Privacy Policy(For Customers Residing in the EU)
Osaka Station City Cinema (joint venture of Shochiku Multiplex Theatres, Ltd., TOHO Cinemas Ltd., andT-Joy Co., Ltd., represented by Shochiku Multiplex Theatres, Ltd.) (the “Company”) will collect andhandle, pursuant to this Privacy Policy (this “Policy”), the personal data of customers residing in the EU
member states and Ireland, Lichtenstein and Norway who have executed an EEA Treaty (collectively, the“EU”).
Index
1. Contact Information
2. Types of Personal Data
3. Purpose of Use and Legal Basis for Handling of Data
4. Recipients of Personal Data
5. Sources for Acquisition of Personal Data
6. Transfer to Third-Country Businesses
7. Retention Period
8. Rights of the Customer
9. Right to File Objection to Handling of Data
10. Right to Withdraw Consent
11. Personal Data Required to Be Provided
12. Right to File Complaint with Supervising Authorities

1.

Contact Information

The contact information of the Company is as follows:
Address: 4-1-1 6th Fl. Togeki Building, Tsukiji, Chuo-ku, Tokyo
Email address : osaka-info@shochiku.co.jp

2.

Types of Personal Data

The Company will collect and handle the following personal data in relation to its provision of services:
Information that can identify the person and contact information
Including, for example, name, address, telephone number and email address

Information regarding the person’s attributes
Including, for example, gender and date of birth

Information regarding the use of services
Including, for example, website access history

3.

Purpose of Use and Legal Basis for Handling of Data

The Company will handle the personal data for the following purposes of use:
For legitimate interests that will be required by the Company when the Company engages in business(including the following purposes of use):(a) To statistically process the customer’s personal data, and use or provide the processed data; and(b) Carry out questionnaires regarding the Company’s services and related services.

To comply with obligations under an agreement or to perform the procedures relating to an agreement(including the following purposes of use):(a) Delivery of prizes if there are products that have been won.

To handle personal information in the event the customer gives consent (including the following
purposes of use):(a) Notices regarding films and various campaigns (where your consent is required in accordancewith applicable law); and(b) Provision of email magazine distribution services (where your consent is required in accordancewith applicable law).

For purposes set forth in the laws and regulations (including the following purposes of use):(a) For use in the event there is a need to maintain or acquire personal information to fulfill a legal
obligation borne by the Company; and(b) When responding to requests of the government or investigative agencies.

4.

Recipients of Personal Data

The Company will provide and handle the customer’s personal data to the following businesses:(a) Joint venture members
The Company will jointly use between each joint venture members the personal data described above
for the aforementioned purposes of use and appoints Shochiku Multiplex Theatres, Ltd., which
represents the joint venture, as the manager of the joint use.
(b) Service providers that will be the Company’s subcontractors
The Company will subcontract the handling of personal data after executing memorandums ofunderstanding concerning the entrustment of the handling of personal data with service providers.
Service providers include, for example, IT infrastructure service providers, customer management
service providers, web hosting vendors, and security service providers.

5.

Sources for Acquisition of Personal Data

The Company may collect other personal data directly from the customer, but in certain instances, theCompany may collect personal data by receiving personal data from the Shochiku Group Companies.

6.

Transfer to Third Country Businesses

The Company may transfer the customer’s personal data to countries outside the EU region to provide its
services. Such countries may include those that the Committee has not decided as providing a sufficientlevel of protection with respect to the protection of personal data.
Please be advised that the Company will transfer personal data to such third countries only if proper
protective measures such as of the standard data protection provisions set forth in Article 46(2) of the EU
General Data Protection Regulation (the “GDPR”) are taken.
To obtain a copy of a document used for the protection of the customer’s information or to obtain detailed
information, please send a letter to the Company (4-1-1, 6th Fl. Togeki Building, Tsukiji, Chuo-ku, Tokyo)
or contact (osaka-info@shochiku.co.jp ).

7.

Retention Period

The Company will retain the customer’s personal data for the period of time required to achieve the purposeof use set forth in this Policy.
The decision on the retention period of personal data is based on (i) whether or not the customer is
continuing to use the Company’s services, (ii) whether or not there are legal obligations that the Company
must comply with, and (iii) whether or not there is a need to perform an agreement that the customer is aparty to.

8.

Rights of the Customer

The customer has (i) the right to request a copy of the personal data, (ii) the right to request revisions, (iii)the right to request deletions, (iv) the right to limit the handling (or stop the processing) of personal data,and (v) the right to have the personal data provided to Shochiku for an agreement or under consent bestructured and receive it in a form that is machine-readable (right of data portability), against the Company.
In addition thereto, the customer has (vi) the right to object to the handling of personal data, under certain
conditions. Please refer to “9. Right to File Objection to Handling of Data” below for details.
These rights may be restricted, for example, if a third party’s personal data is disclosed by complying withthe customer’s request, if the rights of someone other than the customer (including the Company’s rights)
will be infringed, or if retention is required or deletion of information of which its retention has exigent
legitimate interests is required by the laws and regulations. These exceptions to the rights are set forth inboth the GDPR and the domestic laws of each EU state regarding privacy.
To exercise any of these rights, please send a letter to the Company (4-1-1, 6th fl. Togeki Building, Tsukiji,Chuo-ku, Tokyo) or contact (osaka-info@shochiku.co.jp ).

9.

Right to File Objection to Handling of Data

The customer always has the right to file an objection against the handling of personal data that is handled
on the basis of legitimate interests. The handling of personal data used here includes profiling (which meansto analyze and predict the customer’s actions from the customer’s information; the same applies hereafter).
If the customer’s personal data is handled for the purpose of direct marketing, the customer has the absoluteright to refuse direct marketing and to refuse the profiling conducted for such purpose.
To exercise any of these rights, please send a letter to the Company (4-1-1, 6th Fl. Togeki Building, Tsukiji,Chuo-ku, Tokyo) or contact (osaka-info@shochiku.co.jp ).
10. Right to Withdraw Consent
If the Company is handling personal information under the customer’s consent, the customer always has
the right to withdraw such consent. This withdrawal will not have effect on the legality of any handling thatwas conducted under the consent granted before then.
To exercise this right, please send a letter to the Company (4-1-1, 6th Fl. Togeki Building, Tsukiji, Chuoku, Tokyo) or contact (osaka-info@shochiku.co.jp ).
11. Personal Data Required to Be Provided
The personal data that is required to be provided will be indicated on the form that the customer fills out.
If the provision of personal data is required, the Company will not be able to provide its services to thecustomer unless proper information is provided.
12. Right to File Complaint with Supervising Authorities
The customer has the right to file a complaint against the supervising authorities. The supervisingauthorities where the complaint can be filed include the supervising authorities of the EU member states
where the customer’s place of residence or workplace is located or where the place the petition of the GDPR
violation is initiated is located.