Polyplastics Group Code of Conduct

1. We shall not only comply with all laws and regulations, but also constantly act from a high ethical perspective and with common sense.
2. We shall contribute to the development of society as a good corporate citizen.
3. We shall supply safe and high-quality products and services that earn the satisfaction and trust of our customers.
4. We shall comply with international rules and the laws and regulations in force in each country, respecting culture and customs and striving to support the sound development of the local community.
5. We shall actively and impartially disclose trustworthy corporate information.
6. We shall act in accordance with the principles of fair and free competition, while engaging in sincere business transactions.
7. We shall vigorously engage in programs devoted to environmental preservation and maintenance of safety.
8. We shall appropriately manage the Company’s assets, information and other properties.
9. We shall respect the diversity, personality and individuality of every member connected to Polyplastics Group and shall contribute to realize a healthy and sound society that is free from descrimination and harassment.

Policies

Polyplastics Group Policy on the Protection of Personal Information (Privacy Policy)

Polyplastics Group (hereinafter referred to as “the Group”) recognizes that it is its social responsibility as a company to appropriately protect the personal information it possesses, and shall handle personal information in an appropriate manner in compliance with the “Act on the Protection of Personal Information”, other applicable laws and regulations concerning the protection of personal information and privacy as well as generally accepted practices, guidelines, etc. concerning the processing of personal information when acquiring, using and providing personal information.

In addition, the Group shall strive to clarify its rules and regulations concerning the handling of personal information and ensure that all employees and others are familiar with these rules and regulations so that they can properly handle personal information.

Personal information refers to information that can identify you as a specific individual, such as your address, name and phone number (including information that falls under “personal data” as defined in Article 4 of the General Data Protection Regulation (hereinafter referred to as “GDPR”).

Chapter 1: Processing of Personal Information in the Group

1. Purpose of use and legal basis

The Group shall use personal information on the following legal basis for the following purposes.

< Personal Information of Executives or Employees of Existing or Prospective Business Partners>
(Name, Address, Phone Number, E-mail Address, Company Name, Company Address, Department, Position, etc.)
・Conducting business transactions with and providing products and services to business partners
・Managing business partners
・Contact for business purposes
・Confirming visitors and their health condition
・Soliciting services, advertising and other marketing
・Sending of direct mails, e-mail magazines, and other greetings
・Implementing questionnaires, surveys, etc.
・Holding events
・Sending printed materials
・Planning and developing products, or considering measures to improve customer satisfaction
・Patent management services
・Responding to inquiries and sending of responses

< Personal Information of Trustees, etc. >
・Administrating outsourced trustees
・Contact for business purposes
・Confirming visitors and their health condition

< Personal Information of Applicants for Employment >
・Considering employment and sending recruitment-related documents
・Confirming visitors and their health condition
・Responding to inquiries and sending of responses

< Personal Information of Residents Living Near Our Facilities, Visitors to Our Facilities or Officials >
・Making evacuation directive and other necessary contact at the time of any emergency situation, such as natural disaster and other similar situation
・Responding to inquiries and sending of responses
・Confirming visitors and their health condition
・Implementing questionnaires, surveys, etc.
・Soliciting services, advertising and other marketing

2. Provision to third parties

The Group shall not provide personal information to third parties, except in any of the following cases. Provided, however, that the provision of such information shall not constitute disclosure or provision to a third party if it is provided as a result of joint use or entrustment.

1. Cases where the individual concerned has given consent
2. Cases where personal information is provided based on the laws and regulations of each country
3. Cases where the provision of personal information is necessary to protect the life, body, or property of an individual and it is also difficult to obtain the consent of the data subject.
4. CCases where the provision of personal information is especially necessary for the propose of improving public health or promoting the sound growth of children and it is also difficult to obtain the consent of the data subject.
5. Cases where the provision of personal information is necessary to cooperate with the national or local government in the execution of public affairs, and obtaining the consent may interfere with the execution of such affairs.
6. Cases where personal information is provided in connection with the succession of business due to reasons such as a merger, company split, transfer of business.

3. Handling of entrustment

The Group may entrust part of its business operations and provide personal information to outsourcees to the extent necessary to achieve the purpose of its use. In such cases, it shall manage and supervise these outsourcees in an appropriate manner, including executing agreements with them regarding the processing of personal information.
The types of acquirers of personal data, which are outsourcees, are, for example, consultants, recruitment agents, cloud service providers, and IT vendors.

4. Provisions regarding the sharing of personal information

The Group shall share personal information as follows:

1. Items of personal data to be shared
   Name, Address, Phone Number, E-mail Address, Company Name, Company Address, Department and Position
2. Scope of parties among whom personal information is shared
   ・Companies in which we have invested
   ・Daicel Corporation and companies in which it has invested
3. Purpose of use
   ・Purposes of use as set forth in Article 1 above of this policy
4. Company or person responsible for the management of personal data to be shared
   ・Executive officer responsible for risk management and corporate compliance, Polyplastics Co., Ltd.

