devices and theirusage(2) Purposes of using personal information obtained from employees,
applicants for employment, retirees and their family members, etc.
a. To provide recruitment-related information and to perform tasks related
to recruitment
b. For operations related to employment management (includingsecondment and transfer)c. For operations related to the payment of salaries, etc.
d. For operations related to employee benefits, etc.
e. For operations related to health care, etc.
f. For various procedures after retirementg. For various procedures and communications required by laws andregulations
h. For other procedures and communications necessary for businessoperations(3) Purposes of use of specified personal informationa. To perform administrative work related to health and employment
insurance, etc.
b. To perform administrative work related to employees’ pensions andnational pensions, etc.
c. To perform administrative work related to the withholding of income
taxes, such as salaries, bonuses, and year-end adjustments
d. To perform administrative work related to preparing and submitting
withholding tax certificates, payroll reports, etc.
e. To perform administrative work for employee stock ownership plans,etc.
f. To perform administrative work related to preparing and submitting ofstatutory payment records, etc.
g. To perform other administrative work stipulated in the “Act on the Useof Numbers to Identify a Specific Individual in Administrative Procedures(Numbers Act)” and other laws.

3. Provision of Personal Information to Third Parties(1) Except for the purposes stated in “2. Purposes of Use of Personal
Information” and in the following cases, we will not provide personal
information obtained from customers to third parties without obtaining thecustomer’s prior consent.
a. When required by law
b. When it is necessary for the protection of the life, body, or property of
an individual, and it is difficult to obtain the customer’s consent
c. When it is essential to improve public health or promote the soundgrowth of children, and it is difficult to obtain the customer’s consent
d. When it is necessary to cooperate with a national agency, a local
government, or an individual or entity entrusted by either a nationalagency or local government to execute affairs prescribed by laws andregulations, and obtaining the customer’s consent may impede theexecution of such affairs(2) Notwithstanding the preceding item, we will not provide specified
personal information to any third party, except in cases where it fallsunder the purposes of use of specified personal information described in
the preceding paragraph or in cases provided for in the “Act on the Use ofNumbers to Identify a Specific Individual in Administrative Procedures.”4. Measures Taken for the Safe Management of PersonalInformation
We will implement the following items to ensure the safe management ofpersonal information. The following are examples only, and the specificmeasures for implementing safety management may differ depending on
the individual personal information.
(1) Formulation of a basic policy
The “Basic Policy on the Handling of Personal Information” will be
formulated and made public to ensure the proper handling of personalinformation.
(2) Establishment of disciplinary rules for the handling of personal data,etc.
We will establish internal rules for handling personal information to ensure
appropriate acquisition, storage, use, and management.
(3) Organizational safe management measures
In addition to appointing a person responsible for handling personal
information, we will clarify the employees who handle personal
information and their roles and establish a system for contacting theperson responsible in the event of an accident, such as the leakage ofpersonal information (including cases where we become aware of signsof such an accident).
(4) Personnel safety control measures
In addition to providing regular education and training to employees onmatters to keep in mind regarding the handling of personal information,
we will include matters related to the confidentiality of personal
information in our internal rules and regulations.
(5) Physical safety control measures
Personal information shall be disposed of or deleted in a manner thatmakes it difficult to recover, such as by cutting, dissolving, or physicallydestroying it.

(6) Technical safety control measures
When storing or transferring personal data outside the company, we willtake necessary measures to prevent leakage, such as encryption andsetting passwords.
(7) Understanding the external environment
We will take necessary and appropriate measures to safely manage thesecurity of personal data based on our understanding of the systems forprotecting personal data in foreign countries where personal data isstored.
(8) Supervision of employees
We will conduct an audit at least once a year to assess the status ofemployees’ handling of personal data, confirm that it is operating incompliance with laws, regulations, and internal rules, etc., and promptly
make improvements if any problems are found.
(9) Supervision of contractors
We will conduct an audit at least once a year to assess the contractors’
handling of personal data, confirm that they are operating following thecontract, laws and regulations, etc., and take necessary measures if anyproblems are found.

5. Point of Contact for Inquiries
For inquiries regarding this policy or any other matters related to theprotection of personal information, please contact us at the e-mailaddress below.
Please note that we will not respond to any inquiries submitted in any
other way (including those made in person at our company).
E-mail address of “Personal Information Reception Office”:
privacy@jebl.co.jp*We may revise the “Basic Policy on Handling Personal Information” and“Specific Items Regarding the Handling of Personal Information” posted
on our website, etc. to improve the protection of personal information, orin response to changes in laws, regulations, and other norms, so we askthat you periodically check these items.
i