Effective date: October 1, 2012
Revised date: April 1, 2026

Dexerials Corporation and Dexerials Group Companies (collectively, “Dexerials”, “we”, “our” or “us”) will securely store and use Personal Information that you provide and entrust to us, respect your wishes and endeavor to appropriately process and protect your Personal Information by establishing the following Policy regarding the processing of Personal Information.

• I.　Processing of Personal Information
• Ⅲ. Processing of Personal Information of Individuals Residing in the EU
• Ⅳ. Processing of Personal Information of Individuals Residing in China
• Ⅴ. Processing of Personal Information of Individuals Residing in Taiwan
• Ⅵ. Processing of Personal Information of Individuals Residing in South Korea
• Ⅶ. Handling of Personal Information of Individuals Residing in Singapore

For the purposes of this Policy, Personal Information is information about a living individual (i) that makes it possible to identify the specific individual by their name, date of birth or other descriptive details, etc. or (ii) that contains a personal identification code. Information that cannot identify the specific individual on its own but can be easily combined with other information to identify the specific individual will also be treated as Personal Information.

Dexerials will comply with the applicable laws and regulations of each country in which it processes Personal Information, including, but not limited to, the obligations under the Japanese Act on the Protection of Personal Information and other guidelines issued by the Japanese Personal Information Protection Commission and other competent authorities regarding the protection of Personal Information, as well as this Policy.

Dexerials will acquire Personal Information through appropriate procedures, including clarifying the purposes of use, as described below and will not use the Personal Information for any purposes other than the stated purposes. When acquiring Personal Information, Dexerials will endeavor to clearly indicate in advance the Personal Information items to be processed, the purposes of use, contact information for inquiries and other necessary information and to obtain your consent. If the purposes of use are changed, such change will be made within the scope reasonably deemed to be relevant to the purposes of use before the change, and a notice in respect of the changed purposes of use will be provided to you or a public announcement in respect thereof will be made without delay.

《Personal Information of Customers and Business Partners》

• Provision of information on our products and services
• Sales of our products, provision of our services (including technical licenses) and provision of customer support (including after-sales services)
• Sending of information on our products, services, exhibitions and various events and operation of the exhibitions and various events
• Creating statistical data for future product development and sales activities
• Providing information to and communicating with the persons in charge of our business partners, etc.
• Conducting business negotiations and meetings, liaisons, etc.
• Entry and exit management at our facilities
• Responding to various inquiries

《Personal Information of Shareholders》

• Exercise of rights and performance of obligations by shareholders or us in accordance with the Companies Act
• Providing services to shareholders
• Management of shareholders and shares, including preparation of data in accordance with laws and regulations

《Personal Information of Applicants and Retirees》

• Recruitment, providing information and communications, etc. to applicants (including interns), and performing tasks related to recruiting activities
• Use as analysis and statistical data during recruitment and recruiting activities by us
• Providing information and communications, etc. to retirees

If Personal Information includes sensitive Personal Information such as an individual’s race and creed, we will not acquire such Personal Information without obtaining your consent except as permitted by the applicable laws and regulations. In addition, when we acquire Personal Information from a third party, we will comply with the obligations to confirm and create records of such Personal Information when acquiring it from a third party if required by the applicable laws and regulations. Dexerials will not use Personal Information in a manner that may encourage or induce illegal or improper activities.

Dexerials will not provide or disclose Personal Information to any third parties without obtaining your prior consent except in the following cases. If Dexerials provides or discloses Personal Information to a third party, Dexerials will comply with the applicable laws and regulations that require Dexerials to create records when providing or disclosing Personal Information to a third party.

• When entrusting all or part of the processing of Personal Information to a contractor within the scope of the purposes of use you agreed to and providing or disclosing Personal Information in connection therewith
• When it is necessary for the protection of people’s lives, bodies or properties and it is difficult to obtain your consent
• When Personal Information is provided or disclosed as a result of a merger, spin-off, transfer of business or other such event
• Other cases based on laws and regulations

Dexerials Corporation may provide or disclose Personal Information to Dexerials Group Companies in foreign countries (for a list of Dexerials Group Companies in foreign countries, please click here) for the purposes set out in 3 above. The information regarding the provision or disclosure of Personal Information to Dexerials Group Companies in foreign countries is as follows:

《Name of Foreign Countries in Which Third Parties Are Located》

US, Netherlands, Germany, China, Taiwan, Korea and Singapore

《Information on Systems for Protection of Personal Information in Foreign Countries》

Regarding third parties to which information is provided or disclosed and the foreign countries in which they are located, please refer to the following websites of the Personal Information Protection Commission for information on the systems for the protection of Personal Information in such foreign countries.

