Privacy Policy

1. Cation Inc. (the "Company") establishes this Privacy Policy (this "Policy") as set forth below regarding the handling of personal information obtained by the Company, in compliance with the Act on the Protection of Personal Information (the "APPI"), other related laws and regulations, and guidelines issued by the Personal Information Protection Commission.

2. The Company operates marketing production, development and operation of the SaaS product NAVINOME, system development, development and operation of a transaction management cloud system (including automatic delivery of purchase orders, delivery notes, invoices, and similar documents), and secretariat services for campaigns and events. This Policy applies to personal information obtained in all businesses and services operated by the Company.

3. If the Company sets forth a separate privacy policy for an individual service or an individual campaign or event, that separate policy takes precedence over this Policy.

1. In this Policy, the terms listed below have the meanings set forth in each item.

(1) "Personal information" means personal information as defined in Article 2, Paragraph 1 of the APPI: information about a living individual that can identify a specific individual by name, date of birth, address, telephone number, email address, occupation, employer, or other descriptions contained in the information (including personal identification codes).

(2) "Special care-required personal information" means special care-required personal information as defined in Article 2, Paragraph 3 of the APPI: personal information requiring special handling so that the individual is not subjected to unjust discrimination, prejudice, or other disadvantage, such as race, creed, social status, medical history, criminal records, or facts of having been harmed by a crime.

(3) "Principal" means the specific individual identified by personal information.

(4) "User" means any person who uses the Company's website, NAVINOME, other services, or campaigns and events for which the Company serves as secretariat.

(5) "Anonymous information" means information that cannot identify a specific individual, such as cookies, IP addresses, browser information, and access history.

(6) "Joint use" means use of personal information jointly among business operators within a certain scope.

1. Information about the personal information handling business operator under this Policy is as follows.

1. The Company acquires personal information only by lawful and fair means and does not acquire it by deception or other wrongful means.

2. The main situations in which the Company acquires personal information are as follows.

3. When acquiring personal information directly from the principal in writing (including electromagnetic records), the Company will specify the purpose of use in advance, except where the principal has consented or as otherwise provided by law.

1. The Company will not handle personal information acquired by the means described in the preceding article beyond the scope necessary to achieve the purposes of use without the principal's consent. If the Company changes a purpose of use, it will do so only to the extent reasonably recognized as having substantial relevance to the purpose before the change, and will notify or publicly announce the changed purpose to the principal.

2. The Company's purposes of use of personal information are as follows.

(1) To respond to inquiries and for related communication

(2) To send materials, brochures, and similar items and to provide service information

(3) For recruitment selection, interviews, acceptance or rejection notices, and other recruitment-related communication

(4) For human resources and labor management after execution of an employment contract

(5) For conclusion and performance of contracts, ongoing confirmation of contract terms, and related communication

(6) For placing orders, billing fees, and payment administration

(7) For account management, authentication, payment of usage fees, and other service provision for Company services including NAVINOME

(8) For analysis of use of NAVINOME and the Company website, quality improvement, and development of new features

(9) To provide web analytics functions in NAVINOME through integration of Google Analytics (GA4) and heatmap data

(10) For management of transaction documents such as purchase orders, delivery notes, and invoices via the transaction management cloud system and automatic email delivery of those documents

(11) For operation of campaigns and events, including entry acceptance, selection, winner notification, shipping of prizes, and other secretariat operations

(12) For photography and recording of photos and videos related to campaigns and events and public use on the Company website, social media, public relations materials, and other media

(13) For requirements definition, design, build, testing, and maintenance and operation in system development work

(14) For stable operation of the Company website and services, monitoring for unauthorized access, and investigation and resolution when problems occur

(15) For disputes, litigation, responses to supervisory authorities, and other acts required by law

3. Among the purposes listed in the preceding paragraph, specific handling of personal information for each campaign or event (details of photography and public use of photos and videos, provision of information to sponsors and partner companies, etc.) is set forth separately in the individual privacy policy or participation rules for that campaign or event.

1. When acquiring special care-required personal information, the Company obtains the principal's consent in advance, except as based on laws and regulations or as provided in each item of Article 18, Paragraph 3 of the APPI.

2. When acquiring special care-required personal information directly from the principal in writing (including electromagnetic records), the Company obtains the principal's consent in advance.

1. The Company will not provide personal information to third parties without the principal's prior consent, except in any of the following cases.

(1) When based on laws and regulations

(2) When necessary to protect a person's life, body, or property and obtaining the principal's consent is difficult

(3) When particularly necessary to improve public health or promote the sound growth of children and obtaining the principal's consent is difficult

(4) When cooperation is necessary for a national or local government body or a party entrusted by them to perform affairs prescribed by law, and obtaining the principal's consent is likely to impede performance of those affairs, as determined by the Company

(5) When the Company, as a personal information handling business operator, entrusts all or part of handling of personal information within the scope necessary to achieve the purposes of use (limited to entrustees set forth in Article 10)

(6) When requested to disclose by a court, public prosecutor's office, police, bar association, or other body with equivalent authority based on laws and regulations

(7) When falling under provision to another personal information handling business operator or an overseas personal information handling business operator as set forth in each item of Article 27, Paragraph 1 of the APPI, or when providing based on Paragraph 2 of the same article

2. When the Company operates the secretariat for a campaign or event, the Company may provide personal information to organizers and other related parties set forth in Article 9 within the scope necessary to operate the event, with the principal's consent.

3. With respect to special care-required personal information, the Company will not provide it to third parties without the principal's prior consent except where falling under exceptional grounds in Article 28, Paragraph 1 of the APPI.

4. When the Company provides personal information to a third party or receives provision of personal information from a third party, the Company will respond without delay to the principal's request regarding the name or title of the provider or recipient and other necessary matters in accordance with laws and regulations (except where disclosure to the principal of such third party's name is not required by law).

1. The Company jointly uses personal information related to inquiries and personal information related to business partners with its Vietnam subsidiary Cation Vietnam as follows.

1. When the Company is entrusted with secretariat operations for campaigns, golf tournaments, or other events, the Company may provide personal information to organizers, sponsors, golf courses, and other related parties within the scope necessary for operation, to the extent necessary for operation, after obtaining the principal's consent regarding handling of personal information for that tournament or event at the time of entry.

2. Provision under the preceding paragraph includes entry acceptance, winner notification, shipping of prizes, photography and recording of photos and videos associated with tournament operation and public use, and administrative communication related thereto.

3. Specific recipients, categories of information provided, and purposes of use under the preceding paragraphs are stated in the entry form, participation rules, or individual privacy policy for each tournament or event, and the Company obtains the principal's confirmation and consent.

1. The Company may entrust all or part of handling of personal information to external business operators within the scope necessary to achieve the purposes of use set forth in Article 5.

2. When entrusting operations that handle personal information, the Company investigates whether the entrustee can handle personal information appropriately and selects the entrustee accordingly.

3. The Company provides personal information to entrustees only within the scope necessary to achieve the purposes of use and stipulates in entrustment agreements and similar instruments matters concerning appropriate management of personal information, conditions for re-entrustment, leak prevention, and other safety management measures, and exercises necessary and appropriate supervision over their performance.

1. Use of Google Analytics (GA4)

The Company uses Google Analytics 4 (GA4) provided by Google LLC to analyze use of the Company website and NAVINOME. GA4 uses cookies to collect site browsing information (number of visits, pages viewed, time on site, referral source, etc.), anonymizes it, and provides it to the Company. Such information does not include information that identifies a specific individual.

For how Google handles data, see Google's Privacy Policy (https://policies.google.com/privacy?hl=en) and Google Analytics Terms of Service (https://marketingplatform.google.com/about/analytics/terms/us/).

The Company has entered into a Data Processing Agreement with Google LLC and exercises appropriate supervision over data processing by Google.

2. Use of Google Search Console

The Company uses Google Search Console provided by Google LLC to understand and analyze display performance in search engines for the Company website (search queries, impressions, clicks, ranking position, etc.). Information obtained through that service is used only for the purpose of improving the Company website.

3. Handling of GA4 and heatmaps in NAVINOME

When GA4 data and heatmap data are linked and analyzed in NAVINOME's web analytics functions based on the user's consent, such data is processed in an environment managed by the Company and is used only within the scope of analytics purposes authorized by the user.

4. Disabling cookies

Users may refuse acceptance of cookies through browser settings. If cookies are disabled, some functions of the Company website or NAVINOME may not work properly.

