(hereinafter referred to as "the Company"), personal information, i.e., information that can be used to identify our customers and other people associated with the Company, is an irreplaceable and important asset. In addition, there is a social demand that this important personal information be kept confidential and handled accurately and securely. In order to meet such social obligations, we will properly protect personal information in accordance with the following basic policy, based on the spirit of our company and in compliance with laws and regulations concerning the protection of personal information.

1. We will handle personal information within the scope of the stated purpose of use and will take measures to ensure that personal information is not used for purposes other than those stated.
   We will not disclose or provide personal information provided by you to any third party, except with your consent or for justifiable reasons.
2. We will comply with the Personal Information Protection Law, other related laws and regulations, guidelines set forth by the government, and other norms. In addition, we have established a personal information protection management system, which we make known to all directors and employees, ensure that they comply with it, conduct regular training, have it audited by our audit department, and have it reviewed by an external organization, and always maintain it in the best possible condition.
3. In order to appropriately and carefully store and manage personal information or personal-related information, and to prevent leakage, loss, or damage, we strive to implement appropriate and reasonable security measures in terms of both technical and physical security control as well as organizational and personnel security control, and we will continuously review these measures.
   In the unlikely event of leakage, loss, or damage of personal information, we will promptly inform the person in question and take appropriate action and corrective measures.
4. We will promptly respond to requests for disclosure, etc., of personal information from the person in question, as well as complaints and consultations.

Handling of Customers' Personal Information

1.Acquisition of Personal Information from Customers

Acquisition of Personal Information

When you use our services, we may collect personal information from you as described in "Types of Personal Information We Collect".

Method of acquisition

We will collect personal information in the following manner for transactions related to our facilities (lodging, banquets, food and beverage, bathing, sales of goods, provision and sale of other incidental products, implementation of events, provision of other services, etc.) and for other transactions.

1. Obtained directly from the person in question
   Telephone, written documents (including electromagnetic records), business cards, verbal, internet, tablets, scanners, automatic check-in machines, etc.
2. Obtained from a person who is duly authorized by the person in question
   Reservation holders, introducers, accompanying persons, travel-related businesses (including travel agencies, travel service providers, accommodation reservation website operators, etc.), etc.
3. Obtained from publicly available sources
   Newspapers, internet, phone books, publications and other books, etc.

Types of Personal Information We Obtain

The personal information we collect includes name, place of employment, home or work address, e-mail address, telephone number, fax number, date of birth, gender, passport number, facial recognition and other biometric data, as well as information to respond to room requests and other special requests, and information related to the first and second nights as required by law, ordinance, etc. This information may also include information about the previous and subsequent nights' accommodation as required by law or ordinance.

Refusal to provide personal information

You can choose whether or not to provide us with your personal information, but please note that if the personal information you do not provide is essential for us to provide the accommodation services or other products and services you request, you may not be able to use our accommodation services or other products and services, etc. However, please understand that you may not be able to use our accommodation services or other products and services if the personal information you do not provide is essential to the provision of the accommodation services or other products and services you request.

Acquisition of information from minors, etc.

The Company does not intend or desire to obtain personal information directly from minors. In the event that a minor provides personal information of a family member to the Company without the consent of a parent or guardian, please notify the Company's contact person. We will respond in good faith to the minor's request, including the cessation of use and disposal of the personal information.
However, if a minor wishes to use our facilities, please understand that the minor's personal information will be handled in accordance with this policy.

---

2. use of customers' personal information

Purpose of Use of Personal Information

We will not use personal information for any other purposes or beyond the scope of the stated purpose of use at the time of acquisition.

Purpose of Use of Personal Information Obtained by the Company

In principle, the personal information of customers that we obtain and keep in our possession is

1. To make reservations and use our facilities such as hotels, inns, restaurants, bathhouses, and transportation services
2. To provide various information and services regarding membership in our various membership organizations, etc.
3. To provide various information regarding our new facilities, campaigns, special offers, etc.
4. To respond to customer inquiries and requests for information materials
5. FOR SALES, AFTER-SALES SERVICE AND MARKETING ACTIVITIES BY MAIL, TELEPHONE, DIRECT MAIL, E-MAIL, VARIOUS SOCIAL MEDIA, ETC. TO ACHIEVE THE PURPOSES OF 1, 2 AND 3
6. To analyze customer trends or to conduct research and analysis for the development of sales methods, etc.
7. Personal information is acquired and kept for the purpose of handling other matters incidental or related to the Company's business.
   In the event that personal information is to be used for purposes other than those listed above, we will clearly state the purpose and scope of use to the customer prior to acquisition or use, and obtain the customer's consent before acquiring or using the information.

---

3. joint use of personal information

The Company will share the following "shared use items" (name, address, telephone number, e-mail address, etc.) among the personal information provided by customers with the following companies within the minimum scope necessary to simplify future customer applications for accommodation services and other products and services, and to contact and respond to customers. The Company will share personal information with the following companies in our group to the minimum extent necessary for the purpose of simplifying applications for accommodation services and other products and services, and for contacting and responding to customers. The person in charge of managing such personal information is Nakatana Onsen Co.

Group companies, etc.

Harikoshitei

[Joint-use items

E-mail address, first and last name, date of birth, gender, nationality, address (including zip code), telephone number, contact telephone number, passport name, passport number, passport nationality, passport expiration date, expected date of passport receipt, domestic emergency contact name, domestic emergency contact relationship, domestic emergency contact telephone number, cookie information Personal information such as cookie information, product purchase history, location information, and other service usage records.

---

Provision of Personal Information to Third Parties

Restrictions on Provision to Third Parties

We will not provide or disclose your personal information to third parties except in the following cases

1. When the customer has given consent
2. When required by law
3. When it is necessary for the protection of the life, body, or property of an individual and it is difficult to obtain the consent of the individual.
4. When it is especially necessary to improve public health or to promote the sound growth of children and it is difficult to obtain the consent of the individual concerned.
5. When it is necessary to cooperate with a national agency, a local government, or an individual or entity entrusted by either a national agency or local government to execute affairs prescribed by law, and obtaining the consent of the individual is likely to impede the execution of such affairs.
6. When entrusting all or part of the handling of personal information within the scope necessary for the achievement of the specified purpose of use

Supervision of contractors

When we use your personal information, we may entrust it to a third party within the scope of legitimate use. We require the third party to strictly manage personal information at the same level as we do, and we supervise them as necessary and appropriate.

---

5. revision and publication of privacy policy

This Policy may be revised from time to time in response to amendments or changes in related laws and regulations, or in order to meet social needs regarding personal information. In such cases, we will publish this Policy on our website without delay, and will clearly indicate the date of the last revision of this Policy.

---

6. Procedures for disclosure of personal information

If you have any questions about your personal data held by us, or if you wish to request disclosure, deletion, erasure, correction, suspension of use, or suspension of provision to third parties of your personal data, please contact our inquiry desk, which will guide you through the necessary procedures.
We will respond to your request within a reasonable period of time in accordance with the law and our regulations, and notify you of the results. If we are unable to respond to part or all of your request, we will explain the reason. Please note that we may charge a specified fee for this service.

Naoki Tomioka, Representative Director, Nakatana Onsen Co.