PRIVACY STATEMENT

Basic Policy

CIWAKA Corporation and its subsidiaries (collectively “CIWAKA Group” or “we”) understand that personal information about customers, business partners and employees (“Personal Information”) is valuable individual property. Thus, we consider protecting such Personal Information a tremendously important responsibility.

CIWAKA Group will appropriately manage Personal Information and utilize it only for the specified Purposes of Use, so that we can maintain your trust and meet your expectations. In accordance with this basic policy, CIWAKA Group has taken specific measures to protect Personal Information.

I. COMMITMENT TO COMPLIANCE WITH JAPAN'S ACT ON THE PROTECTION OF PERSONAL INFORMATION

Compliance with Laws and Regulations

In processing Personal Information, all officers and employees of CIWAKA Group will comply with Japan's Act on the Protection of Personal Information (APPI) and other relevant laws, regulations and guidelines of Japan.

Collection of Personal Information

When CIWAKA Group collects Personal Information, we will publicly disclose or expressly state to you the Purposes of Use. We will use Personal Information to the minimum extent necessary to achieve the Purposes of Use. In addition, CIWAKA Group will only collect Personal Information by appropriate means, such as customer cards at stores, questionnaires, forms submitted through internet, postcards, etc.

CIWAKA Group saves Personal Information such as your name, address, phone number and email address for the following Purposes of Use:

• to manage orders and the manufacturing process of purchased products
• to provide information about our products and services directly from CIWAKA Group
• to provide information about our products and services in magazines, on websites, etc.
• to provide information about campaigns, fairs and events which are hosted, co-hosted, sponsored, or co-sponsored by us
• to notify the participants and winners about the results, to announce the winners, to ship the relevant prizes, gifts, etc. and to reply to inquiries regarding the campaigns which are hosted, co-hosted, sponsored, or co-sponsored by us
• to reply to inquiries sent to our website
• to provide various benefits from us
• to reply to you regarding repair and maintenance services available for purchased products
• to send requests to answer questionnaires about our products and services
• to develop new products, to improve services, for sales promotion and for marketing within CIWAKA Group
• to provide information regarding special opportunities for you (e.g. birthdays, anniversaries, holidays, etc.)
• to achieve other purposes clearly stated to you at the time of acquisition of Personal Information
• to respond to requests pursuant to laws and regulations or from relevant authorities, etc.

Use of Personal Information

CIWAKA Group uses Personal Information only to the extent necessary to achieve the Purposes of Use that have been publicly disclosed or expressly stated to you. We will not use your Personal Information for any other purpose, except with your prior consent or unless permitted by law.

Please note that in order to provide comprehensive services, CIWAKA Group may share Personal Information within the scope of the Purposes of Use that have been publicly disclosed or expressly stated to you as follows:

1. Data items to be shared
   Name, date of birth, gender, preferred contact method, email address, mailing address, telephone number, purchase history, etc.
2. Scope of entities that data can be shared with
   CIWAKA USA, INC.
3. Purposes of Use by entities that data can be shared with
   Same as stated in Purposes of Use for CIWAKA Group above.
4. Entity responsible for management of data to be shared
   CIWAKA Corporation (Toshikazu Aoki, President)
   105 Fukunaga-cho, Nakagyo-ku, Kyoto, Japan

Personal Information collected from you will be retained unless you request the deletion thereof in accordance with Section 10.

Measures for Security Management of Personal Information

CIWAKA Group will ensure that all employees, including regular workers, temporary workers and part-time workers, are properly trained regarding the protection of Personal Information and will exercise necessary and appropriate supervision to ensure the security of Personal Information. In addition, in order to keep Personal Information accurate, complete and up to date within the scope of the Purposes of Use, CIWAKA Group will take necessary and appropriate measures for security management using up-to-date technologies in order to prevent Personal Information leakage, falsification, loss, damage, unauthorized access, etc.

Providing Personal Information to Third Parties

Unless otherwise permitted by law, CIWAKA Group will not provide your Personal Information to any third party without your prior consent. Even if your consent has been obtained, when Personal Information is disclosed or provided to a third party, we will make arrangements with the third party regarding the handling of Personal Information to ensure its security.

