Policy on Protection of
Personal Data of Employees Subject to
Overseas Data
Protection Laws
This Policy on Protection of Personal Data of Employees Subject to Overseas Data Protection Laws (this "Policy) applies to the processing by SoftBank Corp. (the "Company") of personal data of those who fall under any of the following (collectively, "Employees") and who are subject to foreign data protection laws ("Employee Personal Data"): officers and employees of the Company and its overseas group companies (including employees, contract employees, associate employees, temporary employees, accepted seconded employees, and dispatched employees from personnel agencies), persons who intend or intended to become an officer or employee of the Company ("Job Applicants"), and retirees of the Company and its overseas group companies.
With respect to the processing of personal data of Employees who are the Company's expatriate employees in the EEA or the United Kingdom (the "UK") ("Expatriates"), the privacy notice separately set forth for the processing of personal data of these Expatriates shall take precedence over this Policy; accordingly, please refer to that privacy notice.
In addition, regarding the handling of personal information of the Company's officers and employees in Japan, please refer to the privacy notice separately set forth for the handling of personal information of these officers and employees. For the handling of personal information of the Company's Job Applicants and retirees in Japan, please refer to the "Handling of Personal Information of Job Applicants and Retirees," respectively.
1. Controller for processing of Employee Personal Data
This Policy explains to Employees how the Company will collect and process Employee Personal Data as a controller where Employee Personal Data is provided or disclosed by Employees to the Company, or where Employee Personal Data is received or obtained by the Company through third parties. Please see Section 10 below for the Company's contact information. The Company will process Employee Personal Data in accordance with applicable data protection laws.
2. Purpose of collection and processing of
Employee Personal Data
Depending on the relationship between the Company and the relevant Employees, the Company may collect the following types of Employee Personal Data either directly from Employees or through third parties other than Employees (including the Company's affiliates, business partners, service providers, medical institutions, recruitment agencies, and recommenders), and process the data for the following purposes.
1) Personal data of
officers and employees
| Types of Personal Data | Specific Content | Purpose of Processing |
|---|---|---|
| Internally disclosed information | Name, employee ID number, department, position, from of employment, employee email address, information on business-use mobile device, etc. | For business communication |
| Basic information | Name, address, age, date of birth, gender, telephone number, facial photograph, passport information, criminal record, nationality, status of residence and authorization for employment, information on side jobs, etc. | For employment and personnel management, assignment (including secondment/transfer), preparation of employee register, payment of salaries/allowances, etc., provision of welfare benefits, social insurance-related procedures, re-employment, legally required procedures, and other employment management |
| Wage-related information | Annual income, monthly income, bonuses, etc., salary determination method, retirement benefits, various types of allowance, information on stock options, etc. | For determination and payment of salaries/allowances, etc., tax-withholding procedures, social insurance-related procedures, retirement benefits and welfare benefits, employees’ property accumulation promotion system, re-employment, and other employment management |
| Personnel information | Employee-performance evaluation, educational background, qualifications/licenses, job title, work history (including secondment), disciplinary actions and commendations, training attendance history, information on self-reporting for employee-performance evaluation, information on engagement surveys, etc. | For assessment of human resources, determination of where to assign Employees and their duties, secondment/transfer, training and development of abilities, promotion/demotion, disciplinary actions, implementation of measures for securing an appropriate working environment or improving the working environment, re-employment, legally required procedures, and other employment management |
| Information on families/relatives | Family composition, cohabitation/separation, home ownership, dependent status, health status, information on accompanying family members at the time of assigning Employees to overseas positions, etc. | For determination of salaries/allowances, etc., tax-withholding procedures, social insurance-related procedures, childcare/nursing-care leave, etc., welfare benefits, legally required procedures, and other employment management |
| Physical/Health information | Health conditions, medical history, physical/mental disabilities, results of medical examinations, stress checks, and questionnaire survey, etc. | For health management, implementation of measures for securing an appropriate working environment or improving the working environment, leave of absence and reinstatement, determination of where to assign Employees, management of working hours, payment of allowances, re-employment, and other employment management |
| Emergency contact information | Personal email address, information on personal-use mobile device, family connections/addresses/telephone numbers, information on temporary return or return for occasion of celebration/condolence of Employees assigned to overseas positions, etc. | For communication during leave, emergency communication, ensuring the safety of Employees, and other employment management |
