Sky Bug Bounty Program Terms and Conditions
These Sky Bug Bounty Program Terms and Conditions (these "Terms and Conditions") set forth theterms and conditions for the participation in the Sky Bug Bounty Program (the "Program") enacted by
Sky Co., LTD. ("Sky").

Persons who investigate or report vulnerabilities ("Participate" or“Participation”) pursuant to the Program (the "Reporters") shall be deemed to have agreed to theseTerms and Conditions.
Article 1 Sky Bug Bounty Program
1.

Under the Program, when a Reporter reports any information security flaw(s) caused by aprogram defect or design error (including, but not limited to, vulnerabilities or methods of attack;"Vulnerabilities") relating to products, services, and websites that Sky provides (such products,
services, and websites subject to the Program shall be referred to as the "Target Products") to Sky
in accordance with the methods set forth herein, and Sky judges that it is a valuable report, areward in an amount determined by Sky (the "Reward") shall be paid to the Reporter.

2.

The Target Products are described in the website regarding the Program. The Target Products
may be altered without prior notice.

3.

Sky shall comply with all domestic or foreign laws, cabinet orders, circular notices, regulations(including, but not limited to, regulations set forth by financial instrument exchanges), orders,ordinances, guidelines, and other legal norms ("Laws and Regulations") relating to Reward
payments (including, but not limited to, all laws and regulations, and rules and guidelines relating
to gifts, ethics, and donations), and will provide Rewards in accordance with these Terms andConditions.

Article 2 Amendment of these Terms and Conditions and/or the Program1.

Sky may, at its discretion, amend these Terms and Conditions and/or the contents of the Program,either in whole or in part, to the extent that doing so does not violate any laws or regulations.

2.

In the event that Sky intends to amend the contents of these Terms and Conditions and/or the
Program, Sky shall determine the effective date of such amendment and, prior to such effective
date, post and publicize the contents of the modified Terms and Conditions and/or Program,
together with its effective date, on the website regarding the Program.

3.

If a Reporter Participates in the Program on or after the effective date of the amendment basedon the preceding paragraph, or has Participated in the Program prior to the effective date of theamendment and continues to Participate after the said date, the Reporter shall be deemed to haveconsented to the contents of the amended Terms and Conditions.
If any amendment to these Terms and Conditions is made during the period for assessment of a
Vulnerability Information (as defined in Article 4, Paragraph 3) stipulated in Article 8, Sky will

inform the concerned Reporter of such amendment.
Article 3 Eligibility for Participation
1.

Only those who meet all of the following criteria are entitled to Participate in the Program.
(a) The person shall have reached the age of majority or otherwise have the authority to perform
legal acts independently under the laws of his/her place of residence. If a person is a minor,
or otherwise is unable to perform any legal acts independently, he/she shall have obtained
the permission of his/her parent or legal guardian prior to his/her Participation in the
Program.
(b) The person shall Participate in the Program as an individual. When the person belongs toan organization (including, but not limited to, companies; the same shall apply hereinafter),he/she only shall Participate after confirming, at his/her own responsibility, that his/herParticipation does not violate such organization’s internal rules (including, but not limited
to, work rules; the same shall apply hereinafter).

(If necessary, he/she shall obtain

permission to Participate from the organization to which he/she belongs, and Sky shall not
be responsible for any violation of such organization’s internal rules.)2.

In the event that a person who intends to Participate in the Program is an employee of a national
government or a local government, or is an assembly member, committee member, or other staff
member who engages in public service pursuant to Laws and Regulations ("Public Officials"),
such person shall be eligible to Participate only if he/she satisfies the following criteria in addition
to the those provided in the preceding paragraph.
(1) Before Participating in the program, the person has confirmed with the public organization
to which he/she belongs that it is possible for Sky to pay the Rewards to such publicorganization.

(A document acknowledging the receipt of Rewards must be signed inwriting by an authorized signatory of the public organization in question. The person must
Participate in the program only after having confirmed that the fulfillment of suchrequirement is possible in order to receive the Rewards). Nevertheless, in the event thatSky is unable to pay the Rewards to the public organization to which the person belongs but
the person agrees to such non-payment, confirmation with the public organization shall not
be required.
(2) The person shall comply with ethics rules of the public organization to which he/she belongs
and obtain the approval of the person in charge of the public organization (i.e., the person
who is responsible for supervising the content of the ethics rules and for managing andsupervising the actions of Public Officials; the same shall apply hereinafter) regarding such
person’s Participation in the Program, and the person must obtain the approval of such
person in charge even in the case of the proviso of the preceding item.
3.

