Privacy Policy

Business Operator Information

Name: RareGleam Co., Ltd.
Representative: Kwangjin Choe, Representative Director (CEO)
Address: Marion Iijima 3F, 5-8-3 Higashi-Ueno, Taito-ku, Tokyo 110-0015, Japan

Scope of This Policy

This Policy applies to personal information we obtain through your viewing and use of the Site; through inquiries made via forms on the Site, by email, by telephone, or otherwise; and through our business activities, such as business meetings and transactions.
Where a separate privacy policy has been established for any of the services we provide (such as Rally, Flux, RemoteGate, and SNAP POP), the handling of personal information in that service is governed by that service's privacy policy, and where it contains provisions that differ from this Policy, that service's privacy policy prevails with respect to that service. However, where you send us an inquiry about any of these services through a form or other means on the Site, this Policy applies to the handling of personal information relating to that inquiry.
Terms used in this Policy such as "personal information," "personal data," and "retained personal data" have the meanings defined in the APPI.

Information We Collect

We collect the following information by proper means.

• Contact form: company name, name, email address, telephone number (optional; required for Flux estimate requests), inquiry type, and details of your inquiry; for Flux estimate requests, the monthly number of orders, main order channels, number of customers, the system you use, and preferred start date; and how you arrived at the Site (advertising parameters and the page from which the form was submitted)
• Document download form: company name, name, email address, telephone number (optional), whether you wish to receive informational emails from us, and how you arrived at the Site (advertising parameters)
• Information relating to business meetings and transactions: the names, company names, department names, job titles, and contact details (address, telephone number, email address, etc.) of contact persons at our business partners and prospective customers, and the content of our communications, obtained through exchanging business cards, business meetings, discussions, and communications by email, telephone, or otherwise
• Direct inquiries by email, telephone, etc.: your name, contact details, and the content of your inquiry
• Information on your browsing of the Site: identifiers such as cookies, IP address, pages viewed, date and time of viewing, referrer, type of device and browser used, etc. (for details, see "Cookies and Access Analytics")

Please do not include special care-required personal information (such as race, creed, medical history, or criminal record) in your inquiries.

Purposes of Use

We use the personal information we obtain for the following purposes.

Inquiries

• Responding to inquiries and consultations, contacting you about them, and managing records of our responses
• Sending automatic reply emails confirming receipt of your inquiry
• Sharing the content of inquiries among the relevant staff within our company so that we can respond promptly (including notifications of receipt to our internal chat tool)

Document downloads

• Providing the documents you requested
• Providing information about our products and services, seminars, events, etc. (including sales communications by email, telephone, etc.)

Business meetings and transactions

• Business meetings, discussions, proposals, and estimates
• Communications relating to the conclusion and performance of contracts, delivery, invoicing, payment, and other transactions, and the management of business partners
• Providing information about our products and services, seminars, events, etc.

Operation of the Site

• Analyzing and improving use of the Site, and considering new content and services
• Ensuring stable operation of the Site, responding to failures, preventing unauthorized access and misuse, and ensuring security

General

• Complying with laws and regulations, and responding to lawful requests from courts, administrative agencies, etc.
• Operations incidental to the above purposes of use

Of the communications we send, emails for advertising or promotional purposes are sent, in accordance with the Act on Regulation of Transmission of Specified Electronic Mail and other laws and regulations, to persons who have given prior consent and to others as permitted by law. You may ask us to stop these communications at any time by following the instructions in each email or by contacting the "Contact Point for Inquiries."
If we handle personal information beyond the scope necessary to achieve the purposes of use above, we will obtain the individual's prior consent, except where permitted by law. We will not use personal information in a manner that may encourage or induce illegal or improper conduct.
We retain personal data for the period necessary to achieve the purposes of use, and endeavor to delete it without delay once it is no longer needed.

Provision to Third Parties

We will not provide personal data to third parties without the prior consent of the individual concerned, except in the following cases.

• Where required by law
• Where it is necessary to protect the life, body, or property of a person and it is difficult to obtain the individual's consent
• Where it is especially necessary to improve public health or promote the sound development of children and it is difficult to obtain the individual's consent
• Where it is necessary to cooperate with a national government agency, a local government, or a person entrusted by either of them in performing affairs prescribed by law, and obtaining the individual's consent is likely to impede the performance of those affairs
• Other cases permitted under the APPI or other laws and regulations

In the following cases, the recipient of personal data is not deemed to be a third party.

• Where we entrust all or part of the handling of personal data to another party within the scope necessary to achieve the purposes of use (see "Outsourcing")
• Where personal data is provided in connection with the succession of business due to a merger, company split, business transfer, or other reason

Provision to third parties in foreign countries is governed by "Provision to Third Parties in Foreign Countries."

