Handling of Personal Information

Table of Contents

Basic Approach
Provision of Personal Information to Third Parties through Opt-Out Procedures
Handling of Personal Information of Residents in the European Economic Area (EEA)

1. basic approach

FRONTEO, Inc. and its subsidiaries and affiliates (hereinafter collectively referred to as "FRONTEO") recognize the importance of personal information and personal numbers, and have implemented the following measures for the handling of information.

FRONTEO assigns a manager to each department that handles personal information and personal numbers to ensure the appropriate management of such information.
The Company acquires personal information by legal and fair means only with the consent of the individual and only to the extent necessary to achieve the purpose of use.
We will handle personal information only within the scope of the following purposes of use. Please refer to "Provision of Personal Information to Third Parties through Opt-Out Procedures" below for the use of personal information through opt-out procedures.
1. Purpose of Use of Personal Information Obtained by Means Other than Directly in Writing

(1) To properly perform outsourced work in the event that such work is outsourced.
(2) Personal information of applicants for employment obtained via job sites
- To contact those who wish to receive information regarding employment and for employment selection.
(iii) To authorize the following contractor to use the personal information within the scope stipulated in the terms of service of the contractor to which the personal information management is entrusted.
2. Purpose of use of personal information subject to disclosure

1) Customers' personal information
- To provide, bill, and pay for products and services for which we have received orders
- To send and collect various information, support, and questionnaires regarding our products and services. Also, to provide various types of information (including information on third-party services) that the Company deems beneficial to customers interested in the above products and services.
- To identify participants in seminars and other events, to send various administrative communications regarding the events, to contact customers for follow-up after the events, and to provide information on sponsored events, etc. (e-mail newsletters). To identify registered members of our content website. To provide information using materials and videos on our contents website.
- To send out gifts for campaigns, etc.
- To confirm your identity and respond to your inquiries.
(2) Personal information of business partners
- To contact you regarding business transactions, etc.
- To confirm the identity of the customer at the time of inquiry and to respond to the customer's inquiry
(3) Personal information concerning inquiries, complaints, etc.
- To confirm the content of inquiries, complaints, etc., and to respond to them
4) Personal information of shareholders
- To ensure the exercise of rights as a shareholder, to contact you, and to send IR materials
(v) Personal information of applicants for employment and employees (including temporary employees and retired employees)
- (v) Personal information of applicants for employment and employees (including temporary employees and retirees)
- (6) For personnel and labor management and welfare benefits for employees
(vi) For other purposes agreed to in advance by the individual concerned.
However, this shall not apply in the following cases i through iv.
- i. When required by law When required by law
- ii. When it is necessary for the protection of the life, body, or property of the person concerned or a third party, and it is difficult to obtain the consent of the person concerned.
- iii. When there is a risk of significant hindrance to the proper conduct of our business
- iv. When it is especially necessary to improve public health or to promote the sound growth of children and it is difficult to obtain the consent of the person concerned.
With respect to personal numbers, the Company will use and provide personal numbers only within the scope of use stipulated by laws and regulations and by third-party organizations designated by laws and regulations, and only after obtaining the information by legal and fair means. However, this shall not apply in the following cases v) to vi).
- v. In the event of a catastrophic disaster, etc. In order for financial institutions to make monetary payments in the event of a catastrophic disaster, etc.
- vi. When it is necessary to use personal numbers to protect the life, body, or property of a person.
- If the Company changes the purpose of use of personal information, the Company will notify or publicly announce the changed purpose of use to the person concerned. (except in the case of i. through iv. above).
- We will never disclose or provide personal information to third parties outside of our company without the consent of the individual. (Except in the case of i through iv above)
- The Company will never share personal information with any third party other than the Company without the consent of the person concerned.
- In order to provide better service to our customers, we may outsource a part of our business to a third party and entrust personal information and personal numbers to the outsourced company. In this case, we will select a contractor that meets sufficient security standards, conclude an information protection agreement with the contractor, and thoroughly manage and supervise the contractor. The same measures will also be taken in the unlikely event that the business is re-consigned to a subcontractor.
- We use the services of the following contractors to manage personal information. Depending on the terms of use of the outsourced service, there is a possibility that personal information may be used for purposes such as improvement and development of the outsourced service/system, redisclosure to the outsourced group company, or for other purposes specified in the terms of use. If you do not wish your personal information to be used for any of the following services, please refer to the next section and follow the procedures to stop the provision of your personal information to third parties. If you do so, we will stop providing your personal information to the third party and take appropriate measures such as deletion of your personal information as soon as possible.
  - Adobe (Please refer to the following URL for the Terms of Service)
    https://www.adobe.com/content/dam/cc/jp/legal/terms/enterprise/pdfs/GeneralTerms-JP-2020v1.1.pdf
  - Salesforce (Please refer to the following URL for terms of service)
    https://www.salesforce.com/jp/company/legal/sfdc-website-terms-of-service/
- We will respond to requests for disclosure, correction, addition, deletion, suspension of use or elimination, or suspension of provision to third parties (hereinafter referred to as "disclosure, etc.") of retained personal data from the person in question or his/her representative. (hereinafter referred to as "Disclosure, etc.") from the person or his/her representative of the personal data held by the Company. To make a request for Disclosure, etc., please specify the subject matter of the Disclosure, etc. and submit your request to the following request method.

