PRIVACY POLICY

Additional Rules Applicable to the Handling of Personal Information of EEA Residents
These additional regulations require us to provide our customers resident in the European Economic Area (EEA) with their rights regarding the handling of personal information in accordance with certain additional information and local laws under the General Data Protection Regulation (GDPR) set forth by the European Union (EU). In the event of any conflict between the terms of this Supplement and the body of the Privacy Policy, the Supplement will take precedence.

1. Handling of Personal Information

The method and purpose of the Company’s handling of your personal information and the provision of your personal information to third parties are as described in the Privacy Policy.

2. Legal Basis

Our use of personal information is based on the following legal grounds.

• 1)When customer consent is obtained
• 2)When it is necessary to fulfill the contract with the customer or to execute the procedure as requested by the customer before the conclusion of the contract
• 3)When we need to comply with our legal obligations
• 4)When necessary for the legitimate interests required by the Company or third parties (such as providing marketing and customer service to customers, improving the convenience and security of our website, etc.)

3. Withdraw Consent

Customers can withdraw their consent to use personal information at any time by contacting the inquiry desk indicated in the privacy policy. Withdrawal of consent does not affect the legality of the consent-based use of personal information made prior to withdrawal.

4. Transfer of Personal Information to Third Countries

We may transfer personal information obtained outside of Japan to Japan or third countries (including countries that have not been certified by the EU). If we transfer your personal information to a third country, we will use your personal information with appropriate security and confidentiality measures as described in our Privacy Policy.

5. Retention Period of Personal Information

We retain personal information only for the period necessary to achieve the purpose of use, and take measures to erase or anonymize personal information after the retention period has elapsed within a reasonable period of time in a secure manner.

6. Customer Rights

Customers have the following rights regarding their personal information based on laws and regulations. You can exercise these rights against us by contacting the contact point specified in the privacy policy.

• (1)Access right: The right to check whether or not the customer’s personal information is used, and if so, the right to access the personal information and accompanying information
• (2)Right of correction: Right to correct incorrect personal information of customers
• (3)Erase right: Right to erase customer’s personal information in certain cases
• (4)Right to restrict use: Right to restrict use of personal information
• (5)Right to object: Right to object to the use of customer’s personal information based on legitimate interests required by the Company or a third party
• (6)Data portability rights: Receive personal data provided to you by us in a structured, commonly used and mechanically readable form, and receive that personal data without interference from our company. Right to transition to

7. Appeal to Supervisory Authority

Customers may appeal to the regulatory authorities such as national, regional or international organizations regarding the handling of our personal information in accordance with laws and regulations.

8. Personal Information Required for Accommodation

We need the following information to provide accommodation services to our customers. In particular, entries in the lodging list must be entered and kept for three years under Japanese law. If you do not provide this information, we may not be able to provide accommodation services to you.

• Basic Information (name, phone number, etc.)
• Accommodation list entries (name, address, occupation, nationality, passport number, gender, age, etc.)

9. Children’s Personal Information

If you are under 16 years old, please provide your personal information with the consent of your guardian.

10. Automated Decision Making Such as Profiling

We do not make decisions based solely on automated handling such as profiling personal information.