Privacy Policy

CHANGE Holdings, Inc. (hereinafter referred to as "Company") recognizes that as the business areas handling information that may affect personal privacy are expanding, protecting personal dignity and individual rights and interests while considering the usefulness of that information is one of the most important matters for the Company.
In handling information that may affect personal privacy, Company complies with laws, guidelines, and directives concerning the protection of personal information, as well as the matters stipulated in this Privacy Policy.

Article 1 (Personal Information to be Acquired and Purpose of Use)

Company will acquire the following personal information and use it within the scope necessary to achieve the respective purposes of use.

Personal Information to be Acquired	Purpose of Use
Information concerning business partners	・For contract procedures, business partner management, provision of products/services, and execution of incidental duties. ・For development and improvement of products/services and marketing activities. ・For provision of information related to events, products, and services.
Information concerning members/users of services operated by Company	・For provision, operation, and improvement of services. ・For development and improvement of products/services and marketing activities. ・For provision of information related to events, products, and services.
Information concerning event participants	・For communication concerning participating events and other operational management. ・For development and improvement of products/services and marketing activities. ・For provision of information related to other events, products, and services.
Information of persons who made inquiries via phone/website	・For responding to inquiries, etc. ・For development and improvement of products/services and marketing activities. ・For provision of information related to events, products, and services.
Information concerning shareholders	・For duties related to the exercise of rights and fulfillment of obligations based on laws, provision of information in IR activities, implementation of various measures, and other shareholder management.
Information concerning job applicants	・For providing information to and communicating with job applicants. ・For screening of job applicants and other recruitment management.
Information concerning officers and employees (including those who have resigned/retired)	・For personnel management, wage management, labor management, procedures related to social security/tax, offering of education/training, welfare, safety and health management, business communication, and other duties necessary for business operation.

Article 2 (Purpose of Use of Specific Personal Information)

In handling individual numbers and specific personal information among the acquired personal information, Company will comply with laws, guidelines, and directives concerning the handling of individual numbers and specific personal information, and will handle specific personal information only for affairs related to individual numbers.

Article 3 (Provision to Third Parties and Joint Use of Personal Information)

1. Company will not provide the acquired personal information to third parties without obtaining the consent of the specific individual identified by that personal information (hereinafter referred to as the "Identifiable Person"), except when legal requirements are satisfied.
2. Company will jointly use the acquired personal information shown in (1) below with our Change Group companies shown in (2) below, within the scope necessary to achieve the respective purposes of use. Note that Company will not jointly use any specific personal information.

(1) Items of personal information to be jointly used and purpose of use

Items of Personal Information to be Jointly Used		Purpose of Use
Information concerning business partners	Name, email address, phone number, occupation, workplace (school), workplace (school) address/department/position, transaction status, Cookie/device/advertising ID information.	・For business management, credit, and other risk management of the Change Group. ・For development and improvement of products/services and marketing activities. ・For provision of information related to events, products, and services.
Information concerning event participants
Information of persons who made inquiries via phone/website	Other information concerning inquiries in addition to the above.	・For providing appropriate responses to inquiries in addition to the above.
Information concerning job applicants	Name, address, date of birth, gender, email address, phone number, academic history, work history, qualifications held, and other information submitted by the applicant.	・For business management of the Change Group. ・For providing information to and communicating with job applicants concerning recruitment by the Change Group.
Information concerning officers and employees (including those who have resigned/retired)	Name, email address, phone number, affiliated company/department, position, facial photo.	・For business communication within the Change Group.
	Other information held by the Company in addition to the above.	・For business management and personnel management of the Change Group.

(2) Scope of joint users

The Change Group(refers to CHANGE Holdings, Inc. and its domestic subsidiaries)

(3) Name, address, and representative of person responsible for management of personal information

17-1 Toranomon 3-chome, Minato-ku, Tokyo
CHANGE Holdings, Inc.
Representative Director, Executive Officer & President, Hiroshi Fukudome

* Provisions concerning joint use prior to the end of February 2024 are as follows.

Article 4 (Security Control Measures)

As security control measures for personal information managed as personal data, the Company offers education for all officers and employees, stores personal data in an accurate and up-to-date state, and implements management to prevent unauthorized access to personal data and leakage, loss, or damage of personal data. Furthermore, the Company continuously reviews security control measures and strives for correction and improvement. The key details of the Company's security control measures are as follows.

(1) Formulation of basic policy:

• The Company has formulated its Basic Policy on Information Security and Privacy Policy.