Entrustment of Handling of Personal Information to Service Providers

CIWAKA Group may entrust all or part of its operations to a third party (a “Service Provider”), and such Service Provider may handle Personal Information. CIWAKA Group will select a Service Provider that has implemented the necessary control and safety measures to protect Personal Information. We will also exercise necessary and appropriate supervision over the Service Provider to ensure secure handling of Personal Information.

Handling of Personal Information for Online Stores

When using this website, note that Shopify (the company we use to operate our online shopping platform) and other services we use with respect to the website may collect and save your name, email address, mailing address, telephone number, and other Personal Information. Shopify or other such services may provide us access to that information for the purpose of processing orders and responding to inquiries. In addition, the third-party payment companies we use for this website, such as PayPal and Shopify Payments, may collect Personal Information from you, such as your name, email address, mailing address, telephone number, birthdate, Social Security number, credit card information, etc.

Cookies

CIWAKA Group uses cookies for certain areas of our website.

1. About cookies

   Cookies function to save usage history, contents entered in website forms and other information exchanged between the browser and the server when you access our website on your device (such as a PC or a smartphone). Some cookies are set by CIWAKA Group to enable you to use the functions provided on our website, and others are set by third parties.

2. Purposes of Use of cookies by CIWAKA Group
   • When you visit our website, we use cookies and similar technologies (collectively “cookies”) to identify your device and provide efficient online services. For example, saving cookies on your device makes it more convenient to access our website on a browser because you do not need to repeatedly enter the same information. Please note that some functions may not be available if you visit our website with cookies disabled.
   • CIWAKA Group may use the information collected by using cookies to analyze your usage history of our website (e.g., access status, traffic, routing, etc.), to improve the performance of the website and to enhance and improve the services we provide to you. In addition, your usage history of our website may be shared with the following tool providers used for most of this analysis:

Disclosure of Personal Information

In the event that you request CIWAKA Group to disclose your Personal Information pursuant to the provisions of the APPI, after confirming your identity, we will promptly disclose it to you or notify you that such Personal Information does not exist in our records. However, this will not apply to cases where we are not obliged to disclose Personal Information pursuant to the APPI or other laws and regulations. After receiving your inquiry at our point of contact specified in Section 12, we will promptly inform you of the documents necessary for requesting the disclosure.

Correction and Cessation of Use of Personal Information

1. In the event that you request CIWAKA Group to make a correction, addition, etc. to your Personal Information we retain (“Correction”) pursuant to the provisions of the APPI for the reason that the contents are not correct, after confirming your identity we will promptly conduct a necessary investigation. We will make the Correction based on the results of the investigation and notify you to that effect. Likewise, if we decide not to make the Correction based on reasonable grounds, we will notify you to that effect.

2. In the event that you request CIWAKA Group to cease using your Personal Information or delete your Personal Information (“Cessation of Use”) pursuant to the provisions of the APPI for a reason set forth in (i) or (ii) below, we will confirm the reason and perform the Cessation of Use of your Personal Information to the extent necessary to address your request and will notify you to that effect. However, this will not apply in cases where it is difficult to perform the Cessation of Use of Personal Information (e.g., when it entails substantial expenses) and where alternative action is taken to protect your rights and interests. Likewise, if we decide not to perform the Cessation of Use based on reasonable grounds, we will notify you to that effect.
   • If your Personal Information is handled beyond the scope of the Purposes of Use; or
   • If your Personal Information is acquired in violation of Article 20 of the APPI, such as by deceit or other improper means.
3. In the event that you request CIWAKA Group to cease providing your Personal Information to a third party in accordance with the provisions of the APPI for a reason set forth in (i) or (ii) below, we will confirm the reason and cease providing your Personal Information to the third party to the extent necessary to address your request and will notify you to that effect. However, this will not apply in cases where it is difficult to cease the provision of Personal Information to a third party (e.g., when it entails substantial expenses) and where alternative action is taken to protect your rights and interests. Likewise, if we decide not to cease the provision to a third party based on reasonable grounds, we will notify you to that effect.
   • If your Personal Information is provided to a third party without your prior consent, except as stipulated in each item of Article 27 of the APPI; or
   • If your Personal Information is provided to a third party in a foreign country in violation of Article 28 of the APPI.

4. After receiving your inquiry at our point of contact specified in Section 12, we will promptly inform you of the documents necessary for requesting Correction, Cessation of Use, or cessation of provision to a third party.

