JAPAN NUTRITION CO., LTD
GDPR PRIVACY POLICYJapan Nutrition Co., Ltd. respects the privacy and rights of all individuals and takes very seriously its
responsibilities under the data protection and privacy laws which apply to our business.
This GDPR privacy policy explains how and why we use information which relates to an identifiable individual in
the European Economic Area (Personal Data), and what we do to ensure that your Personal Data is kept safe andsecure in accordance with the General Data Protection Regulation and any other applicable data protection andprivacy laws (Data Protection Laws).
This policy explains:
1. Who we are and how to contact us
2. How we collect and process Personal Data:
A. Business, professional and other contacts
B. Recruitment
C. CCTV
3. Website visitors
4. Recipients of Personal Data
5. How long we store Personal Data for6. How we keep Personal Data safe
7. International transfers
8. Your rights as a data subject
9. Updates to this policy
1. WHO WE ARE AND HOW TO CONTACT US
We are Japan Nutrition Co., Ltd. (the Company, we, our, or us), a corporation having our main place of businessat 1-1, Minami-Aoyama 1-chome, Minato-ku, Tokyo 107-0062, Japan. You can contact us by writing to us at ouroffice address, telephoning us on +81-3-5771-7891 or emailing to kanri2@jnc.co.jp.
For the purposes of Data Protection Laws, we are a controller in relation to much of the Personal Data we collectand process. This means that we are responsible for deciding how and why we use Personal Data, and for keeping
it safe.
2. HOW WE COLLECT AND PROCESS PERSONAL DATA
A. BUSINESS, PROFESSIONAL AND OTHER CONTACTS
How we collect Personal Data
We collect and process Personal Data relating to individual business and professional contacts and other people
we engage with in the course of our business, such as the employees of our corporate customers. Usually thisinformation is:‣provided by the individuals themselves;‣ collected in the process of providing goods and services to our corporate customers (such as throughcorrespondence and exchanging business cards);‣ provided to us by third parties (such as other businesses we work with); or‣ obtained from external sources.
The types of Personal Data we collect
The types of Personal Data we hold about these individuals typically consists of some or all of the following:‣ contact information (such as name, address, telephone and email address);‣ bank details (provided by a supplier and processed when we receive or make a payment).
There may of course be situations where we may process other types of Personal Data in the course of providing
goods and services to our corporate customers, receiving goods and services from our suppliers and promoting
our business. If we do, then it will be protected to the same high standards explained in this policy.
Why we need to use Personal Data
Depending on the circumstances, and the nature of our relationship with the people involved, we may use your
Personal Data to:‣ fulfil our contractual obligations or exercise contractual rights (such as paying our suppliers);‣ communicate with other organizations, advisers or intermediaries; or‣ send business related communications (usually by email);‣ comply with our legal obligations;‣ pursue our legitimate interests in operating and promoting the success of our business, or to pursue theinterests of our corporate customers in providing our goods and services.
B. RECRUITMENT
We collect, store and use Personal Data about individuals who apply to join us. This may include information:‣ you provide to us (such as in CVs, application forms, and through correspondence);‣ you provide during an interview;‣ obtained from previous employers and referees;‣ provided to us by recruitment agencies; and‣ received as a result of our carrying out background checks (such as checks for criminal convictions with theDisclosure and Barring Service).
The information we collect might include sensitive Personal Data, such as information about your health andsickness records. If we need to process sensitive Personal Data, then we will ask for your explicit consent before
doing so.
If you apply for a position with us, we may carry out a check for criminal convictions in order to satisfy ourselvesthat there is nothing in your history which makes you unsuitable for the role. We do this because working with us
involves a high degree of trust (as you will have access to confidential information).
We only carry out criminal records checks and ask for references at the last stage of the application process, when

making an offer of employment, and always act in accordance with the specific requirements of Data Protection
Laws and other applicable national laws.
How we use applicant information
We use the Personal Data we collect about you to:‣ assess your skills, qualifications, and suitability for a role;‣ carry out background and reference checks;‣ communicate with you about your application;‣ keep records related to our hiring process; and‣ comply with legal or regulatory requirements.
We do all of this because either it is a necessary part of entering into a contract of employment with you or because
we have a legitimate interest in ensuring that you are suitable for a particular role.
If you fail to provide Personal Data when requested, which is necessary for us to consider your application (suchas evidence of qualifications or work history), we will not be able to process your application successfully.
Retention of applicant information
We retain Personal Data for a certain period of time so that we can demonstrate, in the event of a legal claim, that
we have not discriminated against an applicant and that the recruitment process was fair and transparent. We willsecurely destroy an applicant’s Personal Data if it becomes unnecessary for the said purpose. If we wish to retain
Personal Data on file, in case future opportunities arise, we will contact the applicant and ask for his or her consent
to do so.
If you are successful, the Personal Data you provided in the application process will be stored as part of yourpersonnel file.
C. CCTV
We operate a CCTV Security System on our premises for security purposes, to detect and prevent crime andprotect the safety of our workers and visitors. We do not use it for any other purpose.
This means that we collect and store (for a limited period) images of visitors to our premises using our CCTV
system and may have to use them in the event of a security incident. If you have any questions, please ask us.
3. WEBSITE VISITORS
We do not normally collect Personal Data about visitors to our website unless they choose to provide suchinformation when they contact us.
We collect anonymous information about visitors to our website in order to optimize and improve the website. Thismight include IP addresses, browser or device details and the connection type (for example, the Internet service
provider used). However, none of this information will by itself directly identify any particular user.

