プライバシーポリシーおよび各種方針

1.Purposes for Using Personal Information

We use personal information for the following purposes:

1. Personal information of registered temporary staffing and job placement candidates (used within the scope of our staffing and placement services, including job referrals)
2. Personal information processed in connection with HR and payroll administration services (used to perform our obligations under outsourced service agreements)
3. Personal information handled in our ship agency business (used for notifications and filings relating to passengers and crew members)
4. Personal information handled in our shipping cargo agency business (used for contract preparation and related operations)
5. Personal information handled in our shipbroking business (used for contract preparation and related operations)
6. Personal information of job applicants (used for recruitment and selection purposes)
7. Personal information relating to personnel (used for the operation of our business and personnel administration)

If, in cases other than those described above, we obtain personal information directly from individuals seeking registration for staffing or job placement services, or from job applicants, through written forms, web-based applications, or similar means, we will clearly indicate the purpose of use at the time of collection. This does not apply where urgent action is required to protect a person’s life, body, or property.

2.Disclosure of Personal Information to Third Parties

We do not disclose personal information obtained from individuals to any third party without prior consent, except in the following circumstances:

1. Where required by law
2. Where disclosure is necessary to protect a person’s life, body, or property, and it is difficult to obtain the individual’s consent
3. Where disclosure is particularly necessary to improve public health or promote the sound development of children, and it is difficult to obtain the individual’s consent
4. Where cooperation with a national or local government body, or a party acting on its behalf, is necessary for the performance of duties prescribed by law, and obtaining the individual’s consent may impede the performance of those duties

3.Disclosure of Personnel Information to Third Parties

We may disclose personal information relating to our personnel to third parties only in the following circumstances:

1. Purpose of disclosure: the purposes described in 1-7 above, together with matters relating to recruitment, promotion, and evaluation of personnel
2. Personal information disclosed: general profile information such as name, address, and date of birth, together with information required for HR and labour administration, including pay, attendance, and employee benefits
3. Scope of disclosure: group companies (Suzuyo & Co., Ltd., Suzuyo Holdings Co., Ltd., and Nippon Yusen Kabushiki Kaisha), and companies to which personnel are seconded
4. Responsible person: our Personal Information Protection Manager

4.Shared Use of Personal Information Relating to Personnel

We may share the personal information of personnel only in the following circumstances:

1. Purpose of shared use: the purposes described in 1-7 above, together with matters relating to recruitment, promotion, and evaluation of personnel
2. Personal information shared: general profile information such as name, address, and date of birth, together with information required for HR and labour administration, including pay, attendance, and employee benefits
3. Scope of shared use: group companies
4. Person responsible for shared use: our Personal Information Protection Manager

5.Procedures for Data Subject Requests

We respond to requests from individuals or their representatives regarding retained personal data, including requests for notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, erasure, suspension of provision to third parties, and disclosure of records of provision to third parties (collectively, “Data Subject Requests”).

1. Categories of Personal Information Subject to Data Subject Requests
   The categories of personal information subject to Data Subject Requests are as follows:

   • Personal information of registered temporary staffing and job placement candidates (items provided by the individual, such as name, address, telephone number, work history, qualifications, and registration number)
   • Personal information of job applicants (items provided by the individual, such as name, address, telephone number, and professional background)
2. Where to Send Data Subject Requests and How to Apply

   • To make a Data Subject Request, please contact the Personal Information Enquiry Desk listed in Section 7 below to obtain the prescribed application form.
   • Please submit the completed application form by post together with the required identity verification documents. Acceptable documents are a copy of one of the following: driver’s licence, passport, health insurance card, or the front side of the My Number Card.
   • If a request is submitted by someone other than the individual concerned, documents proving the representative’s authority must also be enclosed in addition to the documents above.

     • a) In the case of a statutory representative (parental authority holder, guardian of a minor, or adult guardian)
     • – A copy of one of the following: the individual’s family register, a copy of a family court decision, or, in the case of a parental authority holder, a health insurance certificate showing the individual as a dependent
     • – A copy of an official document identifying the statutory representative, such as the statutory representative’s driver’s licence, passport, health insurance card, or the front side of the My Number Card
     • b) In the case of an authorised representative
     • – A letter of authorisation (to be completed in the authorisation section of our prescribed application form)
   • We will send our response to the address stated on the applicant’s application form.
   • Any personal information obtained in connection with a Data Subject Request will be used only to the extent necessary to receive and respond to the request. Documents submitted to us will be retained for two years after the response has been completed and will then be disposed of appropriately.
   • We may decline to disclose retained personal data in the following circumstances. If we decide not to disclose the data, we will notify you accordingly and explain the reason.

     • a) The prescribed application documents are incomplete
     • b) We are unable to verify the individual, for example because the address on the application form, the address shown on the identity verification documents, and the address registered with us do not match
     • c) In the case of an application by a representative, we are unable to verify the representative’s authority
     • d) The request does not concern retained personal data
     • e) Disclosure may harm the life, body, or other rights or interests of the individual or a third party
     • f) Disclosure may seriously interfere with the proper conduct of our business
     • g) Disclosure would otherwise violate applicable laws or regulations
3. Fees for Disclosure and Notification of Purpose of Use

   • For requests for disclosure of personal information or notification of the purpose of use, a fee of JPY 1,000 (including tax) will be charged for each request. Please enclose a postal money order equivalent to JPY 1,000 when sending your application form.

6.Measures Taken for the Secure Management of Personal Data

Establishment of Basic Policy

• We have established and published a Personal Information Protection Policy to ensure compliance with the Act on the Protection of Personal Information and other applicable laws and regulations, and to promote the proper handling of personal information.

Development of Rules for Handling Personal Data

• Based on the Personal Information Protection Policy referred to above, we have established internal rules setting out the basic requirements for handling personal information, including the necessary and appropriate measures to ensure the secure management of personal data, as described below.

Organisational Security Measures

• We appoint a person responsible for the handling of personal data, clarify which personnel handle personal data and the scope of the data they handle, and maintain a reporting structure for escalation to that person.
• To ensure operations are carried out in accordance with our internal rules, we maintain records relating to the handling of personal data and make it possible to monitor the status of such handling.

Human Security Measures

• Upon entering into an employment agreement, we enter into confidentiality agreements relating to personal data, and we also provide all personnel with the necessary and appropriate education and training on the secure handling of personal data after they join us.

Physical Security Measures

• We manage entry to and exit from areas used by personnel, place restrictions on devices and items brought into those areas, and implement measures to prevent unauthorised persons from viewing personal data.
• We take steps to prevent theft, loss, or similar incidents affecting devices, electronic media, and documents containing personal data. When such devices or media are transported, we implement measures such as encryption so that personal data cannot easily be identified.

Technical Security Measures

• We implement technical safeguards including access controls for information systems handling personal data, identification and authentication of users, measures to prevent unauthorised access, protections against data leakage such as encryption and password controls, and monitoring of information systems.

Consideration of the External Environment

• Where we use external cloud services or outsource operations to third parties, we implement appropriate security management measures.