Handling of personal information

1. Acquisition of personal information and purposes of use

IR Japan, Inc. (hereinafter, the “Company”) acquires personal information by lawful and fair means in accordance with the Act on the Protection of Personal Information (hereinafter, the “Personal Information Protection Act”), other relevant laws and regulations and JIS Q 15001:2023, and uses it within the scope necessary to achieve the purposes of use specified in advance.
Except as permitted by laws and regulations, the Company will not use personal information beyond the scope of the purposes of use without obtaining the prior consent of the individual to whom the information pertains.
In addition, the Company may outsource a part of its business operations. In such cases, the Company will select contractors that are recognized as handling personal information appropriately, and will perform necessary and appropriate supervision, including entering into contracts.
The terms “personal information,” “personal data,” and “retained personal data” in this policy have the meanings defined in the Personal Information Protection Act.

1.1 Personal information of persons in charge of exercising voting rights and other institutional investors (investment management institutions)

(1) To provide the following services of the Company

• Provision of Large Volume Holding Reports Search System Service (Stock Watch)
• Provision of Domestic and Overseas Institutional Investors’ Ownership Viewing Service (Domestic and Overseas Fund Stock Watch) based on investment trust management reports, prospectuses, fund management status reports, shareholding information disclosed by foreign funds outside the U.S., information on persons in charge of exercising voting rights, and other information disclosed by institutional investors (investment management institutions)

(2) To provide services of the Company to persons in charge of exercising voting rights and other institutional investors (investment management institutions) for the purpose of facilitating appropriate and smooth dialogue with shareholders regarding engagement between other issuer companies and persons in charge of exercising voting rights/other institutional investors (investment management institutions) in connection with the above services

1.2 Personal information obtained from consignors

• To perform the services entrusted by consignors

1.3 Personal information of inquirers

• To verify the identity of the inquirer
• To respond to the inquiry selected in the inquiry item
• To record and retain inquiries, and to improve the quality of the Company’s responses

1.4 Personal information obtained from publicly available information

• To improve the overall quality of the Company’s services
• To conduct market analysis and surveys
• To provide information regarding the Company’s services
• To confirm the information in accordance with laws and regulations, etc.

1.5 Personal information of applicants for IR briefing information distribution service

• To provide Analyst Network and other services for potential investors that provide useful information to analysts and institutional investors, such as information on the Company’s services, corporate IR briefings, financial results, and general meetings of shareholders

1.6 Personal information of clients pertaining to financial instruments business

• To store records including personal information in accordance with laws and regulations and to manage the Company’s transaction records, etc.
• To provide information related to financial instruments business and propose financial products
• To verify identity and eligibility to use financial services in accordance with laws and regulations, etc.
• To manage ongoing transactions, such as due date management for financial instruments business
• To make decisions regarding continued usage of financial instruments business
• To exercise rights and fulfill obligations based on contracts with applicants and laws, etc.
• To make decisions according to the principle of suitability and other decisions on the appropriateness of providing financial instruments business
• To identify and manage various risks, and to smoothly execute transactions with applicants, etc.
• To use the Individual Number (My Number) in preparing and providing statutory documents relating to financial instruments transactions in accordance with the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures

1.7 Personal information of candidates for outside directors in the Company’s service: Independent Outside Director Search

• To register as a candidate for an outside director position in the Independent Outside Director Search
• To select candidates matching job openings from companies seeking to use the Independent Outside Director Search (hereinafter, “Hiring Companies”) based on registered information
• To provide Hiring Companies with candidates’ names, ages, work history, fields of expertise, qualifications, and other personal information necessary for the introduction, to select and introduce candidates
• To set up interviews with Hiring Companies, and manage selection processes, appointment procedures, and other communications incidental to the Independent Outside Director Search
• To contact candidates as necessary to update or verify their registered information
• To improve the service

To introduce job openings to candidates, the Company will provide candidates’ personal data to prospective companies or recruitment agencies that have entered into an agreement with the Company, only within the scope necessary for the introduction and only if the Company has obtained individual or comprehensive consent from the candidates. Details regarding the recipients, items of data to be provided, and purposes of provision are set forth in “3. Provision of personal data to third parties.”

