Personal Information Protection Declaration

SBI RHEOS HIFUMI Inc. (hereinafter referred to as "SBI RHEOS HIFUMI ," "we," or any variations thereof) will comply with the Act on the Protection of Personal Information, related laws and regulations, guidelines of supervisory authorities, and rules and guidelines of self-regulatory organizations (hereinafter collectively referred to as "Laws and Regulations"), and will strictly protect and properly process personal information and personal identification numbers (hereinafter collectively referred to as "Personal Information") within the course of its operations.

Company address: 27th Floor, Pacific Century Place (PCP) Marunouchi 1-11-1, Marunouchi, Chiyoda-ku, Tokyo 100-6227

Representative: Hideto Fujino

We will use your personal data in performing the following operations when necessary. We will use your personal identification number only for purposes stipulated by law.

1. Business administration and internal control of the Group as a holding company
2. Operations related to recruitment and selection activities
3. Shareholder and investor service operations

1. We use your Personal Information in our operations related to business administration and internal control of the Group for the purposes of:
   1. consider the Group's management plans, sales strategies, etc.
   2. For business administration of the Group's risk management and consolidated financial reporting
   3. provide information on the Group's financial products and services, etc.
   4. exercising our rights and performing under your contract with us as well as in compliance with the law;
   5. conducting market research, measuring the effectiveness of advertisements, analyzing data, conducting surveys, etc. for research and development of financial products and services;
   6. providing information about our group companies and their operations;
   7. performing other operations to smoothly provide you with appropriate services, such as contacting you when necessary.
   8. Notwithstanding the purposes of use of personal information, etc., set forth in the preceding item, personal numbers will be used only for the preparation and submission of payment records of remuneration, fees, etc."
2. We use your Personal Information in our operations related to recruitment and selection activities primarily for the purposes of:
   1. providing you with recruitment and selection information relating to our company and our group companies as well as for performing related operations;
   2. providing you with information on the recruitment and selection activities (such as seminars, events, etc.) of our company and our group companies;
   3. improving the management of our recruiting and selection activities; and
   4. performing other operations related to or incidental to our recruitment and selection activities.
3. We use your Personal Information in our shareholder and investor service operations primarily for the purposes of:
   1. enabling you to exercise your rights as a shareholder under the Companies Act and under other relevant laws and regulations, as well as for performing related administrative procedures;
   2. providing you with the benefits which you are entitled to as a shareholder;
   3. implementing various measures to build better relations with you;
   4. managing shareholder affairs in accordance with prescribed standards as required by law, which includes the creation shareholder data;
   5. managing and distributing our IR information;
   6. responding to inquiries about our company, services, etc.; and
   7. performing other operations related to shareholder and investor relations.

We will not process your Personal Information beyond the scope of the purposes of use specified in 2 and 3 of this Declaration without obtaining your prior consent, except as required by Laws and Regulations.

We will not collect, use, or disclose to third parties any sensitive personal data about clients and other individuals, nor information related to their labor union affiliations, family origins, legal domicile, health, or sex life (hereinafter collectively referred to as "Sensitive Information"), except as required by Laws and Regulations. If we ever collect or use Sensitive Information or disclose it to a third party, we will process it with due care in accordance with Laws and Regulations. If we must provide Sensitive Information to a third party, we will not apply the provisions of Article 27, Paragraph 2 (opt-out clause) of the Act on the Protection of Personal Information.

We will not collect Personal Information through deception or via other wrongful means. We will also not unduly harm the interests of our clients or any other individuals. Please note that we may collect your Personal Information through the following channels:

• Notifications, entries, inquiries, and survey forms, etc. filled out directly by you in writing (including electromagnetic records thereof, with the same applying hereinafter) or via the internet
• Third parties, such as database service providers
• Audio recordings (including the contents of telephone calls), images and video recordings (including security camera and online meeting recordings), online communication (including incoming emails and chats), etc.
• Information posted in official gazettes, newspapers, magazines, on the internet, etc.

We use cookies, web beacons, and IP addresses on our website to:

• determine the cause of a server failure or problem;
• improve website content;
• use your browsing history for marketing activities; and
• use them for anonymous statistical purposes.

* Opt-out Options for Third-party Advertising *
https://www.sbirheoshifumi.rheos.jp/english/policy/sitepolicy/#optout

When we collect your Personal Information, we will, without delay, publicly announce or inform you in writing of how it will be used, unless we have already publicly announced how we use your Personal Information. When collecting your Personal Information by entering into a contract with you, we will inform you in advance of how we will use it. If we change the purposes for which we use your Personal Information, we will notify you or make an announcement to that effect.

