Recognizing the importance of protecting personal information and in order to further enhance the trust of our customers in the insurance business, we will handle personal information in a strict and appropriate manner and take appropriate security measures in compliance with the Act on the Protection of Personal Information (the “APPI”), the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (the “My Number Act”), and other applicable laws and regulations, as well as guidelines issued by the relevant governmental authorities, including the Guidelines for the Proper Handling of Specific Personal Information.

We will ensure that our employees and other personnel receive appropriate education and guidance regarding the proper handling of personal information and will establish and maintain an appropriate framework for such handling. We will also respond promptly to complaints and inquiries concerning the handling of personal information. In addition, we will regularly review and, where necessary, improve our policies and measures relating to the handling and security management of personal information.

1. Collection and Use of Personal Information

We will collect and use personal information only to the extent necessary for the conduct of our business and by lawful and fair means.
(For information concerning Individual Numbers (“My Numbers”) and Specific Personal Information, please refer to Section 6 below.)

2. Purposes of Use of Personal Information

We are entrusted by insurance companies with certain insurance-related operations and will use the personal information we collect only to the extent necessary to perform such entrusted operations.
(For information concerning My Numbers and Specific Personal Information, please refer to Section 6 below.)

As we conduct business with multiple insurance companies, we may use personal information we have obtained to propose products and services offered by the insurance companies with which we have business relationships.

The specific purposes for which we use personal information are set forth below. We will not use personal information for any other purposes.

Any changes to the purposes of use will be made only to the extent reasonably recognized as having a sufficiently relevant relationship to the original purposes. Where we change the purposes of use, we will, in principle, notify the relevant individual of the changes in writing, including by electronic means (collectively, “written notice”), or publicly announce such changes on our website or by other appropriate means.

The purposes of use of personal information by the insurance companies that entrust us with insurance-related operations are set forth on their respective websites below.

• AIG General Insurance Company, Ltd.
• Chubb Insurance Company Limited
• Sompo Japan Insurance Inc.
• Tokio Marine & Nichido Fire Insurance Co., Ltd.
• Daido Life Insurance Company

3. Security Measures for Personal Data

We will implement appropriate and sufficient security measures to prevent the leakage, loss, or damage of personal data that we handle, including My Numbers and Specific Personal Information referred to in Section 6 below, and otherwise ensure the secure management of personal data.

Such measures include establishing and maintaining internal rules and procedures governing the secure management of personal data and an appropriate organizational framework for implementing such measures. We will also take appropriate measures to ensure the accuracy and currency of personal data to the extent necessary to achieve the purposes of use. In the event that any incident or other issue occurs, we will promptly take appropriate corrective measures.

We have established separate internal rules concerning the security measures applicable to personal data. The principal measures are as follows. For inquiries regarding our security measures, please contact the inquiry contact specified in Section 8 below.

(1) Establishment of a Basic Policy

To ensure the proper handling of personal data, we have established this Basic Policy addressing matters including compliance with applicable laws, regulations, guidelines, and other standards; security measures; and the contact point for inquiries and complaints. We review this Basic Policy as necessary.

(2) Establishment of Internal Rules for the Secure Management of Personal Data

We have established internal rules specifying the methods of handling personal data, the responsible officers and personnel, and their respective duties at each stage of the personal data lifecycle, including collection, use, retention, provision, deletion, and disposal. We review these rules as necessary.

(3) Organizational Security Measures

• Appointment of persons responsible for the management of personal data
• Establishment of security measures under our employment rules and other internal regulations
• Operation in accordance with internal rules governing the secure management of personal data
• Establishment of procedures and systems to enable monitoring of the handling of personal data
• Establishment and implementation of inspection and audit systems for the handling of personal data
• Establishment of systems for responding to incidents involving leakage or other security breaches

(4) Personnel Security Measures

• Execution of confidentiality and non-disclosure agreements concerning personal data with employees and other personnel
• Clear definition of employees’ and other personnel’s roles and responsibilities
• Thorough communication, education, and training regarding security measures
• Verification of employees’ and other personnel’s compliance with procedures for the management of personal data

(5) Physical Security Measures

• Management of areas in which personal data is handled
• Measures to prevent theft or other unauthorized removal of equipment and electronic media
• Measures to prevent leakage or other unauthorized disclosure when electronic media or other devices containing personal data are transported
• Secure deletion of personal data and secure disposal of equipment, electronic media, and other devices

(6) Technical Security Measures

• Identification and authentication of users authorized to access personal data
• Establishment of access control based on classifications of personal data
• Management of access privileges to personal data
• Measures to prevent leakage, damage, or other compromise of personal data
• Logging and analysis of access to personal data
• Logging and analysis of the operation of information systems that handle personal data
• Monitoring and auditing of information systems that handle personal data

(7) Supervision of Contractors

When we outsource the handling of personal data, we will select contractors that appropriately handle personal data and establish internal rules governing outsourcing in order to ensure that appropriate security measures are implemented by such contractors. We will periodically review these rules and the relevant outsourcing arrangements.