The US:
https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_america/

The Netherlands and Germany (as both are EU member states, they are foreign countries that have systems for the protection of Personal Information that are recognized as being at the same level as Japan’s for protecting the rights and interests of individuals):
https://www.ppc.go.jp/enforcement/infoprovision/EU/

China:
https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_china/

Taiwan:
https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_taiwan/

Korea:
https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_korea/

Singapore:
https://www.ppc.go.jp/enforcement/infoprovision/laws/offshore_report_singapore/

《Information on Measures that Will Be Taken by Third Parties to Protect Personal Information》

Third parties to whom information is provided or disclosed will take all measures to address the eight principles of the OECD Privacy Guidelines.

Dexerials will endeavor to keep Personal Information accurate and up-to-date to the extent necessary to achieve the Purposes of Use and to erase such Personal Information without delay when it is no longer necessary to use it. Dexerials will manage Personal Information accurately and securely and will take necessary and appropriate security control measures, both physical and technical, to prevent any unauthorized access to Personal Information and any loss, destruction, alteration or leakage of Personal Information and to otherwise safely manage Personal Information.

Dexerials understands that you may have rights to your Personal Information, including the right to request the disclosure; the correction, addition and deletion (hereinafter collectively referred to as “Correction, etc.”); and the suspension of use or erasure (hereinafter referred to as “Suspension of Use, etc.”) of your Personal Information. If such a request is made, we will appropriately respond in accordance with the applicable laws and regulations.

If you wish to request the disclosure; Correction, etc.; or Suspension of use, etc. (hereinafter referred to as “Disclosure, etc.”) of Personal Information we retain, please fill out the required items on the application form we prescribe and send it by mail to the following reception desk. Please download and fill out this application form and mail it to us. In order to carefully confirm your identity, please enclose a copy of a document issued by a public institution to verify your identity (such enclosure is not required for requests for notification in respect of the purposes of use). Please note that, with some exceptions, a processing fee will be charged for requests for Disclosure, etc.

■ Contact for Requests for Disclosure, etc. of Personal Information
Complaints and consultations regarding Personal Information we retain will also be processed at the following contact point.

Personal Information Disclosure, etc. Request Desk, Dexerials Corporation
Mitsui Sumitomo Insurance Tepco Building 9F, 1-6-1 Kyobashi, Chuo-ku, Tokyo 104-0031, Japan

Dexerials will provide its employees with necessary and appropriate supervision in respect of the processing of Personal Information to ensure the security of such Personal Information. Dexerials may entrust all or part of the processing of Personal Information to a third party within the scope of the purposes of use. In such case, Dexerials will require that the contractor safely manage the Personal Information through a contract or otherwise, and Dexerials will exercise necessary and appropriate supervision over the contractor.

In order to appropriately process Personal Information, Dexerials will endeavor to continuously strengthen and improve its internal systems, including the review of this Policy, by appointing a person responsible for management, establishing internal rules, educating officers and employees and conducting appropriate internal audits. Dexerials will also endeavor to educate its contractors and other related parties on the safe management and protection of Personal Information.

We may change this Policy from time to time. The revised Policy will be posted on this website.

In addition to the descriptions in Chapter I, Dexerials will process and endeavor to protect Personal Information of individuals residing in the European Union (“EU”) as described in the EU specific supplementary provisions set out below. Unless otherwise defined in this Chapter Ⅲ, any terms defined in Regulation (EU) No. 2016/679 (General Data Protection Regulation – “GDPR”) have the same meaning when used in this Chapter Ⅲ. In the event of any inconsistency between Chapter I and this Chapter Ⅲ, this Chapter Ⅲ shall prevail for individuals residing in the EU.

Notwithstanding Chapter I.1 (“Definition of Personal Information”) of this Policy, for the purpose of this Chapter Ⅲ, Personal Information extends to all information that relates to an identified or identifiable natural person, even if the information itself does not make it possible to identify the person but such identification can still take place by any (additional) means reasonably likely to be used.

《Personal Information of Customers and Business Partners》

For Personal Information of customers and business partners, the primary “controller” within the meaning of GDPR is the Dexerials entity with regard to which you or the company at which you are employed or at which you are a member of a corporate body is a (prospective) customer or business partner. Where this Chapter Ⅲ refers to Dexerials, it refers to this entity.

As Dexerials operates a common business relationship management, Dexerials Corporation and/or other Dexerials Group Companies jointly decide on the purposes and/or means of some processing activities, in particular the acquisition and use of contact information for a joint customer and/or vendor management. For these processing activities, the relevant Dexerials Group Companies qualify as joint controllers together with the primary controller.

《Personal Information of Shareholders》

For Personal Information of shareholders, the primary controller is the Dexerials entity with regard to which you are or, as applicable, the company at which you are employed or at which you are a member of a corporate body is, a shareholder. Where this Chapter Ⅲ refers to Dexerials, it refers to this entity

《Personal Information of Applicants and Retirees》

For Personal Information of applicants and retirees, the primary controller is the Dexerials entity with regard to which you are an applicant or a retiree. Where this Chapter Ⅲ refers to Dexerials, it refers to this entity.