Outsourcing

We may entrust all or part of the handling of personal data to outside service providers within the scope necessary to achieve the purposes of use. In such cases, we select providers recognized as handling personal information appropriately, set out matters concerning the handling of personal data — such as security control measures, confidentiality, and conditions for subcontracting — in an outsourcing agreement or similar document, and exercise necessary and appropriate supervision over the contractors.
Our main outsourced operations are as follows.

• Sending emails relating to inquiries and document requests (email delivery service)
• Operating the Site and storing data (cloud services)
• Internal notifications of incoming inquiries (internal chat tool)

For contractors located in foreign countries, please also see "Provision to Third Parties in Foreign Countries."

Provision to Third Parties in Foreign Countries

We use cloud services and similar services provided by businesses located in foreign countries, to the extent necessary to achieve the purposes of use. In connection with that use, we may provide personal data to third parties in foreign countries or store it on servers located in foreign countries.

Method of provision

When we provide personal data to a third party in a foreign country, we do so by one of the following methods.

• We provide the data after confirming, by contract or other appropriate and reasonable means, that the recipient has established a system necessary to continuously take measures equivalent to those that a business handling personal information is required to take under the APPI ("equivalent measures").
• Otherwise, except where permitted by law, we provide the data with the individual's consent, after first providing the individual with information on the name of the foreign country where the recipient is located, the personal information protection system of that country, and the measures the recipient takes to protect personal information.

Measures to ensure the continuous implementation of equivalent measures

Where we provide data after confirming that such a system has been established, we periodically (in principle, at least once a year) check how the recipient is implementing the equivalent measures and whether there are any systems in the foreign country that may affect their implementation. If any problem arises in implementing the equivalent measures, we take necessary and appropriate action, and if it becomes difficult to ensure their continuous implementation, we stop providing personal data to that recipient.
Upon request from the individual, we will provide information on these measures through the "Contact Point for Inquiries." However, we may withhold all or part of that information if providing it is likely to significantly hinder the proper conduct of our business.

Main external services and the countries where their providers are located (as of October 2026)

• Google Cloud (United States): operation of the Site and storage of access logs
• Google Analytics (United States): access analytics for the Site
• Google Workspace (United States): sending and receiving email, business communications, and storage of documents
• Slack (United States): internal notifications of incoming inquiries and document download requests (including the content of inquiries)
• SMTP2GO (New Zealand): sending emails relating to inquiries and document requests (notifications of receipt sent to us and automatic reply emails sent to you)

The countries where the servers that store and process personal data are located are determined by each provider's operations and may span multiple countries outside Japan, so it is difficult for us to identify all of them. The list above shows the countries where the provider of each service is located.

Personal information protection systems in foreign countries

An overview of each country's system is available in the "Survey on Personal Information Protection Systems in Foreign Countries" published by the Personal Information Protection Commission. Overviews for the main countries are as follows.

• United States: There is no comprehensive federal law on the protection of personal information; personal information is protected by sector-specific federal laws and by state laws (such as the California Consumer Privacy Act).
• New Zealand: The Privacy Act 2020 is in place as a comprehensive law on the protection of personal information.

Security Control Measures

We take the following measures to prevent leakage, loss, or damage of the personal data we handle and otherwise to ensure its security.

• Establishment of a basic policy: To ensure the proper handling of personal data, we have established and published this Policy.
• Rules on handling: We have established internal handling rules that set out, for each stage — acquisition, use, storage, provision, deletion and disposal, etc. — the handling methods, the persons responsible and in charge, and their duties.
• Organizational security measures: We have appointed a person responsible for the handling of personal data, clarified which employees handle personal data and the scope of the personal data they handle, and established a system for reporting to the responsible person when we become aware of any fact or sign of a violation of laws or internal rules.
• Human security measures: We regularly train employees on matters to note in handling personal data, and have set out confidentiality obligations concerning personal data in our work rules and similar documents.
• Physical security measures: We take measures to prevent unauthorized persons from viewing personal data in areas where it is handled, and to prevent the theft or loss of equipment, electronic media, documents, etc. used to handle personal data.
• Technical security measures: We use access controls to limit the persons who handle personal data and the scope of the data they handle, identify and authenticate users, and have introduced communication encryption and mechanisms that protect our information systems from unauthorized access and malicious software.
• Understanding the external environment: When we handle personal data in a foreign country (including when we store personal data using cloud services provided by foreign businesses), we take security control measures based on an understanding of that country's system for the protection of personal information. The main countries concerned are the United States and New Zealand. For details, see "Provision to Third Parties in Foreign Countries."

If a leak or other incident involving personal data occurs or may have occurred, we will report it to the Personal Information Protection Commission, notify the individuals concerned, and take other steps in accordance with the APPI.

