Privacy Policy (ver.1.2)

Privacy Policy
Version 1.2

1
DBJ Americas Inc.

Privacy Policy (ver.1.2)

Change History
DateVer.

Description

06/28/2022

1.0

Enacted and Implemented

12/16/2022

1.1

Appointment of new CEO (Seiji Jige)

06/24/2024

1.2

Appointment of new CEO for DBJ Americas Inc.
(Norihisa Shimozawa)

2
DBJ Americas Inc.

Privacy Policy (ver.1.2)

Index
Privacy Policy.................................................................................................................. 4
Declaration on Personal Information Protection .............................................................. 4
1.

Policy Initiative..................................................................................................... 42.

Proper Obtainment of Personal Information ......................................................... 43.

Purpose of Use of Personal Information ................................................................ 4

4.

Provision of Personal Information to Third Parties ............................................... 4

5.

Security Management Measures ........................................................................... 56.

Continuous Improvement of Handling of Personal Information ............................ 5

7.

Procedures to Request Disclosure, Etc................................................................... 5

8.

Inquiries ............................................................................................................... 5

Public Announcement Based on the Act on the Protection of Personal Information .......... 5I.

Matters Concerning the Purpose of Use of Personal Information .......................... 6II.

Matters Concerning Joint Use of Personal Data................................................. 7III.

Matters Concerning Retained Personal Data ..................................................... 8IV.

Restrictions on Provision of Personal Data to Third Parties ............................. 10V.

Outsourcing the Handling of Personal Data ........................................................ 10VI.

Where to Direct Complaints Related to the Handling of Retained Personal Data10

Basic Policy on the Proper Handling of Specific Personal Information, Etc. ................... 111.

Name of Business Operator................................................................................. 112.

Compliance with Relevant Laws, Regulations, and Guidelines ............................ 113.

Purpose of Use .................................................................................................... 114.

Matters Concerning Security Management Measures ......................................... 125.

Contact Details for Inquiries ............................................................................... 12

Contact: ........................................................................................................................ 133
DBJ Americas Inc.

Privacy Policy (ver.1.2)

Privacy Policy•

Declaration on Personal Information Protection•

Public Announcement Based on the Act on the Protection of Personal Information•Basic Policy on the Proper Handling of Specific Personal Information, Etc.

Declaration on Personal Information Protection
DBJ Americas Inc. (“DBJA”) has formulated and publicly announces the following“Declaration on Personal Information Protection” (this “Declaration”) as its policy initiative
for protecting personal information and its approach concerning the handling of personalinformation.

1. Policy Initiative
DBJA recognizes the appropriate protection and use of personal information as animportant social responsibility. In conducting its operations, DBJA will comply withrelevant laws and regulations, including the Act on the Protection of PersonalInformation, as well as DBJA’ rules including this Declaration to strive to appropriately
protect and use clients’ personal information.

2. Proper Obtainment of Personal Information
DBJA will acquire clients’ personal information by proper and lawful means to theextent necessary in connection with its services.

3. Purpose of Use of Personal Information
DBJA will specify the purposes of use of clients’ personal information and use theinformation to the extent necessary to achieve those purposes of use. If the purposes ofuse for specific personal information are separately limited by laws or regulations,
DBJA will not use the information for any purpose other than those purposes of use. The
purposes of use for clients' personal information by DBJA will be published on thewebsite of DBJA’ parent company, Development Bank Japan Inc., . Use for any otherpurpose will be clearly indicated at the time that information is obtained.

4. Provision of Personal Information to Third Parties
In principle, DBJA will not provide a client’s personal information to a third party,
except in cases where consent is obtained from the client or where provision is requiredby laws or regulations. However, DBJA may provide a client’s personal information to a4DBJ Americas Inc.

Privacy Policy (ver.1.2)

third party without obtaining consent from the client: (i) in cases where DBJA
outsources the handling of personal information to the third party to the extent necessary
to achieve the purposes of use, (ii) in cases of merger, etc., or (iii) in cases wherepersonal information is jointly used with specific persons as separately determined.

5. Security Management Measures
DBJA will strive to store and manage clients’ personal information in an accurate andup-to-date manner, and take necessary and appropriate measures for securely managing
information to prevent leakage, etc. DBJA will also appropriately supervise its officers,
employees, and outsourcees who handle clients’ personal information.