5. Transfer outside of Japan

The Group may provide personal information to group companies located outside of Japan. In such cases, the Group shall take necessary measures for the transfer of personal information to countries outside Japan in accordance with applicable laws and regulations.

Some of our group companies outside of Japan which receive personal information are located in third countries which are not recognized as providing adequate level of protection by the Japanese Personal Information Protection Commission or the European Commission; however, the Group has executed the data transfer agreements with the Group companies with which it shares personal information in order to maintain sufficient level of data protection.

6. Matters concerning safety management measures

The Group takes measures to prevent leakage, loss, or destruction of personal information and to otherwise manage it appropriately as follows.

1. Development of the basic policy for security control of personal information
   ・This basic policy has been developed to ensure the proper handling of personal information and to inform you of a contact point for questions and complaints.
2. Development of rules for handling of personal information
   ・Development of personal information protection rules for each stage of acquisition, use, storage, provision, deletion/disposal, etc.
3. Institutional security control measures
   ・Appointment of person responsible for the handling of personal information (Personal Information Protection Manager)
   ・Development of security control actions in rules of employment, etc.
   ・Development and implementation of a system for periodic inspections and audits of the status of handling personal data
   ・Development of a system for responding to information leakage or other incidents
4. Human security control measures
   ・Thorough dissemination of security control actions to employees and their education and training ・Provisions regarding confidentiality obligations set forth in our rules of employment
5. Physical security control measures
   ・Management of areas where personal information is handled
   ・Prevention of theft, loss, etc. of a device, electronic medium and the like used to handle personal information
   ・Prevention of situations such as leakage of personal information occurring when carrying electronic medium and the like; and
   ・Deletion of personal data and disposal of a device, electronic medium, and the like
6. Technological security control measures
   ・Setting of management categories of personal data and access control ・Development of measures to prevent the leakage, unauthorized access, and other incidents
7. Understanding external environment
   ・Implementation of safety control measures after understanding the systems related to the protection of personal information at the recipient of personal information.

7. Customer requests

You may have the following rights under applicable laws and regulations with respect to your personal information held by the Group.

1. Withdrawal of consent
2. Request for disclosure, correction, addition or deletion of personal information
3. Request for suspension of use or deletion of personal information or suspension of its provision to third parties
4. Request for data portability

If you wish to make any of the above-mentioned requests regarding your personal data held by the Group, please contact us using the contact information listed in Article 8 below. We shall respond to the request to a reasonable extent and in accordance with applicable laws and regulations, after confirming that the person making the request is the person to whom the personal information pertains.

8. Request for inquiry and complaint

For inquiries or complaints regarding the Group’s handling of personal information, please contact us using the following contact information.

Contact to

General Administration Department, Polyplastics Co., Ltd.
JR Shinagawa East Bldg., 18-1, Konan 2-chome, Minato-ku, Tokyo 108-8280, Japan
E-mail: personal_data@polyplastics.com

9. Appeals to the data protection authority

You have the right to object to the data protection authority having jurisdiction over your residence in processing personal information relating to you. Data protection authorities in the EU countries can be found through following URL.

https://edpb.europa.eu/about-edpb/about-edpb/members_en

10. Contact information for data administrators and data protection officers

Polyplastics Co., Ltd.
JR Shinagawa East Bldg., 18-1, Konan 2-chome, Minato-ku, Tokyo 108-8280, Japan
Representative: Executive officer responsible for risk management and corporate compliance
E-mail: personal_data@polyplastics.com

Chapter 2: Processing of personal information of individuals residing in the State of California, U.S.A

In addition to the provisions set forth in Chapter 1, the provisions set forth in Chapter 2 shall apply to the processing of personal information of customers residing in the State of California, U.S.A., in accordance with the California Consumer Privacy Act of 2018. If there is any conflict between the provisions set forth in Chapter 1 and those set forth in Chapter 2, the provisions set forth in Chapter 2 shall prevail.

