Preliminary Confirmation Process According to the Relevant Laws and the Fujitsu Group Sustainable Procurement Policy

Preliminary Confirmation of Business with Supplier

Fujitsu has been conducting preliminary confirmation process according to relevant laws and the Fujitsu Group Sustainable Procurement Policy.

Fujitsu has been promoting procurement activities based on the basic principles of implementing corporate activities with the highest standards of corporate ethics, including all applicable laws (specifically - but not limited to - all applicable anti-corruption laws, including the UK Bribery Act and the US Foreign Corrupt Practices Act) and the Fujitsu Group Sustainable Procurement Policy.

As part of the above efforts, through Fujitsu's third party due diligence system, Fujitsu has been conducting preliminary confirmation of business with our suppliers and request them to provide Fujitsu with the necessary relevant documents and their company information. All information provided in this process will be used only for the purposes set forth in Section 1 of the Privacy Notice for Suppliers of the System for the Third Party Due Diligence below.

Privacy Notice for Suppliers of the System for the Third Party Due Diligence

Purpose of data processing
The personal data and your company information that you enter in this system (“System”) will be processed by Fujitsu Limited and its subsidiaries (hereinafter referred to as "Fujitsu") for the following purposes. The personal data and your company information that you enter into this System will not be used for any purposes other than those listed below.
The personal data includes but not limited to names, date of birth, citizenship, phone numbers, email addresses of your company representatives, executives and shareholders.
The purpose of using the information you share with us may include:
a) User registration and login authentication to this System.
b) To carry out due diligence on your company in order for Fujitsu to conduct business with your company. If the bank account is solely in an individual’s name, the account number, name, address and country of bank account holder are required for due diligence on your company.
c) Operation and maintenance of this System.
d) Confirmation and communication to conduct business between Fujitsu and the company (including confirmation and communication related to information and documents required before and after commencement of the transaction with Fujitsu in respect of which due diligence on your company is required (“Subject Transaction”)).
e) Investigations, communications and action to ensure Fujitsu and the company complies with all applicable anti-bribery, corruption, financial recordkeeping, anti-money laundering and any other application laws and regulations of the relevant jurisdiction (including but not limited to the U.S. Foreign Corrupt Practices Act, the U.K. Anti-Bribery Act, the Export Control Act and the Sanctions Act (Japan)).
Provision to third parties
- (1) Where reasonably necessary for the purposes set out in the Privacy Notice for Suppliers, Fujitsu may share personal data and your company information among Fujitsu and with One Trust, LLC and duly authorized third party providers or processors (“third party processors”). Fujitsu and third party processors may collect, store, process, disclose personal data and your company information for the purposes described above. Personal data and your company information that you have provided in this System will be stored on servers in Japan.
- (2) These disclosures may involve transferring your personal data overseas. Fujitsu will take steps to ensure that personal data continues to receive a standard of protection that is at least comparable to that provided under the laws of the exporting jurisdiction. If you are dealing with us within the EU/EEA, you should be aware that this may include transfers to countries outside the EU/EEA, which have not been determined by the European Commission to have an adequate level of data protection.
- (3) Fujitsu may share and jointly use personal data with other companies that are a part of Fujitsu group as follows.
  a) Category of data for joint use:
  Personal data (including but not limited names, date of birth, citizenship, phone numbers, email addresses of your company representatives and executives) and company information that you enter into the System
  b) The extent of the joint users:
  Subsidiaries of Fujitsu Limited
  c) The users' purpose of use:
  For Fujitsu to achieve the purpose described in Section1.
  d) The person responsible for managing your personal data:
  Head of Supply Chain Platform Enablement Division, Global Supply Chain Unit Fujitsu Limited
  e) How personal data is acquired:
  Online forms
Information management
- (1) Personal Data
  Fujitsu manages personal data in line with the terms set out in this System Policy as well as the Fujitsu global Privacy Policy or the Privacy Policy that exists in the relevant country or company aligned with the requirements of applicable privacy laws and regulations. Reasonable and appropriate organization, technical, and physical security measures are being implemented to protect your personal data and company information you submitted.
- (2) Confidential Information
  a) Confidential information shall mean information which is entered to this System by you to Fujitsu in connection with above Purpose and which is marked “confidential” at the time of your entering ("Confidential Information”). Fujitsu shall keep such Confidential Information in confidence, and shall not disclose it to any third party except for as described in this Section 2 and Fujitsu shall not use it except for the above purposes.
  b) Fujitsu shall;
  i) Limit use of and access to Confidential Information to its directors, officers and employees who need to know Confidential Information for the above Purpose; and
  ii) ensure such directors, officers and employees to comply with the same obligations set forth in this Section 3.
  c) The obligations set forth in this Section 3(b) shall continue three years from receipt of Confidential Information from you.
  d) The obligations provided in this Section 3(b) above shall not apply to any information;
  i) which is at any time in the public domain otherwise than through act or failure to act on the part of Fujitsu;
  ii) which was known to Fujitsu before its receipt of the same from you, without obligations of confidentiality;
  iii) which is at any time rightfully received by Fujitsu from any third party without obligations of confidentiality; or
  iv) which is at any time developed by Fujitsu independently of the Confidential Information.
  e) Furthermore, in the case of Fujitsu's disclosure of Confidential Information to governmental authorities or other third parties in accordance with governmental requirements or court orders, such disclosure shall not be deemed a breach of this Section 3, provided, however, that prior to any such disclosure Fujitsu shall, where legally permissible:
  i) assert the privileged and confidential nature of the Confidential Information against the third party seeking disclosure;
  ii) promptly notify you in writing of any such requirement or order to disclose; and
  iii) cooperate fully with you in protecting against any such disclosure and/or obtaining a protective order narrowing the scope of such disclosure and/or use of Confidential Information.
- (3) Retention period
  Fujitsu will delete your personal data and company information when Fujitsu no longer need such information in order to achieve the above purpose and/or to continue doing business with you, or for legal purposes. If Fujitsu decides not to conduct business with you as a result of carrying out the due diligence, Fujitsu may retain personal data in order to record the results of due diligence.
  If you would like to add, correct or delete personal data, or if you would like to stop using this System, please contact [Contact] below.
Compliance
When entering personal data and your company information into this System, please comply with applicable data protection laws and other local applicable laws and regulations.
If you do not register personal data and your company information, or if you do not accept or agree to provide the following guarantees, we may not be able to conduct the necessary due diligence and may not be able to enter into the Subject Transaction or otherwise transact any business with your company.
[Contact]
Supply Chain Platform Enablement Division, Global Supply Chain Unit
Fujitsu Limited
fj-cp-tpm-privacy@dl.jp.fujitsu.com