Protection Policy Regarding Specific Personal Information etc. of Business Partners etc.

The purposes of use of Specific Personal Information etc. of Business Partners retained by NTT are as follows.

Further, when collecting Specific Personal Information etc. of Business Partners stated in a written document directly from business partners etc., NTT will explicitly indicate the purposes of use to such business partners etc. in each case unless it falls under any of the items of Article 21, Paragraph 4 of the Act on the Protection of Personal Information; provided, however, that in the cases falling under Article 18, Paragraph 3, Item (1) or (2) of the Act on the Protection of Personal Information, terms of which are partially replaced in accordance with Article 30, Paragraph 3 of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures, NTT may handle Specific Personal Information etc. of Business Partners beyond the extent necessary to achieve the abovementioned purposes of use.

NTT will not provide Specific Personal Information of Business Partners to any third parties; provided, however, that in the cases where any of the items of Article 19 of the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures applies, NTT may, without obtaining prior consent of the relevant business partner(s), provide necessary specific personal information to a related third party or may receive necessary specific personal information from a related third party.

NTT will not jointly use Specific Personal Information of Business Partners with any third parties.

NTT will respond to your requests for disclosure, correction etc., or suspension of usage etc. in regard to Specific Personal Information etc. of Business Partners retained by NTT in accordance with the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures.

NTT establishes organizational management systems by (a) constructing committees, appointing managers of each organization, and constructing other management systems, (b) establishing internal rules, (c) preparing statements including management ledgers and process management tables, and (d) improving the foregoing continuously.

NTT (a) informs and educates all employees who handle Specific Personal Information etc. of Business Partners as to the significance of the protection of Specific Personal Information etc. of Business Partners, regardless of whether such employees are officers, full-time employees, or dispatched employees, (b) enters into non-disclosure agreements with such employees, and (c) conducts necessary oversight and supervision, in order to ensure effectiveness of personnel-related security control measures. When outsourcing handling services for Specific Personal Information etc. of Business Partners, NTT will supervise whether the outsourcing contractors (including subcontractors etc. of such outsourcing contractors) are appropriately managing Specific Personal Information etc. of Business Partners (including obtaining approval for subcontracting, and necessary and appropriate supervision of subcontractors, etc. by outsourcing contractors), and if improvements are necessary, promptly request such improvements. If no improvement is seen, NTT will take strict measures such as changing the outsourcing contractor or other necessary measures.

NTT takes physical security control measures such as (a) access controls and theft preventions etc. for buildings and floors where Specific Personal Information etc. of Business Partners is handled, (b) measures against damage to Specific Personal Information etc. of Business Partners caused by fire, lightning, etc. and (c) locking management when removing, transferring or storing systems and documents.

NTT takes technological security control measures such as (a) access controls, including authentication, authority management, controls and record-keeping when accessing personal data, (b) measures to be taken for systems against unauthorized software and virus, (c) protection measures during transfer, transmission and receipt by means of encryption, clarification of responsibilities or the like and (d) monitoring of information systems.

When handling Specific Personal Information etc. of Business Partners overseas, NTT shall understand the system, etc. for the protection of personal information in those overseas countries and take measures for security control of Specific Personal Information etc. of Business Partners.