| Information on working status | Attendance/absence records, operation records for PCs and business-use mobile phones lent by the Company, and information and logs of devices and accounts authorized by the Company and their records of use of internal networks, etc. | For management of working hours, business communication, securing an appropriate working environment, improvement of work efficiency, and other employment management |
2) Personal data of
job applicants
| Types of Personal Data | Specific Content | Purpose of Processing |
|---|---|---|
| Basic information | Name, address, age, date of birth, gender, telephone number, email address, facial photograph, status of residence and authorization for employment, etc. | For consideration and determination of acceptance or rejection of job applications, consideration/determination of employment conditions, response to inquiries, administrative communication, etc. |
| Wage-related information | Annual income, monthly income, bonuses, etc., salary determination method, job type, form of employment, etc. | |
| Personnel information | Educational background, qualifications/licenses, job title, work history, health conditions, disciplinary record, information contained in application documents such as resumes and letters of recommendation, etc. | |
| Information on families/relatives | Dependent status, emergency contact information, etc. |
3) Personal data of retirees
| Types of Personal Data | Specific Content | Purpose of Processing |
|---|---|---|
| Basic information | Name, address, age, date of birth, gender, telephone number, email address, facial photograph, employee ID number, etc. | For the creation of various types of HR data, legally required procedures, communication with Employees after retirement, etc. |
| Wage-related information | Annual income, monthly income, bonuses, etc., salary determination method, various types of allowance, information on stock options, job type, form of employment, retirement benefits, etc. | |
| Personnel information | Employee-performance evaluation, educational background, qualifications/licenses, job title, work history, disciplinary actions and commendations, etc. | |
| Information on families/relatives | Family composition, cohabitation/separation, etc. | |
| Physical/Health Information | Health conditions, medical history, physical/mental disabilities, results of medical examinations, etc. |
The Company will also process Employee Personal Data described above for the purpose of complying with applicable laws and regulations, responding to court orders and legal proceedings, or establishing, exercising or defending legal claims of the Company.
3. Legal basis for processing Employee Personal Data
The Company will process Employee Personal Data based on the following legal grounds:
- (1)Contract: When processing Employee Personal Data is necessary for the Company to fulfill a contract executed with an Employee, or to take pre-contractual steps based on an Employee’s request.
- (2)Legal obligations: When processing Employee Personal Data is necessary for the Company to comply with legal obligations.
- (3)Legitimate interests: When processing Employee Personal Data is necessary for legitimate interests pursued by the Company or third parties, such as [employment management for officers and employees, business/administrative communication, and recruitment activities]; provided that such interests are not overridden by an Employee’s rights under data protection laws.
- (4)Consent: If an Employee consents to the processing of Employee Personal Data.
If the Company processes personal data that falls under the category of sensitive data under applicable data protection laws, the Company will do so in accordance with the provisions of the relevant data protection laws, by means such as obtaining the explicit consent of the relevant Employee or ensuring that the circumstance falls under a case where the processing is permitted by law or regulation.
4. Disclosure of
Employee Personal Data
The Company may disclose Employee Personal Data to the following parties, within the extent of the purposes set forth in Section 2 above:
-
(1)
Subsidiaries and affiliatesThe Company may disclose Employee Personal Data to its subsidiaries and affiliates in Japan and overseas.
-
(2)
Service providersThe Company may disclose Employee Personal Data to third party service providers who provide the Company with specific services, such as providers of services relating to (i) IT/software (including the development/operation of systems related to the Company's services, as well as data servers and cloud services), (ii) human resources, payroll, and background checks, (iii) education/training, (iv) taking photos/printing, (v) reception/security, (vi) real estate, (vii) logistics/transportation, (viii) insurance, and (ix) collection and disposal of confidential documents.
-
(3)
Benefit providersThe Company may disclose Employee Personal Data to benefit providers such as health insurance societies, pension funds, life insurance companies, travel agencies, credit card companies, medical advisors, and companies related to the provision of company housing.
-
(4)
Customers and business partnersThe Company may disclose Employee Personal Data to its own or its group’s existing and potential customers and business partners (such as parties under business alliance with it or its group).
-
(5)
The Company's officers and employeesThe Company may disclose Employee Personal Data to the Company's officers and employees who have both the authority and need to access Employee Personal Data.
-
(6)
Law enforcement or judicial authorities, etc.The Company may disclose Employee Personal Data to third parties (e.g., regulators, government authorities, courts and lawyers) in relation to purposes such as complying with applicable legal obligations, responding to court orders and legal proceedings, and establishing, exercising or defending legal claims of the Company.
In accordance with the Personal Information Protection Act of Japan, the Company will jointly use personal data with the following parties:
a. Joint use for
business communication
| Scope of Personal Data Joint Users | SoftBank Group Corp., and other SoftBank Group companies |
|---|---|
| Purpose of Use by Joint Users | For business communication |
| Personal Data Items for Joint Use | Internally Disclosed Information in 1) of Section 2 above |
| Person Responsible for Management of Personal Data for Joint Use | The Company |
b. Joint use for
business operations
| Scope of Personal Data Joint Users | SoftBank Group Corp., SB Atwork Corp., and other SoftBank Group companies, companies with which secondment contracts have been executed, health insurance societies, welfare benefits handling companies, and labor unions |
|---|---|
| Purpose of Use by Joint Users | For employment management, providing welfare benefits, and support for services necessary for business |
| Personal Data Items for Joint Use | Personal data in 1) to 3) of Section 2 above |
| Person Responsible for Management of Personal Data for Joint Use | The Company |
5. Transfer of Employee Personal Data abroad
The Company may transfer Employee Personal Data to a third party located outside the country or region where the relevant Employee resides within the extent of the purposes set forth in Section 2 above. In such cases, the Company will comply with applicable data protection laws by means such as securing one of the following or obtaining the Employee’s consent:
- (1)The country or region to which Employee Personal Data will be transferred is designated as a country/region that ensures an adequate level of protection for the rights and freedoms of Employees with respect to Employee Personal Data under applicable data protection laws.
- (2)The third party has entered into a contract with the Company regarding the transfer of Employee Personal Data as required by applicable data protection laws.
6. Security control measures
In addition to establishing rules on the processing of personal data, including Employee Personal Data, the Company takes necessary and appropriate measures to prevent any leaks or loss of, or damage to the personal data to be processed, and otherwise to control the security of the personal data, such as periodic self-inspection of the status of processing personal data, periodic training regarding the processing of personal data, prevention of theft or loss of equipment for processing personal data, and implementation of access controls. The Company also exercises appropriate supervision over its service providers and officers and employees who process personal data.
7. Retention period of personal data
The Company will retain Employee Personal Data for the period necessary for the purpose for which it will be processed. However, this does not apply if the Company is required by laws and regulations to retain Employee Personal Data for a longer period of time, in which case the Company will retain such Employee Personal Data for the period of time required by laws and regulations.
8. Rights of employees
Employees have several legal rights in relation to Employee Personal Data held by the Company about them. These rights may vary depending on where Employees are located and which data protection laws apply to the relationship between Employees and the Company, but typically include the following.
- (1)The right to obtain information regarding the processing of Employee Personal Data about Employees, and the right to access Employee Personal Data about Employees held by the Company.
- (2)The right to request that the Company correct Employees Personal Data of Employees if the data is inaccurate or incomplete.
- (3)The right to request that the Company erase Employee Personal Data in certain circumstances.
- (4)The right to request that the Company restrict the processing of Employee Personal Data in certain circumstances.
- (5)The right to object to the Company's processing of Employee Personal Data.
- (6)The right to receive Employee Personal Data in a structured, commonly used, and machine-readable format and/or to request that the Company directly transmit that Employee Personal Data to a recipient, where doing so is technically feasible.
- (7)If the Company processes Employee Personal Data on the basis of the relevant Employee’s consent, the right to withdraw such consent at any time (however, withdrawal of consent does not affect the lawfulness of processing of Employee Personal Data before its withdrawal).
Employees may exercise any of their rights by contacting the Company at its contact point set forth in Section 10 below. Employees also may lodge a complaint with the relevant data protection authority if they believe that the Company has infringed any of Employees’ rights.
9. Disclosure, correction, etc., and suspension of use under the Act on the Protection of Personal Information of Japan
1) Procedures for disclosure, correction, suspension of use, etc. of Employee Personal Data
- The Company will send an "Application Form for Disclosure of Personal Data" prescribed by the Company, together with a procedural guide stating the address to which the application form should be sent, the prescribed fees and the payment method (in the case of requests involving notification of purpose of use or disclosure), to Employees who requested "Notification of Purpose of Use," "Disclosure," "Correction, Addition, or Deletion" ("Correction, etc."), "Suspension of Use, Erasure, or Suspension of Provision to Third Parties" ("Suspension of Use, etc.") at the contact point set forth in Section 10 below.
