REVOLUT TECHNOLOGIES JAPAN, Inc. (hereafter referred to as the "Company" or "Revolut") complies with all applicable laws and regulations of Japan and other relevant countries for the protection of Personal Information. The Company strives for handling and protection of Personal Information appropriately (including Specific Personal Information such as Individual Number (hereafter referred to as "My Number") of its customers who are users of Revolut services (hereafter referred to as the "Users") pursuant to this Privacy Policy.

Unless otherwise specified herein, defined terms used in this Privacy Policy are given the same meanings as provided in the "Personal Information Protection Act" (hereinafter referred to as the "PIP Act") and the"Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures" (hereinafter referred to as the "My Number Act").

1. Procurement of Personal Information

The Company shall acquire Personal Information in a lawful and fair manner and only to the extent necessary for the provision of its services. The Company shall establish a system to effectively manage and control Personal Information it owns .

2. Use of Personal Information and Purpose of Usage

The Company shall use Personal Information within the scope of use as published, notified or specified when it is so obtained and shall not use for any other purpose .

[Purposes of Use]

(1) To conduct KYC (know-your-customer) proceduresin the course of creating User accounts;

(2) To offer services onour platform, such as transferring Users' bankdeposits to Revolut accounts, money exchange, money transfer, making refundsto Users, and the like;

(3) The provide answers to, or respond to inquiries or consultations by, the Users;

(4) To introduce and publicise to the Users the services of the Company and the Group (as defined in 5. below);

(5) Tomonitor and analyse howRevolut services are used for quality purposes;

(6) To conduct market research with respect to products andservicesof the Company and the Group and to research and develop financial products andservices by data analysis and questionnaire etc.:

(7) To provide maintenance and support for the services of the Company and the Group:

(8) To notify changes or updates of rules, agreements, regulations, guidelines, risk factors, policies, warnings and other rules (collectively, the "Rules") related to the services of the Company and the Group:

(9) To comply with laws and regulations regarding account utilisation by the Users (including responding to enquiries on and drafting and submitting to suspicious transaction reports to relevant authorities) ;

(10) To producebackup data necessary to provide Revolut services;

(11) To issue a warning or take disciplinary action, etc. against a User who has, or is at risk of having, breached the Rules;

(12) To conduct internal audits for the Company or the Group;

(13) To contact users incase ofemergency;

(14) To perform work incidental to the above mentioned purposes and offer other services permitted to fund transfer service providers (including any potential business in future), and produce relevant legal and operational records ;

(15) Forrecruitment purposes; and

(16) Any other reason as required by law or regulations (including submission of information or reports as required by relevant authorities of the Company and the Group) .

Not withstanding the purposes mentioned above, My Number and other Specific Personal Information are used only to the extent permitted by the My Number Act with appropriate security measures and system, which Revolut shall establish and maintain.

3. Changing the Purpose of Use

The Company may change the Purposes of Use (as set out in 2. above) to the extent deemed sufficiently relevant and reasonable and the Company shall notify or make an announcement to the Users when it makes changes.

4. Restrictions on Use of Personal Information

Except where permitted by the PIP Act and other laws and regulations, the Company shall not use Personal Information outside of the scope as required to achieve the Purposes of Use, without obtaining the User's consent. This shall not apply to the following cases;

  • When required or permitted by laws or regulations;
  • When necessary to protectlife, body, or property of an individual, and it is difficult to obtainUser's consent;
  • Where necessary to addresspublic health orsound development of children, and it is difficult to obtainUser's consent; and
  • When necessary to cooperate with a government institution, local government, or an individual or entity retained thereby to performduties or other execution set forth in a law or regulation, there is a risk that obtaining the User's consent would hamper the due performanceof such matters.

5. Joint use of Personal Information among Group Companies

Within the scope of the Purpose of Use, the Company and the group companies set forth below (hereafter referred to as the "Group") may jointly use Personal Information of the Users (excluding My Numbers). However, this shall not apply to the cases where the consent of Users is required by law or regulation .

