1. Name, Address, and Name of the Representative of the Company

　GRCS Inc .
　Palace Building 5F, 1-1-1 Marunouchi, Chiyoda-ku, Tokyo
　Representative Director and President
　Yoshikazu Sasaki

2. Basic Policy

The Company Group recognizes the importance of protecting personal information handled in the course of its business, complies with relevant laws and regulations, and appropriately acquires, uses, and manages personal information, while continuously striving to improve the management system.

3. Scope of Application

This Privacy Policy sets forth the policies that the Company Group adheres to when handling personal information acquired during the course of its business execution.

4. Acquisition and Purpose of Use of Personal Information

Purposes of Use of Personal Information concerning Customers (or officers and employees in the case of corporate customers):

• Acceptance of applications for the Company Group's various services, and communication to customers regarding service provision
• Verification of the customer's identity or verification of eligibility for inquiries when receiving inquiries or requests
• Exercise of rights and fulfillment of obligations based on contracts with customers, laws, etc.
• Sending of e-mails and direct mails, various announcements, and proposals regarding the Company Group's products and services
• Market research, proposals to customers in survey activities such as questionnaires regarding the improvement of the quality of the Company Group's products and services, and research and development of services
• Cancellation of the Company Group's various services and post-cancellation management
• Improvement and enhancement of the Company Group's services
• Other operations necessary for the proper and smooth execution of service provision to customers

Purposes of Use of Personal Information concerning Shareholders of GRCS Inc.:

• Exercise of rights and fulfillment of obligations based on the Companies Act
• Shareholder management, such as the creation of records based on various laws and regulations

* Personal information concerning shareholders is acquired, used, and managed solely by the parent company, GRCS Inc.

Purposes of Use of Personal Information concerning Applicants for Employment with the Company Group:

• Communication and provision of information to employment applicants, and other uses necessary for recruitment activities

Purposes of Use of Personal Information concerning Employees:

• Business communication
• Remuneration payment procedures (payment of wages, bonuses, allowances, expense reimbursement, withholding tax procedures, social insurance related procedures)
• Personnel and labor management
• Welfare administration
• Health management
• Publication and utilization of personal information in public relations, advertising, and recruitment activities

Purposes of Use of Personal Information concerning GRCS Alumni Group Members:

• Provision of information (invitations to social gatherings hosted by the Company Group or third parties, invitations to events/seminars hosted by the Company Group or third parties, the Company Group's management initiatives, and job postings) to users of the GRCS Alumni Group email distribution service, and administrative communication for the provision of the same service
• Utilization necessary for providing the GRCS Alumni Group information exchange service (verification of user eligibility, offering employment or collaboration to users), and administrative communication for the provision of the same service

5. Measures Taken for the Secure Management of Personal Information

The Company Group takes the following measures for the secure management of the personal information it holds.

(Establishment of Guidelines for Personal Information Protection)

This Privacy Policy is established to ensure the proper handling of personal information.

(Development of Rules concerning the Handling of Personal Information)

The Company Group establishes Personal Information Management Regulations regarding the handling methods, responsible persons/personnel, and their duties for each stage of acquisition, utilization, storage, provision, deletion/disposal, etc.

(Organizational Security Control Measures)

• A supervisor responsible for the handling of personal information is appointed and the reporting and communication system to the supervisor is established in the event of grasping facts or signs of violations of the Personal Information Management Regulations.
• The status of personal data handling is regularly evaluated, and improvement measures are implemented as necessary.

(Personnel Security Control Measures)

• Employees receive training on matters requiring attention regarding the handling of personal information.
• Compliance matters regarding the handling of personal information are specified in the work rules.

(Physical Security Control Measures)

• Entry and exit management for employees and controls for bringing in equipment, etc. are implemented.
• Measures are taken to prevent the theft or loss of equipment, electronic media, and documents handling personal information.

(Technical Security Control Measures)

• Mechanisms are introduced for access control.
• Mechanisms are introduced for the protection of information systems from unauthorized external access or malicious software.

(Other)

When outsourcing the handling of personal information, necessary and appropriate supervision of the subcontractor's security management is carried out.

6. Presence of ThirdParty Provision

The Company Group does not provide personal information to third parties without obtaining the prior consent of the individual, except as stipulated by relevant laws and regulations.

7. Joint Use of Personal Information

The Company Group may jointly use personal information as follows:

1. Items of personal information to be jointly used: Personal information concerning customers, employment applicants, employees, etc. (name, address, phone number, email address, and other items necessary to achieve the "4. Acquisition and Purpose of Use of Personal Information").
2. Scope of joint users: The Company and its consolidated subsidiaries.
3. Purpose of use by joint users: Within the scope of the purposes of use stated in "4. Acquisition and Purpose of Use of Personal Information" above.
4. Name, address, and name of the representative of the person responsible for managing the personal data:
   GRCS Inc.
   (For the address and the name of the representative, please refer to "1. Name, Address, and Name of the Representative of the Company" above.)

8. Disclosure, Correction, Suspension of Use, etc., of Personal Information

The Company Group will appropriately respond to requests for the disclosure, correction, suspension of use, etc., of personal information. Please contact the inquiry desk for specific procedures.

9. Inquiry Desk

Please contact the following desk with any opinions or requests regarding the Company Group's handling of personal information.
　GRCS Inc.
　Management Department
　03-6272-9191

Last Revised Date: June 1, 2026