Each of the CAPCOM Group Companies within Japan (meaning CAPCOM Co., Ltd., and its group companies in Japan; please refer to the section marked with an asterisk (*) below for the definition of CAPCOM Group Companies within Japan and the names, addresses, and names of the representatives of such Group Companies), in relation to their business handling personal information, discloses each of the following matters in order to abide by the Act on the Protection of Personal Information (hereinafter referred to as “the Act”).

Please refer to the section specified below as for the matters that each of the CAPCOM Group Companies within Japan discloses in order to abide by laws and regulations other than the Act.
Personal Information of Residents in the European Economic Area (EEA Member States)

1. Purpose of Use of Personal Information and Retained Personal Data
2. Provision of Personal Data to a Third Party
3. Security Control Measures
4. Contact Point on Personal Information
5. Revision of this document, Handling of Personal Information.

1. Purpose of Use of Personal Information and Retained Personal Data

Each of the CAPCOM Group Companies within Japan uses personal information and the retained personal data for the purposes described below. However, we may give notice of any usage purpose other than such purposes at the time of acquisition of the information or data.

• (Personal information of our customers)
• • (i)To carry out several services including game services provided by each of the CAPCOM Group Companies within Japan (such as events and campaigns) and to appropriately operate them (including provision of information on the services, responding to inquiries, and provision of after-the-sale services).
  • (ii)To appropriately operate the facilities operated by each of the CAPCOM Group Companies within Japan.
  • (iii)To analyze data and conduct statistical surveys aimed at the improvement of game services of each CAPCOM Group Company within Japan (including improvement of contents and development of new contents).
  • (iv)To conduct marketing activities with regard to the products, services, campaigns, and other events of each of the CAPCOM Group Companies within Japan (including provision of information on products, services, campaigns, and other events or distribution of advertisements that are associated with a user’s tastes and preferences through analysis of usage history on each service of each CAPCOM Group Company within Japan).

• (Personal information of our business partners (including our prospective business partners; the same applies hereinafter))
• • (v)To make business contacts with our business partners and to provide them with responses.

• (Personal information of job applicants)
• • (vi)To provide responses to and carry out the selection of job applicants.

• (Personal information of our officers, employees, and others [including former officers, employees, and others])
• • (vii)To manage human resources affairs, provide welfare program, and carry out supervision in relation to the business.
  • (viii)To take the procedure and make necessary contacts after retirement of the officers, employees, and others.

• (Personal information of our shareholders)
• • (ix)To provide responses and make contacts in relation to the management of shareholders and exercise of shareholders’ rights.

• (Matters commonly applied to all personal information)
• • (x)To respond to inquiries and provide information in relation to the business activities, products, services, and other matters of each of the CAPCOM Group Companies within Japan.
  • (xi)Any other matters that have individually announced upon collection of personal information.

2. Provision of Personal Data to a Third Party

Each of the CAPCOM Group Companies within Japan does not, except as specified below, provide personal data that it has obtained to a third party.
We do not provide any data to a third party using an opt-out method.

• (i)When the consent of the individual concerned has been obtained in advance.
• (ii)When the data is entrusted to an external party within the extent necessary to accomplish the purpose of use.
  (In such cases, each of the CAPCOM Group Companies within Japan selects contractors appropriately and carries out the supervision necessary to protect personal data by concluding an agreement that stipulates confidentiality obligations and by conducting audits of the management system.)
• (iii)When based on laws and regulations.
• (iv)When the provision is necessary for the protection of the life, body, or property of a person and it is difficult to obtain the consent of the individual concerned.
• (v)When the provision is particularly necessary for the improvement of public health or promotion of sound growth of children and when it is difficult to obtain the consent of the individual concerned.
• (vi)When it is necessary to cooperate with national or local governments in performing any statutory operations and obtaining prior consent of the individual concerned may interfere with the performance of such operations.
• (vii)In cases of a provision to a third party who is an academic research or similar institution and such a third party needs to handle the personal data for academic research purposes (including the case where part of the purpose of handling the personal data is academic research but excluding the case where the rights and interests of an individual may be unfairly infringed).
• (viii) When the data is jointly used among the CAPCOM Group Companies within Japan.