A person may not Participate in the Program if Sky acknowledges that any of the following

criteria are applicable:(a) The person is deemed to be a minor in his/her place of residence, except that this provision
shall not apply where the prior permission of his/her parent or legal guardian has beenobtained;(b) The person is not permitted to Participate in the Program under any applicable law;(c) The person (i) is a resident of a country or entity which (a) is, at the time of reporting, subject
to sanctions by Japan, the United States, or elsewhere (including, but not limited to,sanctions by the United States Department of the Treasury’s Office of Foreign Asset Control
or sanctions under Japan's Foreign Exchange and Foreign Trade Act, etc.), or (b) does notallow its residents to participate in arrangements such as the Program, or (ii) is not entitled
to receive Rewards from Sky in accordance with applicable Laws and Regulations;(d) The person is not permitted to Participate in the Program under the regulations of theorganization to which they belong at the time of reporting;(e) The person, the person’s relatives (spouse, children, parents, or siblings), or a member ofthe same household as the person is an employee of Sky or its subsidiaries or affiliates(including, but not limited to, Egg Co., Ltd.; "Group Companies") at the time of reporting,or anytime within six (6) months prior to the date of reporting (except that if multiple reportson the same or similar Vulnerability are submitted, such period should be six (6) months
prior to the date of the Reporter’s first related report);(f) The person, the person’s relatives (spouse, children, parents, or siblings), or a member ofthe same household as the person was engaged in Sky’s or its Group Companies’ businessat the time of reporting, or anytime within six (6) months prior to the date of reporting(except that if multiple reports on the same or similar Vulnerability are submitted, such
period should be six (6) months prior to the date of the Reporter’s first related report) (e.g.,
those who were stationed at Sky or its Group Companies, those who were engaged inperforming work for Sky or its Group Companies under consignment contracts, dispatch
contracts, secondment agreements, etc. for the purpose of carrying out any work related toSky's or its Group Companies’ website and/or products planned, developed, and/or produced
by Sky or its Group Companies);(g) Persons who are or were engaged in any planning, development, and/or production work or
management, operation, and/or maintenance work related to the Target Products; or(h) An organized crime group, a member of an organized crime group, a quasi-member of anorganized crime group, or any other person equivalent thereto (an "Anti-social Force") or aperson who has a close relationship with an Anti-social Force (hereinafter collectively
referred to as "Anti-social Force, etc."). In the event that a Reporter is found to be an Antisocial Force, etc. after his/her Participation in the Program, his/her eligibility to Participate
in the Program shall be suspended.

Article 4 How to Participate
1.

Reports submitted under the Program shall be in Japanese or English. Reports in languages
other than Japanese or English will not be accepted.

2.

Applications for Participation in the Program may be made through a special web form (the"Program Form"). When Sky needs to contact a Reporter, it will do so by sending an e-mail tothe e-mail address provided via the Program Form.

In the Program Form, the Reporter should

submit an e-mail address that can be used for exchanges with Sky.
3.

When a Reporter discovers or identifies a Vulnerability related to the Target Products, theReporter shall report and submit information on the Vulnerability ("Vulnerability Information")through the Program Form following the procedures specified by Sky.

4.

Reporters are encouraged to include, in as much detail as possible, the following information in
the Vulnerability Information report:(a) Type of problem (buffer overflow, SQL injection, cross-site scripting, etc.)(b) Name and version of the Target Product(s) which include(s) Vulnerabilities, or the URL (foronline services)(c) Special configuration needed to replicate the problem(d) Step-by-step procedure for reproducing problems with a new installation(e) Proof-of-concept code or exploit code(f) Problem impact (e.g., how an attacker could exploit the Vulnerability)

5.

Reporters shall follow the "Sky Bug Bounty Program Rulebook" when reporting Vulnerability
Information to Sky.

6.

