Privacy Policy
This English translation is provided for convenience purposes only. The Japanese versionof this document shall be regarded as the official version. In the event of a dispute, theJapanese language version shall prevail.

bitFlyer, Inc. (the “Company”) understands the importance of protecting
customers’ personal information, and will observe the Act on theProtection of Personal Information (the “Personal Information Act”) as
well as the Act on the Use of Numbers to Identify a Specific Individual in
Administrative Procedures (the “Individual Number Act”) and endeavor tohandle and protect personal information in an appropriate manner inaccordance with this Privacy Policy (the “Privacy Policy”).

1.
1.

Definitions
In the Privacy Policy, “personal information” shall share the definition
given in paragraph 1 of Article 2 of the Personal Information Act; information
on living individuals including any of the following.
Information such as full name, date of birth, or other descriptors thatcan be used to identify a specific individual (includes information thatcan be combined to identify a specific individual).
2.
Includes personal identification codes
The definition of “special care-required personal information” used in thePrivacy Policy shall share the definition given in Article 2, Paragraph 3 of
the Personal Information Act, including, but not limited to, the principal’srace, creed, social status, medical history, criminal record, fact of having
suffered damage by a crime, or other descriptions which could be used for
unfair discrimination, prejudice, or other disadvantages to the principal.
1.

2.

3.

4.

5.

2.

The definition of “personal data” used in the Privacy Policy shall share thedefinition given in Article
3, Paragraph
16 of the Personal InformationAct, summarized as the personal information contained within a personal information
database.
The definition of “individual number” used in the Privacy Policy shall share thedefinition given in Article 2, Paragraph 5 of the Individual Number Act, summarized
as the number obtained through conversion of the code recorded on a Certificate ofResidence, which can be used to identify a specific individual.
The definition of “specific personal information” used in the Privacy Policy
refers to the combination of personal information and the individual number.

Purpose of use

The Company will use customers’ personal information as appropriate for the following
purposes.
However, specific personal information shall only be used foradministrative operations involved in account creation applications and notifications1

related to financial instruments trading, administrative operations involved in creating
and offering legally required documents for financial instruments trading, and otherrelated administrative operations. The Company also obtains information including
cookies, IP addresses, advertising identifiers, device identifiers, behavior history,
etc. from other companies and links the corresponding information to customers' personaldata in accordance with purposes 3. and 4. below.

1. Provision and development of the Company’s products or services;
2. To guide customers to the Company's products, services, campaigns, etc. throughemails, solicitations, etc.;

3. Marketing, research or analysis for the purpose of the quality improvement orexpansion of the Company’s products or services, etc.;
4. Delivering advertisements to meet the customers’ needs.
5. Provision of the maintenance or support of the Company’s services;
6. Notifications of amendment to the Company’s terms, policies, etc. (the “Terms”),
with respect to the Company’s services;
7. Dealing with breach of the Terms, with respect to the Company’s services;
8. Verification of user’s own account at financial institutions;9. Verification of the transfer to user’s account at financial institutions; or
10. Communication in emergencies.
11. The fulfillment of obligations and the exercise of contracts, laws, and self
regulations imposed by the Japan Virtual and Crypto asset Exchange Association thatare derived from laws or contracts, etc.
12. Prevention of criminal use of crypto asset transfer systems, and the ability totrace the usage of the corresponding systems if any criminal use is discovered.
13. Provision to a third party (See "7. Provision of personal data to a third party"
for more information on providing personal data to third parties)

14. For any other purpose related to the above purposes.

3.

Change of purpose of use

The Company may change the purpose of use of personal information and specific personal
information to the extent that the purpose of use after the change is reasonably deemedin relation to the previous purpose of use. When the purpose of use has been changed,
the Company shall notify the customer and/or publicly announce the purpose of use afterthe change.

4.

