Exhibits of EEA (European Economic Area) and the United Kingdom
Effective date: September 9, 2022
Last updated: September 9, 2022

This Exhibit applies to customers who live or reside in the EEA (European Economic Area) and theUnited Kingdom and relates to the GDPR and the UK GDPR (hereinafter simply referred to as the"GDPR").

1.

Legal grounds for the Processing･Security of the Services and Our Website including the prevention of cyber attacks

Purpose of theLegal grounds for Type ofProcessing

the Processing

Data recipient

personal data

Transfer of personal
data outside
EEA/UKRegistration inIn the case whereRegistration

Please refer toPlease refer to Article

the Services

the Processing is

information

Article 6 of the7 of the Global

required in orderGlobal Privacy

Privacy Policy andto meet thePolicy.)

Article 2 of thisrequirements ofExhibit.

the data subject
prior to theconclusion of thecontract (Art. 6.1 b
GDPR)
Provision,

For the provision

Registration

operation andand operation of

information

improvement ofthe Services, in the Service

the Services

case where theProcessing isrequired for theperformance of thecontract (Art. 6.1 b

information

GDPR). For the
improvement ofthe Services, in thecase where theProcessing isrequired for the
pursuit oflegitimate interests(Art. 6.1 f GDPR)
Notification toConsent in theRegistration

customers on

case where it isinformation

information andrequired for directService

questionnaires on marketing (Art.
products,6.1 a GDPR).

services, events,

Otherwise, in theseminars, andcase where thesales

Processing is

information

required for the
performance of thecontract (Art. 6.1 bGDPR)
Analysis of theConsent for otherOnline

attributes ofthan strictly

identifiers andcustomers who

essential cookies

terminal

accessed Our(Art. 6.1 a GDPR). information

Website to help

Otherwise, in theRegistration

personalizationcase where theinformationand improvement Processing is

Serviceof Our Website

information

required for thepursuit oflegitimate interests(Art. 6.1 f GDPR)

Maintenance ofIn the case where

ServiceOur Website,

the Processing is

information

investigation ofrequired for theInquiry

server failures,

pursue ofinformation

and restoration

legitimate interests Strictly essentialfrom failures(Art. 6.1 f GDPR)

online identifiers
and terminal
information

Response toIn the case whereInquiry

customerthe Processing isInformationinquiries

required for theRegistration

performance of the information
contract (Art. 6.1 b ServiceGDPR)

information

Exercise andIn the case where

Registration

defense of legal

the Processing is

information

claimsrequired for theService

pursuit ofinformation

legitimate interests Inquiry(Art. 6.1 f GDPR)

Information

Compliance with

For theRegistration

Laws andcompliance withinformation

Regulations

the legislations ofService

the European

information

Union and theInquiry

United Kingdom,

Informationin the case where

Strictly essential

treatment isonline identifiers

required for theand terminal

compliance withinformation

the legal duty towhich theadministrator issubject (Art. 6.1. cGDPR). For thecompliance withother legislations,in the case where
the Processing isrequired for thepursuit oflegitimate interests(Art. 6.1 f GDPR)
Other services

If required for theRegistrationnecessary for the

performance of the information

provision of thecontract, in theInquiry

Services andcase where theInformation

services

Processing is

Serviceincidental

required for theinformation

thereto.

performance of the Strictly essentialcontract (Art. 6.1 b online identifiers
GDPR) Otherwise, and terminalin the case where

information

the Processing isrequired for the
pursuit oflegitimate interests(Art. 6.1 f GDPR)
Reference for the

In the case where

Servicedevelopment of

the Processing is

information

new services andrequired for theInquiry

the acquisition ofpursue of

information

new content

legitimate interests Strictly essential(Art. 6.1 f GDPR)

online identifiers
and terminal
information
Strictly essential
online identifiers

and terminal
information

Preparation of

In the case whereRegistration

statistical

the Processing is

information

information andrequired for theService

other non-pursue of

information

personal

legitimate interests Strictly essential

information(Art. 6.1 f GDPR)

online identifiers
and terminal
information
Inquiry
information

Security of theIn the case whereServiceServices and Our

the Processing isinformation

Websiterequired for the

Strictly essential

including thepursue of

online identifiers

prevention oflegitimate interests and terminal

cyber attacks(Art. 6.1 f GDPR)

information
Inquiry
Information*Please contact the contact address listed in Article 11 (Contact information) of the Global Privacy
Policy for more information about legitimate interest balancing testing.

