Personal Information Protection Policy(Privacy Policy)
RGA Reinsurance Company Japan Branch
Akasaka 9-7-1, Midtown Tower 41F, Minato-ku, Tokyo, JapanCEO of Japan Branch Hironori Takahashi

As the Personal Information Handling Business Operator, RGA Reinsurance Company Japan
Branch (“the Company”) strongly recognizes the importance of the protection of personal
information. The Company shall comply with Act on the Protection of Personal Information(“APPI”) and other applicable laws and regulations, and secure appropriate personal
information handling without damaging customer trust.
1. Purpose of Personal Information Use
The Company through reinsurance transaction receives personal information from other life
insurers for the purposes listed below to the extent necessary to conduct our business.

•Discussion, negotiation and conclusion of Reinsurance Treaties (includingretrocession)•

Underwriting, maintaining and managing the reinsured policies•

Payment of reinsurance money (death benefit, medical benefit etc.)•

Other business conduct and operation incidental or relating to reinsurance business

2. Types of Personal Information to Receive
The company receives the necessary information, such as names, date of birth, gender,
address, phone number, insurance policy data, or other information required for executing
the business mentioned in Section 1 of this policy.
3. Sensitive Information
The Company shall not handle information concerning health and medical, etc. (“SensitiveInformation”) unless the purpose is in compliance with Article 53-10 of Ordinance for
Insurance Business Law and Article 5 of the FSA personal information guideline.
4. Personal Information Provision to Third Party
The Company shall not provide any personal information to a third party except when;•The Company has prior consent of the principal.

•The Company outsources part of its operation to a third party vendor for the purposes
set forth in Section 1 of this policy by entering into a contract that has non-disclosureclause and compliance clause with APPI .

•It is required by laws and regulations, etc.

•

There is a need to protect a human life, body or fortune, and when it is difficult toobtain a principal’s consent•

There is a special need to enhance public hygiene or promote fostering healthy
children, and when it is difficult to obtain a principal’s consent•

There is a need to cooperate in regard to a central government organization or a local
government, or a person entrusted by them performing affairs prescribed by laws andregulations, and when there is a possibility that obtaining a principal’s consent wouldinterfere with the performance of the said affairs

5. Personal Information Provision to Third Party in foreign countries
The Company provides customer information to third parties in foreign countries (*) after
confirming that such third parties have a system which provides equivalent privacy
protections as are stipulated under APPI and other applicable laws and regulations. In thisregard, pursuant to Article 28, Paragraph 3 of the Act and Article 18 of the Enforcement
Regulations, the following information will be provided upon request by Customer:
1) Method of establishing the system prescribed in Article 28, Paragraph 1 of
the Act by such third party2) Outline of Equivalent Measures Implemented by the Third Party
3) Frequency and method of confirmation in accordance with Article 18,
Paragraph 1, Item 14) The name of the country5) Existence or nonexistence of a system in the foreign country that may affectthe implementation of equivalent measures by the third party and an outlinethereof6) Whether or not there is any hindrance to the implementation of thecorresponding measures by the third party and an outline thereof7) Outline of measures taken by the personal information handling business
operator in accordance with the provisions of Article 18, Paragraph 1, Item 2with regard to the problems set forth in the preceding item
6. Joint Use of Personal Information by RGA Group Companies

The Company may use personal information jointly with RGA Group entities for the purposes
listed below to the extent necessary to conduct our business, in order to make a concerted
efforts to provide comprehensive services in reinsurance business in an efficient manner.
The contents of joint use are as follows.
(1) Data items for joint use
Such as names, date of birth, gender, address, phone number, insurance policy
data, or other information required for executing the business mentioned in Section
1 of this policy.
(2) Extent of users
Entities listed in “SUBSIDIARIES OF REINSURANCE GROUP OF AMERICA,
INCORPORATED” attached to the Form 10-K of Reinsurance Group of America,
Incorporated(3) Purposes
The following operations jointly conducted by RGA group entities stated in (2) above
Operations specified in the Section 1 of this policy(4) Responsible party to personal information management
RGA Reinsurance Company Japan Branch
Akasaka 9-7-1, Midtown Tower 41F, Minato-ku, Tokyo, JapanCEO of Japan Branch Hironori Takahashi
Please refer to RGA Group Privacy Policy by visiting https://www.rgare.com/privacy-policy.
7. Personal Information Security Measures
The Company sets out rules on personal information protection and takes measures inaccordance with such rules to prevent leakage and loss of or damage to personal data. TheCompany conducts personal information protection training to its employees and commit
itself to continuous effort for improvement.
Specifically, we have taken the following safety management measures.
(Formulation of Privacy Policy)
In order to ensure the proper handling of personal data, the Company has established thisPersonal Information Protection Policy, a basic policy that stipulates the name of the business
operator, compliance with relevant laws and guidelines, matters related to safety
management measures, contact points for handling inquiries and complaints, etc.
(Development of Discipline Pertaining to the Handling of Personal Data)
At each stage of acquisition / input, use / processing, storage, transfer / transmission, deletion

