Privacy Policy

CITIZEN WATCH CO., LTD. (the "Company") publishes the following regarding its processing of the personal data (information defined as personal data under the personal data protection laws of each applicable country; the same applies hereinafter) of customers (including prospective customers and visitors to this Site; the same applies hereinafter) acquired in connection with the website of CITIZEN FLAGSHIP STORE (the "Site") and its stores. The Company complies with the personal data protection laws of each applicable country, including Japan's Act on the Protection of Personal Information, in accordance with this Privacy Policy.

1. Categories of Personal Data We Process

The Company acquires and uses the following personal data (including personal information under Japan's Act on the Protection of Personal Information) by lawful and fair means in its business activities on the Site and at its stores. Some of the following is collected automatically.

Identifiers such as name, email address, and telephone number
Information regarding communications from customers, such as the contents of enquiry forms and store reservation forms and details of consultations at stores or by telephone
Store reservation information, such as the desired store and date/time of visit and the nature of the consultation (purchase consultation, repair, maintenance, customization, gift, etc.)
Cookie information of Site visitors, such as user behavior, user environment (IP address, approximate location, etc.), and user attributes
Device location information acquired with the customer's permission to display the nearest store (see Section 15)

* Cookie information of Site visitors such as user behavior, user environment (IP address, etc.), and user attributes may or may not constitute personal data depending on the applicable personal data protection laws of each country. To the extent such information constitutes personal data, it is handled as personal data under this Privacy Policy.

2. Purposes of Processing Personal Data

When processing personal data, the Company specifies the purpose of processing in advance, processes it within the scope necessary to achieve that purpose, and does not process it for other purposes except with the consent of the individual or as permitted under applicable laws. The purposes are as follows:

To respond to, confirm, and keep records of enquiries and consultations
To receive and manage store reservations and to send confirmation communications
To provide products and services and after-sales services (repair, maintenance, support, etc.)
To operate, secure, and improve the Site
To statistically analyze how the Site is used and to improve our services and content
To provide information about events and campaigns (where you have consented)

3. Sources of Personal Data

The Company acquires personal data directly from the individual or from the following third parties:

Other companies within the same corporate group
Website usage analytics service providers, including Google LLC (which provide cookies, IP addresses, device information, web browser information, and user behavior and attributes)
Other cases where personal data is lawfully acquired from third parties

4. Legal Bases for Processing

The Company processes personal data in accordance with applicable data protection regulations. Where the provision of personal data is a statutory or contractual requirement, or is necessary to enter into a contract, the Company may be unable to provide its products and services (including the Site) if the individual does not provide the personal data.

5. Retention Period of Personal Data

The Company keeps personal data accurate and up to date within the scope necessary to achieve the purposes of processing. When personal data is no longer needed, the Company deletes or anonymizes it; where this is not possible (e.g., when stored in backup archives), it securely stores the data until deletion becomes possible and ensures that no new processing takes place thereafter.

6. Provision of Personal Data

To fulfill the purposes above, the Company provides personal data to third parties in the following cases. Where the Company entrusts processing to a processor (service provider), it exercises necessary and appropriate supervision.

Provision to processors (service providers): website hosting service providers, email delivery service providers, data analytics service providers, store operation and customer service providers, data storage service providers, and other contractors providing services necessary for the Company's business activities
Where the individual has consented in advance
Where permitted under applicable law, such as where based on laws and regulations or where necessary to protect the life, body, or property of a person
Where the Company's business is succeeded due to a merger, company split, business transfer, or other reason

The Company may provide de-identified or statistical information without restriction.

7. Security Management Measures

For the secure management of personal data, the Company formulates basic policies, develops rules concerning the processing of personal data, and implements organizational, human, physical, and technical security management measures, as well as ascertaining the external environment. For details, please contact the enquiry desk in Section 9 below.

8. Your Rights

The Company respects the rights that the individual has under the applicable data protection regulations. If you wish to exercise your rights, including requesting notification of the purpose of use, disclosure, correction, suspension of use, or disclosure of third-party provision records of retained personal data under Japan's Act on the Protection of Personal Information, please contact the enquiry desk in Section 9 below.

9. Enquiry Desk

For enquiries regarding personal data (including personal information under Japan's Act on the Protection of Personal Information) and this Privacy Policy, please contact us via the enquiry form on the Site or the CITIZEN WATCH CO., LTD. Personal Information Enquiry Desk below.

CITIZEN WATCH CO., LTD. Personal Information Enquiry Desk — Enquiry Form

10. Pseudonymously Processed Information

When the Company creates, acquires, or handles pseudonymously processed information under Japan's Act on the Protection of Personal Information, it processes, securely manages, and handles such information appropriately in accordance with the Act and the rules of the Personal Information Protection Commission.