1. To prevent leakage, loss, or damage of personal information and for other safety management of personal information, the Company implements the measures listed below and other necessary and appropriate measures.

(1) Organizational safety management measures

The Company appoints a person responsible for handling personal information and maintains internal rules on handling personal information. The Company conducts regular self-inspections and internal audits of handling status.

(2) Human safety management measures

The Company provides regular training to employees on handling personal information and has employees enter confidentiality agreements.

(3) Physical safety management measures

For documents and media on which personal information is recorded, the Company implements theft prevention through locked storage and restrictions on removal.

(4) Technical safety management measures

The Company implements access control for personal information, limits access rights, uses encrypted communication via SSL/TLS, malware countermeasures, and other information security measures.

(5) Understanding external environments

When jointly using personal information with the Vietnam subsidiary set forth in Article 8 or otherwise handling personal information in Vietnam, the Company understands systems for protection of personal information in Vietnam and implements measures necessary and appropriate for its protection.

1. When users use the Company website, various services, or campaign operation systems, anonymous information about users (including IP address, usage time, and browsing history) is automatically recorded on servers and similar systems. The Company uses such information for the following purposes.

(1) To identify causes of problems occurring on servers and similar systems and resolve them

(2) To monitor for unauthorized access and ensure information security

(3) To improve service quality and develop new services

2. Unless the user voluntarily provides information that can identify an individual to the Company, the Company cannot identify an individual user using anonymous information alone.

1. If a leak, loss, damage, or other incident involving personal information occurs, the Company will promptly take necessary measures including notification to the principal, reporting to the Personal Information Protection Commission, and formulation of recurrence prevention measures.

1. When the Company receives a request from the principal for notification of purpose of use, disclosure, correction, addition, deletion, suspension of use, erasure, or suspension of provision to third parties (collectively, "disclosure, etc.") regarding retained personal data, the Company will respond in accordance with laws and regulations.

1. How to submit a request

To request disclosure, etc., complete the Company's prescribed request form, attach identification documents (item 3 below), and submit it by mail or email to the contact point set forth in Article 17. After receiving the request form, the Company will provide separate guidance on required procedures.

2. Requests by an agent

If disclosure, etc. is requested through an agent, submit documents proving authority to act (such as a letter of authorization) together with identification documents for the agent.

3. Identification documents

Identification documents include a copy of a driver's license, passport, health insurance card, or other photo identification issued by a public authority.

4. Fees

For requests for disclosure or notification of purpose of use, a fee of 1,000 yen (tax included) per request applies. Pay by the method designated by the Company. No fee applies to requests for correction, addition, deletion, suspension of use, erasure, or suspension of provision to third parties.

5. Response period

The Company will respond to requests for disclosure, etc. without delay after receiving the request form and identification documents and, in principle, within 30 days of receipt, except where a reasonable reason such as time required for investigation applies.

1. When personal information is no longer necessary to achieve the purposes of use, the Company will erase or dispose of it without delay. If retention for a certain period is required by law, the Company will not retain it beyond the period prescribed by that law.

2. Approximate retention periods by main category of information are as follows.

2. Disposal is carried out by necessary and appropriate methods to prevent risk of external leakage (for electromagnetic records, erasure by means that prevent restoration; for paper media, dissolution, incineration, or similar methods).

1. For opinions, questions, complaints, or other inquiries regarding this Policy or handling of personal information, contact the office below. The Company cannot accept requests made by visiting our office in person. Thank you for your understanding.

1. The Company may review this Policy from time to time and change all or part of its content. When making a change, the Company will announce the effective date and content of the changed Policy to users by posting it on the Company website.

2. The changed Policy takes effect when posted on the Company website. If a change requires the principal's consent under law, the Company will obtain separate consent from the principal.

1. This Policy is the basic policy commonly applied to all services and secretariat operations operated by the Company. If the Company establishes individual terms for a specific service, campaign, or event that differ from this Policy, the provisions of those individual terms take precedence, and conflicting parts of this Policy do not apply to the extent they differ from those individual terms.

1. The interpretation and application of this Policy are governed by the laws of Japan.

2. The Tokyo District Court has exclusive agreed jurisdiction in the first instance for disputes relating to this Policy.

June 2, 2023

July 22, 2026

Cation Inc.

Yuya Ushiro, Representative Director