Privacy Policy

Personal Information Protection Policy

Nitto Pharmaceutical Holdings, Ltd. and its group companies, namely Nitto Pharmaceutical Industries, Ltd. and Noster inc. (collectively, the "Group"), recognize that the protection of Personal Information is an important social responsibility and an essential element of sound corporate governance.
The Group has established the following policy and is committed to the appropriate protection and management of Personal Information in the course of its business activities.

  1. Compliance with Applicable Laws and Regulations
    The Group shall comply with:

    • the Act on the Protection of Personal Information of Japan ("APPI");

    • applicable governmental guidelines issued by competent authorities;

    • applicable data protection and privacy laws;

    • industry standards; and

    • other relevant legal and regulatory requirements governing the handling of Personal Information.

    The Group shall process Personal Information in accordance with such laws, regulations, and standards.

  2. Collection, Use and Disclosure of Personal Information
    The Group shall identify the purposes of use of Personal Information to the extent necessary for its business operations and shall acquire, use, and disclose Personal Information appropriately and lawfully.
    The Group shall implement appropriate measures to prevent the use of Personal Information beyond the scope of the specified purposes of use.
    Except in the following circumstances, Personal Data will not be disclosed or provided to any third party without the prior consent of the individual concerned:

    • where disclosure is required or permitted by applicable law;

    • where processing is entrusted to a service provider to the extent necessary to achieve the stated purposes of use;

    • where Personal Information is shared pursuant to a lawful joint-use arrangement;

    • where disclosure is otherwise authorized under applicable laws and regulations.

  3. Joint Use of Personal Information

    Categories of Personal Information Subject to Joint Use
    The categories of Personal Information that may be jointly used include:

    • name;

    • residential address;

    • telephone number;

    • email address;

    • other contact details; and

    • all other Personal Data held by the Group relating to the individual concerned.

    Entity Responsible for Joint Use
    For purposes of joint use within the Group, the following entity shall be responsible for the management of Personal Information:

    Noster inc.
    35-3 Minamibiraki, Kamiueno-cho,
    Muko City, Kyoto 617-0006, Japan
    Representative Director: Kohey Kitao

  4. Security Management Measures
    The Group shall implement necessary and appropriate organizational, personnel, physical, and technical security measures to protect Personal Information against:

    • unauthorized access;

    • loss;

    • destruction;

    • alteration;

    • leakage; and

    • other security incidents.

    Where Personal Information is disclosed or provided to a third party for outsourced processing or joint use, the Group shall exercise appropriate supervision and management over such third party.

  5. Continuous Improvement

    The Group shall continuously review, evaluate, and improve its organizational structure, internal rules, operational procedures, and management systems relating to the protection of Personal Information in order to ensure their ongoing effectiveness.

  6. Inquiries, Requests for Disclosure, and Complaints
    The Group shall respond sincerely, appropriately, and without undue delay to:

    • inquiries concerning Personal Information;

    • requests for disclosure;

    • requests for correction, addition, deletion, or suspension of use; and

    • complaints regarding the handling of Personal Information,

    in accordance with applicable laws and regulations.

  7. Use of Cookies and Similar Technologies on the Group's E-Commerce Website

    • Cookies
      The Group's use of cookies shall be governed by the Group's Cookie Policy. Cookies may be used to support the operation, functionality, security, and performance of the Group's online services.

    • Advertising Using Facebook Custom Audiences
      The Group may use Meta's Facebook Custom Audiences service to display advertisements based on an individual's use of the Group's services.
      For such purposes, Personal Information held by the Group and information held by third-party advertising providers may be transformed into a form that does not directly identify individuals and matched through privacy-protective processes.
      Advertisements may then be delivered based on the results of such matching.
      Third-party advertising providers are not permitted to use such information for purposes unrelated to advertising activities conducted on behalf of the Group.
      Users may review information regarding Facebook Custom Audiences through the applicable Meta business resources and may manage personalized advertising preferences through Meta's advertising settings and opt-out tools.