Restrictions on the use of personal information (see “10. Specificpersonal information handling” for specific personal information)

The Company shall not use personal information, without the consent of the relevant
customers, beyond the scope necessary for the achievement of the purpose of use, unlesspermitted by the Personal Information Act or other laws or regulations; provided,
however, that this provision shall not apply if:

1. the use of personal information is based on laws and regulations;2. the use of personal information is necessary for the protection of the life, bodyor property of an individual and it is difficult to obtain the consent of therelevant customers;
3. the use of personal information is specially necessary for improving public healthor promoting the sound growth of children and it is difficult to obtain the consent
of the relevant customers; or
4. the use of personal information is necessary for cooperating with a nationalgovernment, a local government, or a person or entity entrusted thereby in2

executing the affairs prescribed by laws and regulations and acquisition of theconsent of the relevant customers may impede the execution of the affairs
concerned.

5.

Proper acquisition

The Company shall acquire personal information by proper means, and shall not acquire it
by deception or other wrongful means.

6.

Security controls for personal data and specific personal

information
The Company shall take security management measures to ensure the security control of
personal data and specific personal information against the risk of loss, destruction,alteration or leakage. When the Company entrusts a third party with the handling ofpersonal data and specific personal information in whole or in part, the Company shallsufficiently and appropriately supervise the third party to ensure the secure control of
personal data and specific personal information.

1.

2.

3.

4.

5.

6.

7.

Formulation of a basic policy
Basic policies such as the "Compliance with relevant laws and guidelines","Question and complaint processing form", etc. are established to ensure that
personal data is handled appropriately.
Development of rules on personal data handlingRules are established for the handling of personal data at each step ofacquisition, use, storage, sharing, deletion, disposal, etc., as well as theindividuals responsible for handling and supervision and their duties, etc.
Organizational security management measures
When a person is made responsible for personal data handling, the employees whowill handle the personal data and the range of personal data to be handled shall beclarified, and a system shall be established for reporting to the person
responsible upon discovery of any facts or indications of a violation of law orhandling rules. The status of personal data handling shall be monitored throughperiodic self-inspection and audits by other departments and external departments.
Human security management measures
Employees shall take regular training on the important points of handling ofpersonal data. The confidentiality of personal data is described in the work
regulations.
Physical security management measures
In areas where personal data is being handled, the entry and exit of employees ismanaged, the equipment allowed in the corresponding areas is restricted, andmeasures are taken to prevent unauthorized individuals from seeing personal data.
Measures are implemented to prevent the loss, theft, etc. of devices, digital
media, and documents that are used for handling personal data. Additional measures
are taken to prevent personal data from being easily displayed when thecorresponding devices, digital media, and documents are being moved.
Technical security management measures
Access controls are implemented to limit the handler, personal information database
used, etc. A structure is established to prevent unauthorized access andunauthorized software from accessing the information systems that handle personaldata.
Understanding the external environment
When storing personal data in a foreign country or providing personal data to a3

third party in a foreign country, the personal information protection systems ofeach country shall be understood and the appropriate measures shall be taken.

7.

Provision of personal data to a third party (see “10. Specificpersonal information handling” for specific personal information)

The Company shall not provide personal data to a third party without the prior consent
of the relevant customers, unless the disclosure is permitted by the Personal
Information Act or other laws or regulations; provided, however, that the following
cases shall not be regarded as a provision to a third party.

1. Cases where the Company entrusts a third party with the handling of personal data
within the scope necessary for the achievement of the purpose of use; or
2. For shared use (see “8. Shared use of personal data” for more information)
3. Cases where personal data is provided as a result of the succession of business ina merger or otherwise.

4. In accordance with the regulations on money laundering and terrorist financing
prevention measures imposed by the Japan Virtual and Crypto asset Exchange
Association, when a customer requests a withdrawal of crypto assets, the Company
shall notify the recipient crypto asset exchange operator of the corresponding
customer's personal data.