<How to request disclosure, etc. of personal information

Persons who can request disclosure, etc.	The person himself/herself, a legal representative, or a voluntary representative
How to make a request	Please prepare the necessary documents and send them to the address below.
Required documents	(1) Request Form for Disclosure, etc. ( Any format is acceptable. Required information includes details of the request, name, address, and telephone number.) (2) Identification documents (a copy of one of the following documents issued by a public institution: driver's license, resident certificate, passport, etc.) If the request is made by a voluntary representative or legal representative, the following additional documents must be attached. (iii) Documents confirming the authority of representation ＜A copy of the family register or other document that confirms the right of legal representation. ＜A letter of attorney (with the applicant's seal) and the applicant's seal registration certificate (issued within the last 3 months) (iv) Identification documents of the proxy (a copy of one of the following documents issued by a public institution: driver's license, certificate of residence, passport, or other document issued by a public institution)
Commission fee	Free of charge (however, the cost of mailing the documents for the request for disclosure, etc. shall be borne by the person making the request)
Requests should be addressed to	Meisan Takahama Building, 12-23, Konan 2-chome, Minato-ku, Tokyo 108-0075, Japan Personal Information Manager, FRONTEO Corporation
Other Notes	<Regarding documents confirming identity and authority of proxy If there are any entries such as permanent domicile or medical records, please cross out the relevant parts before sending the documents. <Cases in which we are unable to respond to requests for disclosure, etc. Please note that we cannot respond to requests for disclosure, etc. in the following cases. In such cases, we will notify you that we are unable to respond to your request for disclosure, etc., clearly indicating the reason for such refusal. (1) Cases in which the identity of the person making the Request for Disclosure, etc. cannot be verified as the person or his/her agent for the retained personal data (2) Cases in which the subject of the Request for Disclosure, etc. does not fall under the category of Retained Personal Data (iii) Where there is a risk of harm to the life, body, property, or other rights or interests of the person in question or a third party (iv) When there is a risk of causing significant hindrance to the proper conduct of our business (v)When it would violate other laws and regulations. ＜Purpose of Use of Personal Information Obtained in Connection with Requests for Disclosure, etc. Personal information obtained in connection with a request for disclosure, etc. shall be handled only to the extent necessary for disclosure, etc. Documents submitted will not be returned. After the response to the request for disclosure is completed, the information will be properly managed and disposed of.

In order to ensure the accuracy of the content of personal data, the Company will endeavor to manage personal information and personal numbers in an accurate and up-to-date manner within the scope of the purpose of use.
We will review and improve our efforts in handling personal information as appropriate, such as by complying with applicable laws and regulations regarding personal information and personal numbers held by us, and by strengthening internal safety control measures.
Please contact the following for any complaints or inquiries regarding the handling of personal information and personal numbers.

2 Konan 2-chome, Minato-ku, Tokyo 108-0075
Meisan Takahama Building, 2-12-23 Konan, Minato-ku, Tokyo, Japan
FRONTEO Corporation Personal Information Manager
E-mail address

In addition to personal information and personal numbers, FRONTEO handles other important customer information for some of our services. Since we handle such important information, we have implemented the following measures

We set up and operate a dedicated laboratory for data analysis by limiting the number of persons authorized to enter and exit the laboratory.
We have installed a system that requires vein authentication when entering and exiting our dedicated data analysis lab, and logs are kept for each person whose fingerprints are registered.
A low-light surveillance camera is installed in our dedicated data analysis lab, and records and saves the entry and exit from our dedicated data analysis lab and access to the analysis PC booths and servers 24 hours a day.
We use our forensic hardware on all PCs in our company to acquire and preserve data in HDDs on a regular basis.