For the purposes as stated in Chapter I.3 (“Acquisition of Personal Information and Use of Personal Information within Scope of Purposes of Use”), Dexerials processes, in particular, the following categories of Personal Information:

《Personal Information of Customers and Business Partners》

• identification data, in particular first name, middle name(s), last name
• contact data, in particular company name, department name, title, address, phone number, fax number, email address;
• product purchase history; and
• communication data, in particular contents and meta-data of inquiry

《Personal Information of Shareholders》

• identification data, in particular first name, middle name(s), last name, date and place of birth;
• contact data, in particular, address, phone number, email address;
• information regarding shareholding, in particular number of shares and any notes/information to be linked to that shareholding according to law, e.g. class of shares, information on participation in shareholder meetings; and
• communication data, in particular contents and meta-data of communication

《Personal Information of Applicants and Retirees》

• identification data, in particular first name, middle name(s), last name, title, gender, other data required to prove identity and right to work in accordance with national laws;
• contact data, in particular address, phone number, email address;
• communication data, in particular contents and meta-data of communication; and
• for Applicants: application data, in particular contents and meta-data of an application or candidacy for membership in a corporate body, which typically includes identification data, contact data and job-related data;
• for Retirees: data on past employment and its contractual conditions, in particular retirement benefits and their administration.

《Personal Information of Customers and Business Partners》

The provision of Personal Information processed in connection with the business relationship is generally voluntary. However, if you do not provide Personal Information, Dexerials may not be able to enter into or perform a contractual relationship with you or the company at which you are employed or at which you are a member of a corporate body. In some cases, providing certain Personal Information may also be contractually required (e.g., certain information regarding your company or business) or a precondition to enter into a contractual relationship because of statutory requirements (e.g., information required under anti-money laundering legislation or similar know-your-customer/vendor requirements). Please feel free to contact Dexerials if you would like more information about whether and/or to which extent the provision of Personal Information is required.

《Personal Information of Shareholders》

The provision of certain Personal Information processed in connection with the shareholder relationship is statutorily required (e.g., name of shareholder, number of shares, address of shareholder). Apart from that, providing Personal Information is generally voluntary. However, if you do not provide Personal Information, Dexerials may not be able to effectively communicate with you as a shareholder and/or you may not be able to fully exercise your rights as a shareholder. The provision of certain Personal Information may also be required under Dexerials’ articles of association, in particular where necessary for the organization of shareholders’ meetings.

《Personal Information of Applicants and Retirees》

The provision of Personal Information processed in connection with an application is voluntary. However, if you do not provide Personal Information along with your application, it cannot be handled successfully. This means that while the provision of the Personal Information is not statutorily or contractually required, Dexerials may not be able to enter into a contractual relationship with you if you do not provide Personal Information. Also if you do not provide Personal Information, Dexerials may not be able to provide information or communicate with you properly. Similarly, the provision of Personal Information as a retiree is generally necessary for Dexerials to perform its contractual obligations in connection with the retirement, for example the payment and/or administration of retirement benefits.

Where the Personal Information of customers and business partners is not acquired directly from you, it is acquired from the company at which you are employed or a member of a corporate body, or another Dexerials entity with which you or the company at which you are employed or at which you are a member of a corporate body were in contact. It may also be acquired from public registers such as the commercial register.

The legal bases for the processing of Personal Information of individuals residing in the EU for the purposes as stated in Chapter I.3 are as follows.

《Personal Information of Customers and Business Partners》

Purpose	Legal basis
Provision of information on our products and services	Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to provide information to and to communicate with customers/business partners regarding products and services
Sales of our products, provision of our services (including technical licenses) and provision of customer support (including after-sales services)	Contractual necessity (Art. 6(1)(b) GDPR) if you are Dexerials’ customer Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to sell our products and provide our services as well as customer support if you are an employee or member of a corporate body at Dexerials’ customer
Sending of information on our products, services, exhibitions and various events and operation of the exhibitions and various events	Consent (Art. 6(1)(a) GDPR) Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to provide information to and to communicate with you regarding products, contests, services and/or events
Creating statistical data for future product development and sales activities	Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to improve product development and sales
Providing information to and communicating with the persons in charge of our business partners, etc.	Contractual necessity (Art. 6(1)(b) GDPR) if you are Dexerials’ business partner Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to provide information to and to communicate with you if you are an employee or member of a corporate body at Dexerials’ business partner
Conducting business negotiations and meetings, liaisons, etc.	Contractual necessity (Art. 6(1)(b) GDPR) if you are Dexerials’ business partner Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) if you are an employee or member of a corporate body at Dexerials’ business partner: to provide products or services; and to administrate the Dexerials business
Entry and exit management at our facilities	Dexerials’ legitimate interest (Art. 6(1)(f) GDPR): to ensure safety of the customers, business partners and employees of Dexerials and Dexerials’ assets; and to ensure data security
Responding to various inquiries	Contractual necessity (Art. 6(1)(b) GDPR) where you are our (prospective) contractual partner Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to handle your inquiry