  8. Requests for Disclosure and Other Privacy-Related Requests
    Requests concerning disclosure, correction, deletion, suspension of use, or other rights relating to Personal Information should be directed to:

    Personal Information Handling Representative
    Noster inc.
    35-3 Minamibiraki, Kamiueno-cho
    Muko City, Kyoto 617-0006, Japan
    Telephone: +81-75-921-5303

  9. Contact Point for Questions and Complaints
    Questions, concerns, and complaints regarding the Group's handling of Personal Information may be directed to:

    Personal Information Handling Representative
    Noster inc.
    35-3 Minamibiraki, Kamiueno-cho
    Muko City, Kyoto 617-0006, Japan
    Telephone: +81-75-921-5303

  10. Personal Information Handling Business Operator
    The business operator responsible for the handling of Personal Information is:

    Noster inc.
    35-3 Minamibiraki, Kamiueno-cho
    Muko City, Kyoto 617-0006, Japan
    Representative Director: Kohey Kitao
    Telephone: +81-75-921-5303

PURPOSES OF PROCESSING PERSONAL INFORMATION

The Group may use Personal Information acquired or retained by the Group for the purposes described below.
Unless otherwise notified to the relevant individual or otherwise disclosed on the Group's website, Personal Information shall not be used for purposes other than those set forth in this Policy.

  1. Healthcare Professionals

    Categories of Individuals
    This section applies to:

    • physicians;

    • dentists;

    • nurses;

    • pharmacists;

    • pharmacies and drugstores; and

    • other healthcare professionals.

    Purposes of Processing
    The Group may process Personal Information and Retained Personal Data relating to healthcare professionals for the following purposes:

    1. Proper Use Information
      To provide and collect information relating to the proper use of the Group's pharmaceutical products, quasi-drugs, health products, and related services.

    2. Product Quality, Safety and Efficacy
      To provide, collect, assess, and maintain information relating to the quality, safety, efficacy, and performance of the Group's products.

    3. Medical and Pharmaceutical Research
      To conduct, support, and participate in research and investigations in the fields of medicine, pharmaceuticals, healthcare, and life sciences.

    4. Medical and Scientific Communications
      To provide, obtain, evaluate, and exchange medical information and academic or scientific information.

    5. Clinical Trials and Post-Marketing Activities
      To request, support, conduct, and manage:

      • clinical trials;

      • observational studies;

      • post-marketing surveillance;

      • safety monitoring activities; and

      • related scientific investigations.

    6. Product Development Activities
      To support and conduct product development activities and investigations relating to the use of the Group's products.

    7. Regulatory Compliance
      To submit notifications, reports, and other required filings to governmental authorities and regulatory agencies.

  2. Persons Making Inquiries and Users of Group Contact Desks

    Categories of Individuals
    This section applies to:

    • persons making inquiries;

    • users of customer support channels;

    • users of consultation services; and

    • other individuals using contact points operated by the Group.

    Purposes of Processing

    1. Inquiry Management
      To review, investigate, and respond to inquiries, requests, consultations, reports, and communications submitted to the Group.

    2. Product Quality, Safety and Efficacy
      To provide, collect, assess, and maintain information relating to the quality, safety, efficacy, and performance of the Group's products.

    3. Communications with Relevant Parties
      To communicate and provide information to:

      • marketing authorization holders;

      • manufacturers;

      • distributors;

      • healthcare professionals; and

      • other relevant stakeholders.

    4. Regulatory Reporting
      To make reports, notifications, and disclosures required by applicable laws and regulations.

  3. Survey Participants and Campaign Applicants

    Categories of Individuals
    This section applies to individuals who have participated in:

    • customer surveys;

    • questionnaires;

    • promotional campaigns;

    • contests; and

    • other initiatives organized by the Group.

    Purposes of Processing

    1. Marketing Analysis
      To conduct data analysis for:

      • sales activities;

      • promotional activities;

      • marketing strategy development;

      • market research; and

      • business planning.

    2. Information Distribution
      To provide information relating to:

      • survey programs;

      • campaigns;

      • promotional activities;

      • products; and

      • services offered by the Group.

  4. Facility Visitors and Tour Participants

    Categories of Individuals
    This section applies to:

    • visitors seeking tours of Group facilities; and

    • persons entering Group premises.

    Purposes of Processing

    1. Visitor Administration
      To provide explanations and assistance relating to visits, tours, and entry procedures and to manage access to and departure from Group facilities.

    2. Post-Visit Communications
      To respond to inquiries or communications received following visits or tours.

  5. Shareholders

    Categories of Individuals
    This section applies to shareholders of the Group.

    Purposes of Processing

    1. Exercise of Shareholder Rights
      To facilitate and respond to the exercise of rights granted to shareholders under the Companies Act and other applicable laws.

    2. Compliance with Legal Obligations
      To fulfill obligations imposed upon the Group under:

      • the Companies Act;

      • securities laws; and

      • other applicable laws and regulations.

    3. Shareholder Administration
      To prepare shareholder records and conduct shareholder management activities.

    4. Distribution of Corporate Materials
      To distribute:

      • annual reports;

      • business reports;

      • shareholder communications; and

      • other corporate materials.

  6. Business Partners and Industry Stakeholders

    Categories of Individuals
    This section applies to:

    • officers and employees of marketing authorization holders;

    • manufacturers;

    • distributors;

    • suppliers;

    • service providers;

    • government officials;

    • officers and employees of corporations;

    • incorporated administrative agencies;

    • foundations;

    • associations;

    • academic societies;

    • research institutions; and

    • other organizations having business, operational, or industry-related relationships with the Group.

    Purposes of Processing

    1. Business Communications
      To communicate regarding:

      • commercial transactions;

      • business operations;

      • partnerships; and

      • industry activities.

    2. Proper Use Information
      To provide and collect information concerning the proper use of pharmaceuticals, quasi-drugs, and related products.

    3. Quality, Safety and Efficacy Information
      To provide, collect, and evaluate information regarding product quality, safety, and efficacy.

    4. Medical and Scientific Information
      To provide, collect, review, and exchange medical and scientific information.

    5. Communication with Industry Participants
      To communicate with:

      • healthcare professionals;

      • manufacturers;

      • distributors; and

      • other relevant stakeholders.

    6. Regulatory Compliance
      To submit notifications and regulatory reports to governmental authorities.

  7. Job Applicants

    Categories of Individuals
    This section applies to individuals applying for employment with the Group.

    Purposes of Processing
    Personal Information may be processed for:

    • recruitment screening;

    • applicant evaluation;

    • hiring decisions;

    • interview administration; and

    • communications relating to employment opportunities.

  8. E-Commerce Customers

    Categories of Individuals
    This section applies to customers using the Group's mail-order and e-commerce services.

    Purposes of Processing

    1. Order Fulfillment
      To process and deliver purchased products and services.

    2. Payment Processing
      To process payments and manage billing-related matters.

    3. Product and Service Information
      To provide information relating to products, services, promotions, and related offerings.

    4. Customer Support
      To respond to inquiries and provide customer support services.

    5. Surveys and Research
      To request participation in surveys and other research activities.

    6. Marketing and Business Analytics
      To conduct information analysis for:

      • promotional activities;

      • customer insights;

      • product development; and

      • marketing strategy formulation.

    7. Regulatory Compliance
      To meet reporting and compliance obligations required by law.

  9. Employees, Former Employees and Family Members

    Categories of Individuals
    This section applies to:

    • current employees;

    • former employees; and

    • family members and dependents of employees.

    Purposes of Processing

    1. Human Resources Planning
      To plan and implement strategies relating to:

      • organizational management;

      • personnel administration;

      • employee welfare;

      • occupational health and safety; and

      • training and education.

    2. Business Communications
      To facilitate business-related communications within the Group.

    3. Employment Administration
      To administer:

      • recruitment;

      • evaluation;

      • compensation;

      • benefits;

      • promotions;

      • disciplinary measures;

      • attendance management;

      • occupational health and safety;

      • disaster preparedness; and

      • employee training programs.

    4. Audits and Compliance Monitoring
      To conduct reviews, inspections, confirmations, and audits necessary for the proper operation of the Group's business activities.

    5. Regulatory Reporting
      To make legally required reports and submissions to governmental authorities.

    6. External Communications
      To communicate with:

      • business partners;

      • industry organizations; and

      • other stakeholders involved in the Group's business operations and industry activities.

