JR WEST RAILTEC Co., Ltd.

1. Basic Concept

The West Japan Railway Company Group (JR-West Group) aspires to promote the evolution of the ties between people, communities, and society, to inspire, and to shape the future. We hope to continue to create and provide new value to our customers and to society at large by utilizing the Group’s abundant and diverse data and translating this data into real-life experiences at stations, at retail outlets, and in the local community.
On the other hand, given that the handling of such data is intimately related to the management of important personal information of our customers, etc., we will not only comply with laws and regulations, but will also actively strive to take privacy into consideration and ensure transparency so that we can dispel any concerns of our customers, etc.

2. Handling of Personal Information

The JR-West Group will observe the following rules regarding the handling of personal information so that we may realize the ideals set forth in the preceding paragraph.

(1) Take privacy into consideration.

• In utilizing the personal information of our customers, etc., we will prioritize the provision of value to each customer and the resolution of local challenges, and will not handle such information in a manner that may infringe on the privacy of individual customers, etc.

(2) Ensure transparency in our privacy protection initiatives.

• When acquiring personal information, we will expressly indicate in advance the purposes for which such information will be used in an easy-to-understand manner so that our customers, etc. can understand these purposes. We will also appropriately disclose how we use personal information.
• We will respond to inquiries from customers, etc. regarding their personal information appropriately and in good faith.

(3) Ensure propriety in our collaborations with business partners.

• We collaborate with business partners as necessary to continue to provide new value to our customers, etc. and to society. When using personal information with business partners in the course of such collaboration (including provision to third parties, joint use, outsourcing, etc.), we require that our counterparties comply with laws and regulations, and handle personal information in an appropriate manner that respects the privacy of our customers, etc. and other considerations.

(4) Carefully manage the personal information of our customers, etc.

• We will use appropriate organizational, personnel, physical, and technological measures to protect the personal information entrusted to us from leakage, theft, falsification, and other such incidents.

1. Basic Concept

JR WEST RAILTEC Co., Ltd. (hereinafter referred to as the "Company") recognizes the importance of personal information and considers the protection of personal information to be its social responsibility. Accordingly, the Company complies with applicable laws and regulations regarding the protection of personal information, as well as its own internal rules, and appropriately collects, uses, and manages the personal information it handles.

2. Handling of Personal Information

The Company will observe the following rules regarding the handling of personal information:

(1) Clarification of the purpose of use

• We will clearly specify the purpose of use of personal information and use it only within the scope of the purpose.

(2) Restriction on use for purposes other than those specified

• Except where the principal has given prior consent or as otherwise provided for in the Act on the Protection of Personal Information and other relevant laws and regulations, we will not use personal information for purposes other than those specified, nor will we disclose personal information to third parties.

(3) Appropriate collection

• We will collect personal information only through lawful and fair means.

(4) Securing accuracy

• We make every effort to ensure that personal information is accurate and up-to-date.

(5) Security measures

• (i) We will appoint a responsible manager for each business operation that handles personal information.
  (ii) We implement security measures to prevent unauthorized access to personal information, as well as the loss, destruction, alteration, or leakage of personal information.
  (iii) We will establish rules and procedures regarding the handling of personal information, ensure that they are fully communicated within the Company, and provide guidance and supervision.
  (iv) When outsourcing the processing of personal information to a third party, we will properly select the contractor and provide guidance and supervision to ensure that the contractor manages personal information appropriately in the same manner as the Company.

(6) Access, correction, deletion, etc.

• We will respond to requests from individuals to access, correct, delete, or take other actions regarding their personal information in accordance with the provisions of the Act on the Protection of Personal Information and other applicable laws and regulations.

(7) Responding to inquiries

• We will also respond appropriately and promptly to any other inquiries from individuals regarding their own personal information.

3. Matters Subject to Disclosure Under the Act on the Protection of Personal Information

With regard to the personal information retained by our company, we hereby disclose the following matters in accordance with the Act on the Protection of Personal Information.

(1) Purposes of use

• The Company uses retained personal information on individuals only for the following purposes.
• (i) Ensuring the proper conduct our business, including the submission of notifications required by laws, regulations, and other applicable rules.
  (ii) Conducting recruitment activities.
  (iii) Compiling and analyzing personal information statistically and creating statistical data processed in a manner that does not allow individuals to be identified.
  (iv) Responding to inquiries, opinions, and requests received from individuals in relation to its business activities.
  (v) Contacting individuals in the event of an emergency or for other necessary purposes.
  (vi) Performing other activities incidental or related to the purposes described above. We may modify the purposes of use within a scope reasonably considered to be related to the foregoing purposes. In such case, we will notify the principal affected or publish the revised purpose of use on our website. If we use personal information beyond the scope necessary to achieve the foregoing purposes of use, we will do so only after obtaining the individual's consent.
  The Company may provide retained personal information on individuals to its contractors to the extent necessary for the performance of outsourced work. In such cases, we will exercise appropriate supervision over the contractors, including by entering into agreements regarding the handling of such personal information.

(2) Provision to third parties

• Except where we have obtained the individual's prior consent or where otherwise permitted under applicable laws and regulations relating to the protection of personal information, the Company does not provide personal data to third parties.

(3) Pseudonymized information and anonymized information

• When creating pseudonymized information and anonymized information, we will do so in compliance with applicable laws and regulations relating to the protection of personal information and related guidelines, etc., and will handle such information in an appropriate manner.

(4) Disclosure of personal data and notification of the purpose of use

• If a principal requests disclosure or notification of the purpose of use of their own personal information retained by the Company, we will respond within a reasonable period and scope after duly confirming that the requester is the principal.

