PRIVACY POLICY

1. Our Policy for the Custody of Personal Information

In order to ensure the smooth operation of our business, the Mori Memorial Foundation acquires and retains certain Personal Information about our clients, including names, addresses, telephone numbers and e-mail addresses (“Personal Information”). We recognize that the proper safekeeping of this Personal Information is an important obligation, and have therefore established the following policies for our handling of all Personal Information.

(1) In addition to complying with all laws, regulations, ordinances and guidelines related to the custody of Personal Information, we adopt and implement practices for the appropriate handling of Personal Information that accord with generally accepted public standards, and will strive to improve the suitability and implementation of those practices.
(2) We establish clear internal regulations regarding the handling of Personal Information and make these regulations known to all our employees. In addition, we require our trading partners and contractors to handle all Personal Information in an appropriate manner.
(3) Upon acquiring any Personal Information, we will specify the purpose for which that information will be used, make a notification or public announcement of that purpose, and only deal with the Personal Information within the scope of that specified purpose.
(4) If we engage any third party to deal with all or any part of our Personal Information to the extent required to achieve the purpose of use of that information, before we provide such Personal Information to the third party, we will confirm that the third party has adequate measures for the safekeeping of that information, and will enter into a contract with that third party for the custody of that Personal Information, as well as put in place any other appropriate measures.
(5) We will establish the necessary measures and engage in the appropriate supervision to prevent any disclosure or loss of, or tampering with, any Personal Information.
(6) If we receive a request from any client in relation to whom we have custody of Personal Information, to disclose, amend, delete or cease using that information, we will respond accordingly in good faith.

2. Purpose of Use of Personal Information

The Organization acquires Personal Information as necessary in the course of undertaking our business, and that Personal Information will be used for one or more of the following purposes.

(1) To conduct surveys and research as part of the Organization’s business to assess the history, current status, and trends of urban areas and urban activities, as well as to project future trends
(2) To send emails and material in connection with information about the Organization’s business or in response to questions from customers
(3) To send invitations, announcements and seasonal greetings in connection with the special events we host, co-host, support and collaborate on
(4) To conduct selection activities and communication related to recruitment
(5) In the event that the Organization is engaged by another business to deal with all or any part of the Personal Information of that business, to undertake that engagement in an appropriate manner
(6) To send e-mail magazines and direct mail regarding the Organization’s business
(7) To conduct market surveys regarding the Organization’s business
(8) To implement any other activity related to any business of the Organization

3. Provision of Personal Information to Third Parties

Except where required by law, we will not disclose any individual’s Personal Information to a third party without the consent of that individual.

4. Management and Custody of Personal Information

The Organization will appoint a Personal Information Manager to ensure the proper and strict safekeeping of the Personal Information received from our clients, and will strive to preserve the accuracy of all Personal Information. Furthermore, we will implement the necessary and appropriate level of safety measures to prevent the risk of any Personal Information being disclosed outside of the Organization and of any improper external access to the Personal Information, based on our Regulations for the Custody of Personal Information and Rules for Dealing with Personal Information.

