We formulate written rules on the management of personal information, which includes clear stipulation on how we should acquire, use, provide, and entrust the management of personal information. Under the rules and chief of administrator for personal information, we manage personal information in an appropriate manner.
The Lawson Group obtains personal information only to the extent that is necessary to meet the purpose that has been clearly presented or notified to the relevant person or that has been publicly announced.
It is possible that we provide and disclose personal information to stores that are members of the Lawson group chain or suppliers of products/goods of the Lawson Group. In this case, we obtain his or her consent in advance to provide a third party in scope of the purpose of use.
For the other cases, we never disclose or provide personal information to any third parties without obtaining his or her consent in advance, while this shall not apply to a case which personal information is handled by our suppliers in scope of the purpose of use and a case which permitted to access to personal information in laws and regulations. If we provide personal information to a supplier, we enter into a confidentiality agreement with the supplier in which the supplier is obliged to protect the personal information concerned. We also monitor the supplier to ensure that it handles the personal information appropriately.
Unless laws and regulations permit, we never disclose or provide specific personal information to any third parties even if we obtain his or her consent.

We take reasonable security measures to protect personal information from the risk of unauthorized access, loss, destruction, tampering, leakage and theft, and others.

We comply with the Act on the Protection of Personal Information and other laws, regulations, and rules pertaining to personal information, and act in line with our internal regulations. We also conduct related education and awareness-raising activities for our directors, officers and employees.

We formulate, implement, and maintain the Private Policy Compliance Program, and work continuously to improve it.

Established on September 1, 2010

Revised on May 30, 2017

Purpose of Use

The Lawson Group uses personal information collected from a user for each service he or she registers and the purpose of use written in flyers to guide a user to campaigns etc.. The Lawson Group never uses personal information collected from a user for the purpose other than the purpose of use written in this page or flyers etc..
The Lawson Group generally uses personal information as follows:

*Please refer to each service and flyer etc. for details as the purpose of use is different from each service etc..

Service for Customer

1. Operation/provision of service and sending of relevant guides (e-mail address)
2. Response to inquiries for our products and services (name, phone number, e-mail address)
3. Advertising and campaigns for customers (name, e-mail address)
4. Notice and sending of a gift to a user in the case that he or she wins in a campaign (name, address, phone number, e-mail address)
5. Delivery of information and e-mail newsletter to customers (e-mail address)
6. Market research/analysis and statistical analysis of questionnaire etc.
7. Improvement of our products and services
8. Provision of personal information to a third party based on this policy
9. The others taken along the above or the purpose closely related to the above

Crew Recruiting

1. Provision the information to our own stores, a member who signs a franchise agreement with us, Lawson Group companies’ own stores, and a member who signs a franchise agreement with Lawson Group companies
2. Provision the information/contact/selection to an applicant who applies to work in the organizations defined in this section1
3. Statistics for the recruiting activity of the organizations defined in this section1
4. Employment management for the recruiting activity of the organizations defined in this section1
5. Response to various inquiries
6. The others taken along the above or the purpose closely related to the above

Owner Recruiting

1. Sending of documents related to the Lawson chain joining
2. Contact for explanatory meeting related to the Lawson chain member store recruiting
3. Response to inquiries for the Lawson chain joining
4. Creation of statistical data without specifying individuals
5. The others taken along the above or the purpose closely related to the above

Safety Management Measures

The Company and each member of the Lawson Group implement the following safety measures to address risks related to personal information, including unauthorized access, loss, destruction, alteration, or leakage.

1. Structure Establishment
   We define roles and responsibilities related to the handling of personal information, appoint a person responsible for management, and establish an organizational framework to implement safety management measures, including systems for emergency response in the event of information leakage incidents.
2. Development of Regulations and Procedures
   We establish regulations and related procedures governing the acquisition, use, and disposal of personal information, and ensure operations are conducted in accordance with these rules.
3. Understanding and Review of Handling Practices
   We maintain records such as applications and ledgers related to the handling of personal information to understand its handling, storage, and disposal status, conduct monitoring including of contractors, and review our safety management measures as necessary.
4. Employees’ Education
   We provide regular training on the handling and management of personal information.
5. Physical Measures
   We define the areas where personal information is handled and implement entry and exit control and monitoring. We also take measures to prevent theft of devices and storage media containing personal information and to prevent data leaks through encryption and other means.
6. Prevention of Unauthorized Access
   We implement functions to prevent unauthorized access to information systems handling personal information, including user authentication, communication and data encryption, intrusion detection and prevention, and malware countermeasures.
7. Understanding of the External Environment
   We regularly review laws and regulations and systems related to personal information protection in foreign countries and take necessary and appropriate measures accordingly.

Joint Use of Personal Information in the Lawson Group

Personal information handled by the Lawson Group is generally used jointly by Lawson Group companies for the following purposes. The purposes of use and items of personal data to be shared differ depending on the service, etc. Therefore, for details on the joint use of personal information, please refer to the privacy policies set out by each Lawson Group company, terms of use for products and services provided by each Lawson Group company, the relevant websites, flyers, etc.

Purposes of use:

1. Operation and provision of services
2. Provision of advertisements and campaigns for customers
3. Improvement of products and services

Shared use within the Lawson Group and Lawson Group chain franchise stores

Details of the purposes of use, items, and responsible party for management concerning the shared use of personal information within the Lawson Group and Lawson Group chain franchise stores are as follows.

1. Purposes of use and items
   Insurance-related administrative processing in the event of accidents, etc. (name, address, telephone number, email address)
   (1) For insurance-related administrative processing concerning accidents, etc.
   (2) For other purposes equivalent to or closely related to the above purposes of use
2. Responsible party for management
   Lawson, Inc.
   For address, representative, and other information, please refer to the Company Information page.