Privacy Policy

Effective Date: July 11, 2023 Revised Date: July 28, 2025 (Translated) Groovy Media, Inc. CEO: Shota Watanabe

Groovy Media, Inc. engages in software-as-a-service (SaaS) and system development operations. Recognizing the critical importance of protecting all personal information used in the course of our business, we consider it a social responsibility to safeguard such information. Accordingly, we have established the following privacy policy as a code of conduct for all employees, ensuring the safe and appropriate handling and protection of personal information.

a) We will obtain, use, and provide personal information appropriately in consideration of the nature and scale of our business. We will not handle personal information beyond the scope necessary to achieve the specified purposes (no use for other purposes), and we will implement necessary measures to prevent such use.

b) We will comply with all applicable laws, regulations, and guidelines regarding the handling of personal information.

c) We will implement measures to prevent and rectify unauthorized access to personal information, as well as the leakage, loss, or damage of personal information.

d) We will endeavor to respond appropriately and promptly to complaints and inquiries regarding the handling of personal information.

e) We will continuously improve our personal information protection management system.

[Contact for Privacy Policy and Complaints/Inquiries] Groovy Media, Inc. Privacy Inquiry Manager: Hyuga Kawazoe City Mansion Akasaka 2F, 6-4-15 Akasaka, Minato-ku, Tokyo 107-0052, Japan TEL: +81-3-4530-3079 | Email: privacy@groovymedia.jp (Office Hours: 10:00 – 18:00 JST, excluding weekends and holidays)

Handling of Personal Information by Our Company

[Name, Address, and Representative of the Business Operator] Groovy Media, Inc. City Mansion Akasaka 2F, 6-4-15 Akasaka, Minato-ku, Tokyo 107-0052, Japan CEO: Shota Watanabe

[Personal Information Protection Manager] Director: Hyuga Kawazoe (Contact: See "Privacy Policy and Complaints/Inquiries" above)

[Purpose of Use for Personal Information Obtained Through Means Other Than Direct Documents]

Personal information entrusted by clients: ・For proper execution of commissioned operations including SaaS-related services and system development
Personal information from telephone inquiries: ・To respond to and address comments or inquiries
Personal information of job applicants received from recruitment agencies: ・For providing information on recruitment, contacting applicants, and processing recruitment selection
Personal information of technical staff of partner companies: ・For selecting engineers and conducting business operations related to software development and information processing

[Purpose of Use for All Retained Personal Data]

Personal information of customers: ・To provide and inform customers of products and services ・For other purposes explicitly consented to by the individual
Personal information of business partners: ・For management, sales activities, and performance of business operations with partners
Personal information of individuals who contact us: ・To respond to and address comments or inquiries
Personal information of shareholders: ・To administer shareholder-related matters such as general meetings and shareholder benefits
Personal information of job applicants: ・For recruitment, communication, and processing of applicant selection
Personal information of employees: ・For internal communication, directory creation, and monitoring of work performance ・For HR selection, assignment decisions, compensation, attendance, payroll, and payment ・For compliance with applicable social insurance and tax laws, health management, and handling of individual number-related matters ・For corporate PR, promotional activities, and employee welfare ・For safety management related to entry/exit of facilities and monitoring of information systems

[Contact for Complaints Regarding Retained Personal Data] See "Privacy Policy and Complaints/Inquiries" above

[Authorized Personal Information Protection Organization] We are not currently a member of any authorized personal information protection organization.

[Procedures for Requests Concerning Disclosure, etc. of Retained Personal Data or Records of Third-Party Provision] a) Submission Contact: See "Privacy Policy and Complaints/Inquiries" above

b) Request Procedure: Please visit us in person or send the required documents by registered mail or courier to the address listed under "Privacy Policy and Complaints/Inquiries." We will respond promptly. (Please note that postage and delivery costs must be borne by the applicant. Requests via telephone, email, or fax are not accepted.) Required documents: ① Our designated "Request Form for Disclosure, etc." (If not in your possession, please contact us to request a copy.) ② Proof of identity

c) Verification of Identity or Proxy: (1) For requests by the individual: Submit one of the following (copies acceptable): ・Official ID with photo (e.g., driver’s license, passport, My Number Card [front side only]) OR ・Two of the following without photo (e.g., national health insurance card, residence certificate, pension booklet)

(2) For requests by a proxy: Submit all applicable documents: ・Proof of authority (e.g., family register or registration certificate for legal representatives) ・If appointed by the individual: 　・Letter of attorney with personal seal 　・Seal registration certificate 　・ID copies of both the individual and the proxy

d) Fees: A fee of JPY 1,000 per request is required for “notification of purpose of use” and “disclosure.” Please enclose a JPY 1,000 postal money order with the documents. (If you are using an app such as Shopify or Color Me Shop, please refer to their respective platforms for fee handling.)

Security Measures for Retained Personal Data

To ensure proper handling of personal data, we have established and comply with a privacy policy specifying our name, legal compliance, security measures, and contact points for complaints. We also implement internal rules for each stage of data handling (acquisition, use, storage, deletion, etc.), and clearly assign roles and responsibilities to relevant personnel. We designate a person in charge of personal data, clarify which employees may handle such data, and implement a reporting structure for any violations or signs thereof. Regular internal audits and third-party reviews are conducted. Employees receive regular training and must sign confidentiality agreements regarding personal data. Access to personal data is physically restricted, and measures are taken to prevent unauthorized viewing. Mobile data carriers are secured and anonymized during transport. Access control is implemented to limit personnel and database access. Systems are protected against unauthorized access and malicious software. We use cloud services with servers located outside Japan. To ensure the secure management of retained personal data, we confirm that those servers are either within the EU or the United Kingdom—jurisdictions recognized by the Personal Information Protection Commission as providing protections equivalent to Japan—or that they have obtained CBPR certification. If neither condition is met, we review the personal information protection framework of the relevant foreign country and implement the necessary and appropriate safeguards for the management of personal data. Currently, the foreign countries to which personal data is provided and information about their regimes are as follows:

United States of America https://www.ppc.go.jp/files/pdf/USA_report.pdf

Commonwealth of Australia https://www.ppc.go.jp/files/pdf/australia_report.pdf

Socialist Republic of Viet Nam https://www.ppc.go.jp/files/pdf/vietnam_report.pdf

Canada https://www.ppc.go.jp/files/pdf/canada_report.pdf

[Privacy Policy and Complaint Contact] Groovy Media, Inc. Privacy Inquiry Manager: Hyuga Kawazoe City Mansion Akasaka 2F, 6-4-15 Akasaka, Minato-ku, Tokyo 107-0052, Japan TEL: +81-3-4530-3079 | Email: privacy@groovymedia.jp (Office Hours: 10:00 – 18:00 JST, excluding weekends and holidays)