If the Vulnerability Information submitted by a Reporter does not reach Sky, the Vulnerability
Information shall be deemed not to have been submitted. Sky shall not be responsible for any
failure of the Vulnerability Information to arrive for any reason whatsoever. If no confirmatione-mail from Sky is received by the Reporter within seven (7) business days of the submission ofa Vulnerability Information, the Vulnerability Information may not have been delivered to Sky.
In such case, please contact Sky through the Program Form.

Article 5 Intellectual Property Rights
1.

The Reporter shall assign to Sky any copyright, trademark right, design right, patent right, utility
model right, know-how, and other rights ("Intellectual Property Rights") relating to the
Vulnerability Information. In addition, the Reporter shall refrain from exercising his/her moral
rights as the right holder with respect to the Vulnerability Information, and approves Sky’s
performance of the following actions:(a) Using, reviewing, evaluating, testing, and analyzing the Vulnerability Information;(b) Copying, altering, distributing, displaying, or publishing the Vulnerability Information andall or part of its contents;(c) Introducing the Vulnerability Information and all of its contents via any media (including,but not limited to, any existing media or media that may be developed in the future) inconnection with the marketing, sale, or promotion of the Program or any other program (e.g.,
screenshots of Vulnerability Information in internal and external sales meetings, conference
presentations, exhibitions and press releases, etc.).
2.

The Reporter represents and warrants that the Vulnerability Information does not use information
owned by others or other entities and that he/she has the legal right to provide the Vulnerability
Information to Sky.

Article 6 Publication, etc. of Vulnerability Information by the Reporter
1.

The Reporter is prohibited from publicizing, disclosing, providing, or leaking to any third party
any Vulnerability Information or any operation that may come to his/her knowledge in the courseof conducting verification investigations, except with the prior consent of Sky. Even with Sky’s
prior consent, publication, disclosure, or provision of Vulnerability Information is permitted onlyin accordance with the provisions of the Sky Bug Bounty Program Rulebook.

2.

In the event of a violation of the preceding paragraph by the Reporter, Sky may suspend theReporter’s Participation in the Program thereafter and may request the reimbursement of the
Reward paid to the Reporter for the Vulnerability Information pertaining to such violation.

Article 7 Vulnerability Investigation
1.

Investigations and verifications relating to the Program must be conducted in an environment thatis legitimately available to the Reporter, either in an on-premises environment or in a cloudservice environment.

2.

In the absence of an environment which is legitimately available to the Reporter, the Reportermay make reports in accordance with the Program to the extent known at the time of reporting.
If the Reporter states in the report that he/she wishes to be provided with a verification
environment by Sky, Sky may give consideration, and if necessary, prepare a verification
environment free of charge, and request that the Reporter submit additional reports using suchverification environment.

3.

Even in a legitimately available cloud service environment in which investigations andverifications are conducted, the Reporter cannot conduct investigations and verifications whichhave a significant impact on such environment or which have the purpose of imposing asubstantial load on the environment.

4.

The Reporter must not access personal information of others without the prior written consent of
the subject individual. Upon accessing the personal information of others, the Reporter shallimmediately (i) discontinue such access, (ii) delete all data of the accessed personal information

remaining in Reporter’s computers, etc., and (iii) report to Sky the method of such access, thecontents of the accessed personal information, etc.
Article 8 Assessment of Vulnerability Information
1.

Sky will assess the Vulnerability Information promptly after it is submitted to Sky and verify its
eligibility for Reward payments at its sole discretion based on the Sky Bug Bounty Program
Rulebook. The time required for the assessment depends on the complexity, completeness, andthe number of Vulnerability Information received by Sky.

2.

If multiple Reporters send Vulnerability Information regarding the same Vulnerability to Sky,
only the Reporter whose Vulnerability Information report for such Vulnerability has arrived firstto Sky shall be eligible for a Reward.

3.

When Vulnerability Information regarding a similar Vulnerability is received, they shall bedeemed to be the same Vulnerability if Sky determines that the received Vulnerability
Information relates to the same Vulnerability (including, but not limited to, Vulnerabilities causedby the same library; the same shall apply hereinafter).

4.

Reporters may be able to receive partial Rewards as provided in the following article even if theyreport Vulnerabilities without including a proof-of-concept code or exploit code.