1.8 Personal information of applicants registering for Candidate Simulation

• To provide the outside director candidate simulation services
• To respond to inquiries regarding the Independent Outside Director Search

1.9 Personal information of users of Kabunushi-Hiroba service

• To notify various surveys
• To aggregate and process survey results
• To send information on company briefings, etc.
• To send rewards for participating in surveys
• To send prizes for promotional campaigns or sweepstakes

1.10 Personal information of applicants for IR tool joint production partners

• To perform screening, credit checks, other verifications based on laws and regulations, and processing procedures toward starting business transactions

1.11 Personal information of applicants for employment

• To provide information on and accept applications for corporate briefings
• To provide company information, recruitment details, etc.
• For screening and selection related to recruitment
• To notify applicants of selection results

1.12 Personal information of employees, resignees, and retirees

• For employee education and training
• For personnel and payroll management
• For internal services and welfare benefits
• For safety, health, and labor management operations
• For business communications and emergency contacts (e.g., in the event of a disaster)
• To manage health of employees in accordance with laws and regulations
• For operational management, asset management, information security, and system administration
• To comply with labor-related laws and regulations concerning resignees and retirees
• To handle administrative and emergency communications with resignees and retirees
• For other activities contributing to operations incidental or related to the above

2. Joint use of personal data

For the purpose of improving the quality of products and services provided by each company in the group centered on IR Japan Holdings, Ltd. (hereinafter, the “Group”), and for properly executing Groupwide business management and risk management, the Company jointly uses personal data in accordance with Article 27, Paragraph 5 of the Personal Information Protection Act as follows:

2.1 Personal data subject to joint use

(1) The following personal data described in 1. (1.1 to 1.8, 1.11, and 1.12) above:

• Name, affiliation information (company name, department name, etc.), job title, address, telephone number, fax number, email address, and other information generated through transactions, discussions, and negotiations necessary to achieve the purpose of joint use
• Name, company, department, job title, address, telephone number, fax number, email address, and other information written on business cards received by the Company necessary to achieve the purpose of joint use

2.2 Scope of joint users

• (1) IR Japan Holdings, Ltd.
• (2) IR Japan, Inc.
• (3) Japan Originated Investment Bank, Inc.
• (4) IRJ Business Consulting Staff, Inc.

Joint users may change due to organizational restructuring, etc.
The latest list of joint users is published on the Company’s website.
https://www.irjapan.jp/en/group/company.html

2.3 Purpose of joint use

• (1) For business management of the Group
• (2) For the proper execution of compliance and risk management
• (3) For information security management
• (4) For internal control and internal audit
• (5) For planning and developing products and services
• (6) For responding to inquiries
• (7) For the smooth execution of operations at each Group company

2.4 Acquisition method of personal data to be jointly used

The personal data to be jointly used is lawfully acquired through the following methods:

• (1) Information acquired from the individual in writing or through electronic methods
• (2) Information acquired orally from the individual
• (3) Information acquired through the exchange of business cards
• (4) Information acquired from publicly available information
• (5) Information acquired based on outsourcing agreements or other contracts
• (6) Information acquired based on laws and regulations

2.5 Entity responsible for managing personal data to be jointly used

Personal Information Protection Manager, IR Japan, Inc.

Note: For the address and representative, please refer to “9. Our organization”

2.6 Security control measures

With respect to jointly used personal data, joint users take necessary and appropriate security control measures based on the Personal Information Protection Act and internal regulations.
In addition, joint users use the jointly used personal data only within the scope of the purpose of joint use, and take necessary measures to prevent unauthorized access, leakage, loss or damage, and for other security control measures.

3. Provision of personal data to third parties

The Company will not provide personal data to third parties without obtaining the prior consent of the individual to whom the information pertains, except as provided by the Personal Information Protection Act and other laws and regulations.

