EEA (European Economic Area) and UK Exhibit

Formulation: June 2, 2025

This Exhibit applies to processing by BIPROGY Group Companies of the personal information of identifiable persons located or residing in the EEA (European Economic Area) or the UK and is related to the GDPR and the UK GDPR (collectively, the “GDPR”).
This Exhibit contains information related to rights concerning protection of each identifiable person’s data, including the right to object to certain processing conducted by BIPROGY Group Companies. Details regarding the rights of identifiable persons and the method of exercising those rights are stated in “3. Rights of identifiable persons”.

1.Legal basis, etc. for processing

Each BIPROGY Group Company processes each identifiable person’s personal information below pursuant to the following legal basis for the purposes stated in “2. Purposes of processing” in the Global Privacy Policy.

Each BIPROGY Group Company might in some cases obtain an identifiable person’s consent in regard to the identifiable person’s personal information, but even in such cases the legal basis for processing is as stated in “When processing is necessary for the performance of a contract,” “When processing is necessary for pursuit of legitimate interests,” or “When processing is necessary for compliance with a legal obligation,” except where stated in (iv) “When BIPROGY Group Companies obtain an identifiable person’s consent in advance” below.

Personal information of customers and other similar trading partners
1. When processing is necessary for pursuit of legitimate interests (GDPR Article 6, Paragraph 1, Item (f)) (*)
  - To conduct offers, sale, or provision in relation to products, services, or support to persons other than any data subject who is a natural person
  - To send announcements regarding products, services, or events (including seminars or exhibits) handled by BIPROGY Group Companies (including announcements depending on the interests, concerns, and needs of the customer or other similar trading partner based on the product and service purchase history and other similar information of the customer or other similar trading partner)
  - To conduct registration for use of services provided by BIPROGY Group Companies for persons other than any data subject who is a natural person
  - To deliver various publications
  - To conduct communications, negotiations, and discussions with customers and trading partners other than any data subject who is a natural person
  - To respond to inquiries or requests from customers and trading partners (including the use of telephone recording information to ensure the accuracy of the details of conversations and appropriate responses) other than any data subject who is a natural person
  - To manage the operation of training programs
  - To conduct various surveys
  - To upgrade and improve existing products, services, and sales activities and to develop new products and services (including upgrading, improvement, and development based on questionnaire surveys, market research, analysis of customer trends, and other such necessary analysis (including analysis of the interests, concerns, and needs of a customer or other similar trading partner based on the product and service purchase history and other similar information of the customer or other similar trading partner))
  - To ensure security, such as crime prevention or disaster prevention, and for entry/exit control of buildings that BIPROGY Group Companies are responsible for managing
  - To use information of a customer or other similar trading partner for the smooth operation and improvement of the services provided in our websites, such as by analyzing information of a customer or other similar trading partner that we obtain when a customer or other similar trading partner accesses our websites (except if the basis for processing is consent from the customer or other similar trading partner as stated below in (iv))
  - For procedures and cooperation in reporting and notifying government agencies and public organizations (except if the basis for processing is compliance with legal obligations as stated below in (iii))
  - For audits, operation of internal report system, and to otherwise prevent and deal with unjust acts (except if the basis for processing is compliance with legal obligations as stated below in (iii))
  - To exercise and defend legal claims
  - To perform obligations and exercise rights under applicable laws (except if the basis for processing is compliance with legal obligations as stated below in (iii))
  - In addition, in relation to customers and other similar trading partners, BIPROGY Group Companies will rely on this basis when, among the purposes stated in “2. Purposes of processing” in the Global Privacy Policy, the processing is required to perform services necessary for the purpose of legitimate interests of BIPROGY Group Companies or a third party.
2. When processing is necessary for the performance of a contract (GDPR Article 6, Paragraph 1, Item (b))
  - To conduct offers, sale, or provision in relation to products, services, or support to a data subject who is a natural person
  - To conduct registration for use of services provided by BIPROGY Group Companies for a data subject who is a natural person
  - To conduct communications, negotiations, and discussions with, and to perform contracts with, customers and trading partners (including performance of contracts with contractors for contracted services, such as system development, consulting, system support, education, and training) who is a data subject who is a natural person
  - To respond to inquiries or requests from customers and trading partners who is a data subject who is a natural person
  - In addition, notwithstanding (i) above, BIPROGY Group Companies will rely on this basis when, among the purposes stated in “2. Purposes of processing” in the Global Privacy Policy, the processing is required for the performance of a contract to which a data subject who is a natural person is a party or the processing is required in order to take measures related to requests from the data subject before entering into a contract.