Procedures for Requests for Disclosure, etc. of Retained Personal Data

When the individual concerned or their agent makes any of the following requests regarding retained personal data held by us ("requests for disclosure, etc."), we will respond without delay in accordance with the APPI.

• Notification of the purposes of use
• Disclosure (by the method the individual specifies from among provision of electronic records, delivery of paper documents, and other methods we prescribe)
• Disclosure of records of provision to third parties
• Correction, addition, or deletion of content
• Suspension of use or erasure
• Suspension of provision to third parties

How to make a request

Please contact us at the email address listed under "Contact Point for Inquiries," stating the type of request, information to identify the retained personal data concerned (such as when you contacted us or the email address you registered), your name, and your contact details. We will then let you know the prescribed request form and other details of the procedure.

Identity verification

To confirm that a request comes from the individual concerned, we may ask you to confirm that you are contacting us from your registered email address, or to submit a copy of a driver's license, passport, or other official identification document. When submitting identification documents, please conceal your registered domicile (honseki), Individual Number (My Number), and any other information that is not needed for the request.

Requests by agents

A legal representative of a minor or an adult ward, or an agent authorized by the individual to make requests for disclosure, etc., may make a request on the individual's behalf. In this case, in addition to identification documents for both the individual and the agent, you must submit documents confirming the agent's authority (such as a power of attorney or a certified copy of the family register).

Fees

We do not charge fees for requests for disclosure, etc.

How we respond

We respond to requests for disclosure by the method the individual specifies. However, if disclosure by that method would involve considerable expense or would otherwise be difficult, we will respond by delivering paper documents and inform you accordingly. We respond to other requests by email in principle.

When we cannot comply with a request

We may be unable to comply with all or part of a request in any of the following cases. In that case, we will notify you and give our reasons.

• Where we cannot verify that the requester is the individual concerned or their agent
• Where the information concerned does not constitute retained personal data held by us
• Where disclosure is likely to harm the life, body, property, or other rights or interests of the individual or a third party
• Where disclosure is likely to significantly hinder the proper conduct of our business
• Where disclosure would violate other laws or regulations
• Where a request for correction, etc., suspension of use, etc., or suspension of provision to third parties does not meet the requirements set out in the APPI (including cases where suspension of use, etc. would involve considerable expense or the like, and we take necessary alternative measures to protect the individual's rights and interests)

Cookies and Access Analytics

To understand how the Site is used and to help improve it, the Site uses Google Analytics (Google Analytics 4), an access analytics tool provided by Google LLC. Google Analytics uses cookies and similar technologies to send the following information from your browser to Google LLC.

• URLs of pages viewed, date and time of viewing, and the referring (linking) page
• Type of device, OS, and browser used, screen size, and language settings
• IP address (and the approximate region estimated from it)
• Identifiers recorded in cookies, etc., and the history of your interactions within the Site

We use this information to understand, analyze, and improve how the Site is used. For how Google handles data, see "How Google uses information from sites or apps that use our services" (https://policies.google.com/technologies/partner-sites).
If you do not want information to be collected by Google Analytics, you can disable it using the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout?hl=en). You can also disable cookies in your browser settings. In that case, some features of the Site may not be available.
This information does not by itself identify a specific individual. If we use this information by matching it with personal information obtained through inquiries or otherwise, we will treat it as personal information in accordance with this Policy.

Server access logs

The Site is operated on Google Cloud. When you access the Site, your IP address, date and time of access, URLs viewed, referrer, browser type (user agent), and similar information are automatically recorded as access logs. We use access logs to ensure the stable operation of the Site, respond to failures, prevent unauthorized access, and ensure security, and we retain them for 30 days and then delete them.

Map display

On our company profile page, we embed Google Maps, provided by Google LLC, to show our location. When the map is displayed, information such as your IP address, browser type, and the URL of the page viewed is sent to Google LLC. For how Google handles information, see Google's Privacy Policy (https://policies.google.com/privacy).

Personal Information of Minors

The Site is intended mainly for corporate customers. If you are a minor and provide personal information to us through the Site, please do so with the consent of a person with parental authority or another legal representative.

Revisions to This Policy

We may revise this Policy as necessary, for example in response to amendments to laws and regulations or changes in our business. Unless a separate effective date is specified, the revised Policy takes effect when it is posted on the Site.
Any change to the purposes of use will be made within the scope reasonably considered to be related to the purposes before the change, and we will notify individuals of, or publicly announce, the changed purposes by posting them on the Site or by other means. For significant changes, we will give clear notice on the Site.

Contact Point for Inquiries

For questions about this Policy, complaints or consultations regarding our handling of personal information, and requests for disclosure, etc., please contact us as follows.