1. Acquired personal information in the past 12 months

The categories of personal information acquired by the Group in the past 12 months are as follows. All of this personal information is acquired from the data subject.
・Personal information on our business partners
　・Personal information acquired
　　Personally identifiable information, which is information that identifies you personally, such as your first and last name, e-mail address, phone number, address and full payment account number and demographic information, such as your gender, age, zip code, interests, and recent and upcoming purchases
・Personal information to be acquired through applications for employment
　・Personal information acquired
　　Personally identifiable information, which is information that identifies you personally, such as your first and last name, e-mail address, phone number, address and full payment account number and demographic information, such as your gender, age, zip code, interests, and recent and upcoming purchases

2. Disclosure to third parties

In addition to the cases set forth in Article 4, Chapter 1 (Provisions regarding the sharing of personal information), the categories of third parties to which the Group disclosed personal information in the past 12 months, and the personal information disclosed are as follows.
・Category of third parties: Group companies
　・Personal information disclosed
　　Personally identifiable information, which is information that identifies you personally, such as your first and last name, e-mail address, phone number, address and full payment account number and demographic information, such as your gender, age, zip code, interests, and recent and upcoming purchases
・Category of third partis: Polyplastics’ agents, vendors, consultants and other service providers
　・Personal information disclosed
　　Personally identifiable information, which is information that identifies you personally, such as your first and last name, e-mail address, phone number, address and full payment account number and demographic information, such as your gender, age, zip code, interests, and recent and upcoming purchases

3. Sales to third parties

The Group does not sell any personal information to third parties.

4. Requests for the processing of personal information

The Group shall respond to requests (the right for requesting disclosure and the right for deletion of personal information) regarding personal information of individuals residing in California, U.S.A., held by the Group within a reasonable period and extent, in accordance with the relevant laws and regulations, as follows. Upon receiving such a request, we will confirm the identity of the customer in advance when responding to a request.

In principle, the contents of the service shall not be changed for the person who made the inquiry. You have the right not to be discriminated against by the Group for exercising your rights. In addition, you may also designate an agent to exercise your rights. If you wish to exercise your rights, please contact us using the following contact information.

Contact information

General Administration Department, Polyplastics Co., Ltd.
JR Shinagawa East Bldg., 18-1, Konan 2-chome, Minato-ku, Tokyo 108-8280, Japan
E-mail: personal_data@polyplastics.com

Please note that the disclosure or deletion (of your personal information) may make it impossible for us to provide you with services that were previously available to you or that meet your requests.

Last updated: February 7, 2023

Chapter 3: Processing of personal information of individuals residing in China

The Group shall comply with the Personal Information Protection Law of the People’s Republic of China and related laws and regulations, handle the personal information of customers residing in China in an appropriate manner, and strive to protect their privacy.

In addition to the provisions set forth in Chapter 1, the provisions set forth in Chapter 3 shall apply to the processing of personal information of individuals residing in China, in accordance with the Personal Information Protection Law of the People’s Republic of China. If there is any conflict between the provisions set forth in Chapter 1 and those set forth in Chapter 3, the provisions set forth in Chapter 3 shall prevail.

1. How we protect your personal information

1. The Group has employed security protection measures according to industry standards, in order to protect your personal information and to prevent unauthorized access to, disclosure, use, modification, damage or loss of data.
2. The Group shall take all reasonable and practicable measures to ensure that unnecessary personal information is not acquired. The Group shall retain your personal information only for the period that is necessary to fulfill the purposes set forth in this policy; however, this shall not apply to cases where an extension of the retention period is required or permitted by law.
3. Our network environment is not 100% secure. The Group shall make its upmost efforts to ensure or guarantee the security of any information you send to us. If your legal rights and benefits are adversely affected due to unauthorized access to, disclosure or tampering or damage of your personal information resulting from the damage of our physical, technical or management protection facilities, the Group shall assume legal liabilities accordingly.
4. In the event of a personal information security incident, the Group shall, in accordance with laws and regulations and without delay, notify the customer of the basic situation and possible impact of the personal information security incident, the response measures that the Group has already implemented or plans to implement, proposals to the customer regarding self-prevention and risk mitigation, and the Group’s improvement measures for the customer. This information hall be notified by means such as e-mail, fax, telephone, push notification. If it is difficult to notify the subject of personal information individually, the information shall be announced in an appropriate and effective manner.

At the same time, we shall also take the initiative in reporting our handling of personal information security incidents in accordance with regulatory requirements.

2. Your rights

You shall have the following rights with respect to your personal information held by the Group.
・Right to access, rectify, and delete your personal information
・Right to inspect and acquire a copy of your personal information
・Right to limit or refuse the handling of your personal information by those other than the Company

3. How your Personal information is transmitted worldwide

In principle, personal information acquired in China shall be stored in China.
We may share your personal information among Polyplastics Co., Ltd. in Japan, with your consent. In addition to that, your personal information may be transmitted to or accessed from a jurisdiction outside of the country/region after we take other necessary measures for the information security.

4. How this Policy will be updated

This policy is subject to change.
We shall not reduce any of your rights under this policy without your explicit consent. We will release any change to the policy on this page.
For major changes, we will provide a more conspicuous notice (including, for certain services, notices via e-mail that explains the details of the changes to the policy).
We will also archive the old versions of this policy for your reference.

5. Contact

If you have any questions or comments regarding this policy, please contact us using the following contact information.

