Tokaido Sanyo Kyushu Shinkansen Internet Reservation Service Privacy Policy

(1) A customer’s name, date of birth, phone number, e-mail address, credit card expiration  date and information related to public transport IC card, as well as changes to such  information (excluding credit card number); 

(2) A history of past purchases of train tickets and travel-related products as well as  services related thereto collected by the Parties from transactions with a customer; (3) Device information and Cookies collected by the Parties from transactions with a  customer; 

(4) Opinions, questions, inquiries and the like which concern the use of the Service and  which are made by a customer by phone or e-mail; and 

(5) Name, gender, age, address, telephone number, and e-mail address of the customer, as entered at the time of application for Travel Products, and information on  transportation, accommodations, tourist facilities, and events used by the customer at  the time of use of the Travel Products. 

(i) For transactions with customers concerning, or for provision to customers of,  train tickets, travel-related products and other services related thereto and the  like; 

(ii) For delivery of promotional materials and printed materials, as service  information by mail, the Internet or any other means; 

(iii) For sales analysis, product development, and improvement of our websites and  other services; and 

(iv) For the purposes of conducting investigations necessary to respond to requests  made by customers and analysing and preparing statistics on member trends. (2) In the event that the Parties outsource to another company the collection of personal  information and any actions that fall under any of the purposes of use set forth herein,  the Parties shall, to the extent necessary for such company to conduct such outsourced  actions, entrust to the company the handling of personal information set forth in  Section 1 after having taken the measures to protect the personal information.

(i) A customer’s name, date of birth, phone number, e-mail address, credit card  expiration date and information related to public transport IC card, as well as  changes to such information (excluding credit card number); 

(ii) A history of past purchases of train tickets and travel-related products as well  as services related thereto collected by the Parties from transactions with a  customer; 

(iii) Device information and Cookies collected by the Parties from transactions  with a customer; and 

(iv) Opinions, questions, inquiries and the like which concern the use of the  Service and which are made by a customer by phone or e-mail. 

(i) For transactions with customers concerning, or for provision to customers of,  train tickets, travel-related products and other services related thereto and the  like; 

(ii) For delivery of promotional materials and printed materials, as service  information, by mail, the Internet or any other means; 

(iii) For sales analysis, product development, and improvement of our websites and  other services; and 

(iv) For the purposes of conducting investigations necessary to respond to  requests made by customers and analyzing and preparing statistics on  member trends. 

(2) Cases in which the disclosure or provision of personal information is based on laws  and regulations of Japan; 

(3) Cases in which the disclosure or provision of personal information is necessary for  the protection of the life, body or property of an individual, and when it is difficult to  obtain the consent of the principal; 

(4) Cases in which the disclosure or provision of personal information is particularly  necessary for improving public health or promoting the sound growth of children, and  when it is difficult to obtain the consent of the principal; 

(5) Cases in which the disclosure or provision of personal information is necessary for  cooperating with a Japanese state organ, a Japanese local government or an individual  or a business operator entrusted by either of the former two in executing the affairs  prescribed by laws and regulations of Japan, and obtaining the consent of the principal  is likely to impede the execution of the affairs concerned; or 

(6) Cases in which the disclosure or provision of personal information is necessary for  cooperating with the issuers of customers’ credit cards, and with the credit card  payment agents used by the Parties for smart EX payments, in order for credit card  issuers to detect and prevent any unauthorized use of credit cards. 

(1) For transactions with customers concerning, or for provision to customers of, train  tickets, travel- related products and other services related thereto and the like; (2) For delivery of promotional materials and printed materials, as service information, by  mail, the Internet or any other means; 

(3) For sales analysis, product development, and improvement of our websites and other  services; and 

(4) For the purposes of conducting investigations necessary to respond to requests made  by customers and analysing and preparing statistics on member trends. 

