Last Updated：2020/12/25

Introduction

Ono Pharmaceutical Co., Ltd., (referred to in this privacy notice as we, us, Ono or our) is a controller for the personal information that it collects and uses about you. Our contact details are set out in this privacy notice. Any reference in this privacy notice to you or your refers to anyone whose personal information we process.

This privacy notice is to inform you about:

• What personal information is;
• How we collect your personal information;
• The types of personal information we collect;
• How we use your personal information;
• The legal basis for processing your personal information;
• What will happen if you do not provide the information we request;
• How we share your personal information;
• How long we keep your personal information;
• How we keep your personal information secure;
• What will happen if you email us;
• Overseas transfers of your personal information;
• Your rights in relation to your personal information;
• How to make complaints in relation to your personal information; and
• How to contact us.

Any references to personal information in this privacy notice will include personal information, and where relevant, special categories of personal information.

Any reference to Group means Ono, its affiliates and its associated companies.

We will treat all of your personal information as confidential and in accordance with the data protection legislation in the European Economic Area (EEA) and your personal information will only be shared with others in accordance with this privacy notice.

We keep this privacy notice up to date, so if there are any changes to the way in which your personal information is used this privacy notice will be updated time to time. When we update this privacy notice, we will revise the “Last Updated” date above. If we make material changes in this privacy notice affecting personal information, we will notify you of the changes by email using the email address you have provided to us.

What is personal information?

Personal information is any information that tells us something about you. This could include information such as name, contact details, date of birth, medical information and bank account details.

How do we collect personal information?

We collect personal information about you from various sources including:

• The personal information you provide us when entering into your applicable contract;
• The personal information you provide us when any contact is made with you (by way of telephone call, email or by any other means) in accordance with the provisions of our agreement with you; and
• Any personal information we already hold about you, such as public information or etc.;

What kind of personal information do we collect?

We collect the following types of personal information about you:

• Personal contact details such as name, title, address, telephone number and personal email addresses;
• Location of your services to Ono;
• CCTV footage and other information obtained through electronic means such as security card records (however we only collect this information when you attend our offices);
• Information about your use of our information and communication systems;
• Bank and financial details; and
• Details of any contact made with you (either initiated by us or by yourself)

How do we use your information?

We use your personal information for the following purposes:

• For insurances purposes;
• For the provision of payment for services;
• To administer the agreement we have with you;
• For business management and planning purposes, including accounting and auditing;
• To make decisions about your continued engagement;
• To retain a record of you;
• To make arrangements for the termination of our working relationship;
• To deal with legal disputes involving you;
• To comply with health and safety obligations;
• To prevent fraud;
• To comply with our obligations to public authorities;
• To comply with our legal obligations and professional codes; and
• To comply with information requests that we receive from regulators and law enforcement authorities or to comply with court orders

What is the legal basis of our data processing?

Under EEA data protection legislation, we are only permitted to use your personal information if we have a legal basis for doing so as set out in the EEA data protection legislation. We rely on the following legal bases to use your information for service-related purposes:

• Where we need information to perform the contract we have entered into with you;
• Where we need to comply with a legal obligation; and
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

In more limited circumstances we may also rely on the following legal bases:

• Where we need to protect your interests (or someone else's interests); and
• Where it is needed in the public interest or for official purposes.

Some information is classified as "special" data under EEA data protection legislation. This includes information relating to health, racial or ethnic origin, religious beliefs or political opinions and sexual orientation. This information is more sensitive and we need to have further justifications for collecting, storing and using this type of personal information (in the event we do so). There are also additional restrictions on the circumstances in which we are permitted to collect and use criminal conviction data. We may process special categories of personal information and criminal conviction information in the following circumstances:

• In limited circumstances with your explicit consent, in which case we will explain the purpose for which the information will be used at the point where we ask for your consent;
• We will use information about your physical and mental health or disability status to comply with our legal obligations, including to ensure your health and safety in Ono's workplace and to assess your fitness to work and to provide appropriate workplace adjustments; and
• We will use information about your race or ethnic origin, religious or philosophical beliefs, your sexual life or sexual orientation to ensure meaningful equal opportunity monitoring and reporting – the legal basis of this processing is that it is in the public interests to carry out diversity monitoring.

What happens if you do not provide information that we request?

• We need some of your personal information in order to perform our contract with you. For example, we need to know your bank details so that we can pay you. We also need some information so that we can comply with our legal obligations. For example, if you attend our offices and suffer an injury or accident, we will need information about this to comply with our health and safety obligations.
• Where information is needed for these purposes if you do not provide it we will not be able to perform our contract with you and may not be able to offer you a contract or continue with your contract. We explain when this is the case at the point where we collect information from you.

How do we share your personal information?

We will keep your personal information confidential and only share it with others for the purposes set out below and elsewhere in this privacy notice.

We may share your personal information in the following ways:

• We may share your personal information with any person working within Ono or with any person working within the Group on a need to know basis to ensure we are able to perform our obligations to you;
• Where we use third party services providers who process personal information on our behalf in order to provide services to you. This includes, but not limited to, contract research organization, site management organization, research laboratories, IT systems providers and IT contractors, payroll providers and pension administration providers;
• We may share personal information with our regulators, governmental or quasi-governmental organisations, law enforcement authorities and with courts, tribunals and arbitrators in order to comply with our regulatory and legal obligations; or
• If we sell any part of our business and/or integrate it with another organisation your personal information may be disclosed to our advisers and to prospective purchasers or joint venture partners and their advisers. If this occurs the new owners of the business will only be permitted to use your information in the same or similar way as set out in this privacy notice.

For how long do we keep your personal information?

