Privacy Policy.

ARIA Co., Ltd. (hereinafter referred to as "the Company") recognizes the importance of protecting personal information, complies with the Act on the Protection of Personal Information (hereinafter referred to as the "APPI"), and strives for the appropriate handling and protection of personal information in accordance with the following Privacy Policy (hereinafter referred to as "this Policy"). Unless otherwise defined herein, definitions of terms used in this Policy shall follow the definitions under the APPI.

1. Definition of Personal Information

In this Policy, "Personal Information" means personal information as defined in Article 2, Paragraph 1 of the APPI.

2. Purpose of Use of Personal Information

The Company shall use personal information for the following purposes:

• To provide the Company's services, products, etc. (hereinafter referred to as "Our Services, etc.");

• To respond to inquiries, guidance, and communications regarding Our Services, etc.;

• To provide information and promotional materials regarding Our Services, etc.;

• To address acts that violate the Company's terms, policies, etc. (hereinafter referred to as "Terms, etc.") concerning Our Services, etc.;

• To notify users of changes or updates to Terms, etc., regarding Our Services, etc.;

• To assist in the improvement of Our Services, etc., and the development of new services, products, etc.;

• To understand and analyze acquired data such as browsing history, behavioral history, and purchase history, in order to improve Our Services, add functions, and conduct development and advertising of new products and services tailored to interests and preferences;

• For employment management and internal office procedures (regarding personal information of officers and employees);

• For shareholder management and compliance with legal procedures under the Companies Act and other laws and regulations (regarding personal information of shareholders, stock acquisition right holders, etc.);

• To create statistical data processed into a format from which individuals cannot be identified, in connection with Our Services, etc.;

• To provide information (including advertisements) from the Company;

• For other purposes incidental or related to the above purposes of use.

3. Change of Purpose of Use of Personal Information

The Company may change the purpose of use of personal information within a scope reasonably deemed to have relevance to the original purpose. In the event of a change, the Company shall notify the individual who is the subject of the personal information (hereinafter referred to as the "Individual") or publicly announce the change.

4. Restrictions on Use of Personal Information

The Company shall not handle personal information beyond the scope necessary to achieve the purpose of use without obtaining the prior consent of the Individual, except as permitted under the APPI or other laws and regulations. However, this shall not apply in the following cases:

• Cases based on laws and regulations;

• Cases in which the provision of personal information is necessary for the protection of human life, body, or property, and it is difficult to obtain the consent of the Individual;

• Cases in which the provision of personal information is specially necessary for improving public health or promoting the sound growth of children, and it is difficult to obtain the consent of the Individual;

• Cases in which the provision of personal information is necessary for cooperating with a national agency, a local government, or an entity entrusted by them in executing statutory affairs, and obtaining the consent of the Individual is likely to impede the execution of such affairs;

• Cases in which personal data is provided to academic research institutions, etc., and such academic research institutions, etc. need to handle the personal data for academic research purposes (including cases where part of the purpose of handling the personal data is for academic research purposes, excluding cases where there is a risk of unreasonably infringing on individual rights and interests).

5. Proper Acquisition of Personal Information

5.1 Proper Means

The Company shall acquire personal information through proper means and shall not acquire it through deception or other improper means.

5.2 Special Care-Required Personal Information

The Company shall not acquire special care-required personal information (meaning personal information defined in Article 2, Paragraph 3 of the APPI) without obtaining the prior consent of the Individual, except in the following cases:

• Cases falling under any of Items (1) through (4) of Section 4 above;

• Cases in which special care-required personal information is acquired from academic research institutions, etc., and it is necessary to acquire such information for academic research purposes (including cases where part of the acquisition purpose is for academic research, excluding cases with a risk of unreasonably infringing on individual rights and interests, and limited to cases where the Company and the academic research institution jointly conduct academic research);

• Cases in which the special care-required personal information is made public by the Individual, a national agency, a local government, a party listed in each item of Article 57, Paragraph 1 of the APPI, or other parties designated by the Rules of the Personal Information Protection Commission;

• Cases in which special care-required personal information that is visually obvious from outer appearance is acquired by observing or photographing the Individual;

• Cases in which special care-required personal information is provided in a manner that does not constitute third-party provision pursuant to the proviso of Section 7.1.

6. Security Control Measures for Personal Information

The Company shall exercise necessary and appropriate supervision over its employees to ensure security control over personal information against risks such as loss, destruction, alteration, and leakage. Furthermore, when entrusting the handling of personal information in whole or in part, the Company shall exercise necessary and appropriate supervision over the trustee to ensure security control over the entrusted personal information. An outline of the Company's security control measures is as follows:

• Establishment of Basic Policies: The Company complies with the APPI, related laws, and applicable guidelines, and accepts inquiries, consultation, and complaints concerning the handling of personal data through the contact desk indicated in Section 15.

