Article 1 (Personal Information)

The meaning of "Personal Information" varies based on each applicable law as follows:

1. For Users to whom the Japanese Act on the Protection of Personal Information (Act No. 57 of 2003, hereinafter referred to as the "APPI") applies, or business operators targeted by the Company's sales activities (including individuals such as representatives, officers, and employees in the case of corporations or other organizations; hereinafter referred to as "Prospective Customers"), it refers to "personal information" as defined in said Act, meaning information about a living individual that can identify a specific individual by name, date of birth, or other descriptions contained in such information, or information that includes a personal identification code.
2. For Users or Prospective Customers to whom the EU General Data Protection Regulation (hereinafter referred to as "GDPR") applies, it refers to "personal data" as defined in said Regulation.

‍

Article 2 (Information Obtained)

1. The Company may acquire the following information from the Contractor or the Contractor's authorized users in Beatrust. Please note that if such information is not provided, Beatrust may not be available for use.

1. User Basic Information: User's name, face image, profile, personality, email address, phone number, and other basic user information.
2. Work-Related Information: User's skills, work content, experience, report lines related to the user, colleagues, department, projects, job title, assigned team, office location, and other information regarding their position within the organization, as well as other information related to the user's work.
3. Service Usage Information: Operation setting information, number of information updates, terminal status at the time of a crash, etc., search logs, various action logs (e.g., button presses), access logs, types of apps and browsers of the terminal used when viewing the Company's services and the pages viewed, information on the device used when accessing the Company's services, hardware model, device IP address, Cookies, serial number, device operation information, mobile network information, MAC address and other unique identifiers, OS and its version, selected language, advertising identifiers, and other information regarding the user's use of the Company's services.

2. If the Contractor permits the Company to acquire user information through a service provided by a third party, the Company may acquire such information. In that case, for the purpose of improving Beatrust or providing advertisements, the Company may combine information independently acquired from the Contractor or User with information obtained from third parties.

3. The Company may acquire the Prospective Customer's corporate number, trade name, location, phone number, and point of contact, as well as the names, departments, job titles, business contact information, and other basic information of the Prospective Customer's officers or employees (hereinafter referred to as "Prospective Customer Basic Information").

‍

Article 3 (Acquisition and Use of Personal Information)

The purposes of use of the information defined in Article 2 acquired by the Company and the legal basis for processing under the GDPR are as follows:

- "Performance of a Contract" means that the Company uses information to fulfill the contract between the Company and the Contractor or User.
- "Legitimate Interests" means that the Company uses information for legitimate interests such as maintaining or improving the standard of the Company's services and preventing unauthorized use of services.
- "Compliance with Legal Obligations" means that the Company uses information to provide necessary cooperation to courts and other public institutions based on applicable laws and regulations.
If the information defined in Article 2 is used beyond the scope of the following purposes, prior consent shall be obtained from the individual in an appropriate manner.

‍

‍

Article 4 (Anonymization, etc.)

To improve Beatrust, the Company may aggregate and analyze information related to the Contractor's authorized users, create statistical data (from which correspondence with specific individuals is excluded) regarding the following items, and use or disclose such data:

1. Number of advice requests, frequency of consultations, and frequency of keyword usage.
2. Information regarding the contents of concluded contracts, billing dates, expiration dates, etc.
3. Information regarding the terminal used, OS, browser, etc.
4. Other information related to the use of Beatrust.

‍

Article 5 (Management and Protection of Personal Information)

1. Personal information shall be strictly managed, and the Company will not disclose or provide data to third parties without the consent of the individual, except in the following cases. Furthermore, considering safety, the Company will implement measures for prevention and correction against risks such as unauthorized access to personal information, and the loss, destruction, falsification, and leakage of personal information:

1. When it is necessary for the protection of human life, body, or property and it is difficult to obtain the consent of the individual.
2. When it is particularly necessary for the improvement of public health or the promotion of the sound development of children and it is difficult to obtain the consent of the individual.
3. When it is necessary to cooperate with a national agency, a local government, or a person entrusted by them in performing affairs prescribed by laws and regulations, and obtaining the individual's consent is likely to impede the performance of such affairs.
4. When all or part of the handling of personal information is entrusted within the scope necessary to achieve the purpose of use in order to perform operations smoothly.
5. When personal information is provided due to the succession of business resulting from a merger, demerger, business transfer, or other reasons.
6. When personal information is used jointly with a specific person, and the individual is notified in advance or placed in a state where the individual can easily know to that effect, as well as the items of personal information to be jointly used, the scope of the persons to jointly use, the purpose of use by the person using it, and the name or designation of the person responsible for the management of the personal information.
7. In other cases permitted by laws and regulations.