  (Disclosure of Matters concerning Joint Utilization)

  • A. Types of personal data.
    • ・Name and contact information (such as address, phone number, and email address) of the individual concerned, as well as the information on the usage of the services provided by each of the CAPCOM Group Companies within Japan.
    • ・Information related to the labor management of officers and employees
    • ・Other items that are separately clarified prior to the joint utilization.
  • B. Scope of users
    • Each of the CAPCOM Group Companies within Japan（※）
  • C. Purpose of use
    • As specified in Article 1.
  • D. Name of the organization and the person responsible for the management of personal data.
    • CAPCOM CO., LTD.
      Management Representative　Haruhiro Tsujimoto

3. Security Control Measures

Each of the CAPCOM Group Companies within Japan implements safety control measures that are necessary and appropriate for the management of personal data (such as preventing divulgation, loss, or damage). Main substance of the safety control measures taken for personal data is as detailed below. For any matters not contained below, please contact the contact point specified in Article 4. We will promptly respond to inquiries.

• (Establishment of Privacy Policy)
• • In order to secure appropriate handling of personal data, we have established basic policies on compliance with related laws and regulations guidelines etc., service for responding to enquiries and complaints, and other matters. As part of this commitment to this activity and effort, we discuss and address matters on safety control measures.

• (Establishment of Disciplinary Rules on Handling of Personal Information)
• • We have specifically defined the management measures in relation to the handling method on acquisition, use, storage, provision, deletion, and disposal (including the safety control measures for personal data) and have established internal rules to clarify the responsible persons for and the persons in charge of each type of the handling and their duties (such as the matters on instruction and supervision).

• (Organizational Control Measures)
• • We have established the position of Personal Information Protection Administrator as the chief officer responsible for the handling of personal information, clarified the scope of employees who handle personal data and of personal information that is handled by such employees, established the system in which a report or contact is made to the Personal Information Protection Administrator in the case where a fact or sign of the occurrence of violation of the Act or any rules provided by any of the CAPCOM Group Companies within Japan is detected, and through these undertakings, been providing responses related to our safety control measures as well.

• (Human Resource Management Measures)
• • We provide employees with training at least once a business year through e-learning (including those related to safety control measures) with regard to the points to consider in the handling of personal information.

• (Physical Safety Control Measures)
• • We implement measures to prevent the loss or theft of information apparatuses and recording media that handle personal data and, when carrying such apparatuses or media, we implement measures so that the data will not be revealed.

• (Technical Safety Control Measures)
• • We limit the scope of employees who may access our personal information database by adopting access restrictions. In addition, we have introduced a mechanism to protect the personal information database from unauthorized access and malicious software.

4. Contact Point on Personal Information

Inquires on the handling of information by any of the CAPCOM Group Companies within Japan are accepted and handled through the online form.

To those who make a request on any of the matters listed below, we will provide responses in accordance with the guidance provided in a separate document, Requests for Disclosure.

• ・Disclosure of the retained personal data or the record of provision to a third party.
• ・Correction, addition, or deletion of the retained personal data.
• ・Discontinuation of use of or erasure of the retained personal data, as well as discontinuation of provision of the same to a third party.

5. Revision of this document, Handling of Personal Information.

This document, Handling of Personal Information, will be responsively revised when the need arises. Such amendments will become effective upon when posted on our website.

• (*)
  Definition of the CAPCOM Group Companies within Japan
  From among the companies that CAPCOM Co., Ltd., materially controls the decision-making of their financial and business policies through such means as direct or indirect ownership of a majority of voting rights, those companies where the principal offices are located in Japan.
  
  Names, Addresses, and Names of the Representatives of each of the CAPCOM Group Companies within Japan:
  As listed in (i) through (v) of the section marked with an asterisk (*) in the Personal Information Protection Statement

Amended on April 1, 2022

• Capcom keeps access logs of customers visiting our web sites in a server controlled by Capcom. Such information is used for statistical data for the usage survey and analysis of our web sites.

• Capcom may collect browsing information of visitors to web sites operated by Capcom through technical means such as cookies and web beacons.
  "Cookies" are small text files sent through browsers from our web servers to your computers and mobile devices intended to be stored in such storages within your computer or device when you access our web sites.
  In general, there are two types of "Cookies," one is "first party cookie" and the other is "third party cookie". "first party cookies" are set by Capcom generally to allow you to use functions available on our web sites, while "third party cookies" are set by affiliated third parties. Some "third party cookies" are set by any affiliated advertising partners in order to post our online ads in an effective way.
  "Web beacons" are small Java Script or image files embedded in web sites or e-mails intended to collect browsing information of web sites or e-mails.