11. Anonymously Processed Information

When the Company creates or handles anonymously processed information under Japan's Act on the Protection of Personal Information, it processes and securely manages such information in accordance with the Act and the rules of the Personal Information Protection Commission, publishes the categories of information about individuals contained therein, and otherwise handles it appropriately. The Company does not perform acts to identify the individual relating to the personal data used to create such information.

12. Management of the Website

In operating the Site, the Company implements appropriate security measures, both systematic and operational, such as server management systems and access restrictions, to securely manage personal data. When you provide personal data via the Site, the Company protects it using communication encryption technologies such as SSL (Secure Sockets Layer).

13. Cookies, etc.

The Site may use cookies and similar technologies ("Cookies, etc."). The Company uses information acquired through Cookies, etc. for purposes such as improving the convenience of the Site and statistically analyzing and improving usage. You may refuse or manage Cookies, etc. via "Cookie Settings" at the bottom of the Site or your browser settings. However, in that case, some services may become unavailable. For details of the cookies used, please see the Cookie Policy on the Site.

14. Access Logs

The Site acquires and records customers' IP addresses and access information, and thereby obtains usage information such as the pages visited ("Access Logs"). The Company uses Access Logs for purposes such as statistically analyzing and improving Site usage and identifying and resolving the causes of problems occurring on the server.

15. Use of Location Information

To display and guide you to the nearest store, the Site may, with your permission, acquire the approximate location of your device through your browser's location feature. The acquired location information is used solely on your device to determine the nearest store and is not transmitted to or stored on the Company's servers. You may refuse the use of location information at any time via your browser settings.

16. Personal Data of Minors

The Company takes necessary measures in accordance with applicable laws regarding the personal data of minors. Where necessary, the Company may obtain the consent of a guardian.

17. External Transmission of Site Visitor Information

To understand usage and improve our services, the Site uses external service providers' services ("External Services") and transmits information about Site visitors necessary for such use, while respecting privacy protection. The transmitted information is managed and used in accordance with the privacy policies, etc. of the providers of the External Services. The External Services used on the Site are as follows:

Google Analytics
- Provider: Google LLC and its affiliates
- Information transmitted: information regarding systems, devices, networks, and communications typically used in internet communications; location information; data on behavior and pages viewed on the Site; and user identifiers (cookies, device identifiers, etc.)
- Purpose: to analyze browsing trends and history on the Site
- Opt-out: Google Analytics Opt-out Browser Add-on. For Google's use of data, please see here.

18. Other

The Company may change this Privacy Policy without notice in order to achieve more appropriate management or to respond to amendments to relevant laws and regulations. In such cases, the Company will notify you by posting the revised Privacy Policy without delay, and after such notice, will process personal data in accordance with the revised Privacy Policy. However, where a change in content requires the individual's consent under applicable law, the Company will obtain such consent by a method prescribed by the Company.

Appendix: EEA (European Economic Area) and the United Kingdom

This Appendix applies where the individual resides in the EEA (European Economic Area) or the United Kingdom, to the Company's processing of the individual's personal data, and refers to the GDPR and the UK GDPR (collectively, the "GDPR"). This Appendix supplements and amends the Privacy Policy above; in the event of any conflict, this Appendix prevails over the Privacy Policy above to the extent relating to the processing of personal data of individuals located in the EEA or the UK.

1. Legal Bases for Processing

The Company processes personal data on the following legal bases:

Where processing is necessary for the performance of a contract (Article 6(1)(b) GDPR): to respond to enquiries, store reservations, and after-sales services
Where processing is necessary for legitimate interests (Article 6(1)(f) GDPR): to operate, secure, and improve the Site, and to use essential cookies, etc.
Where the individual has consented (Article 6(1)(a) GDPR): to use analytics cookies, etc. and to provide information about events and campaigns. To review details of the cookies, etc. we use or to change your consent settings, click "Cookie Settings" in the footer of the Site.
Where processing is necessary to comply with a legal obligation (Article 6(1)(c) GDPR)

2. Transfers of Personal Data to Third Countries

Where necessary to achieve the purposes above, the Company may transfer personal data to countries outside the EEA/UK, including Japan. Where transferring to a region outside the EEA/UK, the Company takes appropriate safeguards, relying on an adequacy decision (Article 45 GDPR) for countries that have one, and concluding the Standard Contractual Clauses approved by the European Commission (Article 46 GDPR) with the recipient for countries that do not. Third countries to which the Company transfers personal data in reliance on an adequacy decision include Japan.

3. Your Rights

Under the GDPR, you have the right of access to your personal data (Article 15), rectification and erasure (Articles 16 and 17), restriction of processing (Article 18), objection to processing (Article 21(1)), objection to direct marketing (Article 21(2)), data portability (Article 20), withdrawal of consent, and not to be subject to automated decision-making (Article 22). You may also lodge a complaint with the relevant data protection supervisory authority in the Member State of your habitual residence, place of work, or place of alleged infringement (Article 77).

4. Contact