Note Regarding Minors and Children

No part of this website is directed toward children under age 13 and we will not knowingly collect Personal Information from any child under age 13. If you are under the age of 13, you are not permitted to make any purchases through this website or use the Contact Us page of this website to send us any Personal Information. Should we discover or be informed that we have received Personal Information relating to a person under the age of 13 through this website, we will delete such information from our records.

Point of Contact

If you request disclosure, Correction, Cessation of Use, cessation of provision to a third party, notification of the Purposes of Use of Personal Information, or wish to make any complaint, request a consultation regarding your Personal Information, or inquire regarding this Privacy Statement, please use the Contact Us page on our website.

Governing Law

This Privacy Statement shall be governed by and construed in accordance with the laws of Japan without regard to conflicts of laws rules.

Modification

If we make any changes with respect to what Personal Information we collect or how we use Personal Information, we will update this page. Therefore, please feel free to periodically check this page to ensure that you are aware of any changes.

II. ENGAGEMENT BASED ON CALIFORNIA PRIVACY RIGHTS ACT (CPRA)

Compliance with Laws and Regulations

With respect to the handling of Personal Information of customers residing in the State of California, U.S., all officers and employees of CIWAKA Group will comply with the California Privacy Rights Act (CPRA).

Collection and Use of Personal Information

The categories of Personal Information that we may collect in the future or that we have collected in the past 12 months are as set forth in the table below. We will use such Personal Information, all of which is collected from the customers via the internet, for the following Purposes of Use:

• to communicate with you, to reply to your inquiries and to ship purchased products
• to manage orders and the manufacturing process of purchased products
• to provide information about our products and services directly from CIWAKA Group
• to provide information about our products and services in magazines, on websites, etc.
• to provide information about campaigns, fairs and events which are hosted, co-hosted, sponsored, or co-sponsored by us
• to notify the participants and winners about the results, to announce the winners, to ship the relevant prizes, gifts, etc. and to reply to inquiries regarding the campaigns which are hosted, co-hosted, sponsored, or co-sponsored by us
• to reply to inquiries sent to our website
• to provide various benefits from us
• to reply to you regarding repair and maintenance services available for purchased products
• to send requests to answer questionnaires about our products and services
• to develop new products, to improve services, for sales promotion and for marketing within CIWAKA Group
• to provide information regarding special opportunities for you (e.g. birthdays, anniversaries, holidays, etc.)
• to achieve other purposes clearly stated to you at the time of acquisition of Personal Information
• to respond to requests pursuant to laws and regulations or from relevant authorities, etc.

Sharing of Personal Information

1. Sale and sharing of Personal Information
   We do not sell Personal Information (including Personal Information of those who are under the age of 16) to third parties or share it with third parties, nor have we sold or shared Personal Information in the past 12 months.

2. Disclosure of Personal Information for business purposes
   The categories of Personal Information we disclosed for our business purposes and the third parties that we disclosed Personal Information to in the past 12 months are as follows:

Requests for Handling of Personal Information

Customers who reside in the State of California have the following rights with respect to Personal Information, as well as the right not to be discriminated or retaliated against for the exercise of such rights:

1. Right to Be Informed
   You have the right to be informed of the categories of Personal Information to be collected and other matters stipulated in the CPRA at the time of or prior to acquisition of your Personal Information by us (the “Right to Be Informed”).

2. Right to Request Disclosure
   You have the right to make a request to us to disclose the following with regard to your Personal Information we have collected, used, or disclosed within the 12 months before the date of your request, and may do so up to twice in a 12-month period (the “Right to Request Disclosure”):

   • The categories of your Personal Information we have collected
   • The sources of the collection of Personal Information
   • The business or commercial purpose for collecting, selling, or sharing your Personal Information
   • The categories of third parties to whom we disclosed your Personal Information
   • The specific pieces of your Personal Information we have collected.
3. Right to Request Deletion

   You have the right to request that we delete certain Personal Information acquired from you (the “Right to Request Deletion”).

4. Right to Request Correction

   You have the right to request correction of inaccurate Personal Information held by us, taking into account the nature and purposes of processing of Personal Information (the “Right to Request Correction”).

When exercising the Right to Request Disclosure, the Right to Request Deletion, or the Right to Request Correction, please make inquiries using the Contact Us page on our website. We will respond to requests from you within the period and scope required by relevant laws and regulations. In addition, we will confirm your identity prior to responding to such requests.

This Privacy Statement is effective from January 17, 2023.