(5) Corrections, additions, or deletions

• If a principal requests the correction, addition, or deletion of information relating to their own personal data retained by the Company, we will, after duly confirming that the requester is the principal, correct, add to, or delete the retained information within a reasonable period and scope if any part of the information is found to be inaccurate.

(6) Suspension of use and erasure

• If a principal requests the suspension of use or erasure of their own personal information retained by the Company, we will, after duly confirming that the requester is the principal, suspend the use of or erase such retained information within a reasonable period and scope. Please note that, as a result of such suspension of use or erasure, we may become unable to provide the services that you wish to receive. We appreciate your understanding and cooperation. (Please also note that we may not be able to comply with requests for the suspension of use or erasure of personal information that we are required to retain in accordance with applicable laws and regulations.)

(7) Action taken in cases of nondisclosure, etc.

• Please note that we will not be able to disclose, etc. personal information in the following specified cases. If we decide not to disclose, etc. personal information, we will notify the requester to that effect and provide the reason for the decision.
• [Cases where Disclosure, Etc., Procedures Are Not Initiated]
  (i) When we are unable to confirm that the requester is the principal.
  (ii) When a request is made by a proxy and the authority of agency of such proxy cannot be verified.
  (iii) When the required documents are incomplete.
  (iv) The prescribed fee has not been paid (applicable only to requests for access and notification of the purpose of use). (The required fee is payable by postage stamps equivalent to the sum of regular postage, registered mail, and mail requiring identity verification.)
• [Cases where Disclosure Is Not Granted]
  (i) The information for which notification is requested does not constitute “Retained Personal Information” or does not exist.
  (ii) When granting such notification would pose a risk of harming the life, physical well-being, property, or other rights and benefits of the principal or third parties.
  (iii) When disclosure would pose a risk of causing significant interference with the proper conducting of the Company’s business.
  (iv) When such disclosure would violate other laws and regulations.
  (v) When separate procedures for disclosure are specified in the provisions of other laws and regulations.
• [Cases where Notification of Purpose of Use is Not Provided]
  (i) When the information for which notification is requested does not fall under “Retained Personal Information.”
  (ii) When the purpose of use is clear.
  (iii) When such notification would pose a risk of harming the life, physical well-being, property, or other rights and benefits of the principals or third parties.
  (iv) When such notification would pose a risk of harming the Company’s rights or legitimate interests.
  (v) When we are required to cooperate with a national agency or a local public body in the performance of its affairs as specified in laws and regulations, and such notification would pose a risk of causing interference with the performance of such affairs.
• [Cases where Corrections, Additions, or Deletions Are Not Made]
  (i) When the information for which suspension of use or erasure is requested does not fall under “Retained Personal Information.”
  (ii) When the details of the “Retained Personal Information” are factual.
  (iii) When separate procedures for corrections, additions, or deletions are specified in the provisions of other laws and regulations.
  (iv) When corrections, additions, or deletions are not required in view of the purposes of use.
• [Cases where Suspension of Use or Erasure Are Not Carried Out]
  (i) When the information for which suspension of use or erasure is requested does not fall under “Retained Personal Information.”
  (ii) When the information is handled within the scope necessary to achieve a purpose of use specified in advance (including cases in which such handling exceeds the limit necessary to rectify an infringement).
  (iii) When the information has been obtained and used with means that are proper (including cases in which such handling exceeds the limit necessary to rectify an infringement).
  (iv) When suspension of use or erasure is difficult due to the substantial costs involved or other difficulties, and alternative measures necessary to protect the rights and interests of the principal are taken.
• [Cases where Provision to Third Parties is Not Suspended]
  (i) When the information for which suspension of provision to third parties is requested does not fall under “Retained Personal Information.”
  (ii) When the information for which suspension of provision to third parties is requested is being provided with the prior consent of the principal.
  (iii) When the information for which suspension of provision to third parties is requested is provided pursuant to laws and regulations.
  (iv) When the provision of personal information to a third party is necessary for the protection of the life, physical well-being, or property of an individual, and it is difficult to obtain consent for such provision from the principal.
  (v) When the provision of personal information to a third party is necessary to improve public health or promote the sound development of children, and it is difficult to obtain consent for such provision from the principal.
  (vi) When we are required to cooperate with a national agency, a local public body, or a contractor thereof in the performance of its affairs as specified in laws and regulations by providing personal information to a third party, and obtaining the consent of the principal would pose a risk of causing interference with the performance of such affairs.
  (vii) When the third party is an academic research institution, etc., and it is necessary for that third party to handle the relevant personal information for academic research purposes (excluding cases where there is a risk of unreasonable infringement on the rights and interests of individual customers, etc.).
  (viii) When suspension of provision to third parties is difficult due to the substantial costs involved or other difficulties, and alternative measures necessary to protect the rights and interests of the principal are taken.

(8) Contact information for inquiries or complaints regarding personal information

• General Affairs Department, Corporate Management Office
  * Please note that we may not be able to respond outside of our normal business hours, including weekends and public holidays.

(9) How to submit your request for disclosure, etc.

• (i) Upon receiving your inquiry through the above contact number, we will send you the appropriate request form by mail. Please note that we are not able to accept your request if you come to our office directly.
  (ii) Please send the completed application form, documents verifying the identity of the customer, and postage stamps equivalent to the prescribed fee to the address to which the application form should be sent.
  (iii) The disclosure procedure will be initiated when we have received all documents, etc. submitted in association with a request for disclosure, etc., upon their arrival at the address specified by us as the address to which the application form should be sent. If you do not submit the set of documents required for disclosure within 3 months, we will send the set of application documents, etc. that we have received up to that point back to you.
  Please note that we cannot accept requests submitted by any method other than that described above.
  (iv) The mailing address is as follows: