• Personal Information Protection Policy
• Handling of Personal Information

Personal Information Protection Policy

BOT Lease Co., Ltd. ("the Company") as a member of MUFG Group, aims to contribute to the prosperity of customers in Japan and overseas as well as to create social and economic corporate value through the provision of integrated financial services by valuing integrity and responsibility.
Under this corporate vision, the Company believes it is our social responsibility to handle customers' personal information including individual numbers and specific personal information (hereinafter collectively referred to as "Specific Personal Information, etc.") properly. The following is our Personal Information Protection Policy. We intend to do our best to protect our customers' personal information and Specific Personal Information, etc. by ensuring that every executive and employee complies with this Policy.

• 1.
  The Company will comply with laws and regulations regarding the proper handling of customers' personal information and Specific Personal Information, etc.
• 2.
  The Company will acquire personal information and Specific Personal Information, etc. properly.In addition, when receiving personal information from a third party, we will confirm the background of the acquisition of such personal data by the third party in accordance with laws and regulations and retain such records for a certain period of time.If it is unable to confirm that we have acquired the information legally, we will refrain from acquiring the information.
• 3.
  The Company will notify and/or disclose the purpose of such personal information to customers and will not use it beyond the disclosed purpose except as permitted by law.In particular, we will use Specific Personal Information, etc. only within the purpose decided by law.
• 4.
  The Company will educate all of its officers and employees so that they understand the importance of protecting personal information and Specific Personal Information, etc., and handle customers' personal information and Specific Personal Information, etc. properly.
• 5.
  The Company will take necessary and appropriate measures to ensure the security of personal information and Specific Personal Information, etc., and will endeavor to prevent improper access to, alteration, loss and/or leakage of personal information.
• 6.
  The Company will not supply any personal information to third parties without the prior consent of the individual concerned, except as permitted by law.In addition, we will not supply Specific Personal Information, etc. to third parties, except as permitted by law.
• 7.
  When outsourcing the handling of personal information and Specific Personal Information, etc. to other institutions, the Company will monitor the institutions concerned to ensure that appropriate measures are taken to protect customers' personal information and Specific Personal Information, etc.
• 8.
  The Company will establish procedures for correcting and disclosing personal information and Specific Personal Information, etc. The Company is also willing to receive opinions and inquiries regarding the handling of personal information and Specific Personal Information, etc.
• 9.
  The Company will continually review and improve its management systems to protect personal information and Specific Personal Information, etc.

BOT Lease Co., Ltd.

Handling of Personal Information

BOT Lease Co., Ltd. (hereinafter referred to as "the Company") pays the utmost attention to the handling of Personal Information, Individual Number, and Specific Personal Information of our customers based on the Personal Information Protection Policy, in order to enable customers to use our services with assurance.

"Personal Information" means information concerning a living person, and information applicable to any of the following:

• (1)
  Information that is able to identify a specific individual by name, date of birth or other description contained in the information
• (2)
  Information that includes an individual identification code

"Individual Number" means the number that is obtained by converting the resident certificate codes and is designated to identify individuals. (It is so-called "My Number")

"Specific Personal Information" means Personal Information that includes the above "Individual Number" contained in the information.
("Specific Personal Information, etc." means the collective term for above mentioned "Individual Number" and " Specific Personal Information".)

The handling of these Personal Information, Individual Number, and Specific Personal Information in the Company is publicly announced below.

1. Purpose of Utilization of Personal Information

The Company will handle the Personal Information within the scope necessary to achieve the purposes of (2) below in the business (1) below.
If the Company directly acquires Personal Information concerning a customer that has been recorded in a written document, etc. from the customer in conjunction with signed agreements with the customer, the Company will specify the purpose for which it will be used beforehand (except when it is prescribed that there is no requirement in laws and regulations). In the event of obtaining Personal Information directly in other method, and indirectly from a public information or a person other than the customer in question, the Company will also use Personal Information within the scope necessary to achieve the purposes of (2) below in the business (1) below.
In addition, the Company will specifically define the purposes of utilization to ensure that they are clear to our customers. For example, when responding to various questionnaires, we will use the questionnaire only for aggregation purposes. Thus, we will strive to limit the purpose of utilization in accordance with the situation in which the information is acquired.