(8) Understanding of the External Environment

Where personal data is handled in a foreign country, we will understand the applicable systems and regulations concerning the protection of personal information in that country and implement appropriate security measures based on such understanding.

4. Provision of Personal Data to Third Parties and Acquisition from Third Parties

(1) Provision to Third Parties

Except in the following cases, we will not provide personal data to any third party without obtaining the prior consent of the relevant individual.
(For information concerning My Numbers and Specific Personal Information, please refer to Section 6 below.)

1. Where required or permitted by applicable laws or regulations;
2. Where necessary for the protection of the life, body, or property of an individual and it is difficult to obtain the individual’s consent;
3. Where particularly necessary for the improvement of public health or the sound development of children and it is difficult to obtain the individual’s consent;
4. Where cooperation is necessary in relation to the performance by a national government agency, local government, or a person entrusted by either of them with duties prescribed by law, and obtaining the individual’s consent may impede the performance of such duties;
5. Where the third party is an academic research institution or other entity, and it is necessary for such third party to handle the personal data for academic research purposes, including cases where only part of the purpose of handling the personal data is for academic research purposes, except where there is a risk of unjustly infringing upon the rights and interests of the individual.

(2) Records Relating to Provision to and Acquisition from Third Parties

When we provide personal data to a third party or acquire personal data from a third party, including cases where personal-related information is acquired as personal data, we will confirm the circumstances and other relevant details of such provision or acquisition and maintain records of the matters required by applicable laws and regulations, including the name and other identifying information of the recipient or provider.

5. Handling of Sensitive Information

As a general rule, we will not collect, use, or provide to third parties Sensitive Information, including special care-required personal information (such as information concerning race, creed, social status, medical history, criminal records, or information concerning crime victims), as well as information concerning membership in labor unions, family origin, domicile of origin, health and medical care, and sex life (excluding information among the foregoing that constitutes special care-required personal information), except in the following cases:

1. Where required or permitted by applicable laws or regulations;
2. Where necessary for the protection of the life, body, or property of an individual;
3. Where particularly necessary for the improvement of public health or the sound development of children;
4. Where cooperation is necessary in relation to the performance by a national government agency, local government, or a person entrusted by either of them with duties prescribed by law;
5. Where, to the extent necessary for the performance of operations such as the collection of insurance premiums, Sensitive Information concerning an employee’s affiliation with or membership in an organization such as a political or religious organization or a labor union is collected, used, or provided to a third party;
6. Where Sensitive Information is collected, used, or provided to a third party to the extent necessary for the performance of insurance benefit payment procedures involving inheritance procedures; or
7. Where, in order to ensure the proper operation of our insurance business, Sensitive Information is collected, used, or provided to a third party, with the consent of the relevant individual, to the extent necessary for the performance of our business operations.

6. Handling of Individual Numbers and Specific Personal Information

We will not collect or use Individual Numbers (“My Numbers”) or Specific Personal Information for purposes other than those specifically prescribed by applicable laws and regulations.

Except where specifically permitted under the My Number Act, we will not provide Individual Numbers or Specific Personal Information to any third party.

7. Disclosure, Correction, Suspension of Use, etc. of Retained Personal Data under the APPI

With respect to requests for disclosure, including disclosure of records, correction, suspension of use, or other rights relating to retained personal data under the APPI, including My Numbers and Specific Personal Information referred to in Section 6 above, we will act as an intermediary between the requesting individual and the insurance company that holds the relevant personal data.

8. Contact Us

For inquiries concerning the handling of personal information, please contact the inquiry contact specified below.

For inquiries concerning an insured event, in addition to contacting the inquiry contact specified below, you may also contact the claims or accident consultation desk of the relevant insurance company indicated on your insurance policy.

Please note that, before responding to an inquiry or request, we will verify the identity of the person making the inquiry to confirm that the individual is the person concerned.