We will not use your personal data in a manner that may serve to encourage or incite illegal or wrongful acts.

We will comply with all applicable Laws and Regulations and thoroughly implement an internal management system to prevent the leakage or loss of, damage to, or unauthorized access of Personal Information, and take other security measures to manage Personal Information. We will take necessary and appropriate measures to protect the personal data we process from being leaked, etc., including the maintaining of a basic personal data protection policy and data processing rules as well as organizations for implementing security measures. These necessary and appropriate measures also include implementing organizational, human, physical, and technical measures to ensure the security of personal data, as well as the assessment of the external environment at each stage of the data lifecycle, including the collection, utilization, and storage stages. Please contact us for more information.

Before we outsource any of the processing of the Personal Information we retain concerning you, we will ensure that the service provider has a security management system in place for the protection of your Personal Information. We will sign a security management agreement with the service provider and provide necessary and appropriate oversight to ensure the security of your Personal Information.

Before disclosing Personal Information we retain concerning you to a third party, we will inform you of who it will be disclosed to, how it will be used, exactly what information is to be disclosed, and obtain your acknowledgement and consent in relation thereto, except in special circumstances specified by Laws and Regulations. We will disclose your personal identification number only when submitting payment records and other documents to the district director of the tax office, within the scope of 3 (1) 8 above.

When we disclose your personal data to a third party, we will, pursuant to the provisions of Laws and Regulations, etc., prepare a record containing the date on which your personal data has been disclosed, the name of the third party, and other matters prescribed by Laws and Regulations. We will retain such records for the period specified by Laws and Regulations starting from the date on which the records have been created.

We may share your personal data with our group companies to jointly perform the businesses that we are authorized to operate as well as operations which are incidental to those businesses.

(1) Types of personal data we share

The personal data we may share with our group companies includes your name, address, date of birth, telephone number, client information such as the details of your inquiries and transaction needs, and inquiries about job openings and employment. However, we will never share your personal identification number.

(2) Scope of parties with whom we may share your personal data

Our consolidated subsidiaries

(3) Operations in which our group companies may use your personal data

1. Operations related business administration and internal control of the Group
2. Operations related to sales activities
   1. Investment management business
   2. Investment advisory and agency business
   3. Type II financial instruments business
   4. Other our group businesses that we are authorized to operate
   5. Operations incidental to each of the above
3. Operations related to recruitment and selection activities

(4) Specific examples of how our group companies may use your Personal Information

1. We use your Personal Information in our operations related to business administration and internal control of the Group for the purposes of:
   1. consider the Group's management plans, sales strategies, etc.
   2. For business administration of the Group's risk management and consolidated financial reporting
   3. provide information on the Group's financial products and services, etc.
   4. exercising our rights and performing under your contract with us as well as in compliance with the law;
   5. conducting market research, measuring the effectiveness of advertisements, analyzing data, conducting surveys, etc. for research and development of financial products and services;
   6. providing information about our group companies and their operations;
   7. performing other operations to smoothly provide you with appropriate services, such as contacting you when necessary.
   8. Notwithstanding the purposes of use of personal information, etc., set forth in the preceding item, personal numbers will be used only for the preparation and submission of payment records of remuneration, fees, etc."
2. We use your Personal Information in our operations related to sales activities primarily for the purposes of:
   1. soliciting sales of and selling securities we issue or providing information on our services;
   2. assessing the suitability of products and services to be offered in light of the principle of suitability, etc.;
   3. processing applications for securities or services, such as opening new accounts;
   4. verifying your identity or the identity of your authorized representative;
   5. notifying you of your transaction results, balance, etc.;
   6. performing operations related to your transactions;
   7. exercising our rights and performing our obligations under your contract with us as well as in compliance with the law;
   8. performing operations related to your investment advisory contract with us (advisory business) or your discretionary investment contract with us;
   9. providing investment advisory services;
   10. notifying you of your investment results, asset balances, etc.;
   11. conducting market research, measuring the effectiveness of advertisements, analyzing data, conducting surveys, etc. for research and development of financial products and services;
   12. providing information about our group companies and their operations; and
   13. performing other operations to smoothly provide you with appropriate services, such as contacting you when necessary.
   14. Regardless of the above-mentioned purposes for which we use your Personal Information, we will use your personal identification number only for processing your new account application and notifications related to your financial product transactions, as well as for preparing and submitting documents related to your financial product transactions as required by law.
3. We use your Personal Information in operations of ours which are related to recruitment and selection activities primarily for the purposes of:
   1. providing you with recruitment and selection information relating to our company and our group companies as well as for performing related operations;
   2. providing you with information on the recruitment and selection activities (such as seminars, events, etc.) of our company and our group companies;
   3. improving the management of our recruiting and selection activities; and
   4. performing other operations related to or incidental to our recruitment and selection activities.