(1) Organizational safety management measures
- ① Organizational structure
  Organizational structures are in place to implement safety management measures.
- ② Operation in accordance with the Disciplinary Rules for the Handling of Personal Information
  Personal Information is handled in accordance with the rules for the handling of Personal Information as established in advance. When necessary, we will record system logs or usage records to verify the status of operation in accordance with the established rules for the handling of Personal Information.
- ③ Developing a means of checking the status of the handling of Personal Information
  We have in place means to check the status of our handling of Personal Information.
- ④ Establishment of a system to deal with an incident of data leakage
  We shall establish a system for responding appropriately and promptly when we become aware of the occurrence of a data leakage or other incident.
  In the event of a leakage or similar incident, the Personal Information Manager will notify the individual or the authorities in accordance with the legal system of the respective country and will promptly disclose the facts and measures to prevent recurrence, secondary damage or similar incidents depending on the incident.
- ⑤ Monitoring of handling data and reviewing security control measures
  We will monitor the handling of Personal Information, and work to assess, review and improve our security management measures.
(2) Personnel security management measures
- ① Employee training
  We ensure that our employees are informed and appropriately trained in the proper handling of Personal Information.
(3) Physical security management measures
- ① Management of areas where Personal Information is handled
  Appropriate management is carried out in areas where important information systems such as servers and main computers that handle Personal Information databases are managed, as well as in areas where other administrative work handling Personal Information is carried out.
- ② Prevention of theft or loss of equipment and electronic media
  We shall exercise appropriate control to prevent the theft or loss of equipment, electronic media and documents that handle Personal Information.
- ③ Prevention of leaks when carrying electronic media
  When we carry electronic media or documents on which Personal Information is recorded, we shall take security measures to ensure that the Personal Information is not readily apparent.
- ④ Deletion of Personal Information and disposal of equipment, electronic media
  When Personal Information is deleted, or equipment or electronic media on which Personal Information is recorded is disposed of, it will be done in a manner that makes it unrecoverable. In addition, when Personal Information is deleted or equipment, electronic media on which Personal Information is recorded is disposed of, a record of the deletion or disposal will be preserved as necessary. When such work is outsourced, we will, if necessary, verify by means of a certificate or other means that the outsourced party has securely deleted or disposed of the Personal Information.
(4) Summary of technical security management measures
- ① Access control
  We shall implement appropriate access controls to limit the scope of the person in charge and the way databases of Personal Information are handled.
- ② Identification and authentication of persons accessing the system
  We shall ensure that employees who use information systems that handle Personal Information are those with legitimate access rights.
- ③ Prevention of unauthorized external access
  We shall implement and properly operate mechanisms to protect information systems that handle Personal Information from unauthorized external access or unauthorized software.
- ④ Prevention of leaks and other problems arising from the use of information systems
  We shall take measures to prevent the leakage of Personal Information arising from the use of our information systems and shall operate information systems appropriately.
(5) Understanding the external environment
When handling Personal Information in countries other than Japan, we will take necessary and appropriate measures for the secure management of Personal Information, based on our understanding of the systems for the protection of Personal Information in those countries.

5. Cookies

When you use our web site and web sites of the Organization’s business (“Our Web Sites”), we may use computer information called “cookies” for the following purposes of use.

Purposes of Use

(1) To grasp each individual’s access status to Our Web Sites
(2) To conduct statistical analysis of access status to Our Web Sites
(3) To distribute advertisements customized for each individual

Cookies enables Our Web Sites to provide better services to you and the information collected by cookies does not identify you.
You may set the browser of your computer to reject receiving cookies, but in that case, you will not receive some services on Our Web Sites.
The Organization also may use advertisement distribution services provided by third parties, which utilize activity information such as cookies. If you hope to stop the distribution of advertisements, you may set the browser to reject receiving cookies or disable (opt-out) such advertisement on some third party’s web site.
What are cookies?
Cookies are used to write and store information in your PC, smartphone, or tablet PC from the server of a web site when you access the web site, including information on browsing by you. Web sites use cookies stored in your PC or the like and enables efficient use of web sites; there is no need to redo the setting every time you access web sites.

6. Where Disclosure is Requested

In the event that any individual in respect of whom we hold Personal Information wishes us to disclose that information, we will, without delay, after first confirming the identity of the individual making such request, disclose the relevant Personal Information, except where otherwise required by law.

7. Amendments, Additions and Deletions

In the event that any individual in respect of whom we hold Personal Information wishes that information to be amended, supplemented or deleted, we will, without delay, after first confirming the identity of the individual making such request, effect the relevant change so that the relevant Personal Information is in accordance with fact.

8. Suspension and Cessation of Use

In the event that any individual in respect of whom we hold Personal Information wishes us to suspend or cease our use of that information or to cease providing that information to a third party, we will, without delay, after first confirming the identity of the individual making such request and ascertaining that there is a reason for the request, effect the relevant suspension or cessation.

9. Contact Person for Disclosure and Other Matters

All requests in relation to an individual’s Personal Information as set forth in Clauses 6, 7 or 8 above, and any inquiries or complaints regarding the Organization’s handling of Personal Information should be made to the following contact office:

Legal Compliance Department, the Mori Memorial Foundation

(1) Address
Toranomon 37 Mori Building 13F 3-5-1 Toranomon Minato-ku, Tokyo 105-0001
(2) E-mail
info@mori-m-foundation.or.jp
The business hours of the Personal Information Response Office are from 10:00am to 5:00pm on weekdays (excluding the Organization’s holidays).

In addition, regarding the handling of Personal Information, you may file a complaint with the Personal Information Protection Commission or other supervisory authorities.

April 20, 2026
President Shigenori Kobayashi
The Mori Memorial Foundation