《Personal Information of Shareholders》

Purpose	Legal basis
Exercise of rights and performance of obligations by shareholders or us in accordance with the Companies Act	Contractual necessity (Art. 6(1)(b) GDPR) if you are the shareholder Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) as set out in the column on the left if you are an employee or member of a corporate body at the shareholder Compliance with the legal obligations (Art. 6(1)(c) GDPR)
Providing services to shareholders	Contractual necessity (Art. 6(1)(b) GDPR) where you are the shareholder Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to maintain and manage the shareholder relationships if you are an employee or member of a corporate body at the shareholder or if the service is unrelated to the shareholder relationship
Management of shareholders and shares, including preparation of data in accordance with laws and regulations	Compliance with the legal obligations (Art. 6(1)(c) GDPR) Contractual necessity (Art. 6(1)(b) GDPR) where you are the shareholder Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to maintain and manage the shareholder relationships if you are an employee or member of a corporate body at the shareholder

《Personal Information of Applicants and Retirees》

Purpose	Legal basis
Recruitment, providing information and communications, etc. to applicants (including interns), and performing tasks related to recruiting activities	Contractual necessity (Art. 6(1)(b) GDPR) Consent (Art. 6(1)(a) GDPR), where applicable Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to pursue the purpose mentioned in the left column
Use as analysis and statistical data during recruitment and recruiting activities by us	Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to pursue the purpose mentioned in the left column
Providing information and communications, etc. to retirees	Consent (Art. 6(1)(a) GDPR), where applicable Dexerials’ legitimate interest (Art. 6(1)(f) GDPR) to pursue the purpose mentioned in the left column

Notwithstanding the descriptions in Chapter I.4 (“Provision or Disclosure of Personal Information to Third Parties”), Personal Information of customers and business partners may be shared with other Dexerials entities to the extent this is necessary for a common business relationship management. The legal basis for sharing such Personal Information is Art. 6(1)(f) GDPR. The relevant legitimate interest is the interest in making use of the synergies of a common business relationship management. Where the transfer of Personal Information is necessary to deliver products or services to you, the legal basis is Art. 6(1)(b) GDPR if you are the customer, and Art. 6(1)(f) GDPR if you are an employee or member of a corporate body at the customer.

Dexerials uses the services of external service providers for certain data processing tasks. These providers are given access to your Personal Information as necessary to provide these services. These service providers are obliged to maintain strict confidentiality, and only process the data in accordance with instructions. Dexerials further relies on other vendors and entities with particular expertise in individual areas or certain specialized subjects (e.g. tax auditors, lawyers, consulting firms, logistics service providers) as well as authorities and courts. These bodies either have a duty of professional confidentiality or have been obliged by us to maintain secrecy. Should it be necessary to share Personal Information with them, the legal basis for this is generally Art. 6(1)(b) or (f) GDPR, depending on what the respective situation. To the extent Dexerials is subject to a statutory obligation under EU or member state law, including a binding order by an EU or member state authority, to disclose Personal Information, the legal basis is Art. 6(1)(c) GDPR in conjunction with the relevant legal provision.

Where the Personal Information is transferred to Dexerials Corporation in Japan or Dexerials entity in Korea, such Personal Information is protected under the laws of the respective jurisdiction, which the European Commission has found to be adequate. A copy of these decisions can be here. For cases in which the Personal Information is transferred to other Dexerials entities outside of the EU or European Economic Area, the respective Dexerials entity and the controller(s) have concluded standard contractual clauses as approved by the European Commission. A copy of these clauses can be requested from Dexerials.

《Personal Information of Customers and Business Partners》

Personal Information of customers and business partners will generally be retained for the duration of the (pre-)contractual relationship on the basis of Art. 6(1)(b) or (f) GDPR.

Moreover, Personal Information will be retained for as long as necessary to comply with statutory retention obligations, in particular under tax and commercial law, on the basis of Art. 6(1)(c) GDPR in conjunction with statutory retention obligations under EU or member state law. These may require retention for a number of years after the business relationship has ended. Please reach out to Dexerials if you would like to know more details.

Finally, Personal Information may be retained as long as necessary to exercise, establish and/or defend legal rights, at the maximum until the expiry of the statute of limitations, on the basis of Art. 6(1)(f) GDPR. The relevant legitimate interest is the interest in protecting legal rights and interests of Dexerials.

《Personal Information of Shareholders》

Personal Information of shareholders will generally be retained for the duration of the shareholder relationship on the basis of Art. 6(1)(b) or (f) GDPR as set out under Chapter Ⅲ.4 above. Moreover, it will be retained for as long as necessary to comply with statutory retention obligations, in particular under tax and commercial law, on the basis of Art. 6(1)(c) GDPR in conjunction with statutory retention obligations under EU or member state law. These may require retention for a number of years after the person in question is no longer a shareholder. Please reach out to Dexerials if you would like to know more details.