2. The Company will not use Users' or Prospective Customers' personal information for purposes such as training or analysis of Generative AI models. However, this shall not apply to statistical data created based on the preceding article, and the Company may use such data for these purposes.

‍

Article 6 (Entrustment of Handling of Personal Information)

1. The Company may entrust all or part of the handling of personal information within the scope necessary to achieve the purpose of use. In this case, the Company will sufficiently examine the eligibility of the entrustee, stipulate matters regarding confidentiality in the contract, and perform necessary and appropriate supervision of the entrustee.

2. The Company may provide Users' or Prospective Customers' personal information to operators of external cloud services, Generative AI services, or other external services necessary for promoting or providing guidance on Beatrust in a form that is inaccessible except for the minimum necessary purpose and scope (provided that when providing to a Generative AI service operator, it will be provided in a form that cannot be used for training).

‍

Article 7 (Provision to Third Parties)

1. The Company will not provide acquired personal information to third parties except in the following cases:

1. When the user or Prospective Customer has consented.
2. When the user violates the Company's terms and it is deemed necessary to disclose personal information to protect the Company's rights, property, services, etc.
3. When it is necessary for the protection of human life, body, or property and it is difficult to obtain the consent of the individual.
4. When it is necessary to cooperate with a national agency, a local government, or a person entrusted by them in performing affairs prescribed by laws and regulations, and obtaining the user's consent is likely to impede the performance of such affairs.
5. When succession of the Company's business, including the provision of personal information, occurs due to a merger, company split, business transfer, or other reasons.
6. In other cases permitted by the APPI or other laws and regulations.

2. Notwithstanding the preceding paragraph, the Company may entrust the handling of and provide Users' or Prospective Customers' personal information to the following third parties in foreign countries within the scope necessary to achieve the purposes defined in Article 3. Please check below for the country where the third party is located and the personal information protection system of said country:

1. Country Name: United States of America
2. Personal Information Protection System of said foreign country: Please refer to the website of the Personal Information Protection Commission below: https://www.ppc.go.jp/files/pdf/USA_report.pdf
3. Personal Information Protection Measures taken by the third party: The third party complies with the legal regulations regarding the protection of personal information in said country.

3. In addition to the cases defined in the preceding paragraph, the Company may provide Users' personal data to a third party in a foreign country that has implemented measures aligned with the intent of the provisions of Chapter 4, Section 2 of the APPI and for which the continuous implementation of such measures is ensured between the Company and the third party.

‍

Article 8 (Cookies)

The Company and advertising service providers may use Cookies by sending them to the browser used by the user through Beatrust.

Users can disable or reject cookies by changing their browser settings. If users disable or reject cookies, some features of Beatrust may not function properly.

If the acceptance of Cookies is not disabled, advertising service providers may acquire Cookie information (browsing history, etc.) of users using Beatrust, and the Company's advertisements may be delivered. Advertising service providers may deliver advertisements based on the preferences of users by using access data, Cookies, the Company's identifiers, attribute information of users, etc.

Cookie information of users acquired by advertising service providers will be handled in accordance with the privacy policy of the advertising service provider.

Users may be able to stop the use of Cookies and access data by advertising service providers by accessing the opt-out page of the advertising service provider and disabling (opting out) them. In that case, advertisements based on the user's preferences may no longer be delivered, or the same advertisement may be delivered repeatedly.

‍

Article 9 (Disclosure of Personal Information)

When the Company is requested by an individual to disclose their personal information, the Company shall disclose it to the individual without delay. However, if disclosure would result in any of the following, the Company may not disclose all or part of it, and if it decides not to disclose, it will notify the individual to that effect without delay:

If there is a risk of harm to the life, body, property, or other rights or interests of the person or a third party
If there is a risk of significant hindrance to the proper conduct of our business
If it would otherwise be in violation of laws and regulations

‍

Article 10 (Correction and Deletion of Personal Information)

1. If personal information held by the Company is incorrect, the Company will correct or delete the personal information upon the individual's request according to the procedures prescribed by the Company.

2. If the Company receives a request from an individual in the preceding paragraph and determines that it is necessary to respond to that request, the Company shall correct or delete the personal information without delay and notify the individual to that effect.

‍

Article 11 (Rights of EU Resident Users, etc.)

