Attachment for European Economic Area (EEA) and United Kingdom
Established: October 18, 2023
Nippon Electric Glass Co., Ltd.
The Company’s processing of Personal Information of identifiable persons located or residingin the European Economic Area (EEA) or the United Kingdom to whom the GDPR (the General
Data Protection Regulation ((EU) 2016/679)) or the UK GDPR (the GDPR incorporated into
the laws of England under the European Union (Withdrawal) Act 2018 and revised under the
Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit)
Regulations 2019) (the GDPR and the UK GDPR are hereinafter collectively referred to as the“GDPR”) are applied shall be governed by this Attachment as well as the “Basic Policy on theProtection of Personal Information concerning Customers, Business Partners, and OtherIndividuals” (the “Protection Policy”) and the “Notice on Disclosure Matters with respect toPersonal Information of Customers, Business Partners, and Other Individuals under the
Personal Information Protection Act” (the “Notice”).
1.

Definitions

In this Attachment, “Personal Information” shall mean information defined as “Personal Data”
in the GDPR.
2.

Purpose of and Legal Basis for Processing Personal Information

The Company will process Personal Information of identifiable persons as follows for thepurposes described below.

Purpose of Processing

Legal Basis

Purposes of processing related to business activities for the Company’s products and services(1)

Manufacturing, design, processing, development, sales, installation,repair, and inspection services of theCompany’s products

It is necessary to perform processing forpursuing legitimate interests (such as
manufacturing,design,processing,development, sales, installation, repair, andinspection of the Company’s products)(2)

Variousinvitation
and/or 
notification services for theCompany’s
newproducts,
exhibitions, services, and surveys

In the case of direct marketing using email
or other methods that are determined torequire consent: Consent

Provision of information on the Company’s products in accordancewith the interests and preferences,etc. of an identifiable person

If the above is not applicable: It is necessary
to perform processing for pursuing
legitimate interests (such as making theidentifiable person aware of the Company’s
products or services).

(4)

Analysis of an identifiable person’s use on the Company’s website
regarding the Company’s products

It is necessary to perform processing forpursuing legitimate interests (such asgrowing or developing the Company’sproducts or services, etc. through theanalysis).

(5)

Manufacturing, design, processing, development, sales, installation,repair, or inspection of machinery,devices, and equipment related to
the Company’s products

It is necessary to perform processing forpursuing legitimate interests (such as
manufacturing,design,processing,development, sales, installation, repair, orinspection of machinery, etc. related to theCompany’s products).

(6)Services based on a contract with an 
identifiable
personoranorganization
towhichtheidentifiable person belongs

It is necessary to perform processing for
performing the contract.

(7)

Services relating to handling of 
applications or requests from an
identifiable person

It is necessary to perform processing forpursuing legitimate interests (such as
appropriate handling of applications orrequests from the identifiable person).

(8)

Verification services
identifiable personan 

It is necessary to perform processing forpursuing legitimate interests (such as theappropriate and efficient handling of theverification of the identifiable person).

(9)Services business operators are 
obligated to perform in accordancewith laws and regulations, etc.

It is necessary to perform processing tocomply with legal obligations.

(10) All other management and services related to (1) through (9) above

It is necessary to perform processing for
performing contracts, or it is necessary to
perform processing for pursuing legitimate
interests (if it is determined that consent isrequired, the Company will obtain consent
from the identifiable person by otherwise
indicating that the legal basis for theprocessing is such consent).

(3)

for

The Company may obtain some form of consent from an identifiable person for his or her
Personal Information. In this case, unless it is clearly indicated in the above table that the legal
basis for processing is “consent,” the legal basis for processing will be that “it is necessary toperform processing for performing contracts,” “it is necessary to perform processing forcomplying with legal obligations,” or “it is necessary to perform processing for pursuing
legitimate interests” (please contact the representatives by using the contact information
described in 7. below for the details of the balancing test of legitimate interests).
If an identifiable person objects to direct marketing, he or she may refuse any communication
sent by using electronic messages in accordance with the instructions indicated in the electronicmessages.
It is not a legal or contractual requirement or obligation for an identifiable person to provide hisor her Personal Information to the Company, unless the Company otherwise gives notice to that
effect. However, the Company may need Personal Information of the identifiable person inorder to achieve the matters described in the “Purpose of Processing” column in the table above.
In such cases, if the identifiable person does not provide the Personal Information in question
to the Company, the Company may be unable to conduct the matters described in the “Purposeof Processing” column in the table above.
3.