6. Continuous Improvement of Handling of Personal Information
DBJA will strive to continuously improve its handling of clients’ personal information
by reviewing this Declaration from time to time, taking into account developments in
information technology and changes in social demands, among other factors.

7. Procedures to Request Disclosure, Etc.
DBJA will strive to appropriately respond to requests for notification of purposes of use
for retained personal data regarding clients, requests for disclosure of content, requests
for correction, addition, or deletion in cases where the content of retained personal datais contrary to the facts, and requests for suspension of use, erasure, and suspension ofprovision to third parties.

8. Inquiries
DBJA will strive to sincerely respond to opinions and requests about its handling ofpersonal information.

Public Announcement Based on the Act on the Protectionof Personal Information
DBJ Americas Inc., (Business operator handling personal information)
DBJ Americas Inc., (“DBJA”) publicly announces the following matters based on the Act
on the Protection of Personal Information (Act No. 57of May 30, 2003, including any
subsequent amendment; collectively, the “Act”).

5DBJ Americas Inc.

Privacy Policy (ver.1.2)

I. Matters Concerning the Purpose of Use of Personal Information
DBJA will handle clients’ personal information in order to perform the businesses
described in item 1. below to the extent necessary to achieve the purposes of use
described in item 2. below, and for no purpose of use exceeding those limits.

1. Business Content•

Advisory business which DBJA provides together with Development Bank ofJapan Inc., and ancillary operations (including operations that it may handle in thefuture; collectively, “DBJA Operations”)

2. Purpose of Use•

To make decisions and perform follow-up management regarding DBJA
Operations•

To conclude contracts, verify identities, or confirm eligibility related to DBJA
Operations•

To manage due dates or ongoing transactions pertaining to DBJA Operations•

To provide to third parties within the scope necessary to perform appropriate
operations•

To exercise contractual and legal rights and fulfill such obligations•

To monitor economic conditions by conducting surveys, distributing
questionnaires, or conducting related operations•

To introduce DBJA’s operations•

To execute other activities to perform smooth and appropriate client transactions

In the event that the purposes of use of specific personal information are separately
limited by laws or regulations, such personal information will not be used other than forsuch purposes of use, as described below.
•In accordance with Article 123, Paragraph 1, Item 7 of the Cabinet Office Order on
Financial Instruments Business, etc., DBJA will not use or provide to third parties
information regarding race, creed, family origin, registered address, medical
history, or criminal records, or any other undisclosed and special information it has
obtained in the course of its business for any purposes except those required for theproper conduct of its business.
6

DBJ Americas Inc.

Privacy Policy (ver.1.2)

II.

Matters Concerning Joint Use of Personal Data

DBJA will jointly use the personal data of its clients as set out below.

1. Personal Data to be Jointly Used
(1)

Information regarding the client, such as contact information, including the client’s name,date of birth, physical address, telephone number, and e-mail address; family-relatedinformation; employer-related information; information regarding the client’s assets andliabilities; information regarding transaction needs; and publicly disclosed information(2)

Information regarding the content of transactions with individual clients, such as transaction
status, type of service, agreement date, transaction amount, balance, and due date

(3)

Information required to manage transactions with clients, such as information on thetransaction process and information used in making loan decisions

2. Scope of Joint Users
DBJA, Development Bank of Japan Inc. (“DBJ”) and DBJ’s subsidiaries and affiliatedcompanies listed in DBJ’s annual securities report (or in its lending reports)(In the event that joint use is limited by the Financial Instruments and Exchange Act orrelated laws and regulations, information will be handled in accordance with the laws orregulations.)

3. Purpose of Use(1)

To propose, inform about, study, or develop investment and loan businesses and financial
products and services together with DBJA’ group companies: for example, to work withgroup companies in developing and proposing investment and loan businesses and financial
products and services that meet client needs(2)

To properly conduct group management activities, including the understanding andmanagement of risks: for example, to create proper business management systems for thegroup and provide clients with stable and consistent services

4. Name and Address of Party Responsible for Managing Personal Data and theName of the Representative
DBJ Americas Inc.
1251 Avenue of the Americas, Suite 2330, New York, NY 10020
CEO and Managing Director: Norihisa Shimozawa

7
DBJ Americas Inc.

Privacy Policy (ver.1.2)

III.

