Handling of Personal Information

Policy on the Protection of Personal Information

1. When collecting personal information, it will be collected by an appropriate means after clarifying the purpose of use, and will be used only within the scope of that purpose.
2. We will take sensible security precautions against the unauthorized access, loss, destruction, falsification, and leakage of collected personal information.
3. We will comply with the Personal Information Protection Law and other related laws and regulations.
4. In addition to establishing a committee to handle personal information, we will give someone the responsibility of managing that information and post personal information managers in each department in order to ensure its protection and proper handling.
   In order to maintain this system for safeguarding personal information, we will continue to make improvements and provide necessary training.

Privacy Policy (Regarding the handling of personal information)

1. “Personal information” is information that can be used to identify the customer personally, such as customer’s name, address, telephone number, and email address.
2. When the customer provides us with personal information, the purpose of use will be specified in advance. Personal information will be used only within the scope of the purpose of use. If there is a need to use the information beyond the scope of the purpose of use, the customer will be notified in advance regarding the intended purpose. If the customer does not agree with the new purpose of use, the customer may refuse this use.
3. Personal information provided to us by customers will not be disclosed or provided to third parties except in the following cases.
   1. There is the customer’s consent
   2. Tasks are outsourced to another company that has signed a confidentiality agreement with the S.T. Group
   3. It is requested by law
   4. There is business succession through merger, company split, transfer of business, or the like
4. We will manage personal information provided by customers in a strict and appropriate manner. We will take strict security measures to prevent the leakage, damage, and loss of personal information. Moreover, we are taking the following measures for an appropriate management of personal data (including personal information acquired or to be acquired that is scheduled to be handled as personal data).
   1. Formulation of guidelines
      ・Formulation of Guidelines for the Protection of Personal Information in order to ensure proper handling of personal information
   2. Recording of the status of handling of personal data
      ・Production of “a personal information management ledger” for checking the status of handling of personal data to manage the safety thereof and recording of the categories of personal information, the items of personal data, the responsible person, the section in charge of handling personal information, the purposes of use, storage periods, etc
   3. Measures for organizational security management
      ・Development of procedures after discovering leakage of personal information, a breach of the system for the protection of personal information or concerns about a potential breach
      ・Inspection of the situation concerning the operation of the system for the protection of personal information by the Audit Department
   4. Measures for personal security management
      ・Conclusion of a confidentiality agreement concerning personal information with employees
   5. Measures for physical security management
      ・Management of entry to and exit from the management area of the server handling personal data as well as the placement of limitations on devices that may be brought in
      ・Storage of devices that handle personal data, electronic media with recorded personal data, documents with written personal data, etc. in a lockable cabinet, archive or the like
      ・Storage of personal data on electronic media after the encryption, protection by a password, etc.
      ・Adoption of methods such as usage of specialized software for deleting data, physical destruction, etc. in case of the disposal of the device, electronical media, etc. with recorded personal data
   6. Measures for technical security management
      ・Identification and authentication to confirm that each individual holds legitimate access rights in order to ensure that the access to the personal data is rightful
   7. Understanding the external environment
      ・Implementation of security management measures after understanding the system for the protection of personal information in a foreign country in case the data are stored in the country
5. If the customer wants to disclose, alter, add, or remove the personal information in our records, please make a request to our customer service center. In order to prevent fraud and information leaks to third parties, once the identity of the person making the request is confirmed, we will promptly disclose, alter, add, or remove the customer's personal information (within reason). (The procedure for making a disclosure request can be found here.)
6. If the customer is a minor, please provide personal information with the consent of the guardian.
7. The S.T. Group complies with laws regarding the protection of personal information and other related laws.
8. The S.T. Group may change this Privacy Policy in order to further protect the personal information, or due to changes in the law.
9. Inquiries regarding this Privacy Policy and personal information are accepted here.

About the Use of This Website

1. Most services on the website operated by the S.T. Group (hereinafter referred to as “This site”) can be used without providing personal information. However, the use of some services requires the user to provide personal information. This Privacy Policy applies to personal information provided by the user through This site.
2. The S.T. Group cannot be held responsible for the handling of personal information on non-S.T. Group websites linked to This site.

Concerning Our Procedures for Responding to Requests for Disclosure, etc.

1. Requests for Disclosure

2. Documents to be Submitted Upon Request for Disclosure

3. Request for Disclosure by Proxy

4. Our Response to Requests for Disclosure

5. Handling of personal information acquired through the Request for Disclosure, etc.

* Cases Where We Cannot Disclose “Retained Personal Data”

• Personal identity cannot be confirmed, for example, when the address on the application form and documents for identity verification do not match the registered address of the Company.
• In the case of applying by proxy, rights of representation for the proxy cannot be confirmed.
• There is a mistake in the designated application documents.
• The Request for Disclosure does not fall under “retained personal data.”
• Other cases stipulated by law

Inquiries Regarding Personal Information

Visits to the Company