Japan Institute for Overseas Investment
Policy for the Protection of Specific Personal Information and Personal Information (Privacy Policy)

Part I. Basic Policy for the Protection of Personal Information, etc.

The Japan Institute for Overseas Investment (the “Institute”) sets forth this basic policy in order to ensure the proper processing of personal information and specific personal information (collectively, “Personal Information, etc.”) to be processed by the Institute, in accordance with the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (the “Numbers Act”), the Act on the Protection of Personal Information (the “APPI”), and other relevant laws and regulations, as well as with the guidelines developed and published by the Personal Information Protection Commission (the “Guidelines”).

1. Legal Compliance
   The Institute will comply with applicable Law (Note) regarding the proper processing of Personal Information, etc.
   (Note) The term “Law” includes the following:
   – The Numbers Act
   – The APPI and all other relevant laws and regulations
   – The Guidelines
2. Security Control Action
   The Institute will take security control action necessary and appropriate for the prevention of leakage and loss of, and damage to, Personal Information, etc. and for any other security control of Personal Information, etc.
3. Proper Acquisition, Storage, Use, and Disposal; Prohibition of Use for Unintended Purpose
   The Institute will properly acquire, store, use, and provide Personal Information, etc. pursuant to applicable Law and to the extent necessary to achieve the intended purpose of the Personal Information that has been notified in advance to the specific individual identifiable by the Personal Information (the “Data Subject”) or that has been published in advance. The Institute will promptly dispose of Personal Information, etc. that is no longer necessary for the Institute. The Institute will take action to prevent using Personal Information, etc. for the other purposes than for intended purpose.
4. Contracting out and Subcontracting
   Where the Institute contracts out all or part of its affairs involving the processing of Personal Information, etc., the Institute will provide necessary and appropriate supervision to the contractor (including its subcontractors) to ensure that the contractor will take action equivalent to the security control action required by Law to be taken by the Institute.
5. Continuous Improvement
   The Institute will strive to improve its processing of Personal Information, etc. by continuously reviewing such processing.

Part II. Policy for the Protection of Personal Information, etc.

1. Acquisition, Use, Storage, Disposal, etc.
   The Institute will acquire Personal Information, etc. by legal and proper means pursuant to applicable Law and to the extent necessary to achieve the intended purpose.
   The Institute will not use Personal Information, etc. in any manner that may encourage or induce illegal or improper activities.
   The Institute will promptly dispose of Personal Information, etc. that is no longer necessary for the Institute.
2. Intended Purpose
   The Institute will use personal information (excluding specific personal information) for the following purposes. The Institute will not use personal information (excluding specific personal information) beyond the scope of the following purposes without the consent of the Data Subject, unless permitted by Law or unless the intended purpose has been separately published or notified.
   1. Handling services requested of the Institute.
   2. Collecting and analyzing information on direct overseas investment, etc.
   3. Sending the Institute’s publications, etc.
   4. Providing information on, and running, lectures, seminars, workshops, and other events.
   5. Paying honoraria to lectures, authors, etc. and executing related administrative affairs.
   6. Providing information on recruitment of members and managing members.
   7. Responding to various inquiries, etc.
   8. Sending administrative communications regarding hiring, conducting selection process, making decisions on whether or not to hire applicants, and providing personnel management, training, etc. to personnel after hiring.
   9. Any other purpose incidental to any of the above.
      The Institute will use specific personal information solely to the extent specified in the Numbers Act.
3. Contracting out and Subcontracting of Services
   The Institute may contract out all or part of a service and may provide the contractor of the service with Personal Information, etc. to the extent necessary to achieve the intended purpose set forth in section 2 above. Where the Institute contracts out all or part of its affairs involving the processing of personal information the Institute will provide necessary and appropriate supervision to the contractor (including its subcontractors) to ensure that the contractor will take action equivalent to the security control action required by Law to be taken by the Institute.
4. Provision to Third Parties
   The Institute may provide personal information (excluding specific personal information) to the Institute’s joint organizers, sponsors or lecturers of lectures and seminars organized by the Institute, provided that if any joint organizer, sponsor or lecturer of a seminar is a foreign company or an overseas resident, the Institute is subject to the provisions of section 5, “Transfer Abroad.” The Institute will not otherwise provide personal information (excluding specific personal information) to any third parties without the prior consent of the Data Subject, unless required or permitted by Law. The Institute will not provide personal information (excluding specific personal information) to any third parties by using a so-called opt-out method.
   Where the Institute provides personal information (excluding specific personal information) to contract out a service or as a result of a business succession caused by a merger, company split, business transfer or other reason, or as joint utilization of personal information (excluding specific personal information), such provision does not constitute the provision of such personal information (excluding specific personal information) to third parties as referred to herein.
   The Institute will not provide specific personal information to the Data Subject or any third parties unless required or permitted by the Numbers Act.
5. Provision to a Third Party in a Foreign Country
   The Institute may, with the consent of a Data Subject, provide his/her personal information (excluding specific personal information) to third parties located in foreign countries, including embassies, foreign companies, and overseas residents.
   In terms of foreign personal data protection laws and regulations, please see the following link.
6. Security Control Action
   The Institute takes the following security control actions for the protection of Personal Information, etc. in order to prevent leakage and loss of, and damage to, Personal Information, etc. and to otherwise manage Personal Information, etc. appropriately.
   1. The Institute has appointed managers to process Personal Information, etc. and has clarified the responsibilities of the managers.
   2. The Institute provides regular training to its full-time Executive Directors and staff members on points to note regarding the processing of Personal Information, etc., and has incorporated provisions concerning the confidentiality and processing of Personal Information, etc. in the Institute’s rules and forms of pledge.
   3. The Institute keeps documents, etc. containing Personal Information, etc. under lock and key.
   4. The Institute restricts the personnel who process Personal Information, etc. and limits the scope of Personal Information processed by them by implementing access control. The Institute receives support from security experts.
7. Disclosure and Correction of, and Suspension of Use of, Personal Information, etc.
   Where the Institute receives from a Data Subject a demand or request under Law for disclosure, correction, addition or deletion of, or suspension of use of, or erasure of, or suspension of provision to third parties of, or notification of the intended purpose of, his/her Personal Information, etc. in the possession of the Institute, the Institute will respond to the demand pursuant to applicable Law after checking that the demand was made by the Data Subject. For further details, please contact the Contact Point for Inquiries specified in section 8.
8. Inquiries
   Please address all requests for consultation, complaints, etc. regarding the processing of Personal Information, etc. by the Institute to the following Contact Point for Inquiries (not available on the Institute’s prescribed holidays).
   (Contact Point for Inquiries)
   General Affairs Department, Japan Institute for Overseas Investment
   Kudan-Kita 2-Chome Bldg., 3-6, Kudan-Kita 2-chome, Chiyoda-ku, Tokyo 102-0073
   Telephone: 03-5210-3311 (main number)
9. Amendment of This Policy

The Institute may amend this basic policy and this policy for the processing of Personal Information where necessary.

Japan Institute for Overseas Investment
Kudan-Kita 2-Chome Bldg., 3-6, Kudan-Kita 2-chome, Chiyoda-ku, Tokyo 102-0073

Established on November 1, 2022