Privacy Notice - Japan

This privacy notice (“Privacy Notice”) explains how Kroll Bond Rating Agency Japan K.K. and its affiliates (“KBRA”, “we”, “us”, or “our”) processes personal information in accordance with the Act on the Protection of Personal Information (“APPI”), the Financial Instruments and Exchange Act (“FIEA”), and other applicable laws and regulations of Japan. It supplements the KBRA Global Privacy Notice and in the event of any conflict between the Privacy Notice - Japan and the KBRA Global Privacy Notice, the Privacy Notice - Japan shall take precedence.

1. Contact Information

  • Company name: Kroll Bond Rating Agency Japan K.K.

  • Address: Marunouchi Nijubashi Building 3F, 3-2-2 Marunouchi, Tokyo Chiyoda-ku, Japan.

  • Representative: Head of Compliance, Japan.

  • Contact email: [email protected].

2. Personal Information Collected

We may collect and process personal information, including:

  • Name, title, employer, and contact information.

  • Employment history.

  • Records of communications with clients, counterparties, or third parties.

  • Information from your web browser, including your IP address when visiting our websites.

  • Information about financial transactions or business relationships.

  • Information provided through inquiries, subscriptions, or participation in events.

  • Information necessary for due diligence, compliance, or internal controls.

3. Purpose of Use of Personal Information

Personal information is used for the following purposes:

  • To provide our products and services regarding credit ratings.

  • To manage business relationships and communications.

  • To fulfill our regulatory and legal obligations pursuant to applicable laws and regulations, including managing conflicts of interest and maintaining transparency.

  • To respond to inquiries or requests.

  • To market our services (with consent where required). If you wish to opt-out of receiving marketing, you may update your preferences at https://www.kbra.com/account-preferences, notify us of this at [email protected], or click the link in the footer of any marketing email received from us.

  • For internal business operations, including data analysis, development and improvement of website content, products and services, statistical analysis of user behavior, product development, account management, and maintaining the security of KBRA’s information systems and data.

  • For other business purposes reasonably related to the purposes set out above.

We use personal information only to the extent necessary for these purposes, and we do not process personal information beyond this scope without obtaining prior consent or unless permitted by law.

4. Joint Use of Personal Information

We may share the personal information we hold with KBRA group affiliates as follows:

  • Items used jointly: Name, title, contact information, employer, communication records, service usage history, data collected using cookies and tracking technologies on our websites.

  • Entities: KBRA Holdings, LLC; Kroll Bond Rating Agency, LLC; KBRA Analytics, LLC; Kroll Bond Rating Agency International Limited; Kroll Bond Rating Agency Europe Limited; and Kroll Bond Rating Agency UK Limited.

  • Purpose: As outlined in section 3 above.

Managing entity: Kroll Bond Rating Agency Japan K.K. (contact details at section 1 above).

5. Cross-Border Data Transfers

We may transfer personal information to jurisdictions outside of Japan, including to the United States, the United Kingdom and Ireland, where KBRA group companies operate and to other locations where our subcontracted processors operate.

In such cases, we check that the recipient jurisdiction has a data protection regime equivalent to that in Japan, or we implement appropriate safeguards to protect personal information in accordance with applicable laws and regulations.

More information about these jurisdictions and our safeguards is available upon request (contact details at section 1 above).

6. Provision to Third Parties

We do not provide personal information to third parties except where:

  • Required or permitted by law.

  • Necessary to protect life, health, or property in an emergency when prior consent cannot be obtained.

  • Consent has been obtained.

  • Subcontracted processors handle data on our behalf within the scope necessary to achieve the purpose of use (pursuant to appropriate safeguards).

Personal information is jointly used in accordance with section 4 above.

When there is a business succession due to a merger or for other reasons.

Personal information is transferred cross-border in accordance with section 5 above.

7. Security Measures

We have implemented appropriate organizational, technical and security measures designed to protect your personal information from unauthorized access, destruction, loss, or misuse. We supervise and provide training to all personnel on the importance of the protection of personal information and the appropriate handling of personal information. Neither the internet nor any electronic or physical system is ever fully secure and many factors outside of our control may affect the security of your personal information, including unauthorized entry or use, hardware, or software failure and we cannot guarantee its security when being transmitted. If you are a KBRA accountholder, you must take measures to protect the confidentiality of any password and/or login details we provide to access our website, log out when you are not using the website, and limit access to your device. You should be aware that your transmission of your data is at your own risk. Once we receive it, we will use appropriate measures designed to protect it, but we cannot guarantee or warrant the security of any information that you transmit to us. More information about these organizational, technical and security measures is available upon request (contact details at section 1 above).

8. Information Collected Using Cookies and Tracking Technologies

With your consent, we use tracking pixels in alerts and marketing emails you have subscribed to, or webforms relating to any events we host or sponsor that you respond to. We use these to improve the effectiveness of our emails. We review the data collected to see which emails were opened or forwarded and whether any links were clicked to understand how many recipients were interested in the content. This enables us to provide more tailored content/event invitations to subscribers based on their interactions with similar content. We also identify if our content is presented appropriately in browsers of devices used to view our emails and visit our websites.

We use cookies and other tracking technologies on our websites and users can manage their cookie settings through the cookie platform on our website. When you set or update your preferences, we record the date and time of this, your confirmed preferences, and a unique ID associated with your device. We aggregate the data of all users who set their consent preferences so that we can confirm that the cookie consent platform is working correctly.

For more information on the cookies we use, their purposes and the lawful basis for the processing of your personal information when using those cookies and tracking technologies, please see our Cookie Policy here.

9. Rights of Individuals

Pursuant to the APPI, you may have the right to:

  • Request disclosure of retained personal information and its usage purposes.

  • Request correction, addition, or deletion of inaccurate or outdated personal information.

  • Object to the use or provision of your personal information to third parties.

  • Lodge complaints or inquiries regarding the handling of your personal information.

To make such a request or other enquiry, please contact us using the details in section 1. We may ask for verification of identity and will respond in accordance with applicable laws and regulations. We may charge a fee for the disclosure of retained personal data and records of provision to third parties depending on the method of disclosure.

10. Pseudonymously processed and Anonymously processed Information

We may collect, track and store information that cannot be used to identify individual users or individuals whose data is provided to us, because it is pseudonymously processed or anonymously processed, including statistical data such as age, profession, gender, domain name, computer type, browser, information such as company names that can be used to specify users that are not individuals, and records of user usage of the website. We may create and use pseudonymously processed or anonymously processed personal information for analysis or research which may be made available publicly or to subscribers. Such data is processed in a way that prevents identification of individuals and is handled in accordance with the APPI.

11. Continuous Improvement and Updates to this Privacy Notice

We regularly review and enhance our data protection policies and procedures, including this Privacy Notice, to maintain the ongoing protection of personal information. We may from time to time revise all or a part of this Privacy Notice, as necessary. Updated versions will be posted on our website with a revised effective date.

12. Language

This Privacy Notice is available in Japanese and English. In the event of a conflict between the two, the Japanese version shall govern in matters subject to Japanese laws and regulations.

Effective date: 27 June, 2025