2. provision of personal information to third parties through opt-out procedures

We will provide personal information to third parties through opt-out procedures only within the scope of the following purposes of use.

Purpose of use of personal information provided to third parties
For the purpose of risk compliance surveys such as risk analysis in the supply chain, surveys related to academic research, surveys related to public policy, and surveys related to product development and research, we will provide information regarding the relationship between the subject researcher and the organization, etc. to which the researcher belongs or participates and other researchers and organizations. In addition, when providing information on papers, we will provide information on the authors associated with such papers.

Recipients of Information
Government and municipal offices, educational institutions, private companies (companies involved in the procurement and distribution of goods, pharmaceutical-related companies, and companies that own or use R&D functions), and other companies and individuals who request analysis or research from us.

Sources of information
Websites for searching and publishing articles on the Internet, etc. (limited to websites that publish author information and articles with the consent of the author(s) of the article).

Method of processing information
In order to maintain the information held and managed in our database, we cross-check and compare the information we already have with the newly acquired information, and perform update processing, such as correcting changed data and adding new data. This includes, for example, the process of collating the names of people and organizations that have different names, and unifying them into the same name.

Appropriate acquisition of information
Information is obtained in an appropriate manner in accordance with the guidelines of the Personal Information Protection Law stipulated by the Personal Information Protection Commission.

Items of personal data provided to third parties
Name of article, name of author(s), organizational affiliation, country/region to which the organization belongs, email address

Method of provision to third parties
(1) By e-mail:
(2) By optical disk, paper, or other media:
(3) Through Internet services that can be viewed only by contracted users
- Procedure for discontinuing provision of information to third parties
We will stop providing your personal information to third parties upon your request by mail or e-mail.

Postal code 108-0075
Meisan Takahama Building, 2-12-23 Konan, Minato-ku, Tokyo
Personal Information Manager, FRONTEO Corporation
E-mail address

3. handling of personal information of persons located in the european economic area (eea)

With respect to the handling of personal information of persons located in the European Economic Area (EEA) to which the European General Data Protection Regulation (GDPR) applies, this "Handling of Personal Information of Persons in the European Economic Area (EEA)" (hereinafter referred to as "this Handling Policy") shall apply in addition to the "Handling of Personal Information" of the Company. The contents of the former policy will be applied in addition to the "Handling of Personal Information". In the event of any conflict between the provisions of the former and the latter, the provisions of the latter shall prevail.

Definition of Terms

The following are definitions of terms used in this Privacy Policy.
- Applicable Privacy Laws
- Applicable privacy laws, including the General Data Protection Regulations (GDPR) and related national laws in force.
- EEA
- Member States of the European Union and countries under the European Economic Area (EEA) Agreement.
- Our Company
- FRONTEO Corporation
  Meisan Takahama Building, 12-23, Konan 2-chome, Minato-ku, Tokyo
- Personal Data
- Information that may identify, directly or indirectly, by reference to an identifier such as name, identification number, location data, or online identifier, or by reference to multiple elements, about an identified or identifiable natural person ("Site User")
- Processor
- A natural or legal person, public authority, department or other organization that handles personal data on behalf of the controller
- Controller
- A natural or legal person, legal entity, government authority body, department or other person who, alone or jointly with others, determines the purposes and means of the processing of personal data
- Third Party
- Natural or legal persons, public authorities, departments or other organizations other than the Site User, the Administrator, the Processor, and persons authorized to handle Personal Data under the direct authorization of the Administrator or the Processor
- Limitation of Processing
- Marking of personal data stored in a record in order to limit its processing in the future.
- Processing
- The collection, recording, compilation, composition, record keeping, modification or alteration, retrieval, reference, use, disclosure by transmission, distribution or otherwise making available, arrangement or combination, restriction, erasure or destruction, whether by automatic means or otherwise, of personal data or a group of personal data, such as The performance of a task or group of tasks carried out on personal data or a group of personal data, such as
- Profiling
- any form of automatic processing of personal data, consisting in the use of personal data to evaluate certain personal aspects associated with a natural person, in particular to analyze or predict aspects relating to the business performance, economic status, health, personal preferences, interests, reliability, behavior, location and mobility of such natural person.
- Consent of the individual
- Means a freely given, specific, prior, unambiguous and unambiguous expression of the intention of a Site User whereby the Site User, by his/her statement or clear affirmative act, expresses his/her consent to the processing of Personal Data relating to him/her.
- Our Site
- https://www.fronteo.com/
Scope of this Handling Policy

a. This Privacy Policy applies to the individual use by visitors of our site and to the processing of personal data via our site, to which the applicable privacy laws apply. We are the controller of such processing.

