Principles of acquisition

We acquire the minimum personal information to the extent necessary to achieve our purpose of use by one of the following methods.

• When obtaining personal information directly from you: As a general rule, we acquire personal information after obtaining your consent.
• In the event we acquire your personal information from a third party: We acquire personal information from a third party after confirming that you have agreed to the provision of your personal information to other parties.
• When acquiring personal information through entrustment from business partners: We acquire personal information to the extent necessary for performance of the consigned services.

We will not, in principle, acquire sensitive information that may cause unreasonable discrimination, prejudice, or other disadvantages. However, if there are justifiable grounds within the extent of the purpose of use of the personal information, we may obtain the following sensitive information after obtaining your consent.

Examples of sensitive information

• Matters relating to political views, philosophical beliefs and religion
• Race, ethnicity, family origin, physical or mental disability, criminal record and other matters that may cause social discrimination
• Matters concerning the right of workers to organize, collective bargaining or other collective action
• Participation in collective demonstrations, exercise of the right to petition and other matters concerning the exercise of political rights
• Information related to health, medical or sexual history

We may acquire, store and use Individual Related Information which contains attribute information (such as age, gender and residential area) that does not correspond to personal information on its own or information of Internet use (such as IP addresses, MAC addresses, SSID, terminal identifiers such as cookies, RDID and web beacons).

In addition, we may receive, store and use Individual Related Information from DMP operators and other advertising companies, research and analysis companies, media operators, database management companies and other business contractors and partners.

Although it is not possible to identify a particular individual on its own, after obtaining your consent, we may treat it as identifiable data by linking it to other information that we hold.

Purpose of use of personal information

In principle, when acquiring personal information, we will clearly indicate the purpose of use in writing, on the website screen, orally or by other means on a case-by-case basis.

When the purpose of use for personal information is clear, such as when the contact is initiated or requested by you, or when the business card is exchanged under business practices, we may not indicate the purpose of use. Even in this case, the personal information acquired will be used within the extent of the purpose of use indicated to you.

Personal information on the person who requested the inquiry or consultation, etc.

• To respond appropriately to inquiries and consultations from you
• In order to request cooperation to satisfy the request for the above consultation service, etc.

Personal information acquired through consigned services

• To perform consigned services such as operation, maintenance and improvement of the quality of our services, response to inquiries about the services, planning, development, advertising, introducing and marketing of beauty and health related products and services

Personal information handled in training and public relation activities

• For publishing in training materials and other uses in various training sessions
• For corporate brochures and other public relation activities

Personal information related to business partners

• For business negotiations and associated contacts

Information on "recruitment candidates" (including unofficial offers, early unofficial offers, and internships)

• For sharing information and communicating with recruitment candidates, including internships
• For recruitment selection
• For job offer management
• For consideration of assignments after formal employment

Information on "employees"

• For the management of employees

Information on "retirees"

• To provide information to retirees and to pay retirement benefits and pensions

Information on disclosure, etc. of personal information and applicants for complaints and consultations

• In order to respond to disclosure, etc., of personal information (disclosure of the purpose of use, disclosure, correction, addition, deletion, cease of utilization and cease of provision to a third party of personal information)

Applicant information on other recruitment activities

• To operate, maintain, develop and improve other application activities, and to respond to inquiries about the activities
  *For the detailed purpose of use for personal information for each activity, please check the Terms of Use or the equivalent document for each activity.

Provision of personal information, etc., to a third party

In the event we provide personal information to a third party (a company other than us), except as otherwise provided by laws and regulations, we shall obtain your prior consent concerning the provision to a third party.

Provided, however, that even if it is provided to a company other than us, in the following cases, it may not be regarded as a "third party" because it may be regarded as the same entity as us in substance, and therefore, we may not obtain your prior consent for such provision.

• When outsourcing all or part of the handling of personal information to an outside company, etc.
• Cases where personal information is provided due to merger of the Company or succession of business, etc.
• Where two or more companies, etc., jointly use personal information in order to achieve the "Purpose of Use"

In some cases, we may handle Individual Related Information. When we provide Individual Related Information to a third party, personal information provided may be treated as personal information at the third-party recipient by linking it to other data held by the third-party recipient. In the event it is anticipated that Individual Related Information will be handled in such a manner, we will provide Individual Related Information to a third party only after confirming that consent has been obtained from you.

Provision of personal information to a third party in a foreign country

We may provide retained personal information to a third party in a foreign country by one of the following methods:

1. 1.Provision based on your consent (please see here [PDF: 95KB]for specific information)
2. 2.Provision of personal information to a third party in EU/EEA member countries and the United Kingdom which are recognized as having a personal information protection system at the same level as Japan in the "Enforcement Rules for the Act on the Protection of Personal Information (Rules of the Personal Information Protection Commission No. 3 of 2016)"
3. 3.Provision to a party to whom it is considered possible to guarantee that measures for the handling of personal information required by the Act on the Protection of Personal Information in Japan are continuously taken

Example of paragraph 3:

• Cases where the handling of personal information is entrusted to a business operator in a foreign country, and where it is clearly stipulated by contract that the measures required by the Act on the Protection of Personal Information in Japan will be taken
• Provision to companies within the Shiseido Group overseas in compliance with the privacy management rules established within the Group

Joint utilization of personal information

We may jointly utilize acquired personal information with other companies in accordance with procedures permitted by laws and regulations. When we jointly utilize personal information with other companies, we provide notice of the following.