Matters Concerning Retained Personal Data

1. Name and Address of Business Operator Handling Personal Information and theName of the Representative
Development Bank of Japan Inc.
Otemachi Financial City South Tower, 9-6, Otemachi 1-chome, Chiyoda-ku, Tokyo
100-8178, Japan
President and CEO: Seiji Jige

2. Purpose of Use of Retained Personal Data
The purposes of use of personal data retained by DBJ are the same as described above in“I. Matters Concerning the Purpose of Use of Personal Information” and “II.3. Purposeof Use.”

3. Procedures Followed to Respond to a Request for Disclosure, Etc.
DBJA will respond, appropriately and promptly in compliance with relevant laws andregulations, including the Act on the Protection of Personal Information, to requests for
notification of the purpose of use, disclosure (including the disclosure of records on theprovision of personal data to a third party), correction, addition or deletion, suspensionof use or erasure, or suspension of provision to a third party ( “Request for Disclosure,Etc.”) with regard to client personal data retained by DBJA.

DBJA will be unable to accept a Request for Disclosure, Etc. if it is unable to confirm
the identity of the individual or the proxy authority of an agent making the application or
if a request form or other stipulated document contains discrepancies. Therefore, persons
making such a request are asked to provide any information required to identify theretained personal data subject to the Request for Disclosure, Etc. (In the interest ofkeeping personal data accurate and up-to-date, clients are requested to promptly notify
DBJA of any changes in information provided.)

Please note that DBJA may not be able to respond to a Request for Disclosure, Etc. if itis prevented from doing so by laws or regulations.

4. Security Management Measures for Personal Data
8
DBJ Americas Inc.

Privacy Policy (ver.1.2)

DBJA will take and strive to improve necessary and appropriate measures via themethods listed below to ensure the secure management of personal data, including
preventing the leakage, loss, or damage (“Leakage, Etc.”) of personal data. In having its
employees handle personal data, DBJA will also exercise necessary and appropriate
supervision over its employees so as to ensure secure management of the personal data.
(1)
(2)
(3)

Formulation of basic policy
Development of rules for handling personal data
Organizational security management measures (development of anorganizational structure for taking security measures; operation in accordancewith rules for handling personal data; development of means to check the statusof handling personal information; development of a system of responding toincidents such as Leakage, Etc.; monitoring the status of handling personalinformation; and review of security management measures)(4) Human security management measures (employee education, etc.)(5) Physical security management measures (control of areas where personal data ishandled; prevention of theft, etc., of equipment and electronic media; preventionof leakage when carrying electronic media, etc.; deletion of personal data; anddisposal of equipment and electronic media, etc.)(6) Technical security management measures (access control; identification andauthentication of authorized persons; prevention of unauthorized external access,etc.; and prevention of Leakage, Etc., associated with the use of informationsystems)(7) Understanding of the external environment (implementing security management
measures based on an understanding of systems for the protection of personal
information in the EU, the U.K., the U.S., Singapore, and China, where personal
data is stored)*Systems related to the protection of personal information in various countries
The U.S. (Federal): https://www.ppc.go.jp/files/pdf/USA_report.pdf
The U.S. (New York State): https://www.ppc.go.jp/files/pdf/newyork_report.pdf
Singapore: https://www.ppc.go.jp/files/pdf/singapore_report.pdf
China: https://www.ppc.go.jp/files/pdf/china_report.pdf
EU: If you would like DBJA to provide information, please contact us at the contact
desk below.
DBJ Americas Inc. +1-212-221-0708

9DBJ Americas Inc.

Privacy Policy (ver.1.2)

IV.

Restrictions on Provision of Personal Data to Third Parties

In principle, DBJA will not provide personal data to third parties without the consent of theindividual, except in the cases set out below.
(1) When required by laws and regulations(2) When it is necessary for the protection of the life, body, or property of anindividual and it is difficult to obtain the consent of the individual(3) When it is especially necessary for improving public health or promoting thesound growth of children and it is difficult to obtain the consent of the individual(4) When it is necessary to cooperate with a national agency, a local government, ora person entrusted by either a national agency or local government to executeaffairs prescribed by laws and regulations, and obtaining the consent of theindividual is likely to impede the execution of those affairs(5) When a third party to which personal data is provided is an academic research
institution, etc., and the third party needs to handle the personal data for
academic research purposes (including cases in which part of the purpose ofhandling the personal data is for academic research purposes, but excluding
cases in which there is a risk of unjustified infringement of the rights andinterests of individuals)(6) When providing personal data to an outsourcee to the extent necessary for theperformance of its business (see “Outsourcing the Handling of Personal Data”
below)(7) When personal data is provided in connection with the succession of businessdue to a merger, corporate split, transfer of business, or other reasons(8) When jointly using personal data with DBJ, DBJ’s subsidiaries and affiliates (see“II. Matters Concerning Joint Use of Personal Data” above)V.