3. When processing is necessary for compliance with a legal obligation (GDPR Article 6, Paragraph 1, Item (c))
  - For procedures and cooperation in reporting and notifying government agencies and public organizations that fall under a legal obligation
  - For audits, operation of internal report system, and to otherwise prevent and deal with unjust acts that fall under a legal obligation
  - To comply with legal obligations under the laws of each country within the EEA or the laws of the United Kingdom
4. When BIPROGY Group Companies obtain an identifiable person’s consent in advance (GDPR Article 6, Paragraph 1, Item (a))
  - To use information of a customer or other similar trading partner for the smooth operation and improvement of the services provided in our websites, such as by analyzing information of a customer or other similar trading partner that we obtain using cookies or other similar technologies when a customer or other similar trading partner accesses our websites
  - When consent is required under laws or regulations for direct marketing to a customer or other similar trading partner
Personal information of shareholders of BIPROGY Group Companies
1. When processing is necessary for pursuit of legitimate interests (GDPR Article 6, Paragraph 1, Item (f)) (*)
  - To take necessary procedures or measures in relation to shareholders (except if the basis for processing is compliance with legal obligations as stated below in (iii))
  - For procedures and cooperation in reporting and notifying government agencies and public organizations (except if the basis for processing is compliance with legal obligations as stated below in (iii))
  - For audits, operation of internal report system, and to otherwise prevent and deal with unjust acts (except if the basis for processing is compliance with legal obligations as stated below in (iii))
  - To perform obligations and exercise rights under applicable laws, including the Companies Act (except if the basis for processing is compliance with legal obligations as stated below in (iii))
2. When processing is necessary for the performance of a contract (GDPR Article 6, Paragraph 1, Item (b))
  - To communicate matters with shareholders
3. When processing is necessary for compliance with a legal obligation (GDPR Article 6, Paragraph 1, Item (c))
  - To take necessary procedures or measures in relation to shareholders that fall under a legal obligation
  - For procedures and cooperation in reporting and notifying government agencies and public organizations that fall under a legal obligation
  - For audits, operation of internal report system, and to otherwise prevent and deal with unjust acts that fall under a legal obligation
  - To perform obligations and exercise rights under applicable laws including the corporate laws of each country within EEA or the United Kingdom
Personal information of job applicants for BIPROGY Group Companies
1. When processing is necessary for pursuit of legitimate interests (GDPR Article 6, Paragraph 1, Item (f)) (*)
  - For recruitment procedures
  - To provide information to, contact, and notify job applicants
  - For procedures and cooperation in reporting and notifying government agencies and public organizations (except if the basis for processing is compliance with legal obligations as stated below in (ii))
  - For audits, operation of internal report system, and to otherwise prevent and deal with unjust acts (except if the basis for processing is compliance with legal obligations as stated below in (ii))
  - To perform obligations and exercise rights under applicable laws (except if the basis for processing is compliance with legal obligations as stated below in (ii))
2. When processing is necessary for compliance with a legal obligation (GDPR Article 6, Paragraph 1, Item (c))
  - For procedures and cooperation in reporting and notifying government agencies and public organizations that fall under a legal obligation
  - For procedures and cooperation in reporting and notifying government agencies and public organizations that fall under a legal obligation
  - To comply with legal obligations under the laws of each country within the EEA or the laws of the United Kingdom
Personal information of former employees of BIPROGY Group Companies
1. When processing is necessary for pursuit of legitimate interests (GDPR Article 6, Paragraph 1, Item (f)) (*)
  - To provide personnel and labor services (including benefits) for former employees as required by the laws of countries other than those within EEA or the United Kingdom
  - To provide former employees with company information, to contact former employees as necessary for social gatherings, etc., and for other former employee management purposes
  - For procedures and cooperation in reporting and notifying government agencies and public organizations (except if the basis for processing is compliance with legal obligations as stated below in (ii))
  - For audits, operation of internal report system, and to otherwise prevent and deal with unjust acts (except if the basis for processing is compliance with legal obligations as stated below in (ii))
  - To perform obligations and exercise rights under applicable laws (except if the basis for processing is compliance with legal obligations as stated below in (ii))
2. When processing is necessary for compliance with a legal obligation (GDPR Article 6, Paragraph 1, Item (c))
  - To provide personnel and labor services (including benefits) for former employees as required by the laws of countries within EEA or the United Kingdom
  - For procedures and cooperation in reporting and notifying government agencies and public organizations that fall under a legal obligation
  - For audits, operation of internal report system, and to otherwise prevent and deal with unjust acts that fall under a legal obligation
  - To comply with legal obligations under the laws of each country within the EEA or the laws of the United Kingdom

