Local Deviations - Japan

Date last revised: November 1, 2026

These Local Deviations apply, together with the “TIER IV Privacy Policy” (the “Policy”), to the handling of personal information of individuals residing in Japan or to which the Act on the Protection of Personal Information of Japan (the “APPI”) applies. With respect to the handling of video, driving data and sensor data on public roads, private land, test sites and other locations for which TIER IV, Inc. is responsible in Japan as a business operator handling personal information, the separately and independently published “Notice on the Recording and Use of Video and Driving Data on Public Roads and Other Locations” supplements these Local Deviations. In the event of any inconsistency or conflict among the Policy, these Local Deviations and that Specific Notice, these Local Deviations or that Specific Notice, whichever sets out the more specific handling, prevails to the extent required by Japanese law.

Applicable TIER IV Group Companies in Japan

The companies covered by these Local Deviations are TIER IV, Inc. and Human Dataware Lab. Co., Ltd. (collectively, the “Covered Companies”). In these Local Deviations, “we”, “us” and “our” refer to the Covered Company or Companies responsible, as a business operator handling personal information under the APPI, for a particular handling of personal information. More than one Covered Company may each be responsible for a particular handling.

TIER IV, Inc.
Jacom Building, 1-12-10 Kitashinagawa, Shinagawa-ku, Tokyo 140-0001, Japan
Information on the representative is available here.

Human Dataware Lab. Co., Ltd.
Nagoya University TOIC, Furo-cho, Chikusa-ku, Nagoya, Aichi 464-0814, Japan
Information on the representative is available here.

Purposes of Use of Personal Information (Japan)

We use the personal information described in “Personal Data We Collect” in the Policy to the extent necessary for the purposes described in “Purposes of and Legal Bases for Processing Personal Data” in the Policy. Where we acquire personal information directly from you in writing or in an electronic or magnetic record, we will clearly indicate the purposes of use in advance, except where a statutory exception applies. We may also separately notify you of, or publicly announce, more specific purposes of use in the context of particular products, services, field trials, recruitment or other situations.

Joint Use

We may jointly use, within the TIER IV Group and to the extent set out below, personal data that actually needs to be used jointly, depending on the actual circumstances of the particular handling. Not all joint users always use all of the personal data described below.

Items of personal data jointly used: such information described in “Personal Data We Collect” in the Policy as is necessary to achieve the purpose of the particular joint use (including names, contact and affiliation information, account and authentication information, transaction and contract information, sales, public relations and event information, service usage information, technical identifiers and metadata, recruitment information, and recruitment and employment eligibility information)
Scope of joint users: TIER IV, Inc., Tier IV North America Inc. and Human Dataware Lab. Co., Ltd.
Purposes of joint use: such of the following purposes as are necessary for the particular joint use: provision and support of products and services, research and development, field trials, joint research, contract development, business development and customer acquisition, information security, accident and failure response, customer and business partner management, sales and public relations, group management, recruitment, accounting, tax, legal, audit and compliance, responding to legal claims, and other purposes described in the Policy
Person responsible for management of the jointly used personal data: TIER IV, Inc.
Jacom Building, 1-12-10 Kitashinagawa, Shinagawa-ku, Tokyo 140-0001, Japan
Information on the representative is available here.

Since the APPI provisions on provision to third parties in a foreign country may apply to joint use with Tier IV North America Inc. and other provision of personal data to joint users in a foreign country, we take the necessary measures in accordance with “Provision of Personal Data to Third Parties in a Foreign Country” below.

Provision of Personal Data to Third Parties in a Foreign Country

We may provide personal data to third parties in a foreign country (meaning a country or region outside Japan) in the following cases.

[Where personal data is provided to a third party based on your consent]

Where the recipient of personal data is a third party in a foreign country, we handle personal data within the scope set out in “Sharing and Disclosure of Personal Data” in the Policy and take the necessary measures in accordance with the APPI.
When providing personal data to a third party in a foreign country, we confirm the personal information protection system in the recipient’s country and other necessary matters, and take the necessary measures, in accordance with the APPI.

[Where the handling of personal information is outsourced]

Outsourcing contractors to which we outsource all or part of the handling of personal information may be located in a foreign country. In such cases, we take the necessary measures in accordance with the APPI, such as confirming that the contractor has established a system that conforms to the standards prescribed under the APPI. Upon your request, we will provide the information prescribed under the APPI.