(1) The Company's business

• ①
  Lease, sales, import and export and intermediary business of property
• ②
  Lease, sales, import and export of buildings, equipment attached to building such as electric equipment, plumbing equipment or others, equipment for an outdoor athletic ground or indoor playroom, electrical generator or facilities for energy supply business
• ③
  Lease and sales of intangible property rights such as patent right, utility model right, design right, trademark right or others
• ④
  Financial services such as lending, credit guarantee and purchase and its intermediary, brokerage, agency services, administrative agency or other services of receivable, note receivable or other receivable or properties
• ⑤
  Sales and its intermediary, brokerage or agency services of negotiable deposit and yen-based bank notes or drafts
• ⑥
  Type II Financial Instruments Business
• ⑦
  Any other business incidental or related to the foregoing items

(2) Purpose of Utilization

• ①
  To receive applications for various financial products and services
• ②
  To identify a person in question in accordance with the Act on Prevention of Transfer of Criminal Proceeds and check eligibility for the use of financial products or services.
• ③
  To manage dates in various financial transactions and others in continued transactions
• ④
  To judge availability of applications for lease , etc. or ongoing use of services
• ⑤
  To judge validity in the provision of financial products or services, such as judgement under the principles of suitability and others.
• ⑥
  To provide Personal Information with a third party within the necessary range for the appropriate implementation of business, e.g. providing Personal Information with the Member Designated Credit Bureau in the credit business
• ⑦
  To implement outsourced business appropriately when other business operators or others outsource all or part of Personal Information processing
• ⑧
  To exercise the rights or perform the obligations under contracts with customers or laws
• ⑨
  To carry out the research or development of financial products or services through market research, data analysis or questionnaires
• ⑩
  To make suggestions about financial products or services, e.g. announcement by direct mail, etc.
• ⑪
  To make suggestions about the products or services of partner companies and others
• ⑫
  For the cancellation of transactions or follow-up after the cancellation of transactions
• ⑬
  To provide to a third party within the scope necessary for assignment of claims (including prior consideration)
• ⑭
  For various management necessary for debt control and debt collection, etc.
• ⑮
  Other purposes for the appropriate and efficient performance of transactions with customers

In addition, the Company will use the customer's Specific Personal Information within the scope necessary to achieve the purposes of Specific Personal Information, etc. as described in (3) below.
When directly acquiring Specific Personal Information, etc., concerning a customer that has been recorded in a written document, etc. from the customer, the Company will specify the purpose for which it will be utilized beforehand (except when it is prescribed that there is no requirement in laws and regulations). When acquiring Specific Personal Information, etc. directly in other method, or indirectly from a person other than the customer in question, the Company will also use Specific Personal Information, etc. within the scope necessary to achieve the purposes below.
In accordance with the provisions of the "Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures," the Company will not acquire, use, or provide Specific Personal Information, etc. with a third party for purposes other than those permitted by the said Act.

(3) Purposes of utilization of Specific Personal Information, etc.

• ①
  For preparation of the statutory documents related to the Company business stipulated in (1) above
• ②
  For preparation of payment records in accordance with legal requirements
• ③
  For other clerical work related to ① and ②

2. Adequate acquisition of Personal Information

The Company will appropriately acquire Personal Information, Specific Personal Information, etc. of customers.For example, the Company may acquire Personal Information from the following kinds of information sources.

Examples of information sources for acquisition

• ①
  Information directly entered and provided by customers in documents, including new applications for leases, etc. (The submission of application forms, etc., by the customer)
• ②
  In the case where Personal Information is provided by a third party such as a joint user as described in 8. below or a personal credit information bureau.

In addition, Specific Personal Information, etc. may be obtained from the following sources.

Examples of information sources for acquisition

• ①
  In the event where information is directly provided through documents such as new lease transaction application forms filled out and submitted by customers

The Company will acquire Personal Information and Specific Personal Information, etc. in an appropriate manner. In addition, when receiving Personal Information from a third party, we will confirm "the background of the acquisition" of such personal data by the third party in accordance with laws and regulations and retain such records for a certain period of time. In the event where it is unable to confirm that we have acquired the information legally, we will refrain from acquiring the information.

3. Cessation of Direct Mail, etc.

As mentioned below, with regard to solicitation through the sending of direct mail and phone calls, etc. relating to sales of products and services by the Company, when we have received a request to cease such activities from customers, we will take measures to stop subsequent utilization and provision for such purposes without delay.

(1) What can be ceased

Marketing information through the sending of the promotional materials and printed matter, etc. from the Company and our business partners

(2) Procedure for cessation

Please contact our head office, branch or the contacts mentioned below.

4. Implementation of Security Control Measures

The Company will manage customers' Personal Information and Specific Personal Information, etc. appropriately by establishing and implementing necessary and appropriate institutional, human, technological and physical security control measures to prevent improper access to Personal Information as well as the loss, alteration or leakage, etc. of Personal Information and Specific Personal Information, etc.