- Employees who receive such application form, etc. shall (in case of requests involving notification of purpose of use or disclosure, pay the prescribed fees in the manner designated by the Company as set forth in the procedural guide, and) send the completed application form (with the required information) and the identity verification documents designated by the Company to the mailing address for the application form. For proxy applications, Employees must also provide proxy verification documents.
- The Company will commence the procedures upon receiving the completed application form (with the required information) and the identity verification documents at the contact point of the mailing address for the application form designated by the Company, and in the case of requests involving notification of purpose of use or disclosure, confirming that the prescribed fees have been paid. The Company will respond appropriately to requests from Employees in accordance with the Act on the Protection of Personal Information of Japan. However, if any of the following applies, the Company may refuse to respond to all or part of requests for disclosure by Employees:
- When responding poses a risk of harming the life, body, property, or other rights and interests of the data subject or a third party.
- When responding poses a risk of significantly interfering with the proper execution of the Company's business.
- When responding would result in a violation of other laws and regulations.
2) Fees for notification of purpose of use or disclosure of
Employee Personal Data and payment method thereof
The fees for notification of purpose of use or disclosure of Employee Personal Data is 1,000 yen (excluding tax) per application. However, the Company may waive the fees in cases specifically permitted at its discretion.
Fees shall be paid in the manner designated by the Company.
10. Contact information
of the Company
If Employees have any questions about this Policy, their rights, or other matters regarding personal data protection, they may contact the Company at:
| Contact Point | Employee Personal Data Inquiry Desk, Human Resources & General Affairs Division, SoftBank Corp. Kaigan 1-7-1, Minato-ku, Tokyo 105-7529 |
|---|---|
| Web Inquiry Form | https://forms.gle/pKE6jtgyBAc6QK1s6 |
Supplementary provisions
- The previous "Policy on Protection of Personal Data of Employees Subject to GDPR" has been revised, and these revised provisions shall apply as from October 31, 2025.
Addendum
Processing of Employee Personal Data
in the EEA /the UK
This Addendum applies to Employees in the EEA and the UK. It supplements the content of this Policy and supersedes any conflicting provisions of this Policy.
1. Legal basis for
processing personal data
The legal basis on which the Company relies for each purpose of processing Employee Personal Data set forth in Section 2 of this Policy is as follows.
When the Company processes special categories of personal data, the Company will rely on the explicit consent of Employees, the exercise of rights or the performance of obligations in the field of employment or social security, the establishment, exercise, or defense of legal claims, or substantial public interests under laws and regulations, as the legal basis for processing such Employee Personal Data. When the Company processes personal data relating to criminal offences, it will do so only as permitted by applicable laws and regulations.
1) Personal data of
officers and employees
| Types of Personal Data | Specific Content | Purpose of Processing | Legal Basis |
|---|---|---|---|
| Internally Disclosed Information | Name, employee ID number, department, position, form of employment, employee email address, information on business-use mobile device, etc. | For business communication | Legitimate interests |
| Basic Information | Name, address, age, date of birth, gender, telephone number, facial photograph, passport information, criminal record, nationality, status of residence and authorization for employment, information on side jobs, etc. | For employment and personnel management, assignment (including secondment/transfer), preparation of employee register, payment of salaries/allowances, etc., provision of welfare benefits, social insurance-related procedures, re-employment, legally required procedures, and other employment management | Contract, legal obligations, or legitimate interests |
| Wage-related Information | Annual income, monthly income, bonuses, etc., salary determination method, retirement benefits, various types of allowance, information on stock options, etc. | For determination and payment of salaries/allowances, etc., tax-withholding procedures, social insurance-related procedures, retirement benefits and welfare benefits, employees’ property accumulation promotion system, re-employment, and other employment management | Contract, legal obligations, or legitimate interests |
| Personnel Information | Employee-performance evaluation, educational background, qualifications/licenses, job title, work history (including secondment), disciplinary actions and commendations, training attendance history, information on self-reporting for employee-performance evaluation, information on engagement surveys, etc. | For assessment of human resources, determination of where to assign Employees and their duties, secondment/transfer, training and development of abilities, promotion/demotion, disciplinary actions, implementation of measures for securing an appropriate working environment or improving the working environment, re-employment, legally required procedures, and other employment management | Legitimate interests |