Outsourcing the Handling of Personal Data

DBJA may outsource all or part of the handling of personal data to third parties to the extent
necessary to achieve the purposes of use of personal data. In such cases, DBJA will selectappropriate outsourcees to ensure that personal data is securely managed by the outsourcees,
and will exercise necessary and appropriate supervision over the outsourcees by, forexample, signing confidentiality and personal data protection agreements with theoutsourcees and confirming how the personal data is handled by the outsourcees.

VI.
Where to Direct Complaints Related to the Handling of Retained
Personal Data
Please direct opinions or requests concerning the handling of retained personal data to DBJA
10
DBJ Americas Inc.

Privacy Policy (ver.1.2)(which telephone number is +1-212-221-0708).
Hours of operation: 9:30 a.m. to 12:00 noon and 1:00 p.m. to 5:00 p.m. (local time)(excluding weekends, public holidays, and year end and new year holidays in Japan and theUnited States)

Basic Policy on the Proper Handling of Specific PersonalInformation, Etc.
DBJ Americas Inc. (“DBJA”) has formulated and publicly announces the following basic
policy to ensure that specific personal information and individual numbers (“SpecificPersonal Information, Etc.”) under the Act on the Use of Numbers to Identify a Specific
Individual in Administrative Procedures (the “My Number Act”) are properly handled onan organization-wide basis.

1. Name of Business Operator
DBJ Americas Inc.

2.

Compliance with Relevant Laws, Regulations, and Guidelines

DBJA will properly handle Specific Personal Information, Etc. in compliance with theMy Number Act, the Act on the Protection of Personal Information, and other laws andregulations, as well as the Guidelines for Proper Handling of Specific PersonalInformation (for Business Operators) and other related guidelines.

3. Purpose of Use
DBJA will use Specific Personal Information, Etc. for the purposes set out below.
For Specific Personal Information, Etc. concerning officers and employees, including
their dependent family members (includes processes related to those listed below):•Tax withholding•Preparation of salary payment reports•

Preparation of written notices concerning the transfer of salaried employees related
to salary payment reports and special collection•

Notifications concerning health insurance, employees’ pension, and corporate
pension•Applications and claims for health insurance, employees’ pension, and corporate
pension11

DBJ Americas Inc.

Privacy Policy (ver.1.2)•Notifications regarding employment insurance and worker’s compensation
insurance•

Applications and claims for employment insurance and worker’s compensation
insurance•Preparation of certificates for employment insurance and worker’s compensation
insurance

For Specific Personal Information, Etc. concerning persons other than officers andemployees, including their dependent family members (includes processes related tothose listed below):•

Preparation of payment records for compensation, fees, and other outlays•

Preparation of payment records for salaries, compensation, pensions, and prizemonies paid to non-residents•

Preparation of payment records for consideration paid to non-residents for projects
providing personal services•

Preparation of payment records for real estate usage fees or the like•

Preparation of payment records for consideration of the acquisition of real estate orthe like•

Preparation of payment records for commissions involving the sale or lease of realestate or the like

4. Matters Concerning Security Management Measures
DBJA will take necessary and appropriate measures to manage the security of Specific
Personal Information, Etc. Security management measures for Specific PersonalInformation, Etc. are set out separately in the “Rules on Handling Specific PersonalInformation, Etc.”

5. Contact Details for Inquiries
If you have any inquiries, complaints, or other communication regarding DBJA’handling of Specific Personal Information, Etc., please contact us at the office below.

12DBJ Americas Inc.

Privacy Policy (ver.1.2)

Contact:
DBJ Americas Inc.
1251 Avenue of the Americas, Suite 2330, New York, NY 10020
Tel: +1-212-221-0708

13
DBJ Americas Inc.