Otsuka Group Global Privacy Policy

I

Introduction to the Policy

1

PurposeThis Policy describes the responsibilities and the processes to be followed by Otsuka

Group to promote compliance with data protection laws and regulations for the processing of
personal data in each country where we operate our businesses and to protect the privacy
and personal data of individuals.
2ScopeThis Policy applies to each Otsuka Group which means Otsuka Holdings Co., Ltd.

and any other entity or establishment that is directly or indirectly, through one or moreintermediaries, being controlled by Otsuka Holdings Co., Ltd. (“we” or “us”) which processes
personal data (including access logs, web beacons or pixels and cookies) in its activities.
This Policy applies to us in our capacity as a data controller (a legal person or entity which
determines the purposes and means of the processing of personal data) and/or a dataprocessor (a legal person or entity which processes personal data on behalf of a controller),
as applicable.
3Policy Statement
We respect the privacy and personal data of individuals. Our business activities

require us to use a variety of personal data, including that of employees, customers,consumers, patients, clinical trial subjects and healthcare professionals.

We are committed

to collecting, maintaining, securing, disclosing and using their personal data in accordancewith applicable laws, rules and regulations, and only for legitimate business purposes.
Through this Policy, we will strive to continuously improve and develop theprotection afforded to individuals and their privacy protection of personal data.
IIActions to Comply with Data Protection Laws and Regulations

1

Lawful Use with fairness and transparency
We process personal data lawfully, fairly and in a transparent manner.

In

particular, where required by local law, we provide data subjects with a privacy noticedetailing how we process personal data, whom personal data will be transferred to and anyother information which may be required.
2

Purpose Limitation
We collect personal data for specified, explicit and legitimate purposes only(“Purpose of Processing”).

In case personal data is further processed, we will ensure that it

is done in a manner which is consistent with the Purpose of Processing.

Where the Purposeof Processing changes, we will comply with applicable data protection laws and regulations.
3Data Minimization
We ensure that personal data collected is adequate, relevant and limited to what isnecessary in relation to the Purpose of Processing.
4Retention of Personal Data
We retain personal data only as long as is necessary for the Purpose of Processingor as legally required.

When personal data is no longer necessary or relevant for thePurpose of Processing or to fulfill a legal or business requirement, it shall be securely deleted
in accordance with industry standards.
5Accuracy of Personal Data
We keep personal data accurate and up to date for the Purposes of Processing.

6Security of Personal Data
We are committed to preserving the integrity and confidentiality of personal data.

In pursuit of this, we take necessary and appropriate technical and organizational measures
to ensure that personal data is kept secure by complying with applicable Information
Technology and Security policies and procedures, to protect personal data from unauthorized
or unlawful processing and against accidental leakage, loss or damage, and thus to ensurebusiness continuity.
Where third parties process personal data on our behalf, we exercise the necessary
and appropriate due diligence and supervision over the relevant data processors so as toensure the security of personal data.
7Third Party Provision
We only transfer personal data to third parties, where it is in compliance withapplicable data protection laws and regulations.

When we provide personal data to a thirdparty in a foreign country, we take into account appropriate data transfer safeguards inaccordance with applicable data protection laws and regulations.
8Rights of Data Subjects
Where required by laws and regulations, we respect the rights of data subjects suchas the right to access, right to rectification, right to erasure, right to restriction of processing,right to data portability, as may be provided by applicable data protection laws andregulations.
9Local Standards
As we operate in many different countries, we may find local laws or regulations

provide stricter requirements than set forth in this Policy, as this Policy represents the global
minimum standard that applies for data protection.

For the avoidance of doubt, we will

adhere to stricter local requirements as necessary and these shall be reflected in countryspecific privacy policies.

ⅢRevision History
Enforced on Apr 15, 2019.