Record Retention Period for Personal Information

The Company will individually determine the appropriate retention period for the Personal
Information obtained by considering, among others, the purpose of processing, volume, nature,and confidentiality of such Personal Information as well as the legal or business necessity forretaining such Personal Information. When the retention period has elapsed, the Company will
delete such Personal Information by secure means or anonymize it in accordance withapplicable laws on the protection of personal information in each country or, if this is notpossible, will safely retain such Personal Information until its deletion becomes practicable andensure that no new use of the Personal Information will be conducted thereafter.
4.

Sharing of Personal Information

In order to fulfill the purposes of processing set out in 2. above, the Company may share thetypes of Personal Information described in 2. above with processors or the Company’s
subsidiaries in Japan and other countries that provide services necessary for the Company’sbusiness activities.
5.

Transfer of Personal Information to Foreign Countries

If the Company transfers Personal Information to areas other than the European Economic Area(EEA) or the United Kingdom, the Company will take appropriate protection measures, except
for transfers made by a method separately notified to the relevant identifiable person, by relying
on the adequacy decision in the countries where adequacy decisions are recognized, or byexecuting the standard data protection clauses approved by the European Commission or theInformation Commissioner’s Office (ICO) of the United Kingdom with the party receiving thePersonal Information in other countries. If an identifiable person wishes to receive a copy ofthe documents relating to those protection measures, please contact the representatives by using
the contact information described in 7. below.
6.

Rights of Identifiable Person

Each identifiable person has the following rights.

(a)Obtaining information regarding the processing of the Personal Information
Each identifiable person has the right to obtain from the Company all necessary
information regarding the acts of processing for his or her Personal Information
performed by the Company.

(b)

Access to the Personal Information
Each identifiable person has the right to obtain from the Company confirmation onwhether or not his or her Personal Information is processed, and if it is processed, he or
she has the right to access the Personal Information and certain related information.

(c)Correction or deletion of the Personal Information
Each identifiable person has the right to cause the Company to correct his or her
inaccurate Personal Information without undue delay, and the right to cause the Company
to complete his or her incomplete Personal Information. If certain conditions are satisfied,each identifiable person has the right to cause the Company to delete his or her Personal
Information without undue delay.

(d)Restricting the processing of the Personal Information
If certain conditions are satisfied, each identifiable person has the right to cause theCompany to restrict the processing of his or her Personal Information.

(e)Data portability of the Personal Information
If certain conditions are satisfied, each identifiable person has the right to receive the dataof his or her Personal Information in a structured, generally available and machinereadable form, and the right to transfer such data to another controller without interference
from the Company.

(f)

Objection to the processing of the Personal Information
Each identifiable person has the right to object to the fact that the Company will rely on
the legitimate interests of the Company (or a third party) as the legal basis for processing
his or her Personal Information that affects his or her rights. Specifically, the identifiable
person has the right to opt out of direct marketing or profiling performed by the Company
for direct marketing at any time.

(g)

Not be subject to automated decision-making
If certain conditions are satisfied, each identifiable person has the right to not be subject
to automated decision-making (decision-making in which no human is involved) thatlegally affects or materially affects the identifiable person.

(h)Withdrawal of consent
Each identifiable person has the right to withdraw his or her consent at any time by themethod separately designated by the Company when the Company obtains his or her
consent. However, the withdrawal of consent by an identifiable person does not affect thelawfulness of any processing performed based on his or her consent before the withdrawalof consent.

(i)Each identifiable person has the right to lodge a complaint about the processing of his or
her Personal Information by the Company with the data protection supervisory agency inthe member country where he or she resides or works or where an alleged infringement
occurs.

When exercising the rights described above, please contact the representatives by using thecontact information described in 7. below. For the purpose of verifying the identity of theidentifiable person exercising those rights, it may be necessary to obtain specific informationfrom the identifiable person. The Company may contact the identifiable person to obtain further
information relating to his or her requests to expedite the measures to be taken by the Company.
7.

Contact Information of Representatives

The contact information of the Company’s representatives is as follows.
Representative in European Union member countries, Iceland, Liechtenstein, and Norway
Name:

Nippon Electric Glass Europe GmbH

Telephone: (49) 211-4184889-0
Address:

Am Seestern 8, 40547 Duesseldorf, Germany

Representative in the United Kingdom
Name:

Electric Glass Fiber UK, Ltd.

Telephone: (44) 1942-257161
Address:

Leigh Road, Hindley Green, Wigan, WN2 4XG, UK