Personal Information Protection Regulations

In view of the nature and use of Clients’ Personal Information in the financial sector, MJI Enterprise Co., Ltd. (The Company) shall treat Clients’ Personal Information as follows:

Definition

“Clients’ Personal Information.” means information in MJI about a living individual that can identify a specific individual. And it includes all information in MJI related clients.

• “Clients’ Personal Information” does not include only information about facts such as name, gender, date of birth, address, age, occupation, relationship, and so on, but also any information implicating judgment and evaluation regarding individual’s body, property, title and so on, and information which is disclosed by publications, which includes videos and audios. If this information can be used to identify a specific individual together with other information and the related information with it, such as name, it becomes “Clients’ Personal Information”.
• Information on corporations and other organizations, such as company names, does not fall under “Clients’ Personal Information”.

Clients’ Personal Information includes the data downloaded from the Company’s software and any media and exported data on paper.

Purpose of Use of Clients’ Personal Information

The Company shall set the expectation to the clients as much as possible so that clients reasonably anticipate for what the purpose of use of Clients’ Personal Information.

The purpose of the utilization of Clients’ Personal Information are as follows:

• Deposits to The Company
• The Company’s credit decision and exposure management
• Development of financial products of The Company, its affiliates, and partner companies
• Market research for financial products in The Company
• Development and research of services in The Company
• Confirmation of eligibility and identification when clients of The Company purchase its services

When The Company acquires Clients’ Personal Information for its credit business, it shall obtain the consent of the client regarding the purpose of the utilization of Clients’ Personal Information. And the purpose of utilization in the contract, etc. shall be clearly stipulated separately from other contract provisions.

The Company shall not change the purpose of the utilization of Clients’ Personal Information which extends to exceed the scope that clients can assume reasonably before the change. In the event of any changes beyond this scope of the utilization, The Company shall obtain the prior written consent of the Client.

Acquisition of Clients’ Personal Information, etc.

The Company shall not acquire Clients’ Personal Information by illegal or other improper means. In addition, when acquiring Clients’ Personal Information from a third party, the Company shall not acquire the information from a third party that has committed illegal acts and after knowing that the information leaked from other bodies.

When The Company acquires Clients’ Personal Information which is written and described in a contract or other document which is related to the contract by clients, The Company shall clearly indicate the purpose of utilization to the clients in advance.

• At the credit business operation, when The Company obtains the consent of the client for the purpose of utilization of Clients’ Personal Information, The Company does not need to “notify or announce” to the clients at the time of using them.
• To the extent necessary, The Company shall store Personal Data accurately and up-to-date and retain it for a certain period. This period shall be determined in accordance with the purpose of use of Personal Data and shall be deleted after the expiration of this period.

The purpose of the utilization of Personal Data is limited to as below:

• Deposits to The Company
• The Company’s credit decision and exposure management
• Development of financial products of the Company, its affiliates, and partner companies
• Market research of financial products in The Company
• Development and research of services
  Specific financial instruments
• Confirmation of eligibility and identification when client purchases The Company’s services

Establishment of an internal system for Clients’ Personal Information.

To prevent the leakage, loss, or damage of Personal Data obtained by The Company and to manage Personal Data accurately and safely, The Company shall take the necessary and appropriate measures based on “Management of Client’s personal information” which stipulations are related to as below:

• The secure management of Personal Data
• Monitoring and auditing of the management of Personal Data
• Outsourcing of Personal Data management
• Acquiring Clients’ Personal Information etc.,
• The Usage of Clients’ Personal Information
• The Storage of Clients’ Personal Information etc.,
• The Transport and Transfer Stages of Clients’ Personal Information etc.,
• The deleting and Disposal Stages Clients’ Personal Information etc.,
• Prevention and reaction to leakage, loss, and theft of Clients’ Personal Information etc.,

“Organizational Security Control Measures”

• Security Control Measures for Clients’ Personal Information, such as defining the responsibilities and authorization of employees who can deal and manage with Clients’ Personal Information, and monitoring and audits of internal rule on Clients’ Personal Information, are as follows;
  • Appointment of a responsible person for the management of Clients’ Personal Information
  • Compliance for the security and controlling measures on Clients’ Personal Information based on the employee contract
  • Operation in accordance with the regulations concerning the security management of Clients’ Personal Information
  • Establishment of means to confirm the management status of Personal Data
  • Monitoring and audit of Clients’ Personal Information by IT Department.
  • Prevention and response to leaks, loss, and theft of Clients’ Personal Information

“Human security management measures”