《Personal Information of Applicants and Retirees》

In case your application is rejected, your Personal Information will generally be stored for four (4) weeks if you apply for a position in the Netherlands, six (6) months if you apply for a position in Germany

for the purpose of preparing and defending against potential claims. Should you in fact raise a claim, your data will be retained for the duration of the legal proceedings and potentially beyond. The legal basis for such retention is Art. 6(1)(f), 9(2)(f) GDPR. The relevant legitimate interest is the interest in safeguarding legal rights and interests. After that, your data will be erased or anonymized.

Should your application be rejected, but you give your consent to store and process your Personal Information in order to consider you for future job opportunities, your data will generally continue to be stored and processed for this purpose as long as reasonably makes sense given your qualifications and Dexerials’ recruitment needs, but not longer than five (5) years after you last updated your application data and thereby show that you are interested in being considered. It will then be erased or anonymized. If you withdraw your consent, your Personal Information will be erased without undue delay.

Personal Information of retirees will be retained for as long as necessary to perform contractual obligations in connection with retirement benefits. To the extent Personal Information of retirees is still included in files and documents of Dexerials, it may be retained as long as necessary to comply with statutory retention obligations, in particular under tax and commercial law, on the basis of Art. 6(1)(c) GDPR in conjunction with statutory retention obligations under EU or member state law. These may require retention for a number of years after retirement benefits have expired.

Notwithstanding Chapter I.6 (“Disclosure; Correction, etc.; and Suspension of Use, etc. of Personal Information”), you have the following rights, subject to the requirements set out in the GDPR and national data protection legislation:

• Right to access
• Right to rectification, including by supplementation
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to withdraw consent at any time with future effect
• Right to lodge a complaint with a supervisory authority

You also have the right to object, on grounds relating to your particular situation, at any time to processing of Personal Information based on Art. 6(1)(f) GDPR. In case of such objection, Dexerials shall no longer process the Personal Information unless Dexerials demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

You also have right to object to the processing of Personal Information for direct marketing purposes. In case of such objection, the Personal Information shall no longer be processed for such purposes.

Within the scope of this Privacy Policy, no decisions are taken with regard to you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

In addition to the matters stipulated in Chapter I, Dexerials will process and endeavor to protect Personal Information of individuals residing in the People’s Republic of China (hereinafter referred to as “China”) in accordance with the applicable laws and regulations of China as detailed below. In the event of any inconsistency between Chapter I and this Chapter Ⅳ, this Chapter Ⅳ shall prevail for individuals residing in China.

1. To achieve the purposes stated in Chapter I. 3 (“Acquisition of Personal Information and Use of Personal Information within Scope of Purposes of Use”), Dexerials will process your Personal Information in accordance with your consent (or the consent by the legal guardian in the case of minors under the age of 14) and in accordance with applicable laws and regulations. For details on the purpose of processing Personal Information, please refer to Chapter I. 3.
2. The categories of Personal Information processed The Personal Information Dexerials acquire and process mainly includes the individual’s name, company name, department name, title, address, phone number, fax number, email address, product purchase history, various inquiry details, and other information that is limited to the minimum scope necessary for achieving the purposes stated in Chapter I. 3.

The Personal Information Dexerials acquire and process may constitute sensitive Personal Information. Disclosure or misuse of such information may result in damage to your dignity, personal safety, or property. Dexerials will adopt strict protective measures and process sensitive Personal Information only to the extent necessary to achieve the purposes set forth in Chapter I. 3, and in compliance with applicable laws and regulations.

Unless otherwise required by laws or regulations of China, Dexerials will retain your Personal Information for the minimum reasonable period necessary to fulfill the purposes of use as determined based on the following criteria:

1. To complete relevant transactions, maintain business records, and respond to potential inquiries or complaints; and
2. To ensure the safety and quality of the services Dexerials provide to you; and
3. To comply with any other special retention requirements set by laws, regulations, or agreements of China.

In addition to the purposes of use and the transferred Personal Information stated in Chapter I. 4 (“Provision or Disclosure of Personal Information to Third Parties”), Dexerials may provide or disclose the Personal Information Dexerials directly acquire from you to Dexerials’ group companies for the following purposes:

• Provision of information on our products and services
• Sales of our products, provision of our service and provision of customer support (including after-sales services)
• Sending information on our products, services, exhibitions and various events and operation of the exhibitions and various events
• Creating statistical data for future product development and sales activities
• Providing information to and communicating with the persons in charge of our business partners, etc.
• Conducting business negotiations and meetings, liaisons, etc.
• Entry and exit management at our facilities
• Responding to various inquiries

Please refer to “迪睿合集团” for the information regarding the recipients of the provided or disclosed Personal Information. Such provision and disclosure of your Personal Information will be conducted in compliance with applicable laws and regulations.

To achieve the purposes set forth in Chapter I.3, Dexerials may entrust others with the processing of Personal Information in part or in whole within the scope of the purposes of use you have agreed to. In such cases, Dexerials will enter into agreements with the entrusted parties on the purpose, time limit and methods of the entrusted processing, categories of Personal Information, protection measures, as well as the rights and obligations of the parties to the agreement and will supervise Personal Information processing activities of the entrusted parties. If any entrusted parties need to use your information for purposes not entrusted by us, they will seek to obtain your consent separately.