  Cookies are used to automatically identify your browsers when you visit internet sites. They may be used for purposes such as to avoid entry of same information made by you and to help improve customer experience. Capcom may use information collected through technologies such as cookies and web beacons for such as usage analysis of web sites to improve performance of and services available on our web sites.
  Also, Capcom may use re-targeting services provided by some third parties to distribute appropriate ads to visitors of our web sites.

  You can disable cookies at any time you like by changing your browser settings. Please note that some contents of our web sites will not be available when you disable cookies.

  You can also disable cookies from the following pages.

  • ■Google Analytics
    Google Analytics opt-out add-on
    https://tools.google.com/dlpage/gaoptout?hl=ja
  • ■Twitter Ads
    Disabling ad display settings
    https://help.twitter.com/ja/safety-and-security/privacy-controls-for-tailored-ads
• Security
  • Our website uses a data encryption mechanism for secure communication called SSL in pages which contain personal information such as names and e-mails, so as to prevent personal information from being stolen or tampered with. We also deploy a firewall system to prevent unauthorized access to our servers.
• For maintenance of your registered ID and password
  • We are not responsible for any unauthorized use by third parties. Please be careful in managing your ID and password. Please note that if your personal information is falsified, information belonging to another party is registered, or some other improper use is made, we may discontinue the use of the ID and password concerned.
• For protection of personal information on websites of other companies
  • We are not responsible for the protection of personal information on websites of any third parties linked to our web sites.
• Governing law
  • The Capcom website can be accessed from all countries of the world where different laws apply. However, you agree that the terms of use of this website shall be governed by the laws of Japan.

When the customer wishes to make a request for disclosure under the Act on the Protection of Personal Information (hereinafter referred to as “the Act”), the customer should print the document designated below and complete with the required information, enclose together in an envelope the identification documents and send it by post to the Personal Information Inquiry Contact.

Application is only accepted by post. The reply will be sent in writing to the address that you designated. The request will be dealt with in as speedy a manner as is feasible.

The following documents are necessary in order for us to confirm the identity of the person.

1. When the customer is requesting his or her own information:
   identity verification documents

2. When another person representing the customer is requesting the information:
   ・Documents for identity confirmation of the principal and the agent
   ・A document to prove the proxy

   [What is the Identity Confirmation Document]
   One of the following types.
   A copy of the certificate of residence (within three months from the date of acquisition), driver's license, health insurance card, pension book, the front side of the Individual Number Card (or My Number Card in Japanese), residence card, special permanent resident certificate, or passport. If the agent is an attorney at law, the attorney's registration number may be used. (All names, dates of birth, and current addresses are stated and only within the valid period.)

   [What is a document to prove the proxy?]
   （If the request is made by a statutory agent who is a person with parental authority, a certified copy of family register, a certified copy of abridged family register, or a copy of a resident certificate in which the names of the individual concerned and the representative, as well as the relationship between them, are specified.
   If the request is made by a statutory agent who is an adult guardian, a certificate of the registered matters.
   If the request is made by a proxy other than the above, a letter of proxy.

1. If you request disclosure of the retained personal data or the record of provision to a third party.
   • Download document (PDF:112k)
     *Method of disclosure:
     Please select one of the following as the method of disclosure of the retained personal data.
     - Sending the data in documentary form to the designated address by post.
     -Sending the data that has been saved in electromagnetic recording media (meaning any standard media, such as CD-ROMs) to the designated address by post.
     (As regards the file type, we will use common types of formats, such as PDF format for text, MP3 format for sound, JPEG format for images, and MPEG format for videos.
     
