Policy for European Union member countries, Iceland, Liechtenstein, Norway, and United Kingdom

This Policy applies to the Processing of the Personal Information of the data subject(s) (hereinafter referred to as “you” or “your”) who is located or resides in European Union member countries, Iceland, Liechtenstein, Norway, and the United Kingdom (hereinafter referred to as the “Applicable Territories”) that relates to the provisions of goods or services to you, or the monitoring of your activities in the Applicable Territories. Please refer to these Principles for matters relating to the Processing of any Personal Information not described in this Policy. We are the Data Controller relating to the obligations set out in these Principles and this Policy.

1. 1.Legal Basis for Processing

   The legal basis for our processing of the Personal Information under the General Data Protection Regulation ((EU) 2016/679) (hereinafter referred to as the “EU GDPR”) or the UK GDPR (the EU GDPR incorporated into the laws of England under the European Union (Withdrawal) Act 2018 and revised under the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) (the EU GDPR and the UK GDPR are hereinafter collectively referred to as the “GDPR”) as set out in the following table (in this Policy, “Personal Information” means the information defined as Personal Data in the GDPR).

   Purpose of Use	Legal Basis
   Invitation and/or communication of the services including events, seminars and surveys	- In the case of direct marketing using email or other methods that are determined to require consent: Consent - In cases not falling under the above: It is necessary to perform Processing for pursuing legitimate interests (such as our needs to let customers know our products, services or market strategies).
   Delivery of newsletters, publications, newspapers, seasonal greetings, etc.
   Prize competition, campaign, various events, etc. performed as assigned business performance of services	- In the case of direct marketing using email or other methods that are determined to require consent: Consent - In cases not falling under the above: Processing is necessary to pursue legitimate interests (e.g., to properly carry out work assigned by our business partners)
   Improvement of our website	- In the case of the collection of data from customer’s terminals through cookies other than strictly necessary cookies, or other similar technologies: Consent - If the above is not applicable: It is necessary to perform Processing for pursuing legitimate interests (such as improving our websites and keeping them in optimal condition).
   Notification of arrival of the visitor at our offices to the person visited and office entrance control	It is necessary to perform Processing for pursuing legitimate interests (such as managing information of a visitor at our office for the safety of such visitor or our security).
   Negotiations, production, and administration of entertainment programs, CM, events, seminars, etc. regarding celebrities and other well-known people.	Processing is necessary to pursue legitimate interests (e.g., smooth negotiation for the personal appearances, production of better programs, etc.)
   Handling of the exercise of shareholders’ rights, implementation of various measures for shareholders, and other shareholder management	It is necessary to perform Processing for pursuing legitimate interests (such as shareholder management under the Japanese Corporation Act and other various laws and regulations including handling of the exercise of shareholders’ rights).
   Operation and communication of job posting, recruitment and screening. Survey for the purpose of future recruitment activities. Personnel database after enrollment. Use as personnel database after enrollment. Various business operations and business promotion systems using employee's data.	It is necessary to perform Processing for pursuing legitimate interests (such as smooth recruitment , securement of better human resources and appropriate personnel evaluation).
   Handling of inquiries, requests, complaints, etc.	It is necessary to perform Processing for pursuing legitimate interests (such as appropriate handling of inquiries, requests, and complaints for the provision of better products and services).
   Other use that is deemed to be reasonably necessary for our business	It is necessary to perform Processing for performing contracts, or it is necessary to perform Processing for pursuing legitimate interests (if it is determined that consent is required, we will obtain consent upon expressly indicating that the legal basis for Processing is consent).

   We may sometimes obtain consent from you for your Personal Information. Even in this case, unless it is clearly indicated in the above table that the legal basis for Processing is “consent,” the legal basis for Processing is “it is necessary to perform Processing for performing contracts,” or “it is necessary to perform Processing for pursuing legitimate interests” (please contact the contact information of the Data Protection Officer described below for the details of the balancing test of legitimate interests).
   You have the right to withdraw your consent at any time by the method separately designated by us when we obtain your consent. However, even if you withdraw your consent, such withdrawal will only be effective prospectively, and does not affect the legitimacy of Processing performed based on your consent before the withdrawal thereof. If you object to direct marketing, you can refuse any communication sent by using electronic messages in accordance with the instructions indicated in the electronic messages conveying such direct marketing.

2. 2.Transfer of Personal Information to Foreign Countries

   If we transfer Personal Information to areas other than the Applicable Territories, except for transfers made by a method separately notified to you, we may do so to (i) such countries where an adequacy decision is adopted by relying on such adequacy decision or (ii) other countries by taking appropriate measures of executing a contract containing the standard data protection clauses approved by the European Commission with the party receiving the Personal Information in such countries. Please contact the contact information of the Data Protection Officer described below if you wish to receive a copy of the documents relating to those protection measures.

3. 3.Your Rights

   You have the following rights.

   • - To acquire information regarding the Processing of the Personal Information: You have the right to acquire all necessary information regarding our Processing activities of your Personal Information from us.
   • – To access the Personal Information: You have the right to acquire confirmation on whether your Personal Information is Processed or not from us, and if such Processing is performed, you have the right to access the Personal Information and certain related information.
   • – To correct or delete the Personal Information: You have the right to cause us to correct your inaccurate Personal Information without undue delay, and the right to cause us to complete your incomplete Personal Information. Under certain conditions being met, you have the right to cause us to delete your Personal Information without undue delay.
   • – To restrict the Processing of the Personal Information: Under certain conditions being met, you have the right to cause us to restrict the Processing of your Personal Information.
   • – Data portability of the Personal Information: Under certain conditions being met , you have the right to receive the data of your Personal Information in a structured, generally available and machine-readable form, and the right to transfer such data to another Data Controller without interference from us.
   • – To object to the Processing of the Personal Information: you have the right to object to our reliance on our legitimate interests (or those of a third party) as the legal basis for Processing your Personal Information that affects your right. Specifically, you have the right to opt out of direct marketing or profiling performed by us for direct marketing at any time.
   • – Not to be a target for automated decision-making: Under certain conditions being met , you have the right not to become a target for automated decision-making (decision-making in which no human is involved) that legally affects or materially affects such data subject.
   • – You have the right to lodge a complaint about our Processing of your Personal Information with the data protection supervisory agency in the member country where he or she resides or works, or an alleged infringement occurs.

   Please contact the contact information of the Data Protection Officer described below if you exercise the rights described above. For the purpose of verifying your identity, we may need to obtain specific information from you. In addition, we may contact you to obtain further information relating to your requests to expedite the measures to be taken by us.

4. 4.Contact Information of Data Protection Officer

   The contact information of the Data Protection Officer is as follows.

   - Data Protection Officer
   info@dme.dentsu.co.jp

   Last updated: 01 31, 2023