IIJ BCR-C Annex 5 - Procedures Regarding Complaints and Consultations Relating to Personal Data
Version No. 1.0, 28th July 2021 Handle With Care

IIJ BCR-C Annex 5Procedures Regarding Complaints and Consultations
Relating to Personal Data

Version 1.0

28th July 2021

Internet Initiative Japan Inc.

1/4

IIJ BCR-C Annex 5 - Procedures Regarding Complaints and Consultations Relating to Personal Data
Version No. 1.0, 28th July 2021 Handle With Care

Version No.

Revision Date Revision Reason & Details Approval

Creation/Revision

Ver. 1.0

28th July 2021 Initial Version

IIJ Chief Privacy OfficeMiyoshi

2/4IIJ BCR-C Annex 5 - Procedures Regarding Complaints and Consultations Relating to Personal Data
Version No. 1.0, 28th July 2021 Handle With Care

1. Positioning of this document
This document sets forth the procedures when there are complaints and consultations from Data
Subjects relating to Personal Data (referred to below in these rules as “complaints, etc.”).
2. Responsibility and Authority
When there are complaints, etc. from Data Subjects, the IIJ Chief Privacy Office is ultimately
responsible for handling them. Complaints may be lodged in writing on paper by sending a letter to theaddresses listed in Annex 1 of the IIJ BCR-C, or electronically by sending an email to the following email address iijgroup-dpo-contact@iij.ad.jp. Complaints may be lodged verbally at the following phone
number: +81-3-5205-4466. Other contact details may be specifically provided by the relevant IIJ
Business Entity.
All complaints received by any Executives or Others of the IIJ Group at any other address of IIJ
Business Entities will be immediately forwarded to the IIJ CPO and the DPO.
3. Procedures for Handling Complaints(1) If there are “complaints, etc.” from Data Subjects, prompt and appropriate follow up shall beconducted as set forth in “Rules Regarding the Rights of Data Subjects."(2) The department that has received the complaints, etc., will record the details of the complaints, etc.
by a method of recording that is normally used in such work and shall promptly contact the IIJ Business
Entity’s CPO.
(3) In case of rejection of a complaint, the Data Subject will be informed that he or she may lodge acomplaint or claim before the competent DPAs and /or the competent courts, pursuant to Section 6 ofthe IIJ BCR-C.
(4) In case a complaint is justified and accepted, the Data Subject will be informed of this and of theway in which the IIJ Group has proceeded to implement the Data Subject’s request. The Data Subject
will also be informed that, in case of disagreement or dissatisfaction as to the way in which the IIJ
Group has proceeded, he or she may lodge a complaint or claim before the competent DPAs, and/or
the competent courts, pursuant to Section 6 of the IIJ BCR-C.
(5) Competent DPAs are, in particular, the DPAs of the jurisdiction of the habitual residence or placeof work of the Data Subject or of the place of the alleged infringement. Competent courts are of thejurisdiction of the Member State where the Data Controller or Data Processor has an establishment or
where the Data Subject has his/her habitual residence.
(6) The exhaustion of this internal complaint system procedure is not necessary for the Data Subject tovalidly lodge a complaint or claim before the competent DPA or court.
4. Response Time Frame(1) The IIJ Business Entity’s CPO will acknowledge receipt of a written complaint received from theData Subject concerned within ten (10) working days.
(2) The IIJ Business Entity’s CPO will make a substantive response within one month starting from thedate the complaint was de facto received by the IIJ Business Entity (regardless of the date when thereceipt of the complaint was acknowledged).
(3) If, due to the complexity of the complaint and the number of requests, a substantive response cannot
be given within one month the Data Subject will be advised accordingly with a reasonable estimate for
3/4

IIJ BCR-C Annex 5 - Procedures Regarding Complaints and Consultations Relating to Personal Data
Version No. 1.0, 28th July 2021 Handle With Carethe timescale within which a response will be provided (not exceeding two additional months).
5. Record Handling(1) The DPO will maintain records of complaints, etc. using a ledger, etc.
(2) Based on the records in the previous item, the DPO analyses complaints, etc. and reviews thehandling procedures.
6. Reports to Senior Management, Including the Company President
The DPO shall make a report to senior management about the details of complaints, etc. as well as thehandling results, at least once a year.

END
Supplementary Provisions
These rules shall take effect from 28th July 2021.

4/4