EU Personal Data Protection Policy

Mitsubishi Kakoki Kaisha, Ltd. ("the Company") and our group including our affiliates recognizes the importance of protecting customers' personal data, defines this policy for EU personal data protection for handling personal data provided or disclosed to the Company through our business activities, and addresses this task in compliance with the EU General Data Protection Regulation ("GDPR").
The personal data subject to this policy is the personal data in the European Economic Space.

Our group will collect and handle personal data on the Customer, etc. only when it is required to provide appropriate products and services to the customers, business associates, and employees of our group ("the Customer, etc.") through our business operations. The purposes of using the personal data shall be as outlined below.
In addition, with consent from the person concerned, our group may provide personal data to a third party, or consign the handling and enable shared use of the information between our group and a third party, within the scope required to achieve the purpose of usage.

1. To consider and accept applications for opening a new account, to undergo formalities for entering into a contract between the Customer, etc. and our group, and for referencing and confirmation in connection with the foregoing;
2. To propose products and services of our group to the Customer, etc.;
3. To enable our group to respond to inquiries from the Customer, etc.;
4. To enable our group to confirm and inquire about products and services provided by the Customer, etc.;
5. To investigate the satisfaction of the Customer, etc.
6. To compile statistical information for product development and service improvement of our group;
7. To confirm application and/or participation in exhibitions, seminars, etc. held by our group, issue thank-you letters, and make reports on such events;
8. To identify visitors to our group;
9. To communicate with journalists, analysts, etc. during public relations activities of our group;
10. To identify the stockholders of our group, fill out paperwork for them, perform procedures and issue invitations to them;
11. To accept applications for job opportunities offered by our group, communicate with job applicants, notify them of decisions, and so forth;
12. To enable our group to give notices to its retired employees, and communicate with its board directors and employees themselves as well as their family members;
13. To accomplish the business entrusted to our group;
14. To comply with laws and regulations such as administrative guidance and transmittal;
15. To perform business activities incidental and related to the foregoing; and
16. For the purposes of usage defined at the time of obtaining the personal data, or those agreed upon thereafter.

If we have received from the Customer etc. consent to the handling of personal data, or in case of any of the following items, our group will handle the personal data accordingly:

Our group will take organizational, personal, physical, and technological safety and security measures to manage the personal data of Customer, etc. properly.

After storing the personal data of the Customer, etc. for the storage period specified by laws and regulations or business procedures, we will delete and destroy the personal data properly.

The Customer, etc. and business associates are entitled to the following rights with respect to the personal data collected and handled by our group.
Moreover, the Customer, etc. and business associates can cancel their agreement on the handling of personal data at any time. However, the cancellation of such agreement has no impact on the legality of the handling of personal data based on the agreement prior to the cancellation.