(i) A customer’s name, date of birth, phone number, e-mail address, credit card  expiration date and information related to public transport IC card, as well as  changes to such information (excluding credit card number); 

(ii) Information collected by the Parties from transactions with a customer, such  as a history of past purchases of train tickets and travel-related products as  well as services related thereto; 

(iii) Device information and Cookies collected by the Parties from transactions with  a customer; and 

(iv) Name, gender, age, address, telephone number and e-mail address of the  customer, as entered at the time of application for Travel Products, and  information on transportation, accommodations, tourist facilities, and events  used by the customer at the time of use of the Travel Products. 

• Application form for notification of purposes of use, or disclosure, of retained personal data 

• Application form for correction, etc. of retained personal data 

• Application form for discontinuation of use, etc. of retained personal data [B] Identification documents 

• One of the following: Passport or driver’s license  

• If the principal cannot be identified due to, among other reasons, any inconsistency  between the information indicated on the application form, the information indicated on  the identification document and the content of retained personal data 

• If the authority of representative cannot be confirmed when an application form is sent by  a representative 

• If any of the designated application documents is insufficient 

• If the target of the Request for Disclosure, Etc. does not fall under retained personal data • If there is a risk of harming the life, body or property, or any of the rights and interests of  the principal or of a third party 

• If there is a risk of significantly impeding the proper execution of the Parties’ businesses • If any provision of any laws and regulations of Japan other than the Personal Information  Protection Act requires that all or part of such retained personal data capable of identifying the principal be disclosed to the principal by a method equivalent to the method prescribed  in the main clause of Article 33, paragraph 2 of the Personal Information Protection Act. • If disclosure will constitute a violation of any other laws or regulations of Japan. 

○ For contact by phone 

Tokaido Sanyo Kyushu Shinkansen Internet Reservation Service Customer Center  JR Central Shinagawa Building-A Wing 

2-1-85 Konan, Minato-ku, Tokyo 108-8204 

Phone number (Not toll-free): +81-(0) 3-6632-5130 (English) 

Business hours: 5:30–23:30 (JST)

○ For contact via the Internet or by mail 

Where an inquiry is made via the Internet or by mail using a Party’s contact point, we are  unable to respond to inquiries concerning individual personal information. Please note that  we may respond by a phone call or by other means. 

○ Visit to a Party’s place of business 

Please note that personal visits to a Party’s place of business in relation to complaints cannot  be accepted. 

(1) Formulation of a basic policy: 

• Formulate this “Privacy Policy” as a basic policy for compliance, etc. with the  relevant laws and regulations, and guidelines to secure the proper handling of  personal information; 

(2) Development of personal data handling rules: 

• Formulate internal rules and manuals for the handling method, managers and  responsible persons, and their duties, etc. for the respective stages of acquisition,  use, storage, provision, deletion, destruction, etc.; 

(3) Organizational measures for secure management: 

• Appoint a manager responsible for the handling of personal data; clearly define the  employees who handle personal data, and the scope of personal data handled by  those employees; and develop a system to report to the manager when any leakage,  etc., or violation of internal rules occurs or is found to be likely to occur; and 

• Conduct internal audits to ensure that personal data are handled in compliance with  the relevant laws and regulations, guidelines and internal rules; 

(4) Measures for secure management by human resources: 

• Provide employees with regular training for consideration in handling personal data; (5) Physical measures for secure management: 

• Manage employees’ entries in and exits from the areas where personal data are  handled, and restrict the devices, etc. used in those areas; and take measures to  prevent unauthorized persons from accessing personal data; and 

• Take measures to prevent theft, loss, etc. of devices, electronic media, documents,  etc., with, on or in which personal data are handled; and take measures to protect  the confidentiality of personal data to ensure that they are not easily identified when  carrying such devices, electronic media, etc., including moving within the Company  premises; 

(6) Technical measures for secure management: 

• Control access and restrict the scope of responsible persons, and the personal  information databases, etc. handled by those persons; and 

• Implement a mechanism to protect the information systems used to handle personal  data against unauthorized access by outsiders, or unauthorized software; and

(7) Understanding the external environment: 

• When handling personal data in a foreign country, implement measures for secure  management by understanding the personal information protection system in the  foreign country.