• The Company shall provide employees trainings on Personal Information Protection.
• The execution of non-disclosure agreements and/or contract to protect and manage Personal Information Protection safely between The Company and employees.
• The Company shall clarify the roles and responsibilities of employees on management of Personal Information Protection.
• Employee in The Company shall confirm the compliance with Personal Information Protection and Management of Client’s personal information management procedures

“Technical Security Control Measures”

• The Company shall implement technical measures related to secure Personal Information Protection as below.
  • Identification and authorization of users of Clients’ Personal Information
  • Measures to prevent to leakage, loss, and theft of Clients’ Personal Information.
  • Logging and analysis of access to Clients’ Personal Information
  • Monitoring and auditing of information systems contains Clients’ Personal Information

The training for Employees

The Company shall establish an appropriate internal control system to ensure the security management of personal data, and shall exercise necessary and appropriate supervision over Employees

• “Employee” means a person who is engaged in the business of The Company and is directly or indirectly supervised by The Company based on the employee contract.

The Company shall conduct supervise Employees appropriately through the implementation of the following systems, etc.

• To prevent Employees from taking out Client’s Personal Information, Employee shall confirm the compliance with the internal security control measures, and the Company shall establish an inspection and audit system for the protection of Clients’ Personal Information.

Provision of Clients’ Personal Information to Third Parties

The Company shall not provide Clients’ Personal Information to third parties without obtaining the prior consent of the clients.

When obtaining consent from a client for provision to a third party, in principle, the consent shall be obtained in writing about (1) providing Clients’ Personal Information to the third party, (2) the purpose of use by the third party, and (3) the content of the information to be provided to the third party based on client’s clear understanding about the consent.

The Company shall show the purpose of utilization of Clients’ Personal Information where clients can know it easily.

• The situation of “where clients can know it easily” refers to a state in which clients can know if they want to know, for example, by posting on Facebook of The Company, or by posting and always installing at the window of a branch, etc

Disclosure of Clients’ Personal Information

When a client requests the Company to disclose Clients’ Personal Information that identifies the Client, The Company shall disclose the Clients’ Personal Information to the Client in written without delay.

When the Company receives a complaint from a client regarding Clients’ Personal Information, The Company shall investigate the content and make efforts to process it appropriately and promptly within a reasonable period.

The Company shall establish the necessary systems for appropriate and prompt reaction to complaints, such as the establishment of a complaint reception desk, and education and training for employees who proceed complaints.

The Company shall upload the stipulation of the Clients’ Personal Information Protection to The Company’s FaceBook page.

Exemptions

Following cases may exclude the application to above-mentioned article.

• Requirement based on laws and regulations
• For the protection of the life, body, or property of a person (including the property of legal entities)
• For necessary for improving public health or promoting the sound development of children.

---

Investor’s information protection

MJI Enterprise Co., Ltd. (“The Company”) makes the best effort to protect the investor’s information in accordance with relevant laws and regulations to improve management quality.

1. Purpose of Use of Investors Information
   1. The Company may use investors information only to the extent necessary to achieve the following purposes of use and may not use for any other purpose.
      1. Exercise of rights and fulfillment of obligations based on laws and regulations
      2. Submission of information from the Company to investors
      3. Implementation of various measures to facilitate the relationship between investors and the Company.
      4. Accurate management of investors information, such as the creation of investor data based on related laws and regulations.
   2. Notwithstanding the above, The Company may use the investor’s personal information only for the preparation of payment records for dividends, distributions of surplus and send periodical financial, operational and social reports of The Company and shall not use it for any other purpose even if there is consent from investors.
2. Types of investors information acquired and stored
   • The investor’s information acquired and stored by The Company shall be used to achieve the purpose of use set forth above.
3. How to acquire investors information
   • The Company shall acquire investor’s information in an appropriate manner based on related laws and regulations
4. Submission of investors information
   The Company shall not provide investor’s information to external parties except in the following cases:
   1. When the investor gives consent
   2. Cases based on laws and regulations
   3. When outsourcing a part of business within the scope that is necessary to achieve the purpose of use
5. Protection and Management of Investor’s Information
   • The Company shall keep the investors information in appropriate manner and protect the investor’s information. And it shall take organizational security control measures, human safety control measures, physical security control measures and technical safety control measures for investors information and review them as appropriate and periodically. Further, the persons in The Company who can deal and manage investor’s information are limited to Managers and equivalent positions as Manager class.
6. Request for disclosure, correction, suspension of use, deletion, etc. of investor’s information held by The Company.
   • If The Company receives a request for disclosure, correction, suspension of use, deletion, etc. of investors information based on laws and regulations, The Company shall promptly respond to the requests after the notification to investors about the requests.
7. Review of the Investor Information Protection Policy
   • To appropriately protect the personal information of investors, this policy shall be reviewed continuously in light of changes in the environment.