BUG BOUNTY PROGRAM
The Bug Bounty Program (hereinafter, the “Program”) is hosted by Cybozu, Inc. (hereinafter,“Cybozu”). Persons who report vulnerability information (hereinafter, “Reporter” or “Reporters”)
pursuant to this Program agree to the following.

Article 1. Purpose
The purpose of the Program is to gain timely and appropriate reports on information related tovulnerabilities in Cybozu’s products and services from outside experts in order for Cybozu to utilize
this vulnerability information to make improvements to its products and services.

Article 2. Implementation Guidelines1.

Under the Program, a Reporter who discovers a vulnerability provides a report on the vulnerability
information to a dedicated vulnerability information reporting portal, and in the event thevulnerability information is validated by Cybozu as satisfying Cybozu’s identification standards,
as a token of appreciation a reward will be paid for cooperation in the improvement of the qualityof Cybozu’s products and services.
ØBug Bounty Program Website
https://cybozu.co.jp/en/company/products/bug-bounty/

2.

The Program may be utilized by individuals, corporations or groups who are capable ofcommunicating in Japanese or English; provided, however, that entities that correspond to thefollowing shall not be entitled to utilize the Program:(1) Persons who are employees of Cybozu or its subsidiary companies as of the time of reporting;(2) Persons who work for Cybozu or its subsidiary companies as of the time of reporting undera contract such as a work delegation agreement, secondment agreement, dispatching
agreement or the like;(3) Persons who have been employed as regular fulltime employees of Cybozu or its subsidiarycompanies within one (1) year prior to the time of reporting; and(4) Persons who have worked in the product development and cloud service operation related
work at Cybozu or its subsidiary companies within one (1) year prior to the time of reporting(excluding Lab-Youth students).

3.

Please see the rulebook and other materials separately provided by Cybozu regarding the detailsof the payment standards and other implementation guidelines.

Article 3. Reward
1.

A Reporter must provide a report to the dedicated vulnerability information reporting portal inaccordance with the separately provided procedures in order for the vulnerability information
discovered in the Program to be eligible for payment under the Program. In addition, in the eventof a suspension provided in Paragraph 2 of the preceding Article, only vulnerability information
reported prior to the suspension notification date will be eligible for payment.
2.

Cybozu will pay the full amount of rewards in accordance with Cybozu’s identification standards
without collecting registration fees or the like from Reporters.

3.

ewards will be paid by remitting funds to the Reporter’s personal account at a financial institution
designated by the Reporter (a personal account will also be utilized in the event a report isprovided in the name of a corporation).

4.

A Reporter shall forfeit eligibility for receiving the payment of the reward in the event Cybozu isunable to provide the payment due to any failure by the Reporter in providing the information
required in the payment of the reward ,or the payment has not been received despite Cybozu
conducted remittance. (The case includes, but not limited to, the information provided by theReporter is incorrect, the remittance to the bank account designated by the Reporter cannot bemade due to the sanctions by Japan, the United States or other countries or regions.)

5.

Rewards paid to Reporters shall include consumption taxes and other taxes, and taxes levied on
Rewards shall be paid by the Reporter.

Article 4. Intellectual Property Rights, etc.
1.

The copyrights, trademark rights, design rights, patent rights, utility model rights, knowhow andother rights (hereinafter, “Intellectual Property Rights, etc.”) related to the Program and thesoftware and services covered by the Program shall belong to Cybozu. These IntellectualProperty Rights, etc. are protected under the Copyright Act, Trademark Act and other laws andtreaties related to intellectual property rights.

2.

The Reporter shall assign the Intellectual Property Rights, etc. related to all or a portion of thevulnerability information reported to Cybozu to Cybozu. In addition, the Reporter shall not object
to the provision, publication or the like of all or a portion of the vulnerability information reported
to Cybozu to the Information-Technology Promotion Agency (IPA) or other third parties at thejudgment of Cybozu.

Article 5. Handling of Vulnerability Information, etc.
1.

The Reporter shall treat the vulnerability information and all information learned in conduct
related to the implementation of testing (hereinafter, “vulnerability information, etc.”) as
confidential, and shall not disclose, divulge, publicize or the like this information to third parties;
provided, however, that the Reporter shall be entitled to disclose the corresponding vulnerability
information, etc. in accordance with the guidelines provided by Cybozu. Furthermore, the dutyof confidentiality under this Article shall remain in effect after the ending of the Program.

ØGuidelines for Third Party Disclosure of Vulnerabilities
https://cybozu.co.jp/en/company/products/bug-bounty/pdf/disclosure_guideline.pdf

2.

A Reporter shall be entitled to disclose his or her thoughts and impressions of the Program to thirdparties, including posting to SNS and the like; provided, however, that the vulnerability
information, etc. shall be treated according to the preceding paragraph.

3.

A Reporter who breaches the provisions of this Article shall forfeit eligibility for receiving thepayment of a reward. In addition, the Reporter will be asked to refund a reward if the reward has
already been paid.

Article 6. Restrictions and Prohibited Matters
1.