Users or Prospective Customers who are residents of the EU (hereinafter collectively referred to as "EU Resident Users, etc.") have the following rights:

1. Right of Access to Personal Information:
   EU Resident Users, etc. have the right to request a copy of their personal information held by the Company. In such cases, the Company may charge a small fee for this service.
2. Right to Rectification or Erasure: EU Resident Users, etc. have the right to request the Company to correct information they believe to be inaccurate. EU Resident Users, etc. also have the right to request the Company to complete information they believe to be incomplete. Furthermore, EU Resident Users, etc. can request the deletion of personal information that the Company handles concerning said EU Resident User, etc., provided certain requirements are met. This excludes cases that fall under exceptions, such as when it is necessary for compliance with legal obligations or for the proof, exercise, or defense of legal claims.
3. Right to Restriction of Processing and Right to Object: EU Resident Users, etc. can request the restriction of the processing of their personal information if certain requirements are met. Additionally, EU Resident Users, etc. may file an objection or complaint with the supervisory authorities of each country within the EEA or with the Company.
4. Right to Data Portability: EU Resident Users, etc. have the right to receive personal information concerning the EU Resident User, etc. in a structured, commonly used, and machine-readable format, and the right to transmit that data to another controller without hindrance from the Company, provided certain requirements are met.

If an EU Resident User, etc. requests to exercise any of the above rights, the Company will respond within one month. If you wish to exercise these rights, please contact the email address listed at the end of this Policy.

‍

Article 12 (Distribution of Advertisements Using Custom Audience and Customer Match)

1. To improve convenience by customizing and displaying advertisements and content related to the Company’s products and services for each user or Prospective Customer, the Company delivers advertisements using "Custom Audiences" provided by Meta Platforms Inc. (hereinafter referred to as "Facebook") and "Customer Match" provided by Google LLC (hereinafter referred to as "Google").

2. Advertisements are delivered based on information obtained by matching encrypted email addresses acquired from users or encrypted email addresses acquired from Prospective Customers with information of Facebook and Google users. However, because the email addresses to be matched are encrypted, they are not provided to third parties such as Facebook or Google.

3. If you wish to stop the use of personal information in "Custom Audiences" and "Customer Match," please perform the deactivation procedure via the links below:

"About Facebook Ads."

https://www.facebook.com/about/ads

Google Policies and Terms

https://policies.google.com/technologies/ads?hl=ja

‍

Article 13 (Suspension of Use of Personal Information, etc.)

If an individual requests the suspension of use or erasure (hereinafter referred to as "Suspension of Use, etc.") of their personal information on the grounds that it is being handled beyond the scope of the purpose of use or that it was acquired by improper means, the Company will conduct the necessary investigation without delay. Based on the results, the Company will perform the Suspension of Use, etc. of the personal information and notify the individual to that effect. However, in cases where the Suspension of Use, etc. would incur a large cost or is otherwise difficult to perform, the Company will implement alternative measures necessary to protect the rights and interests of the individual if such measures are available.

‍

Article 14 (Information Retention and Storage Period)

The Company retains and stores users' or Prospective Customers' personal information for the period necessary to fulfill the aforementioned purposes of acquisition and use, or for the period stipulated by applicable laws and regulations. The specific retention and storage period is determined by considering the purpose of acquisition and processing, the nature of the personal information, and the legal or business necessity of retaining and storing the personal information.

‍

Article 15 (Procedures for Changing Privacy Policy)

The Company will review the contents of this Policy as appropriate and strive for improvement. The contents of this Policy may be changed except as otherwise provided by law or in this Policy. The revised Privacy Policy shall take effect from the time it is notified to users by a method prescribed by the Company or posted on the Company's website.

‍

Article 16 (Compliance with Laws, Regulations and Norms)

The Company will comply with Japanese laws and other applicable laws and regulations regarding the personal information it holds.

‍

Article 17 (Response to complaints and consultations)

The Company accepts complaints and consultations from individuals regarding the handling of personal information and will respond appropriately and promptly. In addition, the Company will respond promptly and appropriately to requests from individuals for the disclosure, correction, addition, deletion, or refusal of use or provision of said personal information.

‍

Article 18 (Contact for Inquiries)

For inquiries regarding the Company's handling of personal information, please contact the following:

‍

Beatrust Corporation Customer Service Contact:
No. 35 Kowa Building 3F, 1-14-14 Akasaka, Minato-ku, Tokyo 107-0052, Japan 306
Mail: support@beatrust.com

Revised October 29, 2026

Revised: February 10, 2026

Revised: March 27, 2023

Enacted and effective as of March 1, 2021