The JAL Foundation's Basic Policies on Information Security and the Protection of Personal Information

In light of the importance of information security and the protection of personal information in an advanced information society, the JAL Foundation manages and protects information that the Foundation possesses under the following Foundation policies.

• Compliance with Regulations
  The JAL Foundation complies with laws, regulations, and guidelines stipulated by administrative bodies.
• Establishment of Management Systems
  The JAL Foundation has established an internal management system and clearly specifies division of responsibilities.
• Compliance with Internal Policies, Regulations, and Guidelines
  The JAL Foundation has established and complies with internal policies, regulations, and guidelines.
• Implementation of Safety Measures
  The JAL Foundation carries out safety measures and takes steps to prevent inappropriate access to information or the loss, destruction, falsification, and leak of information.
• Implementation of Education and Awareness Programs
  The JAL Foundation promotes education and awareness programs for employees and ensures that information is appropriately managed, while striving to improve knowledge and awareness of information management.
• Affiliation with External Vendors
  When entrusting operations related to information management to other companies, the JAL Foundation selects venders with a wealth of experience and outstanding abilities. The contract between the two parties will mandate confidentiality and guarantee that the information will be properly managed.
• Efforts to Improve Operations
  The JAL Foundation regularly checks the information to ensure that it is managed appropriately and works to improve operations on a continual basis.
• Response in the Event of an Accident
  In the unlikely event of an accident, the JAL Foundation will endeavor to minimize the damage, will promptly release the required information, and will take all necessary steps to prevent the reoccurrence of the accident.
• Point of Liaison
  The JAL Foundation will set up a point of liaison to which customers may direct their inquiries, complaints, and requests. The JAL Foundation will respond promptly and with integrity.
• Disclosure of Policies
  The JAL Foundation will disclose its policies on information security and the protection of personal information, as well as this policy, on their website.

Handling of Personal Information by the JAL Foundation

The JAL Foundation shall handle and protect the personal information of our customers in accordance with the Act on the Protection of Personal Information of Japan and The JAL Foundation Basic Policies on Information Security and the Protection of Personal Information.

• Obtaining Personal Information and Purpose of Use
  The JAL Foundation shall acquire the personal information of our customers through appropriate and fair means, and will use the information for the purposes stated below.
  1. Public service projects conducted by the JAL Foundation
  2. To provide information and contact regarding services, various events, promotions, and other activities conducted by the JAL Foundation, and to conduct questionnaires.
  3. Business analysis and other surveys and research conducted by the JAL Foundation, and development of new businesses
  4. Business incidental or related to the above (1) through to (4) to response to inquiries, among others.
• Management and Protection of Personal Information
  The JAL Foundation shall appropriately manage and protect the personal information of our customers, in accordance with The JAL Foundation's Basic Policies on Information Security and the Protection of Personal Information.
  ^* Safety Management Measures
  1. Organizational safety management measures
     The JAL Foundation has established a Secretariat for Information Security and Personal Information Protection, which decides the policies and measures relating to information security and personal information protection of the JAL Foundation. We have also introduced a system that strictly separates the management of personally identifiable information from non-personally identifiable information in order to reduce risks and respond promptly to incidents.
  2. Human safety management measures
     We conduct information security training sessions regularly for all the JAL Foundation employees and obtain a written confirmation concerning the handling of personal data.
  3. Physical safety management measures
     Access to the JAL Foundation's offices is controlled to prevent unauthorized persons from viewing personal data.
  4. Technical safety management measures
     The IT environment of the JAL Foundation conforms to the information systems of Japan Airlines. Anti-virus and anti-leakage measures are implemented to protect systems that handle personal data from unauthorized external access and software. We also conduct cyber threat monitoring 24 hours a day, 365 days a year to prevent unauthorized access and virus infection.
  5. Understanding of the external environment
     When providing personal data to an overseas third party, we implement necessary safety management measures with the understanding of personal information protection laws of that country.
     ^* Please refer to 6 (1) below for major personal information protection laws of other countries.
• Provision of Personal Data to a Third Party
  The JAL Foundation shall not disclose or provide the personal data of our customers to a third party, except in the cases described below. The provision of personal information to service providers and the joint use of personal information shall be implemented in accordance with Articles 4 and 5 below.
  1. Cases in which the customer personally gives their consent
  2. Cases in which the provision of personal data is based on laws
  3. Cases in which the provision of personal data is necessary for the protection of the life, human body, or property of an individual and in which it is difficult to obtain the consent of the person
  4. Cases in which the provision of personal data is specially necessary for improving public hygiene or promoting the sound growth of children and when it is difficult to obtain the consent of the person
  5. Cases in which the provision of personal data is necessary for cooperating with a government institution, a local authority, or an individual or entity entrusted in executing the operations specified by laws, and when obtaining the consent of the person might impede the execution of the operations concerned
• Provision of Personal Information to Service Providers and Relevant Management
  The JAL Foundation may entrust the handling of personal information, within the scope required to achieve the purpose of use, to a third party other than the Foundation itself. In this case, the JAL Foundation shall conduct appropriate management and supervision in accordance with Article 6 of The JAL Foundation's Basic Policies on Information Security and the Protection of Personal Information.
• Joint Use of Personal Information
  The JAL Foundation shall jointly use the personal information of our customers as follows.
  • Purpose of joint use
    Information and point of contact for projects, services, various events, promotions, and the like, project analysis, questionnaires, other surveys and research, development of new projects, and other related activities conducted by the JAL Foundation..
  • Data to be used jointly
    Information of our customer’s name, date of birth, gender, address, telephone number, fax number, e-mail address, company information (company name, department, title, address, telephone/fax number), information contained in correspondence between the customer, the content of our customer’s inquiries, requests, and opinions, information about how our customer uses the JAL Foundation website, including cookies and website activity logs, among others.
  • Range of users
    JAL Group Companies^* and Okura Nikko Hotel Management
    ^*Click here for the list of JAL Group Companies
    JAL GROUP COMPANIES
  • Administrator of personal information
    The JAL Foundation
• Transfer of personal data to an overseas third party
  When providing personal data to overseas business operators such as contractors and outsourcing parties, the JAL Foundation shall implement necessary and appropriate measures in accordance with applicable laws and regulations of said country.
  Please refer to the following for major personal information protection laws of other countries
  