(5) Name and address of the person responsible for the management of your personal data and, in the case of a juridical person, the name of its representative

SBI RHEOS HIFUMI, Inc.
27th Floor Pacific Century Place Marunouchi 1-11-1,
Marunouchi Chiyoda-ku,Tokyo 100-6227
Representative Director, Chairman,Presisent　Hideto Fujino

Except for the above cases, we do not collect Personal Information for the purpose of sharing it with other business operators. If we share your Personal Information with other business operators in the future, we will provide you with the following information in advance or announce it in this Personal Information
Protection Declaration. However, we will never share your personal identification number.

• Notification that your personal data will be shared with a specific party
• Types of personal data concerning you which we will share
• Scope of parties with whom we will share your personal data
• How your personal data will be used by the parties we share it with
• Name and address of the person responsible for the management of your personal data and, in the case of a juridical person, the name of its representative

We will keep the following information about the personal data we hold pertaining to you available to you. This includes making such information available to you without delay upon request.

• Name of our company: SBI RHEOS HIFUMI, Inc.
• Our company address: As noted at the beginning of this Declaration
• Our company representative: As noted at the beginning of this Declaration
• Purposes for which we use your personal data: As noted in 2 and 3 of this Declaration
• Procedures for granting your request to access, to correct, or to stop using your personal data, or to stop sharing it with a third party, etc.: As noted in 16, 17, and 18 of this Declaration
• Security management measures: As noted in 10 of this Declaration
• Where to file complaints with us about the processing of the personal data we hold pertaining to you: As noted at the end of this Declaration

We will grant you, upon request, access to the personal data we hold pertaining to you as well as a record of disclosing your personal data to third parties within a reasonable time period and to a reasonable extent by means of a method requested by you (or in writing when providing information by the requested method incurs too great an expense or is otherwise too difficult), after verifying your identity, except in cases where granting access is not required by Laws and Regulations. We will also notify you upon request with respect to whether or not we have your personal identification number. To request access, contact our Personal Information Complaints and Inquiries Desk.

When you request that we correct, make additions to, or delete (hereinafter collectively referred to as "Corrections") the personal data we hold pertaining to you where said data is inaccurate or incomplete, we will, after verifying your identify, conduct necessary investigations to review all the facts, etc., and perform Corrections to your personal data based on the results of said investigations, to the extent necessary for achieving the purposes for which we use your personal data. To request a Correction, contact our Personal Information Complaints and Inquiries Desk.

When you request that we stop using or that we delete your personal data on the grounds that we have processed it in violation of the provisions of Article 18 or 19 of the Act on the Protection of Personal Information, or on the grounds that we have acquired it in violation of the provisions of Article 20 of the same Act, we will, after verifying your identify, conduct necessary investigations to review all the facts, etc., and stop using or delete your personal data based on the results of said investigations.

When you request that we stop sharing the personal data we hold pertaining to you with third parties on the grounds that we have shared it with third parties in violation of the provisions of Article 27, Paragraph 1 or Article 28 of the Act on the Protection of Personal Information, we will, after verifying your identify, conduct necessary investigations to review all the facts, etc., and stop sharing the said personal data we hold pertaining to you with third parties based on the results of said investigations.

When you request that we stop using or delete the personally identifiable data we hold pertaining to you, or request that we stop sharing it with third parties, we will, after verifying your identify, conduct necessary investigations to review all the facts, etc., and stop using or delete the said personal data we hold pertaining to you or stop sharing it with third parties based on the results of said investigations. You can file such a request in cases where we no longer need to use your personally identifiable data, where we have violated the provisions set forth in the main clause of Article 26, Paragraph 1 of the Act on the Protection of Personal Information, or in other cases where our processing of the personally identifiable data we hold pertaining to you may harm your rights or legitimate interests. To request that we stop using or delete your personal data or to request that we stop sharing it with third parties, please contact our Personal Information Complaints and Inquiries Desk.

When we receive a complaint about the processing of Personal Information, we will look into it and process the complaint appropriately and promptly within a reasonable period of time.

In the event of a Personal Information leak or other incident, we will take necessary measures to promptly resolve the problem and report it to the Personal Information Protection Commission Japan,the Supervisory authority, and the Self-regulated organization etc. as necessary in accordance with Laws and Regulations. In the event of a Personal Information leak or other incident, we will also notify the person concerned about the occurrence of such an incident pursuant to the provisions of Laws and Regulations. In the event we are unable to notify said person, we will take alternative measures to protect his/her rights and interests.