Hyperlinks to other sites
Our website may include links to third-party websites or to other software applications or plug-ins. We are notresponsible for the content or functionality of any of those external websites. If an external website requests
personal information from you, the information you provide will not be covered by this policy. We suggest you readthe privacy policy of any website before providing any personal information.
4. RECIPIENTS OF PERSONAL DATA
Personal Data you provide to us will be kept private and confidential, and we will not disclose or share it with otherdata controllers without your permission. The only exception to this is where we are legally required to disclose
Personal Data. For example, to comply with a court order. We may also be required to share personal information
with regulatory authorities in the event of an audit or investigation.
We share Personal Data with some of the third parties who provide services to our firm. This includes softwareand cloud service providers and IT support services. However, these third parties will only process Personal Data
(which may include your information) on our behalf for specified purposes and in accordance with our strict
instructions.
We only use third party service providers who have provided sufficient guarantees, as required by Data Protection
Laws, that your Personal Data will be kept safe.
5. HOW LONG WE STORE PERSONAL DATA FOR
We only retain Personal Data for as long as is necessary for the specific purpose(s) it was collected for (or forrelated compatible purposes such as complying with applicable legal, accounting, or record-keeping requirements).
To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivityof the Personal Data, the potential risk of harm from its unauthorized use or disclosure, the purposes for which we
process your Personal Data and whether we can achieve those purposes through other means, and the applicablelegal requirements.
6. HOW WE KEEP PERSONAL DATA SAFE
We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost,used or accessed in an unauthorized way, damaged or destroyed, altered or disclosed. This includes both physicalsecurity measures (such as keeping paper files in secure, access-controlled premises) and electronic security
technology (such as digital back-ups and sophisticated anti-virus protection).
We limit access to your Personal Data to those employees, agents, contractors and other third parties who havea business need to know. They will only process your Personal Data on our instructions and they are subject tolegal and contractual confidentiality obligations.
We have put in place reporting procedures to deal with any suspected Personal Data breach and will notify you
and any applicable supervisory authority of a breach when we are legally required to do so.

7. INTERNATIONAL TRANSFERS
We normally only store Personal Data within Japan. However, some of the technology and support services we
use are provided by international organizations and/or companies which are based outside Japan. Before using
such service providers, we take steps to make sure that any Personal Data they process is adequately protected
and transferred in accordance with Data Protection Laws, usually by one or more of the following methods:‣ ensuring the recipient is in the European Economic Area or a country which the EU Commission has deemed
provides adequate protection for Personal Data;‣ implementing appropriate safeguards such as requiring the recipient to enter into Standard Contractual
Clauses approved by the appropriate data protection supervisory authorities; or‣ (if the recipient is based in the USA) transferring Personal Data to recipients who are certified under the EUUS Privacy Shield scheme.
8. YOUR RIGHTS AS A DATA SUBJECT
Data Protection Laws provide you with certain rights in relation to your Personal Data. These are as follows:‣ The right to access your Personal Data. This enables you to receive a copy of the Personal Data we holdabout you.
‣ The right to request correction or completion of Personal Data. This enables you to have any incomplete orinaccurate information we hold about you corrected.
‣ The right to request erasure of your Personal Data. This enables you to ask us to delete or remove Personal
Data (though this may not apply where we have a good, lawful reason to continue using the information inquestion). You also have the right to ask us to delete or remove your Personal Data where you haveexercised your right to object to processing (see below).
‣ The right to object to processing of your Personal Data. You can object to us processing Personal Data for
legitimate interest purposes or for direct marketing.
‣ The right to restrict how your Personal Data is used. You can limit how we use your information (primarily tostorage or for use in legal claims).
‣ The right to have a portable copy or transfer your Personal Data. We will provide you, or (where technicallyfeasible) a third party, with a copy of your Personal Data in a structured, commonly used, machine-readable
format. Note this only applies to automated information we process on the basis of your consent or in orderto perform a contract.
‣ The right to withdraw consent. If we are relying on consent to process your Personal Data you have the rightto withdraw that consent at any time.
Responding
We try to respond to all Personal Data requests within one month. Occasionally it may take us longer than a month
if your request is particularly complex or you have made a number of requests. Please also bear in mind that there
are exceptions to the rights above and some situations where they do not apply.
We may need to request additional information from you to help us confirm your identity. This is a security measure
to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact
you to ask you to clarify your request.

Fees for making a request
You will not normally have to pay a fee to access your Personal Data (or to exercise any of your other rights).
However, we may charge a reasonable fee if your request is unfounded, repetitive or excessive. Alternatively, wemay refuse to comply with your request in these circumstances.
How to make a request
If you want to exercise any of the rights described above, please email to kanri2@jnc.co.jp or write to BusinessControl Unit No.2, Japan Nutrition Co., Ltd., 1-1, Minami-Aoyama 1-chome, Minato-ku, Tokyo 107-0062, Japan.
Your right to complain to a supervisory authority
You have the right to complain to a data protection supervisory authority if you are not satisfied with our response
to a data protection request or if you think your Personal Data has been mishandled.
9. UPDATES TO THIS POLICY
We will update this policy from time to time. The current version will always be posted on our website. This policy
was last updated on 1 April 2024.
［END］