PKSHA Technology Inc.
Privacy Policy

Article 1 (Scope of Application)

1. This Privacy Policy applies to personal information collected in the course of all of our businesses and through all products and services we provide. Where a separate privacy policy has been established for a particular business, product, or service, that policy shall prevail.

2. Customers may use the Company’s products and services only after having read, understood, and agreed to this Privacy Policy.

Article 2 (Definitions)

In this Privacy Policy, the following terms shall have the following meanings

• 1) "Personal Information"

  Personal information as defined in the Act on the Protection of Personal Information of Japan (the “APPI”).

• 2) "Personal Information and Related Data"

  Personal Information together with information that relates to the identification of customers, their activity history on communication services, and information generated or stored on the devices customers use, that is collected by the Company in accordance with this Privacy Policy. Such information may include, without limitation, names, gender, date of birth, occupation, address, contact details (e‑mail address, telephone number, etc.), payment information (credit‑card and bank‑account details, credit information, etc.), referrer information, IP addresses, server access logs, cookies and other identifiers, and location data.

• 3) "Affiliates"

  Affiliated companies as defined in Article 8 of the Ordinance on Terminology, Forms and Preparation Methods of Financial Statements, etc.

Article 3 (Compliance with Laws and Regulations)

The Company handles Personal Information in compliance with all applicable laws, regulations, and guidelines.

Article 4 (Purpose of Use)

The Company acquires Personal Information by lawful and fair means and uses it only for the following purposes. Where the Company intends to use Personal Information for a purpose not listed below, it will obtain the prior consent of the individual concerned unless otherwise permitted by law.

Article 5 (Acquisition and Management of Personal Information)

• 1. The Company will acquire Personal Information lawfully and fairly, to the extent necessary to achieve the purposes of use set out above.
• 2. The Company will take organizational, personnel, physical, and technical security measures, as the Company deems appropriate, to prevent the leakage, loss, or damage of Personal Information and to ensure its proper management. For inquiries about these security measures, please contact us as set forth in Article 10.
• 3. Our products and services uses Google Analytics, a web‑analytics service provided by Google LLC, to understand how the site is used. Google Analytics collects information through cookies. The data is anonymized and does not identify any individual. The collection and use of data by Google is governed by Google’s Privacy Policy (https://policies.google.com/privacy?hl=en).
  You may disable Google Analytics by installing the browser add‑on provided at https://tools.google.com/dlpage/gaoptout?hl=en.
  For further details on how Google Analytics collects and processes data, please refer to the Google Analytics Terms of Service (https://marketingplatform.google.com/about/analytics/terms/us/) and Google's Privacy Policy (https://policies.google.com/privacy?hl=en).
• 4. The Company uses Google Ads Enhanced Conversions to deliver advertisements tailored to your interests and to improve the accuracy of ad‑effectiveness measurement. This feature hashes the name, e‑mail address, and phone number you enter on our website and transmits the hashed data to Google LLC. For an overview, see https://support.google.com/google-ads/answer/9888656?hl=en.
  You can review Google’s Privacy Policy at https://policies.google.com/privacy.
  To opt‑out of personalized ads, please follow the instructions at https://support.google.com/ads/answer/2662922?hl=en.

Article 6 (Provision to Third Parties)

The Company will not provide Personal Information to any third party without the individual’s consent except in the following cases:

• 1. Where Personal Information is jointly used as set forth in Article 7.
• 2. Where handling of Personal Information is outsourced to the extent necessary to achieve the purposes of use (including overseas outsourcing to entities that maintain privacy protections equivalent to those required under the APPI).
• 3. Where Personal Information is provided in connection with a business succession such as a merger.
• 4. Where required by laws or regulations.
• 5. Where necessary to protect the life, body, or property of a person and obtaining consent is difficult.
• 6. Where particularly necessary to improve public health or promote the healthy development of children and obtaining consent is difficult.
• 7. Where cooperation with a national or local government agency is necessary for the execution of matters prescribed by law and obtaining consent may impede that execution.
• 8. Where the third party is an academic research institution and handling is necessary for academic research purposes as provided under the APPI.

Article 7 (Joint Use)

The Company may jointly use Personal Information as follows.

Article 8 (Requests for Disclosure, Correction, Suspension of Use, etc.)

• 1. Customers may request the disclosure (including records of provision to third parties), correction, addition, deletion, suspension of use, or erasure (collectively, “Disclosure, etc.”) of the Personal Information held by the Company by contacting us as set forth in Article 10. The Company may refuse such requests where permitted by law.
• 2. Procedures and fees for Disclosure, etc. are as separately stipulated by the Company.
• 3. The Company will respond to requests only after confirming the identity of the requester.

Article 9 (Security Control Measures)

The Company implements necessary and appropriate security control measures to prevent leakage, loss, or damage of Personal Information and to ensure its proper management, and supervises employees and contractors handling such information. The principal measures include, but are not limited to:

• 1. Regulations on Handling Personal Information

  The Company has instituted detailed internal regulations concerning the handling of personal information, which stipulate the methods of processing, assign responsible parties and personnel in charge, and specify their respective obligations at each phase of the personal information management process, including acquisition, utilization, retention, provision, deletion, and disposal.

• 2. Organizational Security Control Measures

  The Company has designated a person responsible for the management of personal information and has clearly defined both the scope of personal data handled by employees and the personnel authorized to handle such data. Furthermore, a formal reporting and communication framework has been established to ensure that any actual or suspected violations of the Act on the Protection of Personal Information or the Company’s internal regulations on personal data handling are promptly reported to the responsible person. The Company also conducts regular internal reviews of personal data handling practices and implements audits carried out by independent departments or external organizations.

• 3. Human Security Control Measures

  The Company provides regular training to employees on important considerations regarding the handling of personal data. Matters pertaining to the confidentiality of personal data are stipulated in the Company’s employment regulations, and employees are required to submit a written pledge acknowledging and agreeing to these obligations.

• 4. Physical Security Control Measures

  In areas where personal data is handled, the Company strictly controls employee access and implements measures to prevent unauthorized individuals from viewing such data. Appropriate safeguards are also in place to prevent the theft or loss of equipment, electronic media, documents, and other items used in the handling of personal data. Furthermore, when transporting such equipment or media—even within company premises—the Company ensures that personal data cannot be easily identified through the implementation of suitable protective measures.

• 5. Technical Security Control Measures

  The Company implements access controls to restrict the scope of personnel authorized to handle personal data and to limit the range of data accessible to each individual. In addition, security measures have been established to protect information systems that process personal data from unauthorized external access and malicious software.

• 6. Other Measures

  For more detailed information regarding the Company’s personal data management framework and the specific measures implemented, please contact the Personal Information Inquiry and Consultation Desk as outlined in Article 10.

Article 10 (Contact)

For inquiries, requests, or consultations concerning personal information, please contact the Company at the following address.

Article 11 (CChanges to this Privacy Policy)

The Company may amend this Privacy Policy by publishing the revised version in a manner it deems appropriate. Except in cases of urgency, the Company will provide prior notice of any such amendments.

Established on October 1, 2016
Revised June 1, 2020
Revised on April 1, 2022
Revised on July 1, 2025

List of affiliated companies that jointly use personal information, etc.