Mimatsusha Co., Ltd.

Mimatsusha Co., Ltd. (hereinafter "the Company") recognizes the importance of protecting personal information. The Company complies with the Act on the Protection of Personal Information (hereinafter the "Personal Information Protection Act") and strives to handle and protect personal information appropriately in accordance with this Privacy Policy (hereinafter "this Policy"). Unless otherwise specified in this Policy, terms used herein shall be defined in accordance with the Personal Information Protection Act.

1. Definition of Personal Information

In this Policy, "personal information" means personal information as defined in Article 2, Paragraph 1 of the Personal Information Protection Act.

2. Purposes of Use of Personal Information

The Company uses personal information for the following purposes:

1. To provide the Company's services, products, and the like (hereinafter "the Services");
2. To provide information about the Services and respond to inquiries;
3. To introduce the Services;
4. To respond to any conduct that violates the Company's terms, policies, and the like relating to the Services (hereinafter "the Terms");
5. To notify users of changes to the Terms relating to the Services;
6. To improve the Services and to develop new services, products, and the like;
7. To understand and analyze acquired browsing history, behavioral history, purchase history, and similar information, in order to improve the Services and add new features, and to develop and advertise new products and services tailored to users' interests and preferences;
8. For employment management and internal procedures (regarding personal information of officers and employees);
9. For shareholder management and to comply with procedures under the Companies Act and other laws (regarding personal information of shareholders, holders of stock acquisition rights, and others);
10. To create statistical data processed into a form that does not identify individuals, in connection with the Services;
11. To provide information from the Company (including advertisements);
12. For other purposes incidental to the above purposes.

3. Changes to the Purposes of Use

The Company may change the purposes of use of personal information within the scope reasonably deemed to be related to the original purposes. If it does so, it will notify the individual to whom the personal information relates (hereinafter "the Data Subject") or make a public announcement.

4. Restrictions on the Use of Personal Information

Except where permitted by the Personal Information Protection Act or other laws, the Company will not handle personal information beyond the scope necessary to achieve the purposes of use without the Data Subject's consent. However, this does not apply in the following cases:

1. Where required by law;
2. Where necessary to protect the life, body, or property of a person, and it is difficult to obtain the Data Subject's consent;
3. Where particularly necessary to improve public health or promote the sound development of children, and it is difficult to obtain the Data Subject's consent;
4. Where it is necessary to cooperate with a national government agency, a local government, or a person entrusted by them in carrying out duties prescribed by law, and obtaining the Data Subject's consent is likely to impede the performance of those duties;
5. Where personal data is provided to an academic research institution or similar body that needs to handle the data for academic research purposes (including cases where academic research is only part of the purpose, but excluding cases where there is a risk of unjustly infringing the rights and interests of an individual).

5. Proper Acquisition of Personal Information

5.1
The Company acquires personal information by proper means and does not acquire it through deception or other wrongful means.

5.2
The Company does not acquire special care-required personal information (as defined in Article 2, Paragraph 3 of the Personal Information Protection Act) without the Data Subject's prior consent, except in the following cases:

1. Where any of items 1 through 4 of Article 4 applies;
2. Where special care-required personal information is acquired from an academic research institution or similar body and needs to be acquired for academic research purposes (including cases where academic research is only part of the purpose, but excluding cases where there is a risk of unjustly infringing the rights and interests of an individual), limited to cases where the Company and that institution jointly conduct academic research;
3. Where the special care-required personal information has been made public by the Data Subject, a national government agency, a local government, a person listed in the items of Article 57, Paragraph 1 of the Personal Information Protection Act, or another person specified by the rules of the Personal Information Protection Commission;
4. Where special care-required personal information that is apparent from outward appearance is acquired by visually observing or photographing the Data Subject;
5. Where special care-required personal information is provided to the Company in a manner that does not constitute provision to a third party under the proviso to Article 7.1.