• Establishment of Rules for Handling Personal Data: The Company establishes handling rules, responsible persons, personnel in charge, and their duties for each stage of acquisition, use, storage, provision, deletion/disposal, etc.

• Organizational Security Measures: The Company appoints a person responsible for the handling of personal data, who verifies that personal data is handled in accordance with the established handling rules. The Company also establishes a reporting and communication structure from employees to the responsible person upon detecting facts or signs of violation of laws or internal rules, and conducts periodic self-inspections on the status of personal data handling.

• Human Security Measures: The Company conducts necessary training for employees regarding precautions on personal data handling, and includes confidentiality obligations regarding personal data in the employment regulations.

• Physical Security Measures: The Company implements measures to prevent unauthorized viewing of personal data by employees other than authorized personnel or by third parties. To prevent theft or loss of devices, electronic media, and documents containing personal data, they are stored in lockable cabinets or storage rooms. If information systems are operated solely on standalone hardware, such equipment is secured using security wires or similar measures. Additionally, necessary measures are taken during transport within or outside offices to ensure personal data is not easily readable.

• Technical Security Measures: The Company clarifies devices capable of handling personal data and employees authorized to handle such devices to prevent unnecessary access. Mechanisms are introduced to protect devices handling personal data from unauthorized external access or malicious software.

• Confirmation of Disposal: When personal data is deleted or devices/media containing personal data are disposed of, the responsible person verifies and confirms the completion of such deletion or disposal.

7. Provision to Third Parties

7.1 Consent and Exceptions

The Company shall not provide personal information to third parties without obtaining the prior consent of the Individual, except in cases falling under any of the items in Section 4 above. However, the following cases shall not constitute provision to third parties as defined above:

• Where the Company entrusts the handling of personal information in whole or in part within the scope necessary to achieve the purpose of use;

• Where personal information is provided as a result of business succession due to merger or other reasons;

• Where personal information is jointly used based on the provisions of the APPI.

7.2 Cross-Border Transfers

Notwithstanding Section 7.1, when providing personal information to a third party located in a foreign country (excluding countries designated by the Rules of the Personal Information Protection Commission pursuant to Article 28 of the APPI, and excluding entities that have established a system conforming to standards specified by the Rules of the Personal Information Protection Commission under Article 28 of the APPI), the Company shall obtain the Individual's prior consent permitting provision to a third party in a foreign country or take other measures required under the APPI, except in cases falling under any of the items in Section 4 above.

7.3 Record Keeping of Provision

When personal information is provided to a third party, the Company shall create and retain records in accordance with Article 29 of the APPI.

7.4 Record Verification of Receipt

When receiving personal information from a third party, the Company shall perform necessary verifications, create records, and retain such records in accordance with Article 30 of the APPI.

7.5 Provision to Partner Companies

Notwithstanding Section 7.1, the Company may provide user information to partner companies based on the Terms of Use or other special agreements for Our Services.

8. Personally Referable Information

When acquiring personally referable information (as defined in the APPI; the same shall apply hereinafter) from a third party and intending to use it as personal data, the Company shall take necessary steps such as obtaining the Individual's prior consent to such acquisition, and shall handle it within the scope of the purpose of use set forth in Section 2.

When providing personally referable information to a third party where it is expected that the third party will acquire it as personal data, the Company shall confirm that the third party has obtained the Individual's prior consent to acquire such personally referable information as personal data.

9. Disclosure of Personal Information

When requested by an Individual to disclose retained personal data or third-party provision records in accordance with the provisions of the APPI, the Company shall, after confirming that the request is made by the Individual, disclose the information to the Individual without delay (if such retained personal data or records do not exist, the Company shall notify the Individual to that effect). However, this shall not apply in cases where the Company is not obligated to disclose under the APPI or other laws and regulations.

10. Correction, Addition, or Deletion of Personal Information

When requested by an Individual to correct, add, or delete (hereinafter referred to as "Correction, etc.") the contents of personal information on the grounds that the personal information is untrue pursuant to the provisions of the APPI, the Company shall, after confirming that the request is made by the Individual, conduct necessary investigations without delay within the scope necessary to achieve the purpose of use. Based on the results, the Company shall perform Correction, etc. of the personal information and notify the Individual (if the Company decides not to perform Correction, etc., it shall notify the Individual to that effect). However, this shall not apply in cases where the Company is not obligated to perform Correction, etc. under the APPI or other laws and regulations.

11. Suspension of Use, Erasure, and Ceasing Third-Party Provision

When requested by an Individual to suspend the use of or erase (hereinafter referred to as "Suspension of Use, etc.") personal information under the APPI on the grounds that it is being handled beyond the scope of the previously announced purpose of use or was acquired by deception or other improper means, or when requested to cease provision to third parties (hereinafter referred to as "Ceasing Provision") on the grounds that personal information is being provided to third parties without consent, and if the request is found to be justified, the Company shall, after confirming that the request is made by the Individual, suspend use or cease provision of the personal information without delay and notify the Individual. However, this shall not apply in cases where the Company is not obligated to do so under the APPI or other laws and regulations.

In addition, when requested by an Individual to perform Suspension of Use, etc. or Ceasing Provision under the APPI on the grounds that the Company no longer needs to use the personal information, or that a leakage, loss, or damage of retained personal data involving the Individual that carries a high risk of harming individual rights and interests (as defined by the Rules of the Personal Information Protection Commission) has occurred, or that the handling of retained personal data involving the Individual carries a risk of harming the Individual's rights or legitimate interests, and if the request is found to be justified, the Company shall, after confirming that the request is made by the Individual, perform Suspension of Use, etc. or Ceasing Provision without delay and notify the Individual. However, this shall not apply in cases where the Company is not obligated to do so under the APPI or other laws and regulations.

12. Handling of Anonymously Processed Information

12.1 When producing anonymously processed information (meaning information defined in Article 2, Paragraph 6 of the APPI, limited to that constituting an anonymously processed information database, etc. under Article 16, Paragraph 6 of the APPI; the same shall apply hereinafter), the Company shall process personal information in accordance with the standards specified by the Rules of the Personal Information Protection Commission.

12.2 When producing anonymously processed information, the Company shall implement security control measures in accordance with the standards specified by the Rules of the Personal Information Protection Commission.

12.3 When producing anonymously processed information, the Company shall publicly announce the items of information concerning individuals included in such anonymously processed information in accordance with the Rules of the Personal Information Protection Commission.

12.4 When providing anonymously processed information (including information produced by the Company and information received from third parties; the same shall apply hereinafter unless otherwise specified) to a third party, the Company shall, in accordance with the Rules of the Personal Information Protection Commission, publicly announce in advance the items of information concerning individuals included in the anonymously processed information to be provided and the method of provision, and explicitly state to the third party that the provided information is anonymously processed information.

12.5 When handling anonymously processed information, the Company shall not (1) collate the anonymously processed information with other information, or (2) acquire information concerning processing methods or deleted descriptions/personal identification codes (clause (2) applies only to anonymously processed information received from third parties), in order to identify the Individual whose personal information was used to produce the anonymously processed information.

12.6 The Company shall take necessary and appropriate measures for security control of anonymously processed information, handle complaints regarding the production and handling of anonymously processed information, and make efforts to publicly announce the details of such measures to ensure the proper handling of anonymously processed information.

13. Use of Cookies and Other Technologies

The Company's services may use Cookies and similar technologies. These technologies assist the Company in understanding the usage status of its services and contribute to service improvements. Users who wish to disable Cookies may do so by changing their web browser settings. However, disabling Cookies may render certain features of the Company's services unavailable.

14. Use of External Services

The Company's services utilize the following external services for the purposes specified below. Please check the websites of each service provider for their privacy policies:

(1) Understanding User Access Status

The Company may use Google Analytics and Google Analytics Advertising Features provided by Google LLC. The functions used are as follows:

• Remarketing with Google Analytics

• Google Display Network Impression Reporting

• Google Analytics Demographics and Interests Reporting

(2) Marketing Automation

For sales activities related to the Company's services, the Company uses "Wix Forms", a marketing automation tool provided by Wix.com Ltd. and its affiliates.

Cookies set by Wix Forms are used to track and collect access data, such as the date, time, and URL of visits to this website. By linking these cookies with user email addresses or registration information obtained through application forms or business card exchanges, the Company identifies and analyzes users, infers user interests, and conducts sales activities such as sending tailored emails or telephone communications.

(3) Disabling Cookies and Opt-Out Procedures

Users may disable all cookies by changing their web browser settings; however, doing so may prevent certain functions of the web service from operating properly. Users can block cookie storage at any time by rejecting cookies for specific domains. Additionally, data collection can be stopped by performing an opt-out procedure for each service. To opt out individually, please follow the procedures on each provider's privacy policy page:

• Google Inc.: Privacy Policy (https://policies.google.com/privacy)

• Google Analytics Opt-out Browser Add-on: (https://tools.google.com/dlpage/gaoptout)

15. Name, Address, and Name of Representative of Personal Information Handling Business Operator

Company Name: ARIA Co., Ltd.

Address: 582-1 Tadagami-cho, Ota-shi, Gunma 373-0011, Japan

Representative Director: Zen Rahamet

16. Contact Information / Inquiries

For requests regarding disclosure, comments, questions, complaints, or other inquiries regarding the handling of personal information, please contact the following desk by phone or email:

Department: Personal Information Inquiry Desk

Phone: 0276-47-4180

Email: ariajp.ota@gmail.com

Hours: Weekdays 10:00 to 18:00 (JST)

17. Continuous Improvement

The Company shall appropriately review operational practices regarding the handling of personal information and endeavor to make continuous improvements, and may modify this Privacy Policy as necessary.

Enacted: [Month] [Day], 20XX