  (Personal Information Protection Commission website: Survey on personal information protection laws of other countries)
  ^*External site and in Japanese only

• Request for Disclosure and Inquiries
  1. Regarding notification of purpose of use, disclosure, correction, termination of use of retained personal data.
     We will respond to requests by a customer or their representative as follows in accordance with the Act on the Protection of Personal Information of Japan.
     • Notification of purpose of use
       We will give notice of the purpose of use of the retained personal data when it may lead to the identification of the person concerned. However, in the following cases, we may reject a request, in whole or in part, and give the reason why.
       1. Cases in which notifying the person of the purpose of use or publicly announcing the information may harm the life, human body, property, or other rights or interests of the person or third party.
       2. Cases in which notifying the person of the purpose of use or publicly announcing the information may harm the rights or legitimate interests of the JAL Foundation
       3. Cases in which it is necessary to cooperate with a government institution or a local authority in executing the operations specified by laws and when notifying the person of the purpose of use or publicly announcing the information may impede the execution of the operations concerned.
     • Disclosure
       We will disclose such retained personal data when it may lead to the identification of the person concerned. (When the retained personal data does not exist, we will respond accordingly.) However, in the following cases, we may reject the request, in whole or in part, and give the reason why.
       1. Cases in which disclosure may harm the life, human body, property, or other rights or interests of the person or third party.
       2. Cases in which disclosure may seriously impede the proper execution of the business of the entity concerned handling personal information.
       3. Cases in which disclosure violates other laws.
     • Corrections
       When requested by a person to correct, add, or delete such retained personal data as may lead to the identification of the person concerned on the grounds that the retained personal data is contrary to the fact (hereinafter "Corrections"), we will, except in cases in which special procedures are specified by any other laws for such Correction, carry out necessary investigations. As a result, when we have corrected, added, or deleted all or part of the retained personal data as requested, we will give notice to the effect without delay. When we have decided not to make such correction, addition, or deletion, we will give notice and give the reason without delay.
     • Termination of use
       When requested to terminate the use, delete or terminate the provision to a third party as the retained personal data may lead to the identification of the person concerned (hereinafter "Terminate the Use"), and in case the request has a reason, we will terminate the use, delete or terminate the provision to a third party without delay to the extent necessary to redress the violation. However, if the costs are great or it is otherwise difficult to terminate the use or to delete the retained personal data concerned, we may take necessary alternative measures to protect the rights and interests of the said person.
       When we have terminated the use, deleted or terminated the provision of all or part of the retained personal data as requested to a third party, we will give notice without delay. When we have decided not to terminate the use, not to delete, or not to terminate the provision of the retained personal data to a third party, we will give notice and give the reason without delay.
  2. Contact for Inquiries
     If you have any inquiries regarding the handling of personal information by The JAL Foundation, please send your letter to the following address.
     The JAL Foundation Secretariat, in charge of handling personal information
     2-4-11 Higashishinagawa, Shinagawa-ku
     Tokyo 140-0002, Japan

March 5, 2024