Specifically, we are implementing the following security control measures.

• ①
  Development of internal disciplines
  In order to ensure the appropriate handling of personal data, we have formulated a basic policy regarding "compliance with relevant laws and regulations", as well as "contact points for inquiries, complaints, and consultations".
  We have established rules for handling Personal Information at each stage of acquisition, utilization, provision, and disposal, and regularly review the rules.
• ②
  Institutional security control measures
  We have appointed a person in charge of the handling of Personal Information, and have clarified the employees and scope of the handling of personal data.
  We conduct regular self-inspections and audits of other departments with regard to the handling of Personal Information.
• ③
  Human security control measures
  We conduct regularly training on Personal Information protection and information security for employees. Also matters related to confidentiality of employees are stipulated in the Rules of Employment.
• ④
  Physical security control measures
  In areas where personal data is handled, employees are controlled to enter and leave the office, and measures are taken to prevent unauthorized employees from viewing personal data.
• ⑤
  Technological security control measures
  In addition to limiting the scope of handling Personal Information databases, etc. by implementing access control, a system to protect against external access and illegal software has been introduced.
• ⑥
  Identification of the external environment
  We will handle personal data in compliance with Japanese laws and regulations. When handling personal data in foreign countries, including the Company's overseas subsidiaries, we will implement appropriate security control measures after understanding Personal Information protection systems in each country.

5. Outsourcing the Handling of Personal Information

When the Company outsources the handling of Personal Information and Specific Personal Information, etc., we will conduct necessary and appropriate supervision of the subcontractor to ensure the security control of the Personal Information and Specific Personal Information.
For example, the Company outsources the handling of personal data in the following cases.

Example of administration to be outsourced

• ①
  Administration pertaining to the dispatch of various invoices, notices, etc.
• ②
  Operations with respect to the operation and maintenance of information systems

6. Procedures to request disclosures of retained personal data, etc.

If we receive a request from a customer for "notification of the purposes of utilization", "disclosure", or "correction/addition/deletion of details", "suspension of utilization, erasure, or discontinuation of provision to a third party", and "disclosure of the record of provision to a third party" (hereinafter referred to as "Disclosure, etc.") in relation to personal data of the customer, we will respond to this request in accordance with the following procedure without delay, except as permitted by law, etc., after the Company has identified the principal or his/ her representative.

(1) Items of retained personal data subject to disclosure request procedures

• ①
  Basic information such as name, address, phone number, and date of birth, etc.
• ②
  Information on the type, balance, and history of transactions

(2) Applicant

• ①
  Customer himself/herself
• ②
  A person who has been entrusted the letter requesting disclosure, etc. by the customer himself/herself
  (appointed representative)
• ③
  A legal representative of the customer when the customer is a minor or an adult ward

(3) Documents required for a request

• ①
  Request for Disclosure of Retained Personal Data
  (Please ask the Company's contact point for this request form.)
• ②
  Materials for personal verification documents
  One of the official documents with a facial photograph (driver's license, passport, My Number card (surface), residence card, special permanent resident certificate, etc.)Two certificates without a facial photograph (health insurance certificate, pension book, copy of resident certificate, etc.)."
  (In the case of a request by a representative, please contact the contact desk described in Section 7 below.)

(4) Disclosure fees

In the event of a request for disclosure in writing by post or otherwise, we will accept a fee of 1,000 yen (incl. tax) at the time of accepting the request.

(5) Response to disclosure request

Responses shall be made to the applicant in accordance with the method requested in the request form. Please be advised that we may respond directly to the customer even if the request is made by a legal representative.
If we find it difficult to respond by the requested method, please be advised that you may be notified in advance and replied in writing via restricted delivery mail.
Furthermore, please understand that we may not be able to comply with disclosure requests in the following cases. If we decide not to disclose, we will notify you of this decision along with the reasons.

• ①
  In the case where the customer concerned can not be verified
• ②
  In the case where the authority of proxy cannot be confirmed at the time of request by a legal representative
• ③
  In the case of any defect in the contents of the request form
• ④
  In the case of non-payment of the fee
• ⑤
  In the case where the requested Personal Information for disclosure is not applicable to retained personal data
• ⑥
  In the case of information that can harm the life, body, or property of the principal or a third party
• ⑦
  In the case where there is a risk of significant disruption to our business operations
• ⑧
  In the case of a violation of any other law

7. Contact point for inquiries, complaints, consultations, etc.

Please contact the division/branch for inquiries, complaints, or inquiries about Personal Information or Specific Personal Information, such as the disclosure of retained personal data.If you have any questions, please contact the following contact point.