To achieve the purposes set forth in Chapter I.3, Dexerials may entrust others with the processing of Personal Information in part or in whole within the scope of the purposes of use you have agreed to. In such cases, Dexerials will enter into agreements with the entrusted parties on the purpose, time limit and methods of the entrusted processing, categories of Personal Information, protection measures, as well as the rights and obligations of the parties to the agreement and will supervise Personal Information processing activities of the entrusted parties. If any entrusted parties need to use your information for purposes not entrusted by us, they will seek to obtain your consent separately.

1. Where Dexerials have obtained your prior consent; or
2. Where required by laws, regulations, administrative enforcement, or judicial orders of China; or
3. In the event of a merger, corporate split, dissolution, or bankruptcy involving our company, your Personal Information may be transferred as part of the transaction. In such cases, Dexerials will require the receiving party to continue complying with this Policy. If they do not, Dexerials will require them to obtain your renewed consent; or
4. other circumstances set forth in 4 and 5 of this chapter.

Dexerials will not publicly disclose your Personal Information except under the following circumstances:

1. Where Dexerials have obtained your prior consent; or
2. Where required by laws, regulations, administrative enforcement, or judicial orders of China, in which case Dexerials will disclose only the necessary information as required in a manner that ensures compliance with applicable laws and regulations.

1. Dexerials will have implemented the following security measures to protect your Personal Information:
   • Establishment and implementation of internal management systems and operating procedures for Personal Information protection;
   • Implementation of category-based management of Personal Information;
   • Implementation of corresponding technical security measures such as encryption and de-identification;
   • Reasonable determination of the authority to process Personal Information and conducting security education and training for relevant employees on a regular basis;
   • Formulation and implementation of emergency response plans for Personal Information security incidents; and
   • Other security measures required by applicable laws and regulations.
2. Where required by laws, regulations, administrative enforcement, or judicial orders of China, in which case Dexerials will disclose only the necessary information as required in a manner that ensures compliance with applicable laws and regulations.

You have the legal right to access, copy, transfer, and correct your Personal Information, among other rights. To exercise these rights, please contact us using the contact details provided in Chapter I. 6 (“Contact for Requests for Disclosure, etc. of Personal Information”) and follow the procedure stated therein.

According to the relevant Personal Data Protection Act in Taiwan (hereinafter referred to as the "PDPA"), with respect to our acquisition of your Personal Information, in addition to the matters specified in Chapter I, the following procedures will be followed and additional matters will be disclosed to you. We will process your Personal Information as described below and are committed to protecting your Personal Information. In the event of any inconsistency between Chapter I and this Chapter Ⅴ, this Chapter Ⅴ shall prevail for individuals residing in Taiwan.

Notwithstanding Chapter I. 1 (“Definition of Personal Information”) of this Policy, for the purpose of this Chapter Ⅴ, Personal Information includes passport number, physical characteristics, fingerprints, marital status, family information, education background, occupation, medical records, healthcare data, genetic information, sex life, records of physical examinations, criminal records, contact information, financial conditions, and social activities.
We will not acquire, process or use data pertaining to your medical records, healthcare, genetics, sex life, physical examination or criminal records unless under any of the following bases:

1. where it is expressly required by the laws of Taiwan;
2. where it is within the necessary scope for a government agency of Taiwan to perform its statutory duties or for a non-government agency to fulfill its statutory obligation, provided that proper security and maintenance measures are adopted prior or subsequent to such acquisition, processing or use of Personal Information;
3. where the Personal Information has been manifestly made public by you or publicized legally;
4. where it is necessary for statistics gathering or academic research by a government agency or an academic institution for the purpose of healthcare, public health, or crime prevention, provided that such data, as processed by the data provider or as disclosed by the data acquirer, may not lead to the identification of you;
5. where it is necessary to assist a government agency in performing its statutory duties or a non-government agency in fulfilling its statutory obligations, provided that proper security and maintenance measures are adopted prior or subsequent to such acquisition, processing, or use of personal data; or
6. where you have consented to the acquisition, processing and use of your Personal Information in writing, except where the acquisition, processing or use exceeds the necessary scope of the specific purpose, or where the acquisition, processing or use based solely on the consent of you is otherwise prohibited by the laws of Taiwan, or where such consent is not given by you out of your free will.

Dexerials hereby informs you of the following information:

1. Our name: Dexerials (referring to Dexerials Corporation and Dexerials Group Companies)
2. The purpose of the acquisition:
   Please refer to "Purposes of Use of Personal Information by Dexerials" in Chapter I. 3, as well as for the purpose of a merger, spin-off, transfer of business or other such event.
3. The categories of the Personal Information to be acquired:
   the individual’s name, company name, department name, title, address, phone number, fax number, email address, product purchase history, various inquiry details, and other Personal Information sufficient to identify the individual in order to provide our products and services
4. The time period, territory, recipients, and methods of which the Personal Information is used:
   1. Time period: until your Personal Information is no longer required for the aforementioned purpose of acquisition.
   2. Territory: the countries where Dexerials Group Companies are located and any other areas necessary for fulfilling the aforementioned purpose of acquisition.
   3. Recipients: Dexerials Group Companies and other third parties which need to obtain your personal information under Chapter I. 4 (Provision or Disclosure of Personal Information to Third Parties)
   4. Methods: all necessary means within the scope of use described in 2. (2) of this Chapter Ⅴ.
5. Your rights and the methods for exercising such rights:
   You have the rights described below. For information on how to exercise these rights, please refer to "Procedures for Disclosure; Correction, etc.; and Suspension of Use, etc. of Personal Information" in Chapter I. 6.
   1. The right to make an inquiry of and to review your Personal Information;
   2. The right to request a copy of your Personal Information;
   3. The right to supplement or correct your Personal Information;
   4. The right to demand the cessation of the acquisition, processing or use of your Personal Information; and
   5. The right to erase your Personal Information.
6. When Dexerials receives your request to exercise the aforementioned rights I and II, we will decide whether to grant your request within 15 days. If necessary, this period may be extended for up to an additional 15 days, and you will be notified in writing of the reason for the extension. In addition, we will charge the relevant costs and fees for this request.
   When Dexerials receives your request to exercise the aforementioned right III, we will decide whether to grant your request within 30 days. If necessary, this period may be extended for up to an additional 30 days, and you will be notified in writing of the reason for the extension.
7. You are free to choose whether or not to provide or disclose your Personal Information. However, if you choose not to provide or disclose it, this may affect your rights as described in "Purposes of Use of Personal Information by Dexerials" in Chapter I. 3, as well as the services provided by Dexerials.

This Chapter Ⅵ supplements Chapter Ⅰ and sets forth additional information related to how we process the Personal Information of individuals residing in South Korea. To the extent that there are any inconsistencies between Chapter Ⅰ and this Chapter Ⅵ, this Chapter Ⅵ will prevail with respect to individuals residing in South Korea.

The data handler under the Personal Information Protection Act for individuals residing in South Korea (the “PIPA”) is Dexerials Korea Corporation.

Pseudonymized information shall also be treated as Personal Information. Pseudonymization refers to processing Personal Information in such a way that a specific individual cannot be identified without additional information, such as by deleting part of the data or replacing all or part of it.

We process the following types of personal information with your consent pursuant to Articles 15(1)1 of the PIPA.

Items to be Collected	Purpose of Collection	Retention Period
Business card information (the individual’s name, company name, department name, title, address, phone number, fax number, email address)	Customer management, marketing activities, sales support	Until the purpose of use is fulfilled, and thereafter for the retention period required by applicable laws and regulations thereafter
product purchase history	Customer management, marketing activities, sales support	Until the purpose of use is fulfilled, and thereafter for the retention period required by applicable laws and regulations thereafter
various inquiry from customers	Responding to various inquiries	Until the purpose of use is fulfilled, and thereafter for the retention period required by applicable laws and regulations thereafter

We will destroy Personal Information once the purpose for which it was acquired and used (as set forth in Chapter Ⅰ. 3) has been fulfilled.
However, if required to retain Personal Information pursuant to applicable Korean laws, such as those set forth below, we will retain the Personal Information solely for the retention periods and purposes prescribed thereunder.

• Commercial ledgers and material documents/statements related to business operations, all ledgers on business transactions and information related to supporting documentation: 10 years for material business documents and 5 years for statements (the Commercial Code, the Framework Act on National Taxes, and the Corporate Tax Act)
• Employment contracts; wage ledgers; documents relating to the method of determining and paying wages and the basis for calculating wages; documents relating to hiring, firing, and resignation; documents relating to promotions and reductions; and documents relating to vacations: 3 years (the Labor Standards Act)
• Ledgers and documents related to year-end tax settlement, etc.: 5 years (the Income Tax Act, the Framework Act on National Taxes)
• Documents related to the notification of acquisition or loss of status as a workplace-based insured person, etc.: 5 years (the National Pension Act)
• Health examination charts and results of health examinations: 5 years (or 30 years in the case of workers handling certain materials prescribed by the Ministry of Employment and Labor) (the Occupational Safety and Health Act)

When Personal Information becomes unnecessary due to the expiration of the retention period or the achievement of the purpose of processing, etc., we will destroy the Personal Information without delay. The process and method for destruction are as follows:

• Destruction Process: We select certain items of Personal Information to be destroyed and destroys them with the approval of the Chief Privacy Officer, who is an executive officer designated by Dexerials Korea Corporation for the general supervision and control of the work regarding personal information processing.
• Destruction Method: We destroy Personal Information recorded and stored in the form of electronic files by using a technical method (e.g., low level format) to ensure that the records may not be reproduced, while Personal Information recorded and stored in the form of paper documents would be shredded or incinerated.

If you do not want your Personal Information to be transferred overseas, you can refuse by requesting us to stop the cross-border transfer by contacting us through the contact information specified in Section 8 below, in which case you may not be able to receive our services etc. described in “Personal Information of Customers and Business Partners” of Chapter Ⅰ. 3.

We may use cookies to store and retrieve your information to provide individualized services to you. Cookies are small amounts of information sent to the user’s computer browser by the server used to operate the website and are also stored on the hard disk of the user’s computer. If you refuse to save cookies, you may experience difficulties in using customized services.

• Purpose of using cookies: To provide more convenient service to you by identifying the type of visit and use of the service, etc.
• Installation, operation, and refusal of cookies: You can allow or refuse cookies through the option settings in the Tools/Options menu at the top of the web browser.

We pseudonymize Personal Information for the purpose of statistical compilation, scientific research, or archiving for the public interest in accordance with Article 28-2 of the PIPA, and use the pseudonymized information as follows.

Purposes of use	Items of Pseudonymized information	Periods of retention and use
Statistical compilation for future product development and sales activities	The company name of the individual who contacted us, the product name related to the inquiry, and the details of the inquiry	Until the purpose of use is fulfilled

Name of recipient	Purposes of use by the recipient	Items of Pseudonymized information to be provided	Periods of retention and use by the recipient
Dexerials Corporation (Tel:+81-0285-39-7950)	Statistical compilation for future product development and sales activities	The company name of the individual who contacted us, the product name related to the inquiry, and the details of the inquiry	Until the purpose of use is fulfilled
Dexerials America Corporation (Tel:+1-408-564-4588) (Onward transfer from Dexerials Corporation)
Dexerials (Suzhou) Co., Ltd. (Tel:+86-512-6825-2005) (Onward transfer from Dexerials Corporation)
Dexerials Marketing Taiwan Corporation (Tel:+886-2-2515-8386) (Onward transfer from Dexerials Corporation)
Dexerials Singapore Pte. Ltd. (Tel:+65-6933-1968) (Onward transfer from Dexerials Corporation)
Dexerials Europe B.V. (Tel:+31-85-401-7120) (Onward transfer from Dexerials Corporation)

• Organizational Measures: Establishment and implementation of an internal management plan for pseudonymized information, regular employee training, etc.
• Technical Measures: Separate storage of pseudonymized information and additional information, destruction of additional information when no longer necessary, installation of access control systems to separate access rights for pseudonymized and additional information, implementation of other relevant protective measures, retention and inspection of processing and access logs for pseudonymized information, installation of security programs, etc.
• Physical Measures: Access control for computer rooms, data storage rooms, and other facilities where pseudonymized information is stored

In addition to the rights to your Personal Information set forth in Chapter Ⅰ. 6, you also have the right to withdraw your consent to the processing of your Personal Information You may exercise all the above rights by contacting our Chief Privacy Officer: Ju Jinyoung /department responsible for protection of Personal Information: Planning & Control Team using the contact details provided in Section 8 below. Your rights may also be exercised by your legal representative.

If you have any questions about this Addendum or how we process your Personal Information, please contact our Chief Privacy Officer: Ju Jinyoung/department responsible for protection of Personal Information: Planning & Control Team.

• Name: Ju Jinyoung
• Contact Information: jyju@dexerials.com

This Chapter Ⅶ of this Policy serves to add to or modify Chapter I of this Policy in relation to the handling and management of Personal Information of individuals residing in Singapore, in line with Singapore law. In the event of any inconsistency between Chapter I and this Chapter Ⅶ, this Chapter Ⅶ shall prevail for individuals residing in Singapore.
In addition, in relation to the Personal Information of individuals residing in Singapore, Chapter I shall be read and construed by replacing the terms “process”, “processes”, “processing” and “processed” with “handle”, “handles”, “handling” and “handled”, respectively.

Notwithstanding Chapter I. 1 (“Definition of Personal Information”) of this Policy, for the purpose of this Chapter Ⅶ, (i) Personal Information includes information about any individual who is deceased, but (ii) Personal Information does not include business contact information unless it was provided by the individual solely for his/her personal purposes. In this Chapter Ⅶ, “business contact information” means an individual’s name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his or her personal purposes.

Notwithstanding Chapter I. 3 (“Acquisition of Personal Information and Use of Personal Information within Scope of Purposes of Use”) and Chapter I. 4 (“Provision or Disclosure of Personal Information to Third Parties”) of this Policy, before we acquire, use, provide or disclose any of your Personal Information, we will inform you the purpose of, and obtain your consent for, such acquisition, use or disclosure, subject to any exception under Singapore law.

If we transfer your Personal Information outside Singapore, we will ensure that your Personal Information will continue to be protected to a comparable standard as required under Singapore law.

The contact information of our Data Protection Officer is as follows: karen.lim@dexerials.com / +65 6933 1965 / 9, Jurong Town Hall Road, #02-17/18 Singapore 609431

About Inquiries Regarding the Disclosure of Personal Information