It is the social responsibility of Toyota Tsusho Insurance Management Corporation (hereinafter referred to as "the company") to appropriately handle and securely manage information provided by clients. Appropriate and secure management also forms the basis for the building of a relationship of mutual trust between the company and its clients.

In order to protect personal information provided by clients, the company complies with the Personal Information Protection Law and all other laws and regulations related to the protection of personal information as well as any guidelines stipulated by the cabinet minister in charge. The company has also formulated the following Basic Policy, and based on this we endeavor to handle and protect personal information appropriately.

I. Obtaining personal information appropriately and notifying clients or announcing the purposes for which it is used

The company specifies the purposes for which information is used as much as possible, and uses appropriate methods to collect personal information (i.e. information about living persons that can be used to identify individuals). When obtaining information, the company either declares the purposes for which it will be used in advance, or notifies the client, or announces those purposes as soon as possible after the information has been obtained. However if the information was obtained directly from the client in writing or otherwise, the company explains its purpose clearly in advance (hereinafter, these measures are referred to collectively as notifications or announcements).

II. Use of personal information

The company will only use personal information within the scope of the purposes of use it has announced or notified clients of. However this may not apply if the client's permission has been obtained in advance, or if an exception is required by law.

III. Provision of personal information to third parties

The Company will not provide or disclose personal data (meaning personal information used to build personal information databases, etc.; personal information databases are legally defined as collections of information including personal information that are systematically constructed to make it easy to search for specific personal information) to third parties without the advance consent of the client. However exceptions may be made in the following cases.

1. When required by law.
2. When necessary to protect life or property and where it is difficult to obtain the client's consent.
3. When specially necessary to improve public well-being or promote the healthy development of children, and where it is difficult to obtain the client's consent.
4. When it is necessary to cooperate with a government organization, or local government, or a person commissioned by such a body in the performance of their legally-mandated duties, and where obtaining the consent of the client may interfere with the performance of those duties.
5. Where the information is provided to a subcontractor to the extent necessary for the performance of the company's duties.

IV. Joint use with the company's affiliates

Under the following conditions, the company may share the use of a client's personal data with companies affiliated with the company, the parent company (Toyota Tsusho Corporation) or group companies (consolidated subsidiaries listed in the annual securities report) of the parent company within the scope of the purposes of use of which the client (meaning all business partners including suppliers and entities the company may do business with in the future) was informed or notified.

1. Personal data used jointly

   Company name, affiliation, full name, position, address, telephone number, email address, company website URL, fax number, other contact information written on business cards, etc.

2. Manager: Toyota Tsusho Insurance Management Corporation

V. Management of personal information

The Company endeavors to maintain accurate, up-to-date information to the extent necessary for the use of the personal data it handles. The company has also established necessary and appropriate measures to prevent leaks, destruction, damage or unauthorized access, and the company supervises employees and outsourced parties to ensure they manage information correctly.

VI. Inquiries about personal data held

If the company receives a request from the client (including their proxy) to disclose, notify the purpose of use, correct or desist from using, the client's own personal data (meaning personal data which the Company has the authority to disclose or edit the details of, excluding cases where clarifying the existence of such data may negatively affect the public interest or other interests as determined by cabinet order, or data that will be deleted within 6 months) held by the company, as stipulated by law, the company shall, having first confirmed that the request comes from the client (or their proxy), respond to the request as far as is reasonable.

VII. Response to complaints

The company will respond to complaints from clients about the personal information we handle in a speedy and appropriate fashion, and will build the company structure necessary to carry out this response.