[Where personal data is provided in connection with the succession of business due to a merger or other reason]

The successor to a business due to a merger or other reason may be a business operator located in a foreign country. In such cases, the personal data will be handled within the scope of the purposes of use before the succession.

Security Control Measures We Have Taken

To protect retained personal data against unauthorized or unlawful use, alteration, unauthorized access or disclosure, and accidental or intentional destruction and loss, we take necessary and appropriate security control measures according to the nature of the personal data and the purposes and risks of the handling. If you request details, we will explain them to the extent that doing so does not interfere with our security controls.

Organizational security measures
We establish basic policies and rules on the handling of personal data, designate persons responsible for the handling of personal data, and establish a reporting and communication system for cases where we become aware of facts or indications of violations of laws or internal rules, and other necessary management systems.
Human security measures
We provide our officers and employees with necessary education and training on the proper handling of personal data, and inform them of confidentiality and other matters necessary for the protection of personal data.
Physical security measures
We appropriately control entry to areas where personal data is handled, and take the measures necessary to prevent theft, loss and the like of equipment, electronic media, documents and other items used to handle personal data.
Technical security measures
We appropriately manage access rights to personal data and take the measures necessary to protect information systems that handle personal data from unauthorized external access and malicious software.
Understanding the external environment
When handling personal data in a foreign country, we take necessary and appropriate security control measures after understanding the personal information protection system and other relevant systems of that foreign country. Upon your request, we will respond without delay, through the “Contact Point for Requests and Inquiries” below, regarding the name of any foreign country in which we handle personal data and the measures we have taken in light of the systems of that foreign country.

Matters Made Public regarding Retained Personal Data

The names and addresses of the Covered Companies, their representatives, the purposes of use described in the Policy, the procedures for requests for disclosure, etc., the security control measures and where to submit complaints are as described in these Local Deviations and the Policy.

Requests for Disclosure, etc. of Retained Personal Data

With respect to your retained personal data or records of provision to third parties held by us, you or your duly authorized agent may make the following requests under the APPI:

Notification of the purposes of use
Disclosure of retained personal data
Disclosure of records of provision to third parties
Correction, addition or deletion where the content is not factual
Cessation of use, erasure or cessation of provision to third parties where the statutory requirements are met

Disclosure will be made by the method you specify, whether by electronic or magnetic record or otherwise, except where disclosure by that method would be difficult. If we do not comply with all or part of a request, we will notify you of that fact and the reasons.

How to make a request
If you wish to make a request, please contact the contact point below. The common contact point will confirm the details of your request, and the Covered Company responsible for the particular handling will provide you with the prescribed request form and inform you of the identity verification documents, the documents verifying the authority of an agent in the case of a request made by an agent, and the method of submission. We may ask for additional information to the extent necessary to confirm the details of the request and to verify your identity.
Fees and responses
We may charge a fee, to the extent permitted by law, for requests for notification of the purposes of use or for disclosure. We will respond within a reasonable period after completing the necessary verification. Responses may take longer due to postal delivery, identity verification or other circumstances.

Contact Point for Requests and Inquiries

Inquiries regarding these Local Deviations, the handling of personal information, complaints or requests for disclosure, etc. are received at the TIER IV, Inc. contact point below, which serves as the common contact point for the Covered Companies. Depending on the nature of the inquiry, the Covered Company responsible for the particular handling will respond.

TIER IV, Inc. Personal Information Contact Desk
Jacom Building, 1-12-10 Kitashinagawa, Shinagawa-ku, Tokyo 140-0001, Japan
Email: personalinfo@tier4.jp

Specific Notice on the Recording and Use of Video and Driving Data on Public Roads and Other Locations

For the handling of video, driving data and sensor data that TIER IV, Inc. collects, itself or through outsourcing contractors, using vehicles, cameras, LiDAR and other devices on public roads, private land, test sites and other locations, and for which it is responsible as a business operator handling personal information, please refer to the separately published “Notice on the Recording and Use of Video and Driving Data on Public Roads and Other Locations”. That notice is an independent Specific Notice supplementing these Local Deviations.