Article 9 Rewards
1.

All matters relating to Rewards (including, but not limited to, whether to pay a Reward and theamount thereof) shall be determined by Sky. The amount of a Reward shall be determined inaccordance with the provisions of Article 10 depending on the contents and details of the
Vulnerability Information.

2.

However, Rewards shall not be paid if Sky decides not to do so.

The reporting and response process shall be considered to have been completed when Sky
receives all Vulnerability Information on a Vulnerability from a Reporter and notifies theReporter of such receipt, and the date of completion shall be that date. Once the reporting andresponse process is completed, Sky will notify the Reporter of the amount of such Reward andinform the Reporter of the payment procedures.

3.

A Reporter may decline his/her receipt of the Reward by notifying Sky that he/she declines the
Reward.

4.

A Reporter who receives the notification stipulated in Paragraph 2 of this Article from Sky must
submit the necessary information to Sky within 30 days after receiving such notification.

5.

A Reporter shall not be entitled to the payment of a Reward if there is any deficiency in thecompletion of the necessary steps relating to the payment procedures, or if he/she fails to submit
the necessary information relating to the payment procedures within the time limit set forth in thepreceding paragraph.

6.

A Reporter may not designate a third party other than the Reporter as a recipient of a Reward.

However, this does not apply in the following cases:(a) When Sky shall pay the public authority to which the Reporter belongs in accordance withthe provisions of Article 3, Paragraph 2;(b) When a Reporter who is eligible to Participate in the Program pursuant to the proviso of
Article 3, Paragraph 3(a) requests that his/her parent or legal guardian receive the Reward,in which case such parents or legal guardians themselves may be required to carry out thepayment procedures; or(c) When Sky agrees to pay a Reward to a third party other than the Reporter.

If such third

party is a corporation, an invoice to Sky from said corporation must be issued.
7.

When receiving a Reward, the Reporter is liable for all taxes associated with his/her receipt of
the Reward.

8.

The only method of payment of Rewards shall be by remittance to the bank account designatedby the relevant Reporter. If any income tax withholding is required by laws or regulations, Skyshall withhold such income tax when paying the Rewards.

9.

In the event that a Reporter fails to receive all or part of a Reward despite Sky having carried out
proper remittance procedures based on information submitted by the Reporter, Sky's obligation
to pay the Reward shall cease to exist.

10. Sky will not respond to any inquiries on the number of days required for the remittance of a
Reward.

Reporters shall acknowledge that if the designated bank account for receipt of a

Reward is located overseas, the remittance of such Reward may take more time than usual.
11. The number of times a Reporter can receive a Reward for the same Vulnerability (including thosewhich Sky determines to be the same Vulnerability) shall be one (1). However, there is no limiton the number of times that a Reporter may report different Vulnerabilities or the number of times
Rewards may be received.
12. Reporters are not entitled to a Reward if they report Vulnerability Information on Vulnerabilities
already known to Sky (including those that Sky determines to be the same Vulnerability).
Article 10 Method of Calculating Rewards
1.

If Sky decides to pay a Reward pursuant to Paragraph 1 of the preceding article, Sky shall pay
the Reward as remuneration to the Reporter.

2.

In general, the amount of Rewards shall be the sum of the amounts listed in (a) and (b) below,
multiplied by the ratio listed in (c) below.
(a) The basis amount grounded on the CVSS v3 Base Score as set out in Appended Table 1(b) The additional amount depending on the category of the Vulnerability Information as set out
in Appended Table 2(c) The ratio determined by the impact of the Vulnerability Information on Sky’s customers as
set out in Appended Table 3

3.

Notwithstanding the provisions of the preceding two paragraphs, the Reward amount determinedin accordance with Paragraph 2 may be adjusted in consideration of the contents of the
Vulnerability Information, the impact on Sky, and/or the impact on Sky’s customers.

Article 11 Publication
1.

Sky shall handle Vulnerability Information in accordance with Sky’s “Publication Process ofVulnerability Information on our Products and Services”.

2.

Sky may announce information on Reporters who have submitted Vulnerability Information that
qualifies for a Reward.

3.