(Cases based on laws and regulations)

• When it is necessary for the protection of human life, body, or property, and it is difficult to obtain the consent of the individual
• When it is particularly necessary for public health improvement or the promotion of sound child development, and it is difficult to obtain the consent of the individual
• When it is necessary to cooperate with a state organ, a local government, or an entity entrusted by them in executing affairs prescribed by laws and regulations, and obtaining the consent of the individual is likely to impede the execution of such affairs
• Cases that are deemed not to fall under provision to third parties under the Personal Information Protection Act (outsourcing, joint use, or other cases specified by laws and regulations)

3.1 Third-party provision in the Independent Outside Director Search

In providing the Independent Outside Director Search, the Company may, based on the consent obtained from a candidate at the time of registration or introduction, provide the candidate’s name, age, work history, field of expertise, qualifications, and other personal data necessary for the introduction to Hiring Companies. This is done to select and introduce candidates and to carry out procedures reasonably necessary for providing the service.
The provision of the above personal data is limited to Hiring Companies that have concluded a contract regarding the handling of personal information, only to the extent necessary for providing the service. The Company requires Hiring Companies to strictly manage the personal data, including not using it for any purpose other than candidate selection and introduction.

3.2 Third-party provision in the Large Volume Holding Reports Search System Service (Stock Watch), etc.

In providing the Large Volume Holding Reports Search System Service (Stock Watch) and Domestic and Overseas Institutional Investors’ Ownership Viewing Service (Domestic and Overseas Fund Stock Watch), the Company may provide personal data to service users in accordance with the disclosures made under Article 27, Paragraph 2 of the Personal Information Protection Act. For details, please refer to “4. Provision of personal data to third parties pursuant to Article 27, Paragraph 2 of the Personal Information Protection Act and JIS Q 15001.”

3.3 Suspension of third-party provision

If a request to stop providing personal data to third parties is made in accordance with laws and regulations, the Company will investigate without delay upon request by the individual or their agent and respond in accordance with laws and regulations.

4. Provision of personal data to third parties pursuant to Article 27, Paragraph 2 of the Personal Information Protection Act and JIS Q 15001

Regarding the Large Volume Holding Reports Search System Service (Stock Watch) and Domestic and Overseas Institutional Investors’ Ownership Viewing Service (Domestic and Overseas Fund Stock Watch), the Company may provide the personal data of submitters and holders of large volume holding reports, institutional investors, and persons in charge of exercising voting rights to users of each service within the scope necessary to provide each service in the following manner. The Company has submitted a notification to that effect and made it publicly available pursuant to Article 27, Paragraph 2 of the Personal Information Protection Act.
Regarding the provision of personal data to third parties in each service, the Company will stop providing personal data that identifies the individual to third parties upon the request of the individual. If you wish to suspend the provision of personal data, please submit a request to the contact point shown in “8. Contact for inquiries regarding personal information protection” in accordance with the procedures below, and the Company will immediately take measures to stop the provision.

4.1 Regarding Large Volume Holding Reports Search System Service (Stock Watch)

• (1) Purpose of provision

Searching and viewing large volume holding reports (Article 27-23 of the Financial Instruments and Exchange Act)

• (2) Items of personal data provided to third parties
• Submitter
  Submitter name, total number of issued shares, number of shares held, holding ratio, change in holding ratio, total acquisition amount, date of reporting obligation, submission date, issuer company name, securities code, and document name
• Holder
  Holder name, total amount stipulated in the main clause of Article 27-23, Paragraph 3 of the Financial Instruments and Exchange Act^*1, total amount stipulated in Article 27-23, Paragraph 3, Item (i) of the same Act^*2, total amount stipulated in Article 27-23, Paragraph 3, Item (ii) of the same Act^*3, deducted shares, number of shares deducted among joint holders, number of shares held, number of potential shares held, holding ratio, change in holding ratio, and acquisition funds

*1 Total amount stipulated in the main clause of Article 27-23, Paragraph 3 of the Financial Instruments and Exchange Act refers to the total of share certificates, etc. (share certificates, share subscription warrants, share acquisition rights, corporate bond certificates with share acquisition rights, covered warrants of target securities, depository receipts of share certificates, depository receipts related to share certificates, and target securities redeemable bonds; the same shall apply hereinafter) held by a person who has acquired them in their own name or in the name of another person (including a fictitious person) in accordance with the main clause of Article 27-23, Paragraph 3 of the Financial Instruments and Exchange Act (including those who have the right to request delivery of share certificates, etc. based on a sales contract or other contracts).

*2 Total amount stipulated in Article 27-23, Paragraph 3, Item (i) of the Financial Instruments and Exchange Act refers to the total of share certificates, etc., held by a person who has the authority to exercise voting rights as a shareholder of the company that is the issuer of the share certificates, or has the authority to give instructions regarding the exercise of such voting rights, based on a monetary trust contract, other contracts, or provisions of laws and regulations, and whose purpose is to control the business activities of said company, in accordance with Article 27-23, Paragraph 3, Item (i) of the Financial Instruments and Exchange Act.