5. Offering the bitFlyer ID, etc. of customers to advertising agencies, etc. for thepurpose of determining the effectiveness of advertising, etc.

8.

Shared use of personal data

The company may share customers’ personal data for the following uses. Personal data
shall not be shared where restricted by the Financial Instruments and Exchange Act orother laws unless the corresponding law has an approved method such as obtaining writtenconsent from the customer.

1. Categories of personal data for shared use
1. Information about a customer including their name, address, date ofbirth, telephone number, occupation, trading needs, etc.
2. Information about a customer's trading, account balance, etc.
2. List of parties for information sharing
1. bitFlyer Holdings, Inc.
2. bitFlyer, Inc.
3. bitFlyer USA, Inc.
4. bitFlyer Europe S.A.
5. bitFlyer Blockchain, Inc.
3. Purpose of sharing
The scope of sharing shall be the same as stated in “2. Purpose of use.”

4. Name, address, and representative's name of the one holding responsibility formanaging person data
bitFlyer, Inc.
The Company’s address, representative, etc. can be referenced below.

https://bitflyer.com/en-jp/company

9.

Sharing personal data with foreign third parties

4

The Company may share personal data for the purposes detailed in "8. Shared use ofpersonal data" clauses 1 and 3 within the bitFlyer Group companies including bitFlyer
USA, Inc. (United States of America) and bitFlyer Europe S.A. (Luxembourg).
More information on the personal information protection system in the United States ofAmerica can be found on the website of the Personal Information Protection Commission
which can be referenced below. Since the United States of America is participating in
APEC's CBPR system, it is understood that the protection of personal information will beequivalent to the personal information protection system in Japan.

https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku
The Privacy Policy for bitFlyer USA, Inc. can be found below.

https://bitflyer.com/en-us/privacy

10. Specific personal information handling
The Company shall not obtain or handle specific personal information beyond the scope ofwhat is required for purpose of use. The Company shall not provide specific personal
information to any third parties except where allowed by the Individual Number Act.

11. Disclosure of held personal data
In cases where the Company is requested by a customer to disclose the held personal
data or records of sharing the corresponding personal data to a third party under thePersonal Information Act or notification of the purpose of use (hereafter“Disclosure”), the Company shall, after confirming that the request is made by theprincipal, disclose the held personal data to the customer without delay (in cases where
the Company does not have such held personal data, the Company shall notify the customer
to that effect); provided, however, that this provision shall not apply to cases where
the Company is not obliged to disclose such held personal data under the Personal
Information Act or other laws or regulations. For more information, please read
“Request for disclosure of held personal data in accordance with the Personal
Information Protection Act” on the Company’s FAQ. Please note that the Company will
charge a fee (eight hundred (1,100 JPY (including tax) per disclosure) to the customer
in connection with the disclosure of the held personal data.

12. Revisions of held personal data
In cases where the Company is requested by a customer to correct, add or delete the held
personal data under the Personal Information Act on the grounds that such held personal
data is contrary to fact, the Company shall, after confirming that the request is madeby the principal, make a necessary investigation without delay within the scopenecessary for the achievement of the purpose of use, and on the basis of the result,correct, add or delete the held personal data and notify the customer to that effect (incases where the Company decides not to make such a correction, addition or deletion, theCompany shall notify the customer to that effect); provided, however, that thisprovision shall not apply to cases in which the Company is not obliged to make such acorrection, addition or deletion under the Personal Information Act or other laws orregulations. For more information, please read “Request for disclosure of held personal
data in accordance with the Personal Information Protection Act” on the Company’s FAQ.

13. Discontinuing the use of personal data
In cases where the Company is requested by a customer to discontinue using or to erase
the held personal data under the Personal Information Act on the grounds that such held
personal data is being handled beyond the purpose of use publicly announced in advance5

or has been acquired by deception or other wrongful means and where it is found that therequest has a reason, the Company shall, after confirming that the request is made by
the principal, discontinue the use of or erase the held personal data without delay andshall notify the customer to that effect; provided, however, that this provision shallnot apply to cases in which the Company is not obliged to make such discontinuance orerasure under the Personal Information Act or other laws or regulations. For more
information, please read “Request for disclosure of held personal data in accordancewith the Personal Information Protection Act” on the Company’s FAQ.

14. Discontinuing the provision of personal data to third parties
In the event that the Company holds personal data obtained from a customer without thecustomer’s approval or acquires personal data in a method not permitted by the Personal
Information Act or Individual Number Act, or if there is a request for thediscontinuation of offering personal data to third parties in accordance with thePersonal Information Act or Individual Number Act, and the claim or request is deemed to
be for one of the preceding reasons, once the request or claim has been confirmed tocome from the actual customer, the Company shall promptly discontinue providing the held
personal data and notify the customer of the discontinuation. However, the Company is
not required to discontinue providing personal data to third parties where not requiredby the Personal Information Act, Individual Number Act, or other laws and ordinances.
For more information, please read “Request for disclosure of held personal data inaccordance with the Personal Information Protection Act” on the Company’s FAQ.

15. Handling of special care-required information
The Company will only obtain a customer’s special care-required personal information
after obtaining permission from that customer, except where permitted by the Personal
Information Act or other relevant laws and ordinances.

16. Use of cookies and other technologies
Cookies or similar technologies may be used in the Company’s service. Such technologies
help the Company to recognize the status of use of the Company’s services, etc. andcontribute to improvement of the services. When a user intends to disable cookies, theuser may disable cookies by changing the web browser settings. Please note that whencookies are disabled, parts of the service may be unavailable.
The Company uses Google Analytics, a service from Google, Inc., to track users' visits
to the Company's website. In order for the Company to use Google Analytics on theCompany's website, the Company issues cookies for Google, Inc. to collect, record, andanalyze the users' history of visiting the Company's website. The Company receives theresults of Google, Inc.'s analysis to track users' visits to the Company's website. The
information obtained, registered, and analyzed by Google Analytics does not contain any
information that can identify any specific individual. The corresponding information
shall be managed by Google, Inc. in accordance with Google, Inc.'s privacy policy.
Users can exclude themselves from the data collected by Google Analytics by disabling
the browser plugin for Google Analytics. Users can exclude themselves from Google
Analytics by downloading and installing the Google Analytics Opt-out Browser Add-on
offered by Google, Inc. and then updating the user's add-on settings. By disabling
Google Analytics, Google Analytics will also be disabled on other websites in addition
to the Company's website. Google Analytics can be enabled again by reconfiguring thesettings in the browser add-on.
For more information, please read the Terms of Use for Google Analytics on the Google
Analytics website as well as Google, Inc.'s privacy policy on Google, Inc.'s website.

6

Google Analytics Terms of Service

https://marketingplatform.google.com/about/analytics/terms/us/
Google Privacy Policy

https://policies.google.com/privacy?hl=en
Google Analytics Opt-out Add-on

https://tools.google.com/dlpage/gaoptout?hl=en

17. The Company’s Name, Address, and Representative’s Name
bitFlyer, Inc.
The Company’s address, representative, etc. can be referenced below.
https://bitflyer.com/en-jp/company

18. Inquiries
With respect to requests for disclosure, etc., comments, questions, complaints and otherinquiries regarding the handling of personal information as well as specific personalinformation, please use the following contact method:
bitFlyer, Inc. General Inquiries
TEL：03-6434-5864

19. Continuous improvement
The Company shall endeavor to perform a timely review of the status of the operations
regarding the handling of personal information as well as specific personal informationand to improve such operations continuously. The Company may amend this Privacy Policy
as necessary.
[Effective as of April 26, 2014][Amended on December 19, 2018][Amended on May 1, 2020][Amended on November 10, 2021][Amended on March 28, 2022][Amended on April 27, 2022]

7