• The fact that they will jointly utilize personal information
• The categories of the jointly utilized personal information
• Scope of the joint user
• The purpose of use by the joint user
• The name or appellation and address of the person responsible, and, for a corporate body, the name of its representative responsible for controlling the said personal data

Deleting personal information

We will strive to delete personal information without delay if we have achieved the matters stated in the purpose of use of personal information and determine that there is no need to retain such personal information. When possible, the retention period of the personal information shall be stated in the terms of use for the individual service, etc. In addition, if we receive a request from you to delete your personal information, we will delete the personal information unless there are special circumstances.

When consent is obtained from a person other than you

If you do not have sufficient ability to judge the consequences of your consent to the handling of personal information, your representative or someone other than you may provide consent on your behalf.

Ensuring the security of personal information

In order to ensure the security (confidentiality, integrity and availability) of personal information, we will establish and maintain a system for the protection and management of personal information and procedures for the handling of personal information, and will properly protect, manage and use such information.

• Confidentiality: Manage personal information so that it is not accessible to anyone other than a defined person
• Integrity: Manage personal information so that it is not falsified or damaged
• Availability: Manage the handling of personal information so that it is available only in situations where it is necessary

The personal information protection management system consists of the implementation of safety management measures from the aspects of organization, people, physical and technology. An overview of this is shown below.

<Organizational safety management measures>
In handling personal information, we appoint a Representative Director as the Information Manager and under the direction of the Information Manager, the persons handling personal information will be limited to ensure appropriate protection, management, and use.
The Information Manager is obliged to conduct periodic inspections of the management and operation of personal information. In the event that improper handling of personal information is discovered through inspections, we shall identify the cause of such improper handling, implement corrective measures, formulate measures to prevent recurrence and inform employees.

<Human safety management measures>
In order for employees to properly handle personal information, we regularly conduct education and training programs for all employees engaged in business related to the handling of personal information.

<Physical safety management measures>
In order to restrict access to facilities where personal information is stored, we are reinforcing the security of these facilities, certifying those who enter and leave these facilities and taking measures to prevent others from accessing them. In addition, records of those entering and leaving the facilities are prepared for confirmation later on.

<Technical safety management measures>
When personal information is handled through a system, the establishment, management, operation and security measures, etc., of the system will be implemented in accordance with the regulations concerning the handling of information systems. Certification and authorization functions will be provided so that the person in charge can perform only the identified operations, and monitoring will be conducted to ensure that there are no problems in the status of handling.

<Understanding of the external environment>
When we handle personal information in a foreign country, we take safety management measures based on an understanding of the systems related to the protection of personal information in the relevant foreign country. Please refer to this (link [PDF: 95KB])for detailed information.

Entrustment of operations handling personal information

In the event it is necessary to provide retained personal information to an entrusted company due to the entrustment of business involving the handling of personal information, we will include an agreement requiring the appropriate management of the information designated by us after carefully selecting a trustworthy company. In addition, we regularly receive reports on the status of handling personal information from the entrusted company in order to confirm that they properly handle personal information in accordance with the applicable agreement, and if there are any problems, we will clearly indicate the measures to be taken for improvement as needed.

Handling pseudonymously processed information

In some cases, we may handle pseudonymously processed information after appropriately processing personal information in our possession in accordance with laws and regulations. In the event the information is used as pseudonymously processed information for purposes other than those stated in the purpose of use of the personal information, the following matters shall be disclosed.

• Contents of pseudonymously processed information to be prepared
• Purpose of use of pseudonymously processed information

When handling anonymously processed information

We may prepare and provide anonymously processed information to a third party by properly processing the obtained personal information so that it cannot be identified as belonging to a specific individual and the personal information used for the preparation thereof cannot be restored in accordance with the procedures permitted by laws and regulations.
When preparing or providing anonymously processed information, the following matters shall be publicly announced.

• Safety management measures, etc., concerning anonymously processed information
• Categories of information relating to an individual contained in anonymously processed information to be prepared
• Categories of information relating to an individual contained in anonymously processed information to be provided to third parties and its providing method
• Inquiry method for anonymously processed information

Matters concerning the procedure for responding to a demand, etc., for disclosure, etc.

In response to a request from you, we will respond to a notification of the purpose of use, disclosure, correction, addition or deletion, cease of utilization and cease of provision to a third party of personal information and disclosure of records relating to the provision or receipt of personal information to a third party (hereinafter referred to as "disclosure, etc.") with regard to personal information stated in the purpose of use of personal information. To request disclosure, please contact us at the following: "For inquiries about personal information." Please refer to the individual service terms of use for the party to whom the demand for disclosure, etc., is made, the method of request and the contents that can be handled with regard to individual services. Please note that we may not be able to accept your demands.

For inquiries about personal information

We will promptly respond to requests for the handling of personal information. If necessary, please contact us at the following address.

<Contact Information>
Shiseido Interactive Beauty Company, Limited
2-3-1 Hamamatsucho, Minato-ku, Tokyo 105-8620
Phone: 03-5402-4777　(9:00-17:00; excluding Saturdays, Sundays and national holidays)
Mail: sib-info@shiseidointeractive.com

<Name and address of business operator handling personal information and name of representative>

Name

Shiseido Interactive Beauty Company, Limited

Address

7-5-5, Ginza, Chuo-ku, Tokyo 104-0061

Representative

Atsunori Takano, Co-Representative Director and President