Customer Personal Information Protection Policy

NTT will, as necessary, notify, or disclose to the public etc. on the homepage etc., the specific purposes of use in advance so that customers can surmise the purposes for which Customer Personal Information is ultimately used.

Further, when collecting Customer Personal Information stated in a written document (including electromagnetic records) directly from the customer, NTT will explicitly indicate the purposes of use to such customer in advance.

Moreover, in cases falling under Article 18, Paragraph 3 of the Act on the Protection of Personal Information, Customer Personal Information may be handled beyond the extent necessary to achieve the abovementioned purposes of use.

Except in the case where Customer Personal Information is provided to third parties in accordance with Article 27, Paragraph 1 or Article 27, Paragraph 5 of the Act on the Protection of Personal Information, NTT will not provide Customer Personal Information to any third parties without obtaining prior consent of the customer(s). NTT will not provide Customer Personal Information to an overseas third party without taking the measures set out in 8. in accordance with the provisions of Article 28 of the Act on the Protection of Personal Information.

NTT may jointly use Customer Personal Information and pseudonymously processed information with third parties in accordance with Article 27, Paragraph 5, Item (3) of the Act on the Protection of Personal Information. In such cases, NTT will notify, or disclose to the public etc. on the homepage etc., the following matters in advance.

If there are any changes in the matters as stated in the purposes of use in Item D or the responsible person in E above after notifying or disclosing to the public etc. on the homepage etc. such matters, NTT will notify or disclose to the public on the homepage etc. such changes in advance. If there are any changes in the matters as stated in the names or addresses of the responsible persons, or if a corporation, the name of the representative in E above after notifying or disclosing to the public etc. on the homepage etc. such matters, NTT will notify or disclose to the public on the homepage etc. such changes without delay.

NTT will respond to your requests for disclosure, correction, addition, deletion, suspension of usage, or erasure, request for disclosure of third-party provision records of Customer Personal Information and requests for suspension of third-party provision of Customer Personal Information etc. in regard to Customer Personal Information retained by NTT in accordance with the Act on the Protection of Personal Information.

NTT establishes organizational management systems by (a) constructing committees, appointing managers of each organization, and constructing other management systems, (b) establishing internal rules, (c) preparing statements including management ledgers and process management tables, and (d) improving the foregoing continuously.

NTT (a) informs and educates all employees who handle Customer Personal Information as to the significance of the protection of Customer Personal Information, regardless of whether such employees are officers, full-time employees, or dispatched employees, (b) enters into non-disclosure agreements with such employees, and (c) conducts necessary oversight and supervision, in order to ensure effectiveness of personnel-related security control measures. When outsourcing handling services for Customer Personal Information, NTT will supervise whether the outsourcing contractors (including subcontractors etc. of such outsourcing contractors) are appropriately managing Customer Personal Information, and if improvements are necessary, promptly request such improvements. If no improvement is seen, NTT will take strict measures such as changing the outsourcing contractor or other necessary measures.

NTT takes physical security control measures such as (a) access controls and theft preventions etc. for buildings and floors where Customer Personal Information is handled, (b) measures against damage to Customer Personal Information caused by fire, lightning, etc. and (c) locking management when removing, transferring or storing systems and documents.

NTT takes technological security control measures such as (a) access controls, including authentication, authority management, controls and record-keeping when accessing personal data, (b) measures to be taken for systems against unauthorized software and virus, (c) protection measures during transfer, transmission and receipt by means of encryption, clarification of responsibilities or the like and (d) monitoring of information systems.

When handling Customer Personal Information overseas, NTT shall understand the system, etc. for the protection of personal information in those overseas countries and take measures for security control of Customer Personal Information.

If it is expected that a third party will receive personally referable information as personal data, excluding cases under Article 27, Paragraph 1 of the Act on the Protection of Personal Information, NTT will not provide personally referable information to such third party without confirming that such third party has obtained prior consent of the customer(s) (when obtaining consent, if such third party is overseas, including the provision to such customer of the name of the overseas country, the system relating to the protection of personal data, protective measures for personal information taken by such third party, and other information that will serve as reference to such customer).

NTT will obtain the prior consent of customer(s) when acquiring personally referable information as personal data. However, if a person who is to provide such personal data has received consent from the customer(s), this may substitute for the prior consent.