In the Program Form, Reporters shall indicate whether Sky may announce information on theReporter, as well as the preferred name of the Reporter that shall be used in the event of suchannouncement (identification name for announcement). Sky shall announce the name as "notdisclosed" if the Reporter does not specify any identification name for announcement or if itjudges that the name provided as the identification name for announcement is inappropriate.

4.

The Reporter’s identification name for announcement shall be used to announce the Reporter on
Sky’s website or in printed materials issued by Sky, etc.

Article 12 Personal Information
1.

Sky shall use the Reporters’ personal information for the purposes of identity confirmation,
contact, review, payment, prevention of unauthorized use, uninterrupted use of the Program, andother administrative procedures necessary to conduct the Program.

2.

Sky shall manage personal information obtained under the Program as follows.
(a) Sky shall not disclose any personal information provided by Reporters to a third party
unless:(1) the consent of the relevant Reporter has been obtained;(2) a request for disclosure of personal information based on legal obligations is received
from a judicial or administrative authority, or otherwise in accordance with Laws andRegulations; or(3) disclosure is made in a manner in which the relevant Reporter cannot be identified.
(b) Sky shall take reasonable safety measures to protect the personal information of Reporters
managed by Sky from loss, destruction, unauthorized outflow, tampering, and unauthorizedaccess.

3.

Any matters relating to the handling of personal information that are not set forth in these Terms
and Conditions shall be governed by the provisions of the “Privacy Policy” published on Sky’s
website.

Article 13 Prohibitions
1.

In addition to the provisions of these Terms and Conditions (other than this Article), the Reporter
shall not engage in any of the following acts when Participating in the Program:(a) acts that are or may be contrary to public order and morality, be in violation of laws and/or
regulations, or cause disadvantage to a third party, or acts that aid and abet or may aid andabet such acts;(b) acts that infringe or may infringe any rights, such as Intellectual Property Rights of Sky ora third party;(c) acts in violation or which may be in violation of these Terms and Conditions;(d) acts that interfere or may interfere with the operation of the Program and/or any services
provided by Sky;(e) acts that defame or may defame Sky or any third party's credibility or reputation;(f) unlawfully publishing, disclosing, providing, or divulging confidential or personal
information of Sky or any third party;(g) acts that may be detrimental to Sky or a third party (including, but not limited to: (i) access,deletion, modification, or publication of data or source code of others; (ii) transmission ofviruses; (iii) stalking; (iv) posting of contents related to terrorists; (v) making discriminatory
statements; (vi) committing slander against others; and (vii) supporting or encouraging
violence); and(h) in addition to the foregoing items, any acts that Sky determines would impede the operationof the Program.

2.

In the event Sky determines that a Reporter has engaged in any of the acts listed in the preceding
paragraph, Sky shall be entitled to (i) prohibit such Reporter’s Participation in the Program, (ii)
decide not to pay a Reward or otherwise withdraw payment decisions for Vulnerability
Information provided by such Reporter, (iii) seek reimbursement of Rewards already paid to such
Reporter, and (iv) block such Reporter’s access or take any other action(s) Sky reasonably
requires, and Sky shall not be liable, directly or indirectly, for any loss incurred by the Reporteras a result of such act.

3.

In the event that a Reporter engages in any of the acts listed in Paragraph 1, the Reporter shall be
liable to indemnify Sky for any damages caused by such act (including, but not limited to, theamount of damages incurred by Sky in the event that Sky is obliged to compensate a third party
for damages caused by such act).

Article 14 Indemnity1.

Sky shall not be liable for any damages incurred by a Reporter as a result of such Reporter's
submission of reports under the Program, receipt of Rewards under the Program, or Participationin the Program.

2.

Sky shall not be liable for any dispute (including, but not limited to, any breach of the provisionsof Article 5, Paragraph 2) arising between the Reporter and a third party (including, but notlimited to, the organization to which the Reporter belongs) due to his/her Participation in the
Program.

Article 15 Voluntary Feedback
1.

In the event that proposals or ideas which are unrelated to the Program in light of the Program’s
goals, such as feedback on new products, technology, promotions, product names, and products,
and product improvement ideas ("Voluntary Feedback") are sent through the Program, Sky shallnot treat such Voluntary Feedback as a report under the Program.

2.

