Privacy Policy

1. Definition of Personal Information

   In this Policy, "personal information" means personal information as defined in Article 2, Paragraph 1 of the APPI.

2. Purposes of Use of Personal Information

   The Company uses personal information for the following purposes.

   1. Customer and user information
      1. To provide the Company's services and products (the "Services")
      2. To provide information about the Services and to respond to inquiries
      3. To inform you about the Services
      4. To respond to conduct that violates the Company's terms, policies and the like relating to the Services (the "Terms")
      5. To notify you of changes to the Terms relating to the Services
      6. To improve the Services and develop new services
      7. To create statistical data, processed into a form that cannot identify individuals, in connection with the Services
      8. To analyze the attributes and preferences of acquired customer and user information, and to display content, advertisements and the like of the Services or third-party services optimized for those attributes and preferences, and to send messages by email, SMS, online chat, browser notifications and similar means
      9. To run prize draws, campaigns and the like
      10. To carry out the Company's customer success and customer support operations
      11. To deliver behaviorally targeted advertising through advertising networks such as Google and Yahoo!
      12. To analyze attribute information, behavioral history and the like acquired by the Company in order to understand customers' interests and preferences
      13. To hold, operate, manage and provide information about exhibitions, seminars and other events
      14. Any purpose incidental to the above
   2. Employee information
      1. For employment management and internal procedures
      2. For payment of salaries, bonuses and the like
      3. For business communications
      4. For filings and reports to government agencies, such as the preparation of withholding tax statements
      5. To investigate and respond to conduct prohibited by work rules, employment agreements and the like
      6. Any purpose incidental to the above
   3. Job applicant information
      1. For screening and communication in recruitment activities
      2. For onboarding procedures
      3. Any purpose incidental to the above
   4. Contractor information
      1. For business communications
      2. For payment of contractor fees and the like
      3. For administration relating to the preparation of payment records for remuneration, fees, contract fees and prize money
      4. To investigate and respond to conduct prohibited by contracts and the like
      5. Any purpose incidental to the above
   5. Shareholder information
      1. For shareholder administration and procedures under the Companies Act and other laws
      2. For notices and communications to shareholders
      3. For filings and reports to government agencies
      4. Any purpose incidental to the above

3. Changes to the Purposes of Use

   The Company may change the purposes of use of personal information to the extent reasonably recognized as relevant to the original purposes, and will notify the individual who is the subject of the personal information (the "Individual") of, or publicly announce, any such change.

4. Restrictions on Use of Personal Information

   Except where permitted by the APPI or other laws, the Company will not handle personal information beyond the scope necessary to achieve the purposes of use without the consent of the Individual. However, this does not apply in the following cases:

   1. Where required by law
   2. Where necessary to protect a person's life, body or property and it is difficult to obtain the Individual's consent
   3. Where particularly necessary to improve public health or promote the sound development of children and it is difficult to obtain the Individual's consent
   4. Where necessary to cooperate with a national or local government agency, or a party entrusted by one, in performing duties prescribed by law, and obtaining the Individual's consent is likely to impede the performance of those duties

5. Proper Acquisition of Personal Information

   1. The Company acquires personal information properly and does not acquire it by deception or other improper means.
   2. Except in the following cases, the Company does not acquire special care-required personal information (as defined in Article 2, Paragraph 3 of the APPI) without the prior consent of the Individual.
      1. Where any of the items in Section 4 applies
      2. Where the special care-required personal information has been made public by the Individual, a national government agency, a local government, a party listed in Article 57, Paragraph 1 of the APPI, or another party prescribed by the rules of the Personal Information Protection Commission
      3. Where special care-required personal information that is outwardly evident is acquired by visually observing or photographing the Individual
      4. Where special care-required personal information is received from a third party and that third party's provision falls under any of the items in Section 7.1
   3. When receiving personal information from a third party, the Company confirms the following matters as prescribed by the rules of the Personal Information Protection Commission, except where the third party's provision of the personal information falls under any of the items in Section 4 or Section 7.1.
      1. The name and address of the third party and, in the case of a corporation, the name of its representative (or, for an unincorporated body with a designated representative or administrator, the name of that representative or administrator)
      2. The circumstances under which the third party acquired the personal information