| Information on Families/Relatives | Family composition, cohabitation/separation, home ownership, dependent status, health status, information on accompanying family members at the time of assigning Employees to overseas positions, etc. | For determination of salaries/allowances, etc., tax-withholding procedures, social insurance-related procedures, childcare/nursing-care leave, etc., welfare benefits, legally required procedures, and other employment management | Contract, legal obligations, or legitimate interests |
| Physical/Health Information | Health conditions, medical history, physical/mental disabilities, results of medical examinations, stress checks, and questionnaire survey, etc. | For health management, implementation of measures for securing an appropriate working environment or improving the working environment, leave of absence and reinstatement, determination of where to assign Employees, management of working hours, payment of allowances, re-employment, and other employment management | Legal obligations, legitimate interests, or consent |
| Emergency Contact Information | Personal email address, information on personal-use mobile device, family connections/addresses/telephone numbers, information on temporary return or return for occasion of celebration/condolence of Employees assigned to overseas positions, etc. | For communication during leave, emergency communication, ensuring the safety of Employees, and other employment management | Legitimate interests |
| Information on Working Status | Attendance/absence records, operation records for PCs and business-use mobile phones lent by the Company, and information and logs of devices and accounts authorized by the Company and their records of use of internal networks, etc. | For management of working hours, business communication, securing an appropriate working environment, improvement of work efficiency, and other employment management | Legal obligations, legitimate interests, or consent |
2) Personal data of job applicants
| Types of Personal Data | Specific Content | Purpose of Processing | Legal Basis |
|---|---|---|---|
| Basic Information | Name, address, age, date of birth, gender, telephone number, email address, facial photograph, status of residence and authorization for employment, etc. | For consideration and determination of acceptance or rejection of job applications, consideration/determination of employment conditions, response to inquiries, administrative communication, etc. | Contract or legitimate interests |
| Wage-related Information | Annual income, monthly income, bonuses, etc., salary determination method, job type, form of employment, etc. | Contract or legitimate interests | |
| Personnel Information | Educational background, qualifications/licenses, job title, work history, health conditions, disciplinary record, information contained in application documents such as resumes and letters of recommendation, etc. | Contract, legitimate interests, or consent | |
| Information on Families/Relatives | Dependent status, emergency contact information, etc. | Contract or legitimate interests |
3) Personal data of retirees
| Types of Personal Data | Specific Content | Purpose of Processing | Legal basis |
|---|---|---|---|
| Basic Information | Name, address, age, date of birth, gender, telephone number, email address, facial photograph, employee ID number, etc, | For the creation of various types of HR data, legally required procedures, communication with Employees after retirement, etc. | Legitimate interests |
| Wage-related Information | Annual income, monthly income, bonuses, etc., salary determination method, various types of allowance, information on stock options, job type, form of employment, retirement benefits, etc. | Contract, legal obligations, or legitimate interests | |
| Personnel Information | Employee-performance evaluation, educational background, qualifications/licenses, job title, work history, disciplinary actions and commendations, etc. | Legitimate interests | |
| Information on Families/Relatives | Family composition, cohabitation/separation, etc. | Legitimate interests | |
| Physical/Health Information | Health conditions, medical history, physical/mental disabilities, results of medical examinations, etc. | Legitimate interests or consent |
The Company will also process Employee Personal Data described above for the purpose of complying with applicable laws and regulations, responding to court orders and legal proceedings, or establishing, exercising or defending legal claims of the Company (legal basis: legitimate interests or legal obligations).
2. Transfer of
Employee Personal Data
outside the EEA or the UK
The Company may transfer Employee Personal Data to a third party located outside the EEA or the UK. When the Company transfers Employee Personal Data to a third party outside the EEA or the UK, the Company will secure one of the following:
- (1)The country or region to which Employee Personal Data will be transferred is designated by the European Commission or the UK Government as a country/region that ensures an adequate level of protection for the rights and freedoms of Employees with respect to Employee Personal Data.
- (2)The third party has entered into the Standard Contractual Clauses (SCC) with the Company that have been approved by the European Commission or the UK Government.
Employees can find out more about the protection provided to them when Employee Personal Data is transferred outside the EEA or the UK, by contacting the Company's contact point set forth in Section 10 of this Policy.