     *Fees:
     A fee of 1,000 yen will be charged for each request for the disclosure of personal information.
     Remittance should be made by postal order, which should be enclosed with the disclosure request form. Even if disclosure is not made, the remitted charge will not be returned.
     *Please obtain the postal money order from a post office. A handling charge is payable to the post office to purchase a postal money order.
2. If a correction, addition or deletion of personal information is to be requested:
   • Download document (PDF:120k)
3. If a discontinuation of use of personal information, erasure or discontinuation of provision to a third party is to be requested:
   • Download document (PDF:116k)
   • • *With regard to section 6 “Reason for requesting discontinuation of use”:
       We may respond to your request only when it is determined that either one of the reasons listed below exists in relation to the relevant retained personal data. Please specify in section 6 “Reason for requesting discontinuation of use” which reason is related to your request.
     • (In case of a request for (i) Discontinuation of use and (ii) Deletion)
       -That the data has been handled in violation of Article 18 or 19 of the Act.
       -That the data has been obtained in violation of Article 20 of the Act.
       -That the data is no longer necessary for use.
       -That a situation provided in the main clause of Article 26, paragraph 1, of the Act has occurred.
       -That there are other risks that the rights or legitimate interests of the individual will be harmed.
     • (In case of a request for (iii) Discontinuation of provision to a third party)
       -That the data has been provided to a third party in violation of Article 27, paragraph 1, or Article 28 of the Act.
       -That the data is no longer necessary for use.
       -That a situation provided in the main clause of Article 26, paragraph 1, of the Act has occurred.
       -That there are other risks that the rights or legitimate interests of the individual will be harmed.

Privacy Questions

If you have any questions or concerns about Capcom's privacy, please contact us by writing us:
Capcom Co., Ltd.
Personal Information Inquiry Contact
3-1-3, Uchihirano-machi, Chuo-ku
Osaka 540-0037, Japan

Or please click here to submit feedback online

Each of the CAPCOM Group Companies within Japan discloses each of the following matters in relation to the business handling personal information to which the General Data Protection Regulation of the European Union (hereinafter referred to as the “GDPR”) is applied. (As regards the details on each of the CAPCOM Group Companies within Japan, please refer to a separate document, Handling of Personal Information [Matters to be disclosed pursuant to the Act on the Protection of Personal Information].)

• (1)We handle personal information only in cases of the following:
  • (i)When the information is required for the fulfillment of an agreement or the processing of the information is required in the pre-contractual procedure.
  • (ii)When the information is required for the legitimate interests pursued by the CAPCOM Group Companies within Japan or a third party.
  • (iii)When consent has been obtained from the individual concerned.
  • (iv)When handling of the information is approved under the GDPR.
• (2)Prior to the start of the handling of personal information, we provide notification on the purpose of use and other matters required under the relevant laws and regulations to the individual concerned.
• (3)When intending to handle personal information after obtaining the consent of the individual concerned, we ensure that the consent is based on a decision freely made by the individual. In addition, we will not stop the individual from withdrawing consent.
• (4)Capcom will retain personal information obtained from you as long as it is necessary to accomplish the purpose, in accordance with our internal regulations.
• (5)Capcom may share personal information with contractors, service providers, or other third parties, to the extent necessary for the purposes of use specified above.
• (6)When transferring personal information to a country or region other than EEA Member States (in such countries and regions, many of the rights granted in EEA Member States may not be granted because they do not have the same data protection legislation as in EEA Member States), we make arrangements so that the measures related to the protection of personal information will be fully implemented through the conclusion, operation, or performance of the standard contractual clauses based on the GDPR.
• (7)We provide the necessary support to those who reside in EEA Member States when they exercise their right to limit the access, correction, deletion, or processing, or their right to data portability.
• (8)We provide the necessary support when the individual concerned exercises the right to file an objection with respect to the processing of personal information related to the individual to the data protection authorities having jurisdiction over any of the CAPCOM Group Companies within Japan or where the individual resides.
• (9) We accept inquiries regarding personal information of the individuals concerned residing in EEA Member States through the online form.
  In addition, the CAPCOM Group Companies within Japan establish and manage the positions of data protection officer (hereinafter referred to as “DPO”) and data protection representative located in EEA Member States and through such positions, we accept and respond to inquiries. The contact information of DPOs and data protection representatives in EEA Member States are as follows:

• DPO
  • CAPCOM CO., LTD. 3-1-3 Uchihiranomachi, Chuo-ku, Osaka 540-0037, Japan
    Personal Information Inquiry Contact（DPO）
    Email: dpo@capcom.com
• Data protection representatives in EEA Member States
  • Capcom Entertainment Germany GmbH
    Borselstraße 20,
    22765 Hamburg,
    Germany
    Email: ceg.gdpr@capcom.com

April 1, 2022 Public