As a general rule we keep your personal information for the duration of your contract with us or for a period as we noticed when we contact you. However, where we have statutory obligations to keep personal information for a longer period or where we may need your information for a longer period in case of a legal claim, then the retention period may be longer.

Notwithstanding the above, any personal information will be deleted in accordance with our data retention policy.

Cookie Policy

This Cookie Policy explains the types of cookies that we use and the purpose therefor. For matters not indicated in this Policy, please refer to our “Privacy Policy.”

What are "Cookies"?

Cookies are small text files which save information about how you use a website. By using cookies, we may collect specific information, such as browsing information. However, we will not collect information that can directly identify an individual, such as a name, address, telephone number or email address.

Type and Purpose of Cookies Used by Us

The table below explains the cookies we use and why.

Cookie	Name	Lifespan	Purpose
cookie-module	cookie-agreed cookie-agreed-version	100 days	This cookie is used to remember a user’s choice about cookies on our website. Where users have previously indicated a preference, that user’s preference will be stored in this cookie.
Cloudflare	__cfduid	30 days	This cookie helps Cloudflare detect malicious visitors to our website and minimizes blocking legitimate users.
Google Analytics	_gid	24 hours	This cookie is used to distinguish users.
Google Analytics	_ga	2 years	This cookie is used to distinguish users.
Google Analytics	_gat_gtag_UA_*	1 minute	This cookie is used to throttle request rate.

＜ Specific Information about Google Analytics ＞
If you want to obtain further information about Google Analytics, please see “How Google Uses Information from Sites or Apps That Use Our Services" at the following link: (www.google.com/policies/privacy/partners/)
To opt out of being tracked by Google Analytics across all websites, please visit http://tools.google.com/dlpage/gaoptout.

How do I Change My Cookie Settings?

Most web browsers allow some control over most cookies through the browser settings. To find information regarding cookie management applicable to your web browser, please visit the website of your web browser’s developer.

How do we keep your information secure?

We store your personal information as set out below:

We will ensure access to personal information is restricted to employees of Ono or any person working within the Group on a need to know basis. Training will be provided to any of those employees of Ono or anyone working within the Group who need to access to your personal information to ensure it is secured at all times.

What will happen if you email us?

If you email us, or give us your personal email address, we will record it. We may use it to contact you occasionally in the event you are no longer providing services to Ono.

If you send us emails from your personal email accounts, remember that your personal email accounts may not be subject to the same security measures as your work email accounts and emails could be intercepted. If you do send emails from your personal accounts, please keep the amount of personal or confidential information you include to a minimum. We will do likewise when we reply to your personal accounts.

Overseas transfers of your personal information

We may transfer, store, or process your personal information in locations outside the EEA. Where the countries to which your personal information is transferred do not offer an equivalent level of protection for personal information to the laws of the EEA we will ensure that appropriate safeguards are put in place.

The countries to which your personal information may be transferred and the safeguards in place are as details below:

• Japan, South Korea, Taiwan and US – all personal information will be shared with and/or accessible by our directors and employees in Japan, South Korea, Taiwan and US, for the purposes set out in this privacy notice.
• Certain countries outside the EEA have been approved by European Commission as providing essential equivalent protection as EEA data protection legislation. EEA data protection legislation allows us to freely transfer personal information to such countries.

Your rights in relation to your personal information

You have a number of rights in relation to your personal information, these include the right to:

• Be informed about how we use your personal information;
• Obtain access to your personal information that we hold;
• Request that your personal information is corrected if you believe it is incorrect, incomplete or inaccurate;
• Request that we erase your personal information in the following circumstances:
  • If Ono is continuing to process personal information beyond the period when it is necessary to do so for the purpose for which it was originally collected;
  • If Ono is relying on consent as the legal basis for processing and you withdraw consent;
  • If Ono is relying on legitimate interest as the legal basis for processing and you object to this processing and there is no overriding compelling ground which enables us continue with the processing;
  • If the personal information has been processed unlawfully (i.e. in breach of the requirements of the EEA data protection legislation); or
  • If it is necessary to delete the personal information to comply with a legal obligation.
• Ask us to restrict our data processing activities where you consider that:
  • Personal information is inaccurate;
  • Our processing of your personal information is unlawful;
  • Where we no longer need the personal information but you require us to keep it to enable you to establish, exercise or defend a legal claim; or
  • Where you have raised an objection to our use of your personal information;
• Request a copy of certain personal information that you have provided to us in a commonly used electronic format. This right relates to personal information that you have provided to us that we need in order to perform our agreement with you and personal information where we are relying on consent to process your personal information;
• Object to our processing of your personal information where we are relying on legitimate interests or exercise of a public interest task to make the processing lawful. If you raise an objection we will carry out an assessment to determine whether we have an overriding legitimate ground which entitles us to continue to process your personal information; and
• Not be subject to wholly automated decisions which produce legal effects or which could have a similarly significant effect on you.

If you would like to exercise any of your rights or find out more, please contact us.

Complaints

If you have any complaints about the way we use your personal information please contact us. We will respond to any rights that you exercise within one month of receiving your request, unless the request is complex or involves a significant amount of data, in which case we will respond within three months.

If we cannot resolve any issue, you have the right to complain to the data protection authority in your country. If you need more information about how to contact your local data protection authority please let us know by contacting Ono’s Personal Information Manager as below.

Contact details

If you have any questions, comments or requests regarding any aspect of this privacy notice, please do not hesitate to contact us by sending a letter.

Please send a letter to Personal Information Manager of Ono
Ono Pharmaceutical Co., Ltd., 8-2 Kyutaromachi 1-Chome Chuo-ku, Osaka-shi, Osaka, Japan 541-8564.