GDPR PRIVACY NOTICE

This GDPR Privacy Notice applies to the processing of Personal Data through the website operated by Nitto Pharmaceutical Holdings, Ltd., Nitto Pharmaceutical Industries, Ltd., and Noster inc. (collectively, the "Group").
This Notice is intended to satisfy the transparency requirements of Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR").
Before using the Group's website, users are encouraged to read this GDPR Privacy Notice carefully.

Article 1. Scope of this Privacy Notice

  1. Scope
    This GDPR Privacy Notice applies to individual users of the Group's website and to the processing of Personal Data conducted through the website where GDPR or other applicable privacy laws are applicable. The Group acts as the Data Controller with respect to such processing activities unless otherwise specified.

  2. Third-Party Content and Websites
    The website may contain information, services, banners, hyperlinks, or other content provided by third parties.
    The Group does not control such third-party websites or services and is not responsible for the privacy practices, policies, or legal compliance of any third party.
    Users are encouraged to review the privacy policies of any third-party website before providing Personal Data or otherwise interacting with such website.

Article 2. Personal Data Collected

  1. Categories of Personal Data
    The Group may collect and process the following categories of Personal Data from users of the website:

    • Full name;

    • Address and location information;

    • Order-related information;

    • Customer service information;

    • Email address;

    • Username and password;

    • IP address;

    • Payment details;

    • Employment-related information;

    • Curriculum vitae (CV) or resume information;

    • Cookie-related information; and

    • Other information voluntarily submitted through the website.

  2. Special Categories of Personal Data
    The Group does not intentionally collect special categories of Personal Data, such as passport information, health data, or other sensitive personal information, through the website.

  3. Sources of Data Collection
    Personal Data may be collected when users:

    • create an account;

    • place an order;

    • apply for employment through the website;

    • communicate with the Group;

    • subscribe to services; or

    • otherwise use the website.

  4. Lawful Processing
    The Group processes Personal Data only in accordance with applicable privacy laws and only for the purposes described in this GDPR Privacy Notice.

Article 3. Purposes of Processing and Legal Bases

The Group collects and processes Personal Data solely for legitimate and specified purposes.

  1. Performance of a Contract
    Where users place orders or otherwise enter into contractual relationships with the Group, Personal Data may be processed as necessary to:

    • administer contracts;

    • fulfill orders;

    • provide products and services;

    • process transactions; and

    • perform pre-contractual activities requested by users.

    The Group will not process Personal Data beyond what is reasonably necessary for contract performance.

  2. Communications
    The Group may process Personal Data in order to:

    • communicate regarding products and services;

    • manage customer accounts;

    • provide important service notices;

    • maintain account functionality;

    • respond to inquiries; and

    • address complaints.

    Where a user creates an online account, Personal Data may be retained to facilitate future access and reduce repetitive data entry.
    The Group's legitimate interests include the effective administration of its business operations and customer relations.

  3. Marketing
    The Group may communicate with users regarding products, services, promotions, and related offerings.
    Except where permitted under applicable law in connection with products or services similar to those previously purchased by a user, the Group will obtain prior consent before sending marketing communications.
    Users may unsubscribe from marketing communications at any time.
    The Group's legitimate interests include maintaining business relationships and informing users about products and services that may be relevant to them.

  4. Customer Service
    Where users contact customer support, the Group may process Personal Data in order to:

    • investigate reported issues;

    • provide support services;

    • administer customer relationships; and

    • improve service quality.

  5. Recruitment Activities
    Where an individual applies for employment through the website, the Group may process Personal Data to:

    • evaluate applications;

    • conduct recruitment reviews;

    • communicate with candidates; and

    • make hiring decisions.

  6. Additional Processing Activities
    If the Group intends to process Personal Data for purposes other than those for which it was originally collected, the Group shall provide information regarding such additional purposes and any related information required by applicable law before commencing the additional processing.