(2) Establishment of discipline concerning the handling of personal data:

• The Company has formulated internal regulations concerning handling methods, responsible persons/persons in charge, and their duties at each stage of acquisition, use, storage, provision, deletion/disposal, etc. of personal data.

(3) Institutional security control measures:

• The Company has appointed a person responsible for handling personal data, specified employees to handle personal data and the scope of personal data to be handled by such employees, and developed a reporting and communication system to the responsible person upon discovering facts or signs of violation of laws or internal regulations.
• The Company is conducting regular self-inspections concerning the handling status of personal data, and audits are also conducted by other departments or external third parties concerning the handling status of personal data.

(4) Personnel security control measures:

• The Company is offering regular training to employees concerning the handling of personal data.
• Provisions concerning confidentiality of personal data are prescribed in the Company's Rules of Employment.

(5) Physical security control measures:

• The Company is implementing entry/exit management of employees and restrictions on devices brought in, and measures to prevent viewing of personal data by unauthorized persons in areas where personal data is handled.
• The Company is taking measures to prevent theft or loss of devices, electronic media, and documents used for handling personal data, and also taking measures so that personal data is not easily visible when carrying such devices, electronic media, and documents, including movement within the office.

(6) Technical security control measures:

• The Company is implementing access control to limit employees who can access personal information databases, etc.
• The Company has introduced mechanisms to protect information systems handling personal data from external unauthorized access or unauthorized software.

(7) Identification of external environment:

• When storing personal data in a foreign country, the Company is implementing security control measures upon identifying the system concerning the protection of personal information in that country.

Article 5 (Procedures for Requests for Disclosure, etc.)

1. The Identifiable Person may request notification of the purpose of use, disclosure, correction, addition or deletion, or suspension of use or erasure of personal information (hereinafter referred to as "Disclosure, etc.") within the scope protected by the Act on the Protection of Personal Information. The procedures for Disclosure, etc. are as follows.
   (1) Please contact the information desk of Article 8 with the details of the request for Disclosure, etc.
   (2) As a general rule, we will respond to the request via email. If there is another preferred method, please state so when contacting us. We will respond by the preferred method to the extent possible.
   (3) No fee is required for the procedures for Disclosure, etc.
   (4) In taking the procedures, the Company may verify the identity of the Identifiable Person by a method determined by us.
2. The Company will take necessary measures without delay in response to requests for Disclosure, etc. from the Identifiable Person in accordance with the provisions of the Act on the Protection of Personal Information.

Article 6 (Handling of Other Information That May Affect Personal Privacy)

1. On the websites operated by the Company, for the purpose of analyzing browsing history, advertising effectiveness, and other matters, the Company may collect information that does not fall under personal information but may affect privacy depending on its handling, by incorporating the following information collection modules:

Name	Provider	Privacy Policy
Google Analytics	Google LLC	https://www.google.com/intl/ja/policies/privacy/External link
List Finder	Innovation Inc.	https://www.innovation.co.jp/policy-co/External link
Adobe Marketo Engage	Adobe Inc.	https://www.adobe.com/jp/privacy/policy.htmlExternal link

2. The Company will not provide information related to personal information to any third party who is anticipated to acquire such information related to personal information as personal data, unless confirmation is obtained that such third party has obtained the consent of the Identifiable Person.

Article 7 (Amendments to this Privacy Policy)

1. The Company may amend this Privacy Policy as necessary. However, if amending this Privacy Policy requires the consent of the Identifiable Person under laws, the amended version of the Privacy Policy will apply only to the Identifiable Person who has consented to the amendment by a method prescribed by the Company. When amending this Privacy Policy, the Company will make known or notify the timing of enforcement and subject matter of the amended version of the Privacy Policy by displaying it on the Company's website or other appropriate methods.
2. If any terms of use, privacy policy or other rules are established for each service provided by the Company, the provisions for each service take precedence over the provisions of this Privacy Policy.
3. This Privacy Policy is interpreted based on the Japanese language.

Article 8 (Information Desk)

For opinions, questions or other inquiries concerning this Privacy Policy and requests for Disclosure, etc. of personal data, please contact the following information desk.

CHANGE Holdings, Inc.
Address: 17-1 Toranomon 3-chome, Minato-ku, Tokyo
Personal Information Handling Officer: Chairperson of the Information Security Committee
E-mail: kanri@change-jp.com

Date of Last Revision: March 1, 2024