「FFRI AMC Information Collection Policy」
Comparative Table of the Old and New Clauses
The words related to the revision are underlined.
OldNew

The FFRI AMC Information Collection Policy ("Policy") explains how information

The FFRI AMC Information Collection Policy ("Policy") explains how informationcollected by FFRI Security, Inc. ("FFRI") via "FFRI AMC" ("Product") from a user

collected by FFRI Security, Inc. ("FFRI") via "FFRI AMC" ("Product") from a userof this Product and FFRI yarai, etc is handled.

of this Product and "FFRI yarai" (including FFRI yarai monthly edition) ("user") ishandled.

The contents of this policy are subject to change without an agreement from an

The contents of this policy are subject to revision without an agreement from anindividualindividualuser.

Pleaserefertotheweb

page,user.

Pleaserefertotheweb

page,

https://www.ffri.jp/information/privacy/amc_eng_privacy_policy.htm, for the latest

https://www.ffri.jp/information/privacy/amc_eng_privacy_policy.htm, for the latest

policy contents.

policy contents.

It is considered that a user of this Product agrees to the latest version of thisIt is deemed that a user agrees to the latest version of this Policy.

Policy.
I. Detection Review Setting

I. Detection Review Setting

A user may submit a scanned file or a file detected by FFRI yarai, etc as malware

A user may submit a scanned file or a file detected by FFRI yarai as malware oror vulnerability attack ("Target File") using "Detection Review setting" ("Setting")

vulnerability attack ("Target File") using "Detection Review setting" ("Setting") ofof the Product based on this Policy to determine if it is a legitimate software (over-the Product based on this Policy to determine if it is a legitimate software (over-detection) or malware and receive the result on the Product.

detection) or malware and receive the result on the Product.

1. Information Transmitted When Using This Setting

1. Information Transmitted When Using This Setting

Following information ("Transmitted Information") shall be transmitted to FFRI

Following information ("Transmitted Information") shall be transmitted to FFRI

server from a user ("Target User") who submits the inquiry based on theserver from a user ("Target User") who submits the inquiry based on thepreceding paragraph. FFRI shall perform the review set forth in the preceding

preceding paragraph. FFRI shall perform the review set forth in the preceding

paragraph using Transmitted Information and transmit the review result to Target

paragraph using Transmitted Information and transmit the review result to Target

User when it becomes available. Other purposes of usage of the Transmitted

User when it becomes available. Other purposes of usage of the Transmitted1

Information shall be as described in Article V. FFRI will not provide Transmitted

Information shall be as described in Article VI. FFRI will not provide Transmitted

Information to third parties in any format that could be identified by other thirdInformation to third parties in any format that could be identified by other thirdparties, unless otherwise specified by laws and regulations.

parties, unless otherwise specified by laws and regulations.

(1) Target File

(1) Target File

This includes information pertaining to the Target File that is required for theThis includes information pertaining to the Target File that is required for thereview process.

review process.

(2) Information To Identify Target User

(2) Information To Identify Target User

This includes user attributable information registered upon initial usage ofThis includes user attributable information registered upon initial usage of FFRI

products such as FFRI yarai, the Product and the Setting which shall be used foryarai, the Product and the Setting which shall be used for the aforesaid review

the aforesaid review process and sending back the review result.

process and sending back the review result.

(3) Target User's User Environment For FFRI yarai, etc(3) Target User's User Environment For FFRI yarai

This includes information pertaining to FFRI yarai managed by this ProductThis includes information pertaining to FFRI yarai managed by this Product(software version information, the hardware environment in which FFRI yarai is(software version information, the hardware environment in which FFRI yarai isinstalled on, Operating System, applications concurrently running, etc.) that is

installed, Operating System, applications concurrently running, etc.) that isrequired for the review of Target File.

required for the review of Target File.

(4) Target User's FFRI yarai Operation Logs Managed By This Product(4) Target User's FFRI yarai Operation Logs Managed By This ProductThis information is used for Target File review.

This information is used for Target File review.

II. Cloud Collaboration Feature

II. Cloud Collaboration Feature

In addition to Setting, a user may submit a Target File using “Cloud Collaboration

In addition to Setting, a user may submit a Target File using "Cloud Collaboration

Feature” (“Feature”) through or not through the Product based on this Policy toFeature" ("Feature") through or not through the Product based on this Policy todetermine if it is a legitimate software (over-detection) or malware and receive

determine if it is a legitimate software (over-detection) or malware and receive

the result on the Product.

the result on the Product.

1. Information Transmitted When Using This Feature

1. Information Transmitted When Using This Feature

Hash values relating to a Target File (“Hash Values”) shall be transmitted from a

Hash values relating to a Target File ("Hash Values") shall be transmitted from a

User who submit a Target File based on the preceding paragraph (“Target User”)

User who submits a Target File based on the preceding paragraph ("Target User2

to FFRI server. FFRI shall perform the review set forth in the preceding paragraphof this Feature") to the FFRI server. FFRI shall perform the review set forth in theusing the Hash Values and transmit the result to a Target User when it becomes

preceding paragraph using the Hash Values and transmit the result to a Target

available. Other purposes of usage of Hash Values shall be as described in Article

User of this Feature when it becomes available. Other purposes of usage of Hash

V.

Values shall be as described in Article VI.

III. FFRI yarai Cloud

III. FFRI yarai Cloud(Omitted)(No change)

1. Information Collected When Using FFRI yarai Cloud

1. Information Collected When Using FFRI yarai CloudFFRI shall be able to view various information and files that a user manages withFFRI shall be able to view various information and files that a user manages withthis Product, including but not limited to a user's client management information,

this Product, including but not limited to a user's client management information,

incident management information, event management information, malware, files

incident management information, event management information, malware, files

used to exploit vulnerabilities, as FFRI yarai Cloud is provided in FFRI's cloud.

used to exploit vulnerabilities, as FFRI yarai Cloud is provided in FFRI's cloud.

Other purposes of usage of such information will be as described in V hereafter.

Other purposes of usage of such information will be as described in VI hereafter.

(Established)

IV. Log Collection Feature
FFRI uses the "Log Collection Feature", which is used to manually distribute log
collection commands via this Product to collect user information, in order tocollect the information required to provide the Support Service, etc.
1. Information collected when using the Log Collection Feature
FFRI may collect information regarding the user's system information (information
about the system, services, tasks, network, drivers, installed software, etc.), FFRI
yarai log information and setting information managed by the system and theProduct, Microsoft Defender information, special folder information, information
stored in the browser, registry information, and other information. Other purposesof usage of this information shall be as described in Article VI.
3

Ⅳ. Support ServiceV. Support Service

FFRI shall provide a Support Service to a user who has purchased the Product,

FFRI shall provide a Support Service to a user who has purchased the Product,

for the objectives of ensuring the proper and suitable use of the Product andfor the objectives of ensuring the proper and suitable use of the Product andassisting in the resolution of any issues that occur and are confirmed in use ofassisting in the resolution of any issues that occur and are confirmed in use ofthe Product.

the Product.

1. Information collected in the Support Service

1. Information collected in the Support Service

In conducting the Support Service, FFRI may collect the user information

In conducting the Support Service, FFRI may collect user system information forregarding the user's system (information about system, services, tasks, network,

the environment where this Product is installed (information about the system,installed software, etc.), log information regarding the system and the Product,services, tasks, network, drivers, installed software, etc.), log information

information on the Product settings, and other information in addition to theregarding the system and the Product, information on the Product settings, andinformation described in I-III above. Other purposes of usage of such information

other information in addition to the information described in I-IV above. Other

will be as described in V hereafter.

purposes of usage of such information will be as described in VI hereafter.

V. Purpose of Usage of the Information Collected

VI. Purpose of Usage of the Information Collected

FFRI shall be able to view and use the information collected through I-IV above

FFRI shall be able to view and use the information collected through I-V above atat any time for the following purposes:

any time for the following purposes:(1) For user support such as updates and maintenance of the Product(1) For user support such as updates and maintenance of FFRI products(2) For improvement, development, etc. of FFRI product functions and quality(2) For improvement, development, etc. of FFRI product functions and quality(3) For improvement in quality of FFRI services(3) For improvement in quality of FFRI services(4) For external disclosure including research pertaining to detected malware or(4) For external disclosure including research pertaining to detected malware orvulnerability attacks and commercial usage such as statistical data and malware

vulnerability attacks and commercial usage such as statistical data and malware

analysis information

analysis information(5) For provide FFRI Security Managed Service.

(Deleted)

However, FFRI shall never provide user attributable information to third parties in

However, FFRI shall never provide user attributable information to third parties inany format that could be identified by other third parties.

any format that could be identified by other third parties.

Moreover, FFRI shall take the necessary and appropriate safety control

Moreover, FFRI shall take the necessary and appropriate safety control
4measures to manage the information that is collected in I-IV above.

measures to manage the information that is collected in I-V above.

Ⅵ, Disclaimer

VII. Disclaimer

Malware and vulnerability attacks continuously become more sophisticated andMalware and vulnerability attacks continuously become more sophisticated andcomplicated on a daily basis and in no case shall FFRI guarantee to Target Usercomplicated on a daily basis and in no case shall FFRI guarantee to Target User,

that this Setting and this Feature works perfectly. Target User hereby agrees

etc., that this Setting and this Feature work perfectly. Target User, etc., hereby

that FFRI shall not be liable for any damages with respect to usage of the Setting

agrees that FFRI shall not be liable for any damages incurred by Target User,and the Feature .

etc., with respect to usage of the Setting and the Feature.

Ⅶ. Reference On Information Collected via Product

VIII. Reference On Information Collected via Product(Omitted)(No change)

Revised on July 25, 2022

Revised on March 30, 2023

5