6. Security Management of Personal Information

To guard against the risks of loss, destruction, alteration, and leakage of personal information, the Company provides necessary and appropriate supervision of its employees so that personal information is securely managed. When the Company entrusts all or part of the handling of personal information to another party, it provides necessary and appropriate supervision of that party so that personal information is securely managed. An overview of the Company's security management measures is as follows:

1. The Company complies with the Personal Information Protection Act, related laws and regulations, and applicable guidelines, and accepts questions, consultations, and complaints regarding the handling of personal data at the contact point specified in Article 15.
2. The Company defines handling methods, responsible persons and staff, and their duties for each stage: acquisition, use, storage, provision, and deletion/disposal.
3. The Company appoints a person responsible for the handling of personal data, who confirms that personal data is handled in accordance with the established procedures. The Company also maintains a reporting system through which employees report to the responsible person any violation, or risk of violation, of laws, regulations, or internal rules. In addition, the responsible person conducts periodic inspections of how personal data is handled.
4. The Company provides employees with necessary training on matters to be observed when handling personal data, and includes provisions on confidentiality of personal data in its work rules.
5. The Company implements measures to prevent personal data from being easily viewed by anyone other than authorized employees and the Data Subject. To prevent theft or loss of devices, electronic media, and documents that handle personal data, electronic media containing personal data and documents containing personal data are stored in lockable cabinets, storage rooms, or similar places. Furthermore, where an information system handling personal data is operated solely on a standalone device, that device is secured with a security cable or similar means. In addition to the above, the Company takes other necessary measures to prevent theft or loss of devices, electronic media, and documents that handle personal data, and takes measures so that personal data cannot be easily identified when such devices or media are carried, including when moved within the workplace.
6. The Company clearly identifies the devices that may be used to handle personal data and the employees who may operate them, in order to prevent unnecessary access to personal data. The Company also introduces mechanisms to protect devices that handle personal data from unauthorized external access and malicious software.
7. When personal data is deleted, or when devices or electronic media on which personal data was recorded are disposed of, the responsible person confirms that this has been done.

7. Provision to Third Parties

7.1
Except where any of the items of Article 4 applies, the Company does not provide personal information to third parties without the Data Subject's prior consent. However, the following cases do not constitute provision to a third party as described above:

1. Where personal information is provided in connection with the Company's entrustment of all or part of the handling of personal information, to the extent necessary to achieve the purposes of use;
2. Where personal information is provided in connection with the succession of a business due to a merger or other reasons;
3. Where personal information is jointly used in accordance with the provisions of the Personal Information Protection Act.

7.2
Notwithstanding Article 7.1, except where any of the items of Article 4 applies, when the Company provides personal information to a third party located in a foreign country (excluding countries designated by the rules of the Personal Information Protection Commission under Article 28 of the Personal Information Protection Act), other than a third party that has established a system conforming to the standards designated by those rules under the same Article, the Company will obtain the Data Subject's prior consent to the provision of information to a third party in a foreign country, or take other measures under the Personal Information Protection Act.

7.3
When the Company provides personal information to a third party, it creates and retains records in accordance with Article 29 of the Personal Information Protection Act.

7.4
When the Company receives personal information from a third party, it conducts the necessary verification in accordance with Article 30 of the Personal Information Protection Act, and creates and retains records of that verification.

7.5
Notwithstanding Article 7.1, the Company may provide user information to partner companies based on the terms of use of the Services or other special agreements.

8. Personal-Related Information

1. When the Company obtains personal-related information (as defined in the Personal Information Protection Act; the same applies hereinafter) from a third party and uses it as personal data, the Company will take measures in advance, such as obtaining the Data Subject's consent to the Company's acquisition of that personal-related information as personal data, and will use it within the scope of the purposes of use set out in Article 2.
2. When providing personal-related information to a third party, if it is expected that the third party will use the information as personal data, the Company will confirm, among other things, that the third party has obtained the Data Subject's prior consent to acquire that personal-related information as personal data.

9. Disclosure of Personal Information

When a Data Subject requests disclosure of retained personal data or records of third-party provision under the Personal Information Protection Act, the Company will, after confirming that the request is made by the Data Subject personally, disclose the information to the Data Subject without delay (or notify the Data Subject if the retained personal data or records do not exist). However, this does not apply where the Company is not obligated to disclose under the Personal Information Protection Act or other laws.

10. Correction of Personal Information

When a Data Subject requests the correction, addition, or deletion (hereinafter "Correction") of the content of their personal information under the Personal Information Protection Act on the grounds that it is inaccurate, the Company will, after confirming that the request is made by the Data Subject personally, conduct the necessary investigation without delay to the extent necessary to achieve the purposes of use. Based on the results, the Company will make the Correction and notify the Data Subject (or notify the Data Subject if it decides not to make the Correction). However, this does not apply where the Company is not obligated to make Corrections under the Personal Information Protection Act or other laws.