2.Overseas transfer of personal information

If a BIPROGY Group Company transfers personal information to areas other than the EEA (European Economic Area) or the UK, the BIPROGY Group Company (i) takes appropriate protection measures based on an adequacy decision (*) in the countries where adequacy decisions (GDPR Article 45) are adopted or (ii) takes appropriate protection measures by executing the standard data protection clauses approved by the European Commission (GDPR Article 46, Paragraph 2, Item (c) and Paragraph 5) or the standard data protection clauses approved by ICO (UK GDPR Article 46, Paragraph 2, Item (d)) with the party receiving personal information in countries where adequacy decisions are not adopted.

(*) Adequacy decisions for each country

adequacy decision別ウィンドウで開く

Japan (please see here for the details of the adequacy decision)別ウィンドウで開く

US (please see here for the details of the adequacy decision regarding the DPF between the EU and the US; BIPROGY Group Companies transfer personal information to companies registered on the DPF list based on the adequacy decision)別ウィンドウで開く

3.Rights of identifiable persons

Identifiable persons have the following rights.

Obtaining information regarding data processing: Each identifiable person has the right to obtain from us all necessary information regarding our processing of data concerning the identifiable person (GDPR Article 13 and Article 14).
Access to personal information: Each identifiable person has the right to obtain confirmation from us as to whether personal information concerning the identifiable person is being processed, and, where that is the case, to access the personal information and certain relevant information (GDPR Article 15).
Rectification and erasure of personal information: Each identifiable person has the right to have us rectify inaccurate personal information concerning the identifiable person without undue delay and have incomplete personal information completed by us (GDPR Article 16). Each identifiable person also has the right to have us erase personal information concerning the identifiable person without undue delay when certain conditions are met (GDPR Article 17).
Restricting processing of personal information: Each identifiable person has the right to restrict our processing of personal information concerning the identifiable person when certain conditions are met (GDPR Article 18).
Objection to processing of personal information: Each identifiable person has the right to object to our processing of personal information concerning the identifiable person when certain conditions are met (GDPR Article 21, Paragraph 1).
Objection to direct marketing: Each identifiable person has the right to object at any time to our processing of personal information for direct marketing (GDPR Article 21, Paragraph 2).
Personal information portability: Each identifiable person has the right to receive personal information concerning the identifiable person in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance from us, when certain conditions are met (GDPR Article 20).
Right to withdraw identifiable person’s consent: Each identifiable person has the right to withdraw the identifiable person’s consent at any time by the means separately specified at the time we obtain identifiable person’s consent. However, the identifiable person’s withdrawal of consent does not affect the lawfulness of processing conducted based on the identifiable person’s consent before the withdrawal.
Freedom from automated decision-making: When certain conditions are met, an identifiable person has the right not to be subject to automated (meaning without human involvement) decision-making that produces legal effects or significant effects on the identifiable person (GDPR Article 22).
Regarding our processing of an identifiable person’s personal information, the identifiable person may lodge a complaint with the relevant data protection supervisory authority of the member state where the identifiable person’s habitual residence, the identifiable person’s place of work, or the place of the alleged infringement, is located (GDPR Article 77).