2.

Transfer of personal data overseas

Where necessary, the Company may transfer personal information obtained in the EEA to Japan andother countries within and outside the EEA . Some of the countries to which information is transferredhave received sufficiency certification based on the GDPR such as Japan. The European Commission
has determined that Japan has provided adequate levels of protection. More information is available
here, the determination of sufficiency certification. In addition, some countries have not received
sufficiency certification, but in the case where personal information of users is transferred to countries
which have not received the sufficiency certification, the transfer shall be subject to the Standard
Contract Clause (Articles 46(2)(c) and 46(5) of GDPR).

Customers' rights

3.

Customers who are residents in the EEA the Company handles have the following rights under theGDPR with respect to their personal information if they meet the GDPR requirements. [MHM: The
contents of the Main Paragraph 4 of the draft policy we received. If you wish to exercise the rights,
please contact the contact address in Article 11 of the Global Privacy Policy.
–Acquisition of information relating to the Processing of data: The customer has the right toobtain from the Company all required information relating to the Company’s dataprocessing activities relating to the customer (Articles 13 and 14 of GDPR).

–

Access to personal data: The customer has the right to obtain confirmation from theCompany as to whether personal data relating to the customer has been processed, and if
such Processing has been carried out, the customer has the right to access personal data andcertain related information (Article 15 of GDPR).

–

Correction or deletion of personal data: The customer has the right to have the Company
correct inaccurate personal data relating to the customer without undue delay and to have
the Company complete the incomplete personal data (Article 16 of GDPR). In addition, if
certain conditions are met, the customer has the right to have the Company erase thepersonal data relating to the customer without undue delay (Article 17 of GDPR). However,this does not apply to the following cases:
1. In the case where necessary to comply with legal obligations
2. In the case where there is a legitimate business purpose
3. In the case where necessary for the proof, exercise or defense relating to a legal claim,
restrictions on the Processing of personal data: In the case where certain conditions are met,
the customer has the right to have the Company restrict the Processing of personal data
relating to the customer (Article 18 of GDPR).

–

Objection to the processing of personal data: In the case where certain conditions are met,
the customer has the right to object to the following regulatory authorities or the Company
regarding the Processing of personal data relating to the customer (Article 21 of GDPR).

–

Data portability of personal data: In the case where certain conditions are met, the customer
has the right to receive personal data relating to the customer in a structured, commonlyused and machine-readable form and to transfer such data to another administrator without
interference from the Company (Article 20 of GDPR). Provided, however, that such rights
shall be limited to those provided pursuant to the consent or contract of the customer andimplemented by the means where the handling of personal information has been automated.

–Withdrawal of consent: The customer has the right to withdraw the consent at any time bymeans separately designated by the Company when the Company obtains the customer’sconsent. Provided, however, that the withdrawal of the customer’s consent will not affectthe legitimacy of any Processing performed with the customer’s consent before withdrawal.
In addition, in the case where the customer withdraws the consent, the customer may nolonger be able to use the Services in whole or in part.
–Not being subject to automated decision-making: In the case where certain conditions aremet, the customer has the right not to be subject to automated (non-human) decision-making
that will have a legal or material effect on the customer (Article 22 of GDPR).

The customer may also file a direct complaint with the relevant regulatory authorities listed here if thecustomer resides in EEA, or with Information Commissioner's Office if the customer resides in theUnited Kingdom with respect to the Processing of the customer’s personal data by the Company.