• Legal & Compliance Division: 03-3537-8038
  (Reception hours: 9:00 - 17:30 on our business day)

8. Joint use of personal data (excluding Specific Personal Information, etc.)

In order to meet the diverse expectations of customers, the Company may jointly use the Personal Information of customers with the group companies (domestic group companies and overseas subsidiaries listed in the "Group companies" and "Overseas subsidiaries" on the Company website) as joint users according to the following:

(1) Items of personal data to be jointly used

• ①
  Attribute information such as name, gender, address, date of birth, telephone number, e-mail address, and occupation
• ②
  Information on transactions with the Company and transaction record with group companies such as transaction amount, and balance, etc.

(2) Purpose of Utilization by joint users

Joint users will use it to the extent necessary to achieve the purpose of utilization of aforementioned in Section 1.
(However, Specific Personal Information, etc. shall not be jointly used with other companies.)

(3) The name of the entity with responsibility for the management of personal data

2-27-1 Shinkawa Chuo-ku, Tokyo, Japan
BOT Lease Co., Ltd.

Personal information of customers (business card information, etc.) received prior to December 2022 may be jointly used with the joint users in accordance with the above. If you have any objections to this joint utilization, please contact "7. Contacts point for inquiries, complaints, consultations, etc.".

9. Provision, Registration, and Utilization of Personal Information to Personal Credit Information Bureau (Excluding Specific Personal Information etc.)

• (1)
  When the Company closes a contract with a customer or receives an application for a contract from a customer, we obtain the consent of the customer to provide, register, or use Personal Information to a personal credit information bureau as follows.
  • ①
    When personal credit information of customers (including information registered by the personal credit information bureau to which the Company is a member (hereinafter referred to as the "member organization") and the credit information organization cooperating with the member organization (hereinafter referred to as the "partner organization"), information on public records such as bankruptcy procedures, information on telephone directories, and other information independently collected and registered by such organizations, and information requested to be registered by Japan Financial Services Association) is registered with the member organization and the partner organization, we will obtain and utilize the information for the purpose of obtaining such Personal Information and investigating repayment or solvency.
  • ②
    The provision of the information to the member organization, including the customer's Personal Information (information to identify the customer (name, date of birth, address, etc.), information pertaining to the application (information on the application date and type of product applied for, etc.), information pertaining to the contract (type of contract, date of contract, contract amount, etc.), information pertaining to the status of repayment (date of deposit, scheduled payment date, balance, completion date delinquency, elimination of delinquency, etc.), and information pertaining to the facts of transaction (debt collection, debt arrangement, performance of guarantee, compulsory cancellation, bankruptcy filing, assignment of claims, etc.).) Hereinafter referred to as the "Personal Information of this matter".
  • ③
    The period of the registration of the Personal Information of this matter by the member organization are as follows:The information to identify the customer: The period during which any of the information regarding the application, contract details, repayment status, or transaction facts is registered.The information regarding the application: The period within six months from the date of inquiryThe information regarding contract details and repayment status: During the contract period and the period within five years from the termination date of the contractThe information related to transaction facts: During the contract period and the period within five years from the termination date of the contract (However, for the information on the assignment of receivables, the period is one year from the date of the occurrence of the relevant event.)"
  • ④
    The provision by the partner organization of the Personal Information of this matter to the partner organizations, the member organization and the members of the partner organization. The member organization and the members of the partner organization shall use personal credit information of customers only for the purpose of investigating repayment or ability to pay.
• (2)
  Following are the member organization and the partner organization and their contact information.

  Member organization

  Japan Credit Information Reference Center Corp .
  (TEL 0570-055-955)

  Partner organization

  Japanese Bankers Association/Personal Credit Information Center Japan Bank
  (TEL 03-3214-5020)
  Credit Information Center CORP.
  (TEL 0570-666-414)

• (3)
  Please contact us directly, as the Company cannot disclose personal credit information registered with the member organization and the partner organization.

10. Others: Provision of Personal Information to a third party and utilization of Personal Information (excluding Specific Personal Information, etc.)

Unless otherwise provided by law, the Company will not provide personal data to any third party without obtaining the prior consent of the principal.
When providing personal data to a third party in a foreign country, the Company will provide such information to the relevant third party in accordance with laws and regulations. Information that can be retrospectively identified about the third party will be provided upon request of the principal.

January 1, 2023
BOT Lease Co., Ltd.