Information Management Guidelines
Chapter 1 General Provisions
1 Purpose
The purpose of these Guidelines is to define the basic matters concerning the management ofConfidential Information and Personal Information to be observed by officers and employees ofour group or group companies.

2 Scope of Application
These Guidelines cover all Confidential Information and Personal Information held by our groupcompanies and apply to the handling of all Confidential Information and Personal Information byofficers and employees of our group or group companies.

3 Definitions of Terms
Definitions of terms used in these Guidelines are as follows:
3.1 Confidential Information
Information that our group companies determine should be kept confidential as not to bedisclosed outside our group companies or as inappropriate for disclosure.
3.2 Personal Information
Information concerning a living individual, which means information that enables theidentification of a specific individual by itself or by comparison with other information, or otherinformation concerning an individual as defined by the Act on the Protection of Personal
Information or GDPR or other applicable laws and regulations.
3.3 Employee Information
Personal Information of employees and all persons in the employment relationship.
3.4 Principal
An individual who is identified or can be identified by certain information.
3.5 Handling
Any operation or set of operations which is performed on Personal Information or on sets of
Personal Information, whether or not by automated means, such as collection, recording,organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure
by transmission, dissemination or otherwise making available, alignment or combination,restriction, erasure, or destruction.
3.6 Act on the Protection of Personal Information
The Act on the Protection of Personal Information in Japan (Act No. 57 of May 30, 2003) andany amendments thereto.
3.7 GDPR
1The EU General Data Protection Regulation ("REGULATION OF THE EUROPEANPARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to theprocessing of personal data and on the free movement of such data, and repealing Directive
95/46/EC"), including the General Data Protection Regulation which became UK Law by theEuropean Union Withdrawal Act 2018, and any amendments thereto.
3.8 EUThe European Union, including Iceland, Liechtenstein, and Norway, under the European Union
Member States and the European Economic Area ("EEA") Agreement.
3.9 Profiling
Any form of computer processing and analysis of Personal Information made to analyze orpredict personal trends related to the performance, economic conditions, health, personal
preferences, interests, trust, behavior, location, or movement of the individual.
3.10 Processor
Any individual, corporation, public organization, administrative organization, or otherorganization that handles Personal Information on behalf of our group or group companies.

Chapter 2 Information Management System
4 Obligation to Establish a Responsible Person
Our group or group companies shall appoint an information management supervisor as the person
responsible for overseeing the information management system.

5 Establishment of Data Protection Officer (DPO)
5.1 Our group or group companies shall appoint a person in charge of data protection inaccordance with the provisions of laws and regulations related to Personal Information.
5.2 Our group or group companies must disclose the information of the data protection officer(e.g., contact information) and notify the supervisory authority (if available in each country).

6 Implementation of Education
Our group or group companies must provide officers and employees with the education necessary
to ensure that they understand the contents of these Guidelines and practice the proper handlingof information assets.

7 Cooperation in Auditing
Our group or group companies must cooperate with the audit of our group's information
management system conducted by us, and the officers and employees must also cooperate withthe audit.

2

8 Establishment of Inquiry and Complaint Contact
Our group or group companies must set up a contact point to receive inquiries and complaints
about Personal Information from employees and customers and respond appropriately to inquiries
and complaints.

Chapter 3 Proper Handling of Confidential Information
9 Proper Handling of Confidential Information
Officers and employees of our group or group companies shall handle and use the Confidential
Information in accordance with the laws and regulations related to the handling of trade secrets
and the Detailed Regulations for the Management of Confidential Information (provided,
however, that in the event that the same contents are stipulated by each company, the former
regulations shall mean these regulations; the same shall apply hereinafter).

10 Disclosure and Provision of Confidential Information to Business Partners, Etc.
Officers and employees of our group or group companies shall disclose and provide Confidential
Information to business partners in accordance with the laws and regulations related to thehandling of trade secrets and the Detailed Rules for the Management of Confidential Information.

Chapter 4 Handling Personal Information
11 Proper Handling of Personal Information
Officers and employees of our group or group companies shall handle Personal Information inaccordance with laws and regulations related to Personal Information and the Detailed Rules for
the Management of Personal Information (provided, however, that in the event that equivalentcontents are stipulated by each company, the former regulations shall mean these regulations; thesame shall apply hereinafter) stipulated in 3.6 to 3.8.

12 Prohibition on the Handling of Sensitive Information
Officers and employees of our group or group companies shall not handle sensitive PersonalInformation, including race, beliefs, etc., except in cases where laws and regulations relating to
Personal Information and the Detailed Rules for the Management of Personal Information permit
it or where explicit consent is obtained from the principal.

13 Collection of Personal Information
Officers and employees of our group or group companies shall obtain consent from the principal
at the time of Personal Information collection in accordance with the Detailed Rules for theManagement of Personal Information.
314 Measures to Be Taken When Collecting Data From the Principal
When collecting Personal Information directly from the principal, officers and employees of ourgroup or group companies shall clearly indicate in writing the matters at the time of obtaining
Personal Information in accordance with the Detailed Rules for the Management of PersonalInformation.

15 Measures to Be Taken When Collecting Personal Information from Persons Other Thanthe Principal
When collecting Personal Information from a person other than the principal, officers andemployees of our group or group companies shall notify the person of the matters specified in thepreceding article in accordance with the Detailed Rules for the Management of Personal
Information within one month after collecting the Personal Information.