A Reporter must not engage in the following activities in the use of the Program:(1) The activities set forth in the [Restrictions / Prohibited Matters] of the Bug Bounty Program
Website;https://cybozu.co.jp/en/company/products/bug-bounty/#restriction(2) Activities which cause or may cause detriment or damage to Cybozu or third parties;(3) Activities which are contrary to public order and good morals;(4) Activities that violate laws and regulations, criminal activities, and activities that aid and abetor may aid and abet these activities;(5) Activities that interfere with or may interfere with the operation of the Program and any of
the services provided by Cybozu;(6) Activities that harm or may harm the credibility, reputation or the like of the Program andany of the services provided by Cybozu; and(7) Any other activities deemed inappropriate by Cybozu.

2.

When a Reporter violates any of the items of the preceding paragraph, the Reporter shall forfeit
eligibility for receiving a reward, and Cybozu shall be entitled to block access and take any othermeasures found necessary by Cybozu without providing prior notice to the Reporter.

3.

Cybozu shall not be liable for the direct, indirect or any other damages arising from the measuresof the preceding paragraph.

4.

In the event a Reporter breaches the provisions of Paragraph 1, the Reporter shall be liable for thecompensation of the damages suffered by Cybozu due to the corresponding breach. In addition,in the event Cybozu compensates damages to a third party or bears any other damages or expenses
due arising from the corresponding breach, Cybozu shall be entitled to seek reimbursement forthe amount borne from the Reporter.

Article 7. Exemption from Liability
A Reporter shall provide reports under the Program at its own risk, and Cybozu shall not be liable forthe compensation of any damages suffered due to the provision of a report on vulnerability information

under the Program or otherwise for involvement in the Program. Cybozu shall not involve itself inany disputes between Reporters or with third parties related to the Program, and the Reporter shallresolve disputes, including the damages suffered by a third party due to a breach of the preceding
Article, at its own responsibility and burden.

Article 8. Handling of Personal Information
1.

Cybozu shall use the personal information of Reporters for the following purposes:(1) For the implementation, management and operation of the Program; and(2) For confirmations and communications required in the delivery of rewards under the Program.

2.

If a Reporter wishes, Cybozu shall correct, delete, or discontinue the use of the personal
information of the Reporter upon Reporter’s request. To make a request to correct, delete, ordiscontinue the use of personal information, please contact the Cy-PSIRT Office(productsecurity@cybozu.co.jp).

3.

Cybozu may disclose the personal information of Reporters to third parties when required indemands made in accordance with laws and regulations or in procedures under laws andregulations, when required in order to protect the rights of Cybozu, other Reporters or third parties,
and when otherwise found necessary by Cybozu. Please see the following data protection policy
regarding other matters.
Ø Data Protection Policy (Japanese only)
https://cybozu.co.jp/privacy/Article 9. Elimination of Antisocial Forces
1.

The Reporter and Cybozu hereby warrant to the other party that they and their officers oremployees are not at present an organized crime group, member of an organized crime group,member of an organized crime group within the past five (5) years, quasi-member of an organizedcrime group, organized crime group affiliated enterprise, soukaiya (corporate racketeer), groupengaged in criminal activities under the pretext of a social movement, crime group specialized inintellectual crimes, or any other entity commensurate thereto (hereinafter, “Member of an
Organized Crime Group, etc.”), and do not fall under the following respective items:(1) Having a relationship in which management is found to be controlled by a Member of anOrganized Crime Group, etc.;(2) Having a relationship in which a Member of an Organized Crime Group, etc. is found to be
substantially involved in management;(3) Having a relationship in which a Member of an Organized Crime Group, etc. is found to beunjustly utilized for the purpose of seeking unjust profits for oneself or a third party, for thepurpose of causing damages to a third party, or the like;(4) Having a relationship where money or any other conveniences are provided to a Member ofan Organized Crime Group, etc. or the like; or(5) An officer or persons substantially involved in management has a socially condemnable
relationship with a Member of an Organized Crime Group, etc.
2.

Cybozu shall be entitled to refuse use of the Program without any peremptory notice when it
discovers that the Reporter or an officer or employee of the Reporter is a Member of an Organized
Crime Group, etc. or falls under any one of the respective items of the preceding paragraph inbreach of the representations and covenants of the preceding paragraph.

Article 10. Suspension or Discontinuation of the Program1.

Cybozu may suspend or discontinue the program at its sole discretion. In such case, Cybozu will
notify you through the Bug Bounty Program Website at least thirty (30) days prior to the date ofsuspension or discontinuation.

2.

In no event shall Cybozu be responsible for any damages or losses incurred by the Reporters dueto the suspension or discontinuation of the Program.

Article 11. Amendment of Terms and Conditions
1.

Cybozu shall be entitled to amend these Terms and Conditions without prior public notification.

2.

When amending a key portion of these Terms and Conditions, Cybozu shall provide the Reporters
with notice of the details thereof, and if a Reporter continues to use the Program after theamendment, he or she shall be deemed to have agreed to the amended Terms and Conditions.

Article 12. Governing Law and Court of Jurisdiction
Except where the principles of conflict of laws apply, these Terms and Conditions shall be governedby the laws of Japan. Additionally, the Tokyo Summary Court or the Tokyo District Court, dependingon the amount of the claim, shall be the court of first instance with exclusive jurisdiction over thedisputes related to these Terms and Conditions.