6. Security Management of Personal Information

   To guard against risks such as loss, destruction, alteration and leakage of personal information, the Company takes necessary and appropriate security measures, including necessary and appropriate supervision of employees, appointment of a personal information manager, establishment of internal rules, entry and exit controls, restrictions on devices brought in, restrictions on access to information, and measures to prevent unauthorized access. Where the Company entrusts all or part of the handling of personal information to a third party, it exercises necessary and appropriate supervision to ensure that the contractor manages the personal information securely. For questions about these security measures, please use the contact form described in Section 13.

7. Provision to Third Parties

   1. Except where any of the items in Section 4 applies, the Company does not provide personal information to third parties without the prior consent of the Individual. However, the following cases do not constitute provision to a third party:
      1. Where personal information is provided in connection with entrusting all or part of its handling to a contractor within the scope necessary to achieve the purposes of use
      2. Where personal information is provided as a result of business succession due to merger or other reasons
      3. Where personal information is jointly used in accordance with the APPI
   2. Notwithstanding Section 7.1, except where any of the items in Section 4 applies, when providing personal information to a third party in a foreign country (excluding countries designated by the rules of the Personal Information Protection Commission under Article 28 of the APPI) that is not a party that has established a system conforming to the standards designated by those rules under Article 28 of the APPI, the Company obtains the Individual's prior consent to the provision to a third party in a foreign country.
   3. When the Company provides personal information to a third party, it prepares and retains records in accordance with Article 29 of the APPI.
   4. When the Company receives personal information from a third party, it carries out the necessary confirmation and prepares and retains records of that confirmation in accordance with Article 30 of the APPI.

8. Disclosure of Personal Information

   When an Individual requests disclosure of personal information (including disclosure of records of provision to or receipt from third parties) or notification of the purposes of use in accordance with the APPI, the Company will, after confirming that the request is made by the Individual, disclose or notify without delay (or notify the Individual if the personal information does not exist). However, this does not apply where the Company is not obliged to disclose under the APPI or other laws. Please note that a fee of JPY 1,000 per request is charged for disclosure of personal information.

9. Correction of Personal Information

   When an Individual requests correction, addition or deletion (collectively, "Correction") of personal information in accordance with the APPI on the grounds that it is inaccurate, the Company will, after confirming that the request is made by the Individual, conduct the necessary investigation without delay within the scope necessary to achieve the purposes of use, make the Correction based on the results, and notify the Individual (or notify the Individual if it decides not to make the Correction). However, this does not apply where the Company is not obliged to make the Correction under the APPI or other laws.

10. Suspension of Use of Personal Information

    When an Individual requests suspension of use or deletion (collectively, "Suspension of Use") of personal information in accordance with the APPI on the grounds that it is being handled beyond the scope of the publicly announced purposes of use, that there is a risk of encouraging or inducing unlawful or unjust conduct, or that it was acquired by deception or other improper means, or requests suspension of provision to third parties ("Suspension of Provision") on the grounds that it is being provided to a third party without the Individual's consent, and the request is found to be justified, the Company will, after confirming that the request is made by the Individual, suspend use or provision of the personal information without delay and notify the Individual. However, this does not apply where the Company is not obliged to suspend use or provision under the APPI or other laws.

11. Handling of Anonymized Information

    1. When creating anonymized information (as defined in Article 2, Paragraph 6 of the APPI and limited to information constituting an anonymized information database or the like under Article 16, Paragraph 6 of the APPI; the same applies below), the Company processes personal information in accordance with the standards prescribed by the rules of the Personal Information Protection Commission.
    2. When the Company creates anonymized information, it takes security measures in accordance with the standards prescribed by the rules of the Personal Information Protection Commission.
    3. When the Company creates anonymized information, it publicly announces the categories of information about individuals contained in the anonymized information, as prescribed by the rules of the Personal Information Protection Commission.
    4. When the Company provides anonymized information (including anonymized information it has created and anonymized information received from third parties; the same applies below unless otherwise stated) to a third party, it publicly announces in advance the categories of information about individuals contained in the anonymized information to be provided and the method of provision, as prescribed by the rules of the Personal Information Protection Commission, and expressly informs the third party that the information provided is anonymized information.
    5. In handling anonymized information, the Company does not, for the purpose of identifying the Individual to whom the personal information used to create the anonymized information relates, (1) collate the anonymized information with other information, or (2) acquire descriptions or individual identification codes deleted from the personal information, or information about the processing method applied under Article 43, Paragraph 1 of the APPI ((2) applies only to anonymized information received from third parties).
    6. The Company itself takes the measures necessary to ensure the proper handling of anonymized information, including necessary and appropriate measures for its security management and the handling of complaints about its creation and other handling, and endeavors to publicly announce the content of those measures.