11. Suspension of Use of Personal Information

When a Data Subject requests, under the Personal Information Protection Act, the suspension of use or deletion (hereinafter "Suspension of Use") of their personal information on the grounds that it is being handled beyond the scope of the previously announced purposes of use or was acquired through deception or other wrongful means, or requests the suspension of its provision to third parties (hereinafter "Suspension of Provision") on the grounds that it has been provided to a third party without the Data Subject's consent, and the request is found to be well-founded, the Company will, after confirming that the request is made by the Data Subject personally, carry out the Suspension of Use or Suspension of Provision without delay and notify the Data Subject. However, this does not apply where the Company is not obligated to do so under the Personal Information Protection Act or other laws.

In addition, when a Data Subject requests Suspension of Use or Suspension of Provision under the Personal Information Protection Act on the grounds that the Company no longer needs to use their personal information; that an incident concerning retained personal data identifying the Data Subject has occurred, such as a leak, loss, or damage of personal data, or another situation concerning the security of personal data that is specified by the rules of the Personal Information Protection Commission as being likely to harm an individual's rights and interests; or that the handling of retained personal data identifying the Data Subject may otherwise harm the Data Subject's rights or legitimate interests, and the request is found to be well-founded, the Company will, after confirming that the request is made by the Data Subject personally, carry out the Suspension of Use or Suspension of Provision without delay and notify the Data Subject. However, this does not apply where the Company is not obligated to do so under the Personal Information Protection Act or other laws.

12. Handling of Anonymously Processed Information

12.1
When creating anonymously processed information (meaning information defined in Article 2, Paragraph 6 of the Personal Information Protection Act, limited to information constituting an anonymously processed information database, etc., as defined in Article 16, Paragraph 6 of the same Act; the same applies hereinafter), the Company will process personal information in accordance with the standards set by the rules of the Personal Information Protection Commission.

12.2
When the Company creates anonymously processed information, it will take security management measures in accordance with the standards set by the rules of the Personal Information Protection Commission.

12.3
When the Company creates anonymously processed information, it will publicly disclose the categories of information about individuals contained in that anonymously processed information, as provided by the rules of the Personal Information Protection Commission.

12.4
When the Company provides anonymously processed information (including information the Company created and information provided by third parties; the same applies hereinafter unless otherwise specified) to a third party, it will, in advance and as provided by the rules of the Personal Information Protection Commission, publicly disclose the categories of information about individuals contained in the anonymously processed information to be provided and the method of provision, and will clearly state to the third party that the information being provided is anonymously processed information.

12.5
When handling anonymously processed information, the Company will not, for the purpose of identifying the Data Subject of the personal information used to create the anonymously processed information, (1) cross-reference the anonymously processed information with other information, or (2) acquire descriptions or personal identification codes deleted from that personal information, or information about the processing methods carried out under Article 43, Paragraph 1 of the Personal Information Protection Act (item (2) applies only to anonymously processed information provided by a third party).

12.6
The Company will itself take the measures necessary and appropriate for the security management of anonymously processed information, for handling complaints regarding the creation and other handling of anonymously processed information, and for otherwise ensuring the proper handling of anonymously processed information, and will endeavor to publicly disclose the content of those measures.

13. Use of Cookies and Other Technologies

The Company's services may use cookies and similar technologies. These technologies help the Company understand how its services are used and contribute to improving them. Users who wish to disable cookies may do so by changing their web browser settings. However, if cookies are disabled, some features of the Company's services may become unavailable.

14. Use of External Services

The Company's services use the following external services for the purposes described below. For each provider's privacy policy, please refer to that provider's website.

1) Understanding User Visits

The Company may use the web analytics service "Google Analytics" and the "Google Analytics advertising features" provided by Google.

The features used are as follows:

• Google Analytics Remarketing
• Google Display Network Impression Reporting
• Google Analytics Demographics and Interest Categories Reporting

15. Name and Address of the Personal Information Handling Business Operator, and Name of Its Representative

Mimatsusha Co., Ltd.
Address: 2-37-1 Toryoke, Kawaguchi-shi, Saitama, Japan

16. Contact

For requests for disclosure, opinions, questions, complaints, or any other inquiries regarding the handling of personal information, please contact the following desk by phone or email.

Personal Information Inquiry Desk
Phone: 048-223-1221
Email: mimatsusha99@gmail.com
(Reception hours are 9:00 AM to 5:00 PM on weekdays.)

17. Continuous Improvement

The Company will review how it handles personal information as appropriate and strive for continuous improvement, and may revise this Policy as necessary.

Established: May 1, 2026