Contact information

General Administration Department, Polyplastics Co., Ltd.
JR Shinagawa East Bldg., 18-1, Konan 2-chome, Minato-ku, Tokyo 108-8280, Japan
E-mail: personal_data@polyplastics.com

Last updated: February 7, 2023

Privacy Policy for General Data Protection Regulation

Released at May 28th, 2018

POLYPLASTICS CO., LTD. (hereinafter referred to as “Company”) is committed to process the personal data of the Customer (hereinafter referred to as “Personal Data”), in accordance with the following policies.

“Personal Data” means any data which are able to identify natural person living in the European Economic Area (hereinafter referred to as “EEA”) (hereinafter referred to as “Customer”), including but not limited to his or her names, addresses, birth dates, gender, telephone numbers, e-mail addresses, company name, IP addresses and other online identifiers.

“Processing” means any operation which is performed on the Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

1. The purpose of the Processing of the Personal Data in the Company

The Personal Data possessed by the Company is processed for the sales, marketing survey, product management, and other customer management activities of the Company.

2. Additional Processing

In the case of the Processing of the Personal Data for purposes other than the above, the Company shall notify the Customer in advance of such new purposes of the Processing and other matters as required by applicable law.

3. Consent to the Processing of the Personal Data

By manifesting their intentions to consent to the Privacy Policy, the Customer shall be deemed as having consented to the Processing of the Personal Data by the Company, and the Company shall process the Personal Data based on such consent; provided, however, that Customer may withdraw such consent at any time. The withdrawal of such consent shall not affect the lawfulness of the Processing based on the consent before its withdrawal.

The Company may require the Customer to provide their personal data in connection with the provision of the Company’s services and information. In such case, if a certain Customer does not provide their personal data, the Company may be unable to provide the services and information.

4. Transfers

By manifesting their intentions to consent to the Privacy Policy, the Customer shall be deemed as consented to the Processing of the Personal Data in Japan, where the European Commission has not decided on adequacy of the level of protection, without protection measures such as standard contract provisions.

With respect to the Processing of the Personal Data, the Company shall properly take organizational safety management measures, and technical safety management measures as mentioned in “9. Safety management measures”.

The Company may provide the Personal Data to third parties such as the subsidiaries and affiliates of the Company, cloud vendors and outside contractors of the Company etc., to implement the purposes of the Processing specified above. Since some companies located in countries outside of the EEA (including, without limitation, Japan, the U.S., the same shall apply hereafter) are included in the third parties to whom the Company will disclose the Personal Data of the Customer, the Customer shall be deemed as having consented to the following matters by consenting to the Privacy Policy:

1. In the case that the country in which the third parties are located is outside the EEA and does not have the same data protection laws as the EEA, i.e., many of the rights provided in the EEA to the Customers are not given.
2. The Personal Data will be provided to the third parties located outside the EEA.The Personal Data will be provided to the third parties located outside the EEA.
3. The Personal Data will be provided and processed for the purposes specified above by the third parties outside the EEA to whom the Company will disclose the Personal Data of the Customer.

In the case that the Company provides the Personal Data to a third party located in a country outside the EEA, the Company shall ensure that adequate measures are taken concerning the protection of the Personal Data by executing standard contract provisions based on the EU General Data Protection Regulation, etc.

5. Rights of the Customer

The Customer is entitled to access, request for rectification, request for erasure, request to restrict the processing, object to the processing, and request for data portability, with regards to the Personal Data retained by the Company pursuant to the provisions of relevant laws and regulations.

The Customer may object to the data protection authorities with jurisdiction over the Company or the location of the Customer’s domicile with regard to the Processing of the Personal Data of the Customer.

6. Contacts

In the event of any questions or concerns regarding the Privacy Policy or the Processing of the Personal Data by the Company, or any requests, etc., concerning the access to, rectification or erasure of, restriction of the Processing of the Personal Data, objecting to the Processing of the Personal Data, or requesting for data portability, please contact the Company. The Company determines the purpose and means of the Processing of the Personal Data.

The contact information for the Company is as follows:
https://www.polyplastics.com/InqForm/Index.do?_LOCALE=ENGLISH

7. Compliance with applicable laws

With respect to the Processing of the Personal Data, the Company shall comply with the General Data Protection Regulation and related laws and regulations, and shall observe the guidelines of competent government agencies and industry guidelines.

8. Retention Period

The Company shall retain the Personal Data as long as we require such data to provide the services to the Customer.

9. Safety management measures

With respect to the Processing of the Personal Data, the Company shall properly take organizational safety management measures, and technical safety management measures.

10. Amendment to the “Privacy Policy”

The Company may amend the Privacy Policy by publishing the amended Privacy Policy on the Company’s website without any individual notice to the Customer.