/ disposal, we have established rules for the handling of personal data, including handling
methods, responsible personnel and their duties.
(Organizational Safety Management Measures)
In addition to appointing a person responsible for handling personal data, the Company
clarifies who handles personal data and the scope of personal data handled by such
employees. Also the Company has established a system for reporting to responsible
personnel when they are aware of any fact or sign of violation of laws and handlingregulations. The Company also conducts regular self-inspections of the handling status ofpersonal data.
(Human Safety Management Measures)
Employees are given regular training regarding the handling of personal data, and theconfidentiality of personal data is stated in the rules of employment.
(Physical Safety Management Measures)
We take measures to prevent the theft or loss of equipment, electronic media, and documentsthat handle personal data. We also take measures to ensure that personal data is not easily
revealed when the equipment, electronic media, and other items are carried around,including when moving within the office.
(Technical Safety Management Measures)
Access control is implemented to limit the scope of personnel in charge and personal
information databases handled, and a mechanism has been introduced to protect information
systems that handle personal data from unauthorized access from outside or unauthorizedsoftware.
(Understanding of External Environment)
We are implementing safety management measures based on an understanding of systems
related to the protection of personal information in the following countries where personal
data is processed.
Australia, Barbados, British Bermuda, Brazil, Canada, United Arab Emirates (DIFC), France,Germany, Hong Kong, India, Ireland, Italy, Malaysia, Mexico, New Zealand, Poland,Singapore, Spain, Switzerland, South Korea, South Africa, Taiwan, Netherlands, United
Kingdom, United States of America (e.g. Missouri)

8. Retained Personal Data
The Company retains Personal Data as follows.
(1) Name, Address and CEO of the said Personal Information Handling Business Operator
RGA Reinsurance Company Japan Branch
Akasaka 9-7-1, Midtown Tower 41F, Minato-ku, Tokyo, JapanCEO of Japan Branch Hironori Takahashi(2) Purpose of use for all retained personal data
Purpose of use specified in Section 1 of this policy(3) Data items of retained personal data
Such as names, date of birth, gender, address, insurance policy data, or otherinformation required for executing the business specified in Section 1 of this policy.
9. Notice of Purpose of Utilization, Disclosure, Correction, Addition, Deletion,Suspension of Use, Suspension of third party provision, Disclosure of third party
provision records for Retained Personal Data
The Company shall respond any principal’s request to such insurer on notifying purpose ofuse or disclosure of retained personal data complying with the laws and regulations when
the requester shall be identified as the principal. The Company shall convey to a ceding
insurer the information of any principal’s request to such insurer on notifying correction,
addition, deletion, suspension of its use, suspension of third party provision and disclosureof third party provision records.
Please contact RGA Contact in Section 11 with the evidence for personal identification by
post regarding above requests.
We ask for your understanding that the requester should bear the costs for sending
documents.
10. Handling of Anonymously Processed Information
The Company will not produce Anonymously Processed Information. When the Company
provides Anonymously Processed Information to a third party, the Company shall publicly
announce the items of information concerning individuals included in the Anonymously
Processed Information to be provided and the method of provision, and clearly indicate tothe third party that the information to be provided is Anonymously Processed Information.
With respect to Anonymously Processed Information held by the Company, the Company will
provide such information to third parties on an ongoing basis after clearly indicating that suchinformation is Anonymously Processed Information.
(1) Items of information concerning individuals included in the Anonymously Processed

Information(i) Age (month of birth)(ii) Gender(iii) Social insurance eligibility information (individual/family classification, date of eligibility
acquisition/loss, etc.)(iv) Details of the medical fee statement (name of the injury or disease, date of admission
and discharge (hospital visit), date of medical treatment, etc.)(v) Health checkup item data (numerical values, etc.)(vi) Date of health checkup, data on health guidance items (numerical values, etc.)(vii) Lifelog information (number of steps, etc.)(2) Method of provision(i) E-mail(ii) File sharing service(iii) Share Folder of RGA group companies(iv) Physical delivery of external storage medium
11. Contacts
Please do not hesitate to contact any of the contacts below should you have any questions,consultations, opinions or complaints regarding the personal information handling.
<RGA Contact>
RGA Reinsurance Company Japan BranchCompliance and Legal
41F, Midtown Tower, 9-7-1Akasaka, Minato-ku, Tokyo, 107-6241
Tel： 03-3479-7191(Main)
From：9:00 to 17:00（except for Sat, Sun & holidays)<Authorized Personal Information Protection Organization>
The Company is a member of Foreign Non-Life Insurance Association of Japan which is oneof the Authorized Personal Information Protection Organization,
Foreign Non-Life Insurance Association of Japan (FNLIA)

HP：http://www.fnlia.gr.jp/< Designated Dispute Resolution Organization>
The Company has the contract with General Association Insurance Ombudsman which isone of the Designated Dispute Resolution Organization.

General Association Insurance Ombudsman

HP：http://www.hoken-ombs.or.jp/
TEL：03-5425-7963
From：9:00 to 17:00（except for 12:00 to 13:00 and Sat, Sun & December 29th to January4th)(*) "Foreign country" refers to a country or region outside Japan, and excludes foreigncountries that have systems for the protection of personal information that are considered to
be at the same level as Japan in terms of protecting the rights and interests of individuals as
defined by the rules of the Personal Information Protection Commission.
(September 21st, 2023)