Personal Data
Protection Policy

1．Business Operator

2. Personal Data Protection Manager

3. Using Personal Data

4. Sharing Personal Data

Soken will not share personal data we collect with third parties, except:

5. Subcontracting Personal Data

Soken may outsource some of our operations to provide better service. Accordingly, Soken may provide personal data to its subcontractors. Soken will select and contract only with subcontractors that demonstrate active data management systems capable of adequately protecting personal data.

6. Disclosure Request for Personal Data

A person or entity authorized to provide or control personal data (owner) may request that Soken disclose, amend, append, delete, or cease to provide personal data under our control to third parties. Soken will respond to such requests in a timely manner.

7. Disclosing Personal Data and Providing Records to Third Parties

Upon receipt of a request by the owner of personal data and confirmation of the owner’s identity, Soken, to a reasonable extent, will disclose, amend, append, delete, or cease providing relevant personal data and associated records to third parties. The disclosure shall be made by the method specified by the owner of personal data, including the provision of electromagnetic records. Personal data will not be disclosed when such disclosure may harm the life, body, property, or other rights and interests of any individual; when disclosure may significantly hinder Soken’s business operations; or when disclosure may contravene binding laws and regulations. Where otherwise required by law, Soken will take appropriate measures in accordance with the relevant laws and regulations.

8. Measures for Secure Management of Personal Data

To prevent unauthorized access, loss, leakage, or other damage to retained personal data, Soken will implement measures for appropriate security management. Specific security control practices include:

1. 1)

   Organizational security management practices
   Soken maintains a Personal Data Protection Manager and related staff who handle personal data and monitor compliance with Soken’s policies and external law regarding personal data. Soken conducts periodic inspections and internal audits to maintain security and compliance with its personal data management policies.

2. 2)

   Personnel security management practices
   Soken employees who handle personal data are bound by confidentiality agreements and receive ongoing training regarding their duties and responsibilities.

3. 3)

   Technical security management practices
   Soken restricts the number of employees and equipment authorized to handle personal data. Equipment carrying personal data is outfitted with antivirus software and is inspected regularly for unauthorized access and other security breaches. Soken prevents leakage, loss, or other damage to personal data by setting passwords and access barriers to such information.

4. 4)

   Physical security management practices
   Soken limits the equipment on which personal data may be handled and the areas where such equipment may be used.
   In areas where personal data is handled, Soken prevents unauthorized persons from viewing personal data by controlling employee access and restricting the equipment and other items they may bring in. Soken takes steps to ensure personal data is not inadvertently revealed on portable media. When equipment is disposed and personal data is deleted, all data is destroyed and unrecoverable.

9. Confirming Identity

Before acting on a request to disclose, amend, append, delete, or cease to provide personal data under Soken’s control to third parties, Soken will confirm the owner’s identity and authority.

Individual owner

1. 1)

   Soken will send a document requesting confirmation of the owner’s identity to the owner’s
   preferred address on file. The owner must verify the information in the request, then sign and return the confirmation to Soken, along with a certificate of residence.

2. 2)

   Soken will contact the owner at the phone number on file to seek confirmation of the request and verification of the owner’s identity.

3. 3)

   Soken will send an e-mail to the e-mail address on file. The owner must reply to the incoming e-mail to confirm the request and verify his/her identity.

Owner’s attorney
The following documents are required:

1. a)

   Request in person

   • –

     Driver’s license or other document verifying the attorney’s identity.

   • –

     A family register or other document, no more than 30 days old, certifying the attorney’s qualification. Photocopies will not be accepted.

2. b)

   Request by mail

   • –

     A copy of a driver’s license or other document verifying the attorney’s identity.

   • –

     A certificate of residence, no more than 30 days old, certifying the attorney’s residence. Photocopies will not be accepted.

   • –

     A family register, no more than 30 days old, certifying the attorney’s identity. Photocopies will not be accepted.

Owner’s proxy or authorized representative
The following documents are required:

1. a)

   Request in person

   • –

     Authorization letter.

   • –

     Driver’s license or other document verifying the proxy’s identity.

2. b)

   Request by mail

   • –

     Authorization letter.

   • –

     A copy of driver’s license or other document verifying the proxy’s identity.

   • –

     A certificate of residence, no more than 30 days old, certifying the proxy’s identity. Photocopies will not be accepted.

10. Procedures for Disclosing Personal Data

After confirming the owner’s identity, Soken will mail a “Disclosure Request” form to the owner. Upon receipt of the completed form, Soken will acknowledge receipt and confirm by telephone or return mail that personal data has been disclosed, amended, appended, deleted, or no longer provided to third parties per the request. Data will be disclosed by the method designated by the requester, when possible. Otherwise, data will be disclosed by document. No fee will be charged in connection with requests to disclose, amend, append, delete, or cease providing personal data to third parties.

Please direct all correspondence regarding personal data to: