Handling of Personal Information

１.Purpose of Use
SBI Security Solutions Co., Ltd. (“the Company”, “we”, or “our”) will use the Personal Information that we have obtained based on our own proper procedures for the purposes described below. In order to facilitate smooth business operations, the Company may outsource a part of the business and may outsource the handling of Personal Information to an outsourced contractor within the scope necessary for the business. In this case, we will ensure that such outsourced contractor will use Personal Information within the scope of the following purposes of use in the conduct of appropriate supervision, including the conclusion of contracts with such outsourced contractors regarding the handling of Personal Information.

The Company will not notify or disclose the purpose of use in the following cases.
(1)When notifying the person concerned of the purpose of use or publicly announcing it may harm the life, body, property, or other rights or interests of the person concerned or a third party.
(2)When notifying the person concerned of the purpose of use or publicly announcing it may harm the rights or legitimate interests of the organization concerned.
(3)When the Company needs to cooperate with a national institution or a local government in the conduct of the procedures stipulated by laws and regulations, and notifying the person concerned of the purpose of use or publicly announcing it may impact on the performance of the said procedures.
(4)When the purpose of use is recognized to be clear in light of the circumstances of acquisition. 

In the following cases, Personal Information may be used beyond the scope of the purpose of use in accordance with laws and regulations.
(1)When required by laws and regulations
(2)When it is necessary for the protection of a person’s life, body, or property and it is difficult to obtain the consent of the person concerned.
(3)When especially required to improve public hygiene or promote the sound growth of children under difficulties in obtaining the consent of the person concerned.
(4)When the Company needs to cooperate with a national institution, a local government, or a contractor outsourced by either of them in the conduct of the procedures stipulated by laws and regulations, and obtaining the consent of the person concerned may impact the performance of such procedures.
(5)When the businesses handling Personal Information is an academic research institute, etc. and needs to handle the Personal Information for academic research purposes (including when a part of the purpose of handling the Personal Information is for academic research purposes, but excluding when there is a risk of unjustified infringement on the rights and interests of individuals)
(6)When providing personal data to an academic research institute, etc., and the academic research institute, etc. needs to handle such personal data for the purpose of academic research (including when a part of the purpose of handling the personal data is for academic research purposes, but excluding when there is a risk of unjustified infringement on the rights and interests of individuals). 

2．Method of Acquiring Personal Information
The main methods of acquisition are documents received directly from the person (mailed or hand-delivered), inquiry forms on our website, e-mail, and security cameras, etc.In acquiring Personal Information, in accordance with applicable laws and regulations, etc., the Company will publicly announce the purpose of use as stated in 1. above on our website, and will also clearly state the purpose of use in the following ways when we receive Personal Information.
(1) When acquiring Personal Information in writing, we will clearly state the purpose of use in the relevant document or accompanying documents, in principle.
(2) When acquiring the customer’s information that was registered directly to a screen, etc., we will clearly state the purpose of use on the screen or another screen, etc., in principle.
(3) When the Company asks for or acquire Personal Information by telephone or other means, we will, in principle, clearly state the purpose of use of such information in advance by describing it on our website. Furthermore, when you speak with us by telephone or are recorded by a security camera, we may store the content in order to take appropriate action.

3. Provision and Disclosure to Any Third Parties
The Company will not provide or disclose the provided Personal Information to any third party, except in any of the following situations.
(1)When the Company has obtained consent of the person who provided such information.
(2)When we outsource the handling of such information.
(3)When such information is provided as a result of business succession such as merger.
(4)When it falls under joint use.
(5)When the purpose of use is recognized to be clear from the circumstances of acquisition, and the person concerned is contacted without any explicit indication, etc.
(6)When required by laws and regulations.
(7)When it is necessary for the protection of a person’s life, body, or property and it is difficult to obtain the consent of the person concerned.
(8)When especially required to improve public hygiene or promote the sound growth of children under difficulties in obtaining the consent of the person concerned.
(9)When the Company needs to cooperate with a national institution, a local government, or a contractor outsourced by either of them in the conduct of the procedures stipulated by laws and regulations, and obtaining the consent of the person concerned may impact the performance of such procedures.
(10)When disclosing or providing statistical data etc. in a form that does not allow the identification of the person concerned such as anonymized personal information.

4.Joint Use of Personal Information
The Company may share the Personal Information held by us (described in “(1) Items of Personal Information to be shared” below) with the persons described in “(2) Scope of joint users” below. If the joint use of Personal Information is restricted by related various laws and regulations, the information will be handled pursuant to such laws and regulations.
(1) Items of Personal Information to be shared
Information on the employee’s name, address, date of birth, telephone number, email address, technical information and other personal attributes.
(2)Scope of joint users
SBI Group companies listed on the website at the following URL (hereinafter referred to as “SBI Group Companies”). For details of SBI Group Companies included in the scope of joint users, please refer to:
https://www.sbigroup.co.jp/company/group/overview.html
(3) Purpose of Joint Use
(a)Management of information systems and access control within SBI Group Companies.
(b)Personnel, labor, welfare, health and safety management within SBI Group Companies.
(c)Other Incidental Use.
Necessary use for the provision of services of SBI Group Companies incidental to (a) and (b) above.
(d)Others
Personal information may be used for purposes other than those listed in (a) to (c) above in the services provided by SBI Group Companies in course of providing their services. In such cases, a notice will be posted on the website of the concerning service provided by the SBI Group Companies.
(4)The name of the representative who is responsible for the management of the Personal Information.
Yoshitaka Kitao, Representative Director, Chairman, President and CEO, SBI Holdings, Inc.
(5)For inquiries about the joint use, please contact
General Affairs Department,SBI Holdings, Inc.
Tel: 03-6229-0100 (main telephone number)
(6)Method of acquisition
In writing or e-mail

5. About Voluntariness
The Personal Information we collect is that the person concerned provides voluntarily. Please note that if you do not provide such information, we may not be able to provide you with the services and information you have requested.

6.Responding to Exercising the Rights as a Person Concerned
Requests to exercise the rights as the person concerned with respect to Personal Information held by the Company (including Specific Personal Information etc.) (hereinafter referred to as “Request for Disclosure Etc.”) will be received in the following manner. However, please understand that we may not be able to respond to requests for Personal Information if we are unable to disclose the requested Personal Information in accordance with laws and regulations, etc., if the Company’s storage period has passed, or if the request has not been made pursuant to the following method of receipt.
(1)Requests for Disclosure Etc.
“Notification or disclosure of purpose of use”, “correction, addition or deletion of content”, “suspension of use”, “erasure or suspension of provision to third parties”, “disclosure of records of provision to third parties”,
“complaints and consultation regarding Personal Information”
(2)Method of receipt
Please apply to the following contact details by phone, mail or e-mail.
(3)Procedure of receipt
Details of the receipt procedures will be provided when a request is made. After confirming the identity of the person concerned (or the attorney of such person), we will respond to the request by the same method the request was made or by delivering a written document. We will inform the person of the preparation such as identity verification documents. In addition, depending on the details of the request, we may ask the person to send an application form prescribed by us.
(4)Contact
Address: 13F, Izumi Garden Tower 1-6-1, Roppongi, Minato-ku, Tokyo,106-6019, Japan
E-mail: privacy@sbisecsol.com
Business hours: E-mails are accepted for 24 hours.
Business closure: Saturday, Sunday, public holiday, year-end and new-year holidays (December 31 through January 3) in JST.
(5)Identification of the person concerned or the attorney of such person
i.When the application is made by the person concerned
To verify the identity of the person concerned, we will check the following information: Driver’s license, passport, insurance identification certificate, seal registration certificate and other certification documents (but must be valid or issued within the past three months), and the person’s registered information, such as name, address, and telephone number in our system.
ⅱ.Application by an applicant’s attorney
To confirm that the application has been officially entrusted by the person concerned, we will verify the following information: A power of attorney that clearly states the attorney, a seal registration certificate of the seal stamped on the power of attorney, a certificate of registered matters (for an adult guardian), or a copy of a family register (for a person with parental authority), etc.
ⅲ.Fees and other charges
There is no fee to be paid by the person concerned to the Company in response to Requests for Disclosure Etc. However, the person concerned will bear the communication costs from the person to the Company, transportation costs, as well as the costs incurred in preparing materials and other documents in the person’s side for the identity verification process as stipulated above. 

Enacted on: April 1, 2023
Last revised on: April 1, 2023  
COO, Manager Responsible for Personal Information Protection
SBI Security Solutions Co., Ltd.

For the inquiry about the Proper Handling of Personal Information,
please e-mail to: privacy@sbisecsol.com