*3 Total amount stipulated in Article 27-23, Paragraph 3, Item (ii) of the Financial Instruments and Exchange Act refers to the total of share certificates, etc., held by a person who has the authority necessary to invest in share certificates, etc., based on a discretionary investment contract, other contracts, or provisions of law, in accordance with Article 27-23, Paragraph 3, Item (ii) of the Financial Instruments and Exchange Act.

• (3) Method of provision to third parties
  Email to members, IR-Pro online service for members
• (4) Method of acquisition
  Acquired from the Financial Services Agency’s Electronic Disclosure for Investors’ NETwork (EDINET)

4.2 Regarding Domestic and Overseas Institutional Investors’ Ownership Viewing Service (Domestic and Overseas Fund Stock Watch)

• (1) Purpose of provision
  Searching and viewing investment trust management reports, prospectuses, fund management status reports, shareholding information disclosed by foreign funds outside the U.S., information on persons in charge of exercising voting rights, other information disclosed by institutional investors (investment management institutions), as well as stock portfolio inclusion information created by the Company based on such information
• (2) Items of personal data provided to third parties
  Name, job title, and managed investment funds of the persons in charge of exercising voting rights
• (3) Method of provision to third parties
  IR-Pro online service for members
• (4) Method of acquisition
  Acquiring information disclosed by various investment management institutions through various media

5. Requests regarding retained personal data

5.1 Content of requests

An individual may make the following requests regarding their retained personal data held by the Company:

• Notification of purpose of use
• Disclosure
• Correction, addition or deletion of contents
• Suspension of use
• Erasure
• Suspension of provision to third parties
• Disclosure of third-party provision records

5.2 Method of request

If you wish to make a request, please contact “8. Contact for inquiries regarding personal information protection.”
We will explain the request procedures, identity verification process, and methods for requests by agents.

5.3 Identity verification

To confirm that the requester is the individual concerned or a legitimate agent, the Company may ask for the submission of identity verification documents or other necessary materials.

5.4 Requests by agents

Requests by agents are limited to (1) statutory agents and (2) voluntary agents authorized by the individual.
When a request is made by an agent, the Company may ask for the submission of documents confirming authority of agency.

5.5 Cases where requests cannot be met

In the following cases, the Company may not be able to meet your request in accordance with laws and regulations.
If we cannot meet your request, we will explain the reason.

• If there is a risk of harming the life, body, property, or other rights and interests of the individual or a third party.
• If there is a risk of causing a significant impediment to the proper execution of the Company’s business.
• If meeting the request violates other laws and regulations.
• In other cases permitted under the Personal Information Protection Act.

5.6 Method of response

Responses will be provided by the method requested by the individual.
However, if responding by that method is impracticable, we will notify the individual of the reason and respond using an alternative appropriate method.

5.7 Fees

For requests regarding notification of the purpose of use and disclosure of retained personal data, the Company may charge a fee separately determined by the Company.

6. Security control measures

The Company takes necessary and appropriate security control measures based on the Personal Information Protection Act, other relevant laws and regulations, and internal rules to prevent leakage, loss, or damage of personal data and to otherwise securely manage personal data.

6.1 Organizational security control measures

To ensure proper management of personal data, the Company appoints a personal information protection manager, establishes internal rules on personal information protection, and properly manages the acquisition, use, storage, provision, deletion, etc., of personal data.
The Company also conducts periodic inspections and audits regarding handling status of personal data.

6.2 Personnel security control measures

The Company continuously provides education and training on personal information protection to its employees and stipulates confidentiality obligations in its employment regulations and other internal rules.

6.3 Physical security control measures

The Company implements entry and exit control, locking management, document storage management, recording media management, disposal management, and other necessary physical security control measures.

6.4 Technical security control measures

The Company implements access authority management, acquisition of access logs, measures against unauthorized access, measures against malware, encryption of communications, authentication management, and other necessary technical security control measures.

6.5 Supervision of contractors

When outsourcing the handling of personal data, the Company appropriately selects contractors and exercises necessary and appropriate supervision, including entering into contracts and conducting periodic checks.