12. Use of Cookies and Google Analytics

    The Company may use cookies and similar technologies. These technologies help the Company understand how its Services are used and contribute to improving them. Users who wish to disable cookies can do so by changing their web browser settings; however, disabling cookies may prevent the use of some features of the Services. The Company also uses Google Analytics to understand how its website is used. For details of how Google Analytics collects and processes data, please see the following:

    • Google Analytics Terms of Service
    • Google Privacy Policy
    • How Google uses information from sites or apps that use its services

13. Contact

    For requests for disclosure and the like, opinions, questions, complaints and other inquiries regarding the handling of personal information, please use the contact form below.

    https://quado.io/en/#contact

14. Continuous Improvement

    The Company reviews the operation of its handling of personal information as appropriate, strives for continuous improvement, and may amend this Policy as necessary.

15. Handling of Personal Data Received on the Basis of an Adequacy Decision

    In addition to the preceding Sections, the following provisions apply to personal data received on the basis of an Adequacy Decision as defined below. Where the provisions of this Section differ from the preceding Sections, this Section prevails.

    1. Definitions
       • "EU" means the European Union, including the EU member states and, under the European Economic Area (EEA) Agreement, Iceland, Liechtenstein and Norway.
       • "GDPR" means the Regulation of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
       • "Adequacy Decision" means a decision by the European Commission under Article 45 of the GDPR that a country, territory or the like ensures an adequate level of protection of personal data.
    2. Where personal data received from the EU on the basis of an Adequacy Decision contains information concerning sex life, sexual orientation or trade union membership, which is defined as "special categories of personal data" under the GDPR, the Company treats that information as special care-required personal information.
    3. The Company treats personal data received from the EU on the basis of an Adequacy Decision as retained personal data under Article 16, Paragraph 4 of the APPI, regardless of the period within which it is scheduled to be deleted, unless it falls under "data whose existence, if revealed, would harm the public interest or other interests as prescribed by Cabinet Order" under that paragraph.
    4. When the Company receives personal data from the EU on the basis of an Adequacy Decision, it confirms and records the circumstances of acquisition, including the purposes of use specified when the personal data was received from the EU, in accordance with Article 30, Paragraphs 1 and 3 of the APPI.
    5. When the Company receives personal data from another business operator that received it from the EU on the basis of an Adequacy Decision, it confirms and records the circumstances of acquisition, including the purposes of use specified when the personal data was received, in accordance with Article 30, Paragraphs 1 and 3 of the APPI.
    6. For personal data confirmed and recorded under Section 15.4 or 15.5, the Company specifies the purposes of use within the scope of the purposes specified at the time of the original or subsequent receipt, and uses the personal data within that scope.
    7. When providing personal data received from the EU on the basis of an Adequacy Decision to a third party in a foreign country, the Company, in obtaining the Individual's consent under Section 7.2, provides the Individual with the information about the circumstances of the transfer destination necessary to make a decision on consent, and obtains the Individual's prior consent to the provision of personal data to a third party in a foreign country.
    8. Personal data received from the EU on the basis of an Adequacy Decision is deemed anonymized information only where the processing method information (descriptions and individual identification codes deleted from the personal information used to create the anonymized information, and information about the processing method applied under Article 43, Paragraph 1 of the APPI, limited to information that could be used to restore that personal information) is deleted so that it is impossible for anyone to re-identify the anonymized individual.

Established: August 20, 2026
Quado, Inc.