b. Our site may contain third party information (e.g. hyperlinks, banners, etc.). We do not control such third party information and are not responsible for compliance by third parties with applicable privacy laws. We encourage you to carefully read the privacy policies of any third party websites you visit.
The purposes for which we use the personal data we collect and hold and the basis for lawful treatment in accordance with the EU General Data Protection Regulation (GDPR) are as follows

a. Business partners: for transactions with us and related communication. Based on the person's consent (Art. 6(1)(a) GDPR) or legitimate interests (Art. 6(1)(f) GDPR)

b. To respond to inquiries from the person in question. Based on the person's consent (Art. 6(1)(a) GDPR) or legitimate interests (Art. 6(1)(f) GDPR)
Personal Data to be collected

We may collect the following personal data from users of our website

a. Name and address

b.e-mail address

c.User name and password

d.IP address

e. Cookies

f.Employment information and resumes

We do not collect sensitive personal data such as passport information or health data through our site, except as required by applicable privacy laws.
Purpose of Data Processing

We collect personal data when any of the following actions are taken by users of our site We process personal data only in accordance with applicable privacy laws as described in this Privacy Policy.

a. When you register on our site

b. When applying for employment through our site

c. When you use our site for other purposes.

We collect and process personal data only for the following purposes

d.Customers and business partners: To execute contracts or to respond to requests from our site users prior to the conclusion of a contract.

e.Customer service: To respond to inquiries about products and services, to provide important information, and to respond to complaints.

f.Marketing: To provide information on our products, services, and events, to conduct surveys, and to send gifts for campaigns, etc.

g.Shareholders: To ensure the exercise of rights as a shareholder, to contact you and respond to your inquiries, and to send IR materials

h. Applicants for employment: To contact those who wish to receive information regarding employment and to make employment selections
Transfer to a third country

When we provide personal data to our companies, contractors, or subcontractors, it may involve the transfer of personal data outside of the EEA. We will only transfer personal data to third parties located outside the EEA if at least one of the following applies

a. transfers to countries that the European Commission has identified as having an adequate level of protection for personal data (Article 45 GDPR)

b. transfers to a contractual partner with whom you have entered into a data transfer agreement containing standard contractual clauses specified by the European Commission (Article 46(2) GDPR)

c. Transfers that fall under the exceptional circumstances set out in Article 49(1) of the GDPR
Retention Period

We will retain personal data for an appropriate period of time as stipulated by the relevant laws and regulations. After such retention period, personal data that is no longer required to be handled will be appropriately erased in accordance with internal regulations.
Changes to Registered Information

When we receive a request for disclosure, correction, addition, deletion, suspension of use, or erasure of personal data, we will respond to the request in an appropriate manner after confirming that the person making the request is the person in question or a person authorized by the person in question.
(See Handling of Personal Information <How to Request Disclosure, etc. of Personal Information>)
Inquiries regarding the above requests and other personal data should be directed to the appropriate contact person. If you do not know the contact person, please contact us at the following address.

2 Konan, Minato-ku, Tokyo 108-0075
Meisan Takahama Building, 2-12-23 Konan, Minato-ku, Tokyo, Japan
FRONTEO Corporation Personal Data Manager
E-mail address

In addition to the requests for the items listed above, those located in the EEA may make the following requests regarding their own personal data.
- Disclosure (access)
- Correction
- Erasure
- Restriction of use
- Data portability
- Objections
- Withdrawal of consent
Objections to the Supervisory Authority

If you are located in the EEA, you have the right to appeal against the processing of your personal data to the competent supervisory authority (available at the URL below).
http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm
Contact person of the Data Protection Officer

Requests should be addressed to
Meisan Takahama Building, 12-23, Konan 2-chome, Minato-ku, Tokyo 108-0075, Japan
FRONTEO Corporation DPO Officer
E-mail address

Last revised: June 14, 2023