16 Measures Concerning Using Personal Information
Officers and employees of our group or group companies must use Personal Information only
within the extent of the purpose of use for which they are notified.
When Personal Information is used beyond the scope necessary for achieving the specified
purpose of use, the principal must be notified in advance of the matters specified in Article 15 ormatters of equivalent or higher content and consent of the principal must be obtained.

17 Preparation of Records on Handling17.1 When handling Personal Information, officers and employees of our group or groupcompanies shall record the necessary matters stipulated in the laws and regulations related to
Personal Information and the Detailed Rules for the Management of Personal Information.
17.2 Papers and electronic records containing the information set forth in the preceding paragraphshall be retained only for the necessary period as provided for by laws and regulations related
to Personal Information.
17.3 Officers and employees of our group or group companies must properly manage paper andelectronic records containing information specified in 17.1 that can be submitted when requiredby the supervisory authority.

18 Use of Processors
When the management of Personal Information is outsourced to a processor, officers andemployees of our group or group companies shall conclude a written (including electromagneticrecords) agreement with the processor stating the necessary matters stipulated in the DetailedRules for the Management of Personal Information.

4

19 Joint Management
When determining the purpose of use and the method of handling Personal Information with a third
party, officers and employees of our group or group companies shall stipulate in the agreementwith the third party that they shall comply with the obligations stipulated by laws and regulations.

20 Transfer to a Foreign Country
Any transfer of Personal Information by officers and employees of our group or group companies
to a place other than the country or region in which the group companies are located (hereinafterreferred to as the "data exporting country") shall be made in accordance with the Detailed Rules
for the Management of Personal Information.

21 Ensuring the Safety of Use
When handling Personal Information, officers and employees of our group or group companies
shall implement, inspect, and improve appropriate technical and organizational safety
management measures in accordance with the Detailed Rules for the Management of PersonalInformation.

22 Ensuring Accuracy of Personal Information
22.1 Personal Information shall be managed in an accurate and up-to-date manner to the extent
necessary for the achievement of the purpose of use.
22.2 We shall not retain personal information for more than the period necessary for the purpose
for which it is to be processed.

23 Right of Access23.1 Officers and employees of our group or group companies must respond to requests forconfirmation by the principal on whether or not their Personal Information is being handled.
23.2 Our group or group companies must comply with requests for access to information stipulated
in the Detailed Rules for the Management of Personal Information.

24 Correction of Personal Information
Officers and employees of our group or group companies must respond to requests for correctionof their Personal Information without delay.

25 Deleting Personal Information
25.1 Officers and employees of our group or group companies must respond without undue delay
to any request for the deletion of Personal Information from the principal that falls under thecircumstances stipulated in the Detailed Rules for the Management of Personal Information.

5

26 Suspension of Use of Personal Information
Officers and employees of our group or group companies must discontinue the use of Personal
Information if requested by the principal under the circumstances stipulated in the Detailed Rules
for the Management of Personal Information.

27 Obligation to Notify Subcontractors
In cases where Personal Information is provided to an outsourced party or third party, and theprincipal makes a request for correction, deletion, or suspension of use of Personal Information,
officers and employees of our group or group companies shall notify the said outsourced party or
third party of such request. In addition, when requested by the principal to provide information
concerning the outsourced party or the third party to whom the Personal Information is provided,officers and employees of our group or group companies shall inform the principle of information
concerning the outsourced party or the third party.

28 Data Portability
When required to provide Personal Information by the principal, officers and employees of ourgroup or group companies shall provide the information to the principal in an appropriate form andin a proper manner if they fall under the circumstances stipulated in the Detailed Rules for theManagement of Personal Information.

29 Filing an Objection
29.1 When challenged by the principal with regard to the handling of their Personal Information asprovided in the Detailed Rules for the Management of Personal Information, officers andemployees of our group or group companies shall cease using such information. Provided,
however, that this shall not apply where it can be proved that reasonable grounds for thehandling of the Personal Information supersede the benefits, rights, and freedoms of theprincipal or are necessary for a legal claim.
29.2 Officers and employees of our group or group companies must cease using Personal
Information if it is handled for the purpose of direct marketing and challenged by the principal.
29.3 Officers and employees of our group or group companies must respond to any objection fromthe principal to an analytical decision made solely by means of computer processing, including
profiling, which has a legal effect or material adverse effect on the principal.

30 Response to Requests for Access, Etc.
Officers and employees of our group or group companies must, in principle, respond to requests
within one (1) month from the time they receive requests from the principal in accordance with theprovisions of the Detailed Rules for the Management of Personal Information.

6

31 Implementation of Data Protection Impact Assessment
Officers and employees of our group or group companies must conduct a data protection impact
assessment as defined in the Detailed Rules for the Management of Personal Information wheredata processing may pose a high degree of risk to the rights and freedoms of individuals.
32 Notification to the Supervisory Authority and the Principal
When officers and employees of our group or group companies recognize the existence ofinfringement of Personal Information (i.e., leakage, loss, or damage of Personal Information), theymust notify the supervisory authority of the matters stipulated in the laws and regulations relatedto Personal Information and the Detailed Rules for the Management of Personal Information within
72 hours and explain them to the principal.

Chapter 5 Miscellaneous Provisions
33 Penalty
Our group or group companies will take disciplinary action against officers and employees of ourgroup or group companies who violate these Guidelines in accordance with the procedures.

34 Compensation for Damages
In the event that officers and employees of our group or group companies, by intent or grossnegligence, disclose or lose the Confidential Information of us or our business partners and cause
damage to us, our group or group companies shall be entitled to claim compensation for suchdamage.

7