Article 4. Transfer of Personal Data to Third Parties

  1. Processors and Service Providers
    The Group may disclose Personal Data to third-party vendors, contractors, and service providers that process Personal Data on behalf of the Group where such processing is necessary to achieve the purposes described in this Notice.
    Such processors shall be selected in accordance with the Group's internal standards and shall be subject to appropriate contractual, organizational, and supervisory measures.

  2. Joint Use with Group Companies
    The Group jointly uses certain e-commerce customer information with Noster inc. in connection with online sales activities.

    Categories of Data

    • Name

    • Date of birth

    • Contact details

    • Purchased product information

    • Quantity purchased

    Purpose
    Provision of after-sales support and customer service.

    Responsible Entity
    Noster inc.

Article 5. Security

The Group implements appropriate technical and organizational measures designed to protect Personal Data against unauthorized processing, loss, destruction, disclosure, or alteration.
Access to Personal Data is limited to employees, representatives, contractors, and service providers who have a legitimate need to access such data.
All such recipients are subject to confidentiality obligations arising under employment agreements, processing agreements, or applicable law.

Article 6. Retention of Personal Data

The Group shall retain Personal Data only for as long as necessary to fulfill the purposes for which the data were collected and processed.
Users may request deletion of Personal Data at any time.
Where Personal Data is no longer necessary for the purpose for which it was collected or processed, the Group will delete or otherwise remove such Personal Data, subject to applicable legal requirements.

Article 7. Cookies

The Group's use of cookies and similar technologies is governed by the Group's Cookie Policy.
Additional information regarding cookies is available in the section of COOKIE POLICY of this Privacy Framework.

Article 8. Rights of Data Subjects

Subject to applicable law, users may exercise the following rights.

  1. Right to Withdraw Consent
    Where processing is based upon consent, users may withdraw consent at any time. Withdrawal shall not affect the lawfulness of processing conducted before withdrawal.

  2. Right of Access
    Users have the right to request access to Personal Data concerning them and to obtain a copy of such Personal Data.

  3. Right to Rectification
    Users may request correction of inaccurate Personal Data and completion of incomplete Personal Data.

  4. Right to Erasure
    Users may request deletion of Personal Data where permitted by applicable law, including where the Group lacks a continuing legal basis for processing.

  5. Right to Object
    Users may object to processing based upon the Group's legitimate interests.
    Where processing is conducted for direct marketing purposes, the Group shall honor such objections without exception.
    For all other processing activities, the Group may continue processing only where compelling legitimate grounds outweigh the interests, rights, and freedoms of the individual or where processing is necessary for legal proceedings.

  6. Right to Lodge a Complaint
    Users may lodge a complaint with a competent supervisory authority, including the supervisory authority located in:

    • their habitual residence;

    • their place of work; or

    • the location of the alleged GDPR infringement.

    The Group welcomes the opportunity to address concerns directly before a complaint is submitted to a supervisory authority.

  7. Minors
    Individuals under sixteen (16) years of age must obtain parental or guardian authorization where required by applicable law before exercising rights or using services requiring consent.

Article 9. Contact Information

Questions, complaints, or requests to exercise rights under Article 8 may be directed to:

Noster inc.

Telephone:

+81-75-921-5303

Business Hours:

Monday to Friday, 9:00 a.m. to 5:00 p.m. (excluding public holidays and company holidays).

Article 10. Data Protection Authorities

In addition to the rights described above, individuals residing in the European Union, working within the European Union, or otherwise protected by GDPR may submit complaints to the competent supervisory authority.
The Group respectfully requests that users contact the Group before escalating concerns to a supervisory authority so that the matter may be reviewed and addressed promptly.

Article 11. General Provisions

  1. Account Removal
    The Group reserves the right to remove or deactivate website accounts at any time without prior notice where permitted by applicable law.
    The Group shall not be liable for losses arising from such removal except to the extent required by law.

  2. Amendments
    The Group reserves the right to revise this GDPR Privacy Notice periodically.
    Users are encouraged to review this Notice regularly. According to the Japanese source document, the notice was last revised in September 2022.

  3. Severability
    If any provision of this Notice is determined to be invalid, unlawful, or unenforceable, such provision shall be replaced to the extent possible by a valid provision reflecting the original intent, and the remaining provisions shall remain in full force and effect.