Sky is under no obligation to treat any Voluntary Feedback as confidential or proprietary valuable
information and does not warranty that it will be treated as such.

Article 16 Language
The Japanese version of these Terms and Conditions shall constitute the official version, and theJapanese version shall prevail over any translations in other languages with respect to any
interpretation thereof.
Article 17 Entire Terms and Conditions
These Terms and Conditions constitute the entire agreement between Sky and the Reporters withrespect to the Program and supersede any prior agreements between Sky and the Reporters withrespect to the Program.
Article 18 Governing Law and Exclusive Agreement on Jurisdiction
These Terms and Conditions shall be governed by the laws of Japan, except for the applicationof the conflict of laws principles.

In addition, the Osaka District Court or the Osaka Summary

Court shall be the exclusive jurisdictional court of the first instance for any dispute arising inconnection with these Terms and Conditions, depending on the amount being claimed.
END

Appendix
List of Target Products

Table 1
Basis Amount Grounded on the CVSS v3 Base Score
Severity

CVSS v3 Base Score

Basis Amount

Critical

9.0 - 10.0

CVSS v3 Base Score × 50,000 JPY

High

7.0 - 8.9

CVSS v3 Base Score × 30,000 JPY

Medium

4.0 - 6.9

Low

0.1 - 3.9

None

0

CVSS v3 Base Score × 10,000 JPY
No Reward

The CVSS v3 Base Score is based on the “Common Vulnerability Scoring System CVSS v3
Overview” published by the Information-technology Promotion Agency.

Table 2
Additional Amount Depending on the Category of the Vulnerability Information

Classification

Category

Additional Amount(Maximum)

RCE*

RCE

1,500,000 JPY

Evaluation

Other than RCE

500,000 JPY

SQL Injection

250,000 JPY

Injection (other than SQL Injection)

100,000 JPY

Defect in access control

300,000 JPY

Defect in input validation

250,000 JPY

XSS

70,000 JPY

Vulnerability

OthersCategory(Depending on the contents of the report, Sky may create
a new category.

The amount set out in the right-handcolumn is the maximum amount in the case of a report not
falling under any of the categories listed above, and the
additional amount shall be evaluated and determined inaccordance with the newly created category.)* Arbitrary commands or codes may be executed remotely.

300,000 JPY

Table 3
Ratio Determined by the Impact of the Vulnerability Information on Sky’s Customers
1. Products/Cloud Services
Ratio to theLevel of Impact of the Vulnerability Information on Sky’s Customers

Maximum
AmountDamage to customers caused by the Vulnerability already has been detected,
and Sky has created and released or will create and release a program on an

100%

urgent basis to correct the problem
Attacks on customers caused by the Vulnerability already have been detected,
but no damage to customers has occurred, and Sky has created and released or75%

will create and release a program to correct the problem
No attacks on customers caused by the Vulnerability have been detected, but
Sky has created and released or will create and release a program to correct the50%

problem
No attacks on customers caused by the Vulnerability have been detected, andthe problem may be handled temporarily by a workaround which does not

25%

involve Sky’s provision of a program to correct the problem
No attacks on customers caused by the Vulnerability have been detected, andthe problem may be addressed during the course of ordinary version upgrades

25%

The Vulnerability exists with respect to a part that was not developed by Sky,
and, as a result of investigation, was found to be caused by another company’s
module, etc. which Sky uses

0%

2. Websites published by Sky
Ratio to theLevel of Impact of the Vulnerability Information on Sky’s Customers

Maximum
AmountDamages such as the leakage of personal information of users of the website
already has occurred, and Sky has taken or will take urgent actions to address
this issue, such as shutting down or upgrading the website or posting notices to100%

the users of the website
Damage such as the leakage of information other than personal information ofusers of the website already has occurred, and Sky has taken or will take urgent
actions to address this issue, such as shutting down or upgrading the website or

50%

posting notices to the users of the website
Manipulation of the website has been detected or will be detected, but wasrecovered by restoration
No damage to the website has been detected or will be detected, and the website
was normalized by upgrading

20%
15%

Since there is no Basis Amount grounded on the CVSS v3 Base Score for websites, the Reward
amount will generally be the amount obtained by multiplying the Additional Amount in Appended
Table 2 by the ratio above.