Privacy Policy for the EEA and the UK GDPR
（AEON HOLDINGS CORPORATION）

AEON HOLDINGS CORPORATION of Japan (“AEON HOLDINGS”) may have occasion tocollect and process Personal Data (as defined below). This Privacy Policy (this “Policy”)
applies to the processing of Personal Data concerning data subjects in the European
Economic Area (“EEA”) in accordance with the Regulation (EU) 2016/679 (General Data
Protection Regulation, the “GDPR”) and data subjects in the United Kingdom (the “UK”) inaccordance with the UK GDPR as defined in the Data Protection, Privacy and ElectronicCommunications (Amendments etc.) (EU Exit) Regulations 2019 (the “UK GDPR”).

1. Personal Data
In this Policy, Personal Data means any data relating to an identified or identifiable natural
person (“Personal Data”). AEON HOLDINGS may acquire and process Personal Data,
including the name, address, telephone number, gender, nationality, occupation, and email
address of a natural person in the EEA and the UK.

2. Use of Personal Data
AEON HOLDINGS acquires and processes Personal Data for the following purposes:•Providing services to relevant clients;•Legitimate business interests, such as undertaking business research andanalysis or managing the operation of the business;•Public relations, such as responding to inquiries;•Engaging in marketing and business development activities in relation to theservices. This may include sending client newsletters, marketing
communications and other information that may be of interest to them;•

Defense of certain rights or interests;•Compliance with legal and regulatory obligations that AEON HOLDINGS has todischarge; and•Managing customer relationships

AEON HOLDINGS relies on the following legal grounds to process Personal Data:

•The data subject’s consent expressly given to process his/her Personal Data insuch manner. The data subject may withdraw his/her consent to this processing
at any time; however, this will not affect the lawfulness of any processing carriedout before withdrawal of the consent;•Entering into a contract with a data subject or performing obligations under acontract with a data subject;•

Legitimate interests, some examples of which are given above; and•Compliance with applicable laws or regulations.

If you fail to provide certain information when requested, we may not be able to perform thecontract we have entered into with you (such as paying you or providing a benefit), or wemay be prevented from complying with our legal obligations.

3. Disclosure to Third Parties
AEON HOLDINGS may supply or disclose Personal Data, without the data subjects’ priorconsent, to AEON HOLDINGS’s group companies and other third parties that are AEONHOLDINGS’s service assignees. AEON HOLDINGS may also supply or disclose Personal
Data to third parties when it is necessary for some other justifiable reason permitted by thelaws and regulations.

4. Cross-Border Transfer
Personal Data may be transferred to entities in countries or jurisdictions outside the EEA
and the UK, such as Japan, if required for the purposes as described above. Please notethat such countries or jurisdictions may not have the same data protection laws as the EEA
and the UK and will not afford many of the rights conferred upon data subjects in the EEA
and the UK. AEON HOLDINGS will ensure that any such international transfers are madesubject to appropriate and suitable safeguards as required by the GDPR, the UK GDPR orother relevant laws. When doing so, AEON HOLDINGS will comply with applicable dataprotection requirements and take appropriate safeguards to ensure the security andintegrity of Personal Data.

5. Retention of Personal Data
AEON HOLDINGS will retain Personal Data for the period necessary to fulfill the purposes
outlined in this Policy, unless a longer retention period is required or permitted by law.

6. Rights of Data Subjects
Data subjects have the right to access, request correction of, request deletion of, request
the limitation of processing of, object to the processing of, and request the data portabilityof their Personal Data retained by AEON HOLDINGS. When AEON HOLDINGS receives arequest based on a right specified above, AEON HOLDINGS shall conduct any necessary
investigation without delay and provide data subjects or nominated third parties withPersonal Data or respond to such rights without delay.

7. Right to Lodge Complaint with Data Protection Authority
Data subjects have the right to lodge a complaint with the local data protection authority ifthey have a complaint with regard to AEON HOLDINGS’s processing of their PersonalData.

8. Contact
For any questions about this Policy, AEON HOLDINGS’s privacy practices or your rights
described in “Section 6. Rights of Data Subjects”, please contact us at the following:
For all data subjects
Department：Group Strategy Division

E-mail address：

privacy-holdings@corp.aeonet.co.jp

Phone number：

03-6316-1500

EU Representative for

PLANIT // LEGAL

Data subjects in the EEA： Bischof Freund Schmidt Partnerschaft von Rechtsanwälten mbB
Neuer Wall 54, 20354 Hamburg, Germany
E-mail address：

mail@planit.legal

UK Representative for

TMI Associates London LLP

Data subjects in the UK： Citypoint One Ropemaker Street London EC2Y 9SS, UK
E-mail address：

Enacted as of 2019/Feb/1
Revised as of 2021/Jan/1

london@tmi.gr.jp