[Our Groupas joint users]

  • Revolut Ltd (United Kingdom)    
  • Revolut Bank UAB
  • Revolut Holdings US Inc.
  • Revolut Payments Australia Pty Ltd
  • Revolut Payments Ireland Limited
  • Revolut Payments UAB
  • Revolut Technologies Ltd (Canada)
  • Revolut Technologies Singapore Pte. Ltd.
  • Other subsidiaries and affiliates of Revolut Ltd.

6. Outsourcing

To the extent necessary to achieve the Purpose of Use, the Company may wholly or partly outsource its handling of Personal Information to a third party. If the Company uses an external vendor or subcontractor, the Company shall choose an entity which will handle Personal Information pursuant to all applicable laws and regulations of Japan and other relevant jurisdictions. Such appointment shall be within the scope of the Purpose of Use. Upon entering into an outsourcing agreement, the Company shall agree to the terms of handling Personal Information with such vendors and appropriately oversight their operation.

7. Provision of Personal Information to Third Party

The Company, in principle, shall not provide Personal Data to any third party. However, where permitted by laws and regulations or consent of the Users obtained to provide Revolut services, the Company may provide Personal Information (excluding My Numbers and Sensitive Information) to third parties in the form of complying with laws and regulations.

My Numbers and Sensitive Information shall not be provided to third unless permitted by laws and regulations.

8. Management of Personal Information

  • The Company Implements appropriate safety measures to keep Users' Personal Information accurate and up-to-date
  • The Company implements appropriate measures to prevent unauthorized access such as minimizing accessto User's' Personal Information.
  • To prevent loss, destruction, falsification and leakage of Personal Information and other material information, the Company implements appropriate security measures including countermeasures for unauthorized access andcomputer viruses and establishes and upgrades cybersecurity.
  • The Company limits the departments that handle Users' Personal Information and grants minimumaccess along the Purpose of Use.
  • The Company oversees the operations of external vendors and subcontractors handling Personal Information as needed to ensure the same level of safety measures are implemented.

9. Disclosure/Rectification/Suspension of Usage/Deletion based on the Request fromthe User

Where a User makes a request for disclosure, recertification, suspension of use, deletion or suspension of provision to third parties of his/her Personal Information, or asks the Company whether it holds his/her Personal Information, the Company shall, upon verification of the identity of the requester, respond in accordance with the procedures prescribed by the Company, unless there are special or regulatory reasons not to do so.

Furthermore, a User may verify and correct his/her Personal Information held by the Company on the Revolut app or website on the user information page. Fees may be charged if a User asks the Company to disclose or rectify his/her information on the system..

10. Contact Information

For requests for disclosure, rectification, suspension of use, deletion of Personal Information or any questions, please contact the following.

dpo@revolut.com

Business hours:9:00 〜 17:00

(Closed on Saturday, Sunday, public holidays, and Year-end / New Year holidays)

11. Voluntarily provision

The Company shall obtain Users' Personal Information on this platform upon opening an account or using Revolut services as required by laws and regulations. The Company may request additional Personal Information which is necessary to provide Revolut services. Generally, provision of additional Personal Information is on a voluntary as opposed to compulsory basis. However, the Company may not be able to provide its services if not provided.

12. Acquisition of the Personal Information by a method that the User cannot easily recognize

When applying for the Company service, certain information that does not identify individuals may be automatically collected through cookies, Internet tags, web beacons etc. Such information may be provided to third parties, but shall not be used to identify any individual by such third parties.

13. Exclusion of liability

The Company shall take stringent measures to protect Personal Information from outside attacks or threats, but is always exposed to such attacks and threats. The Company can not fully guarantee the effectiveness of its security measures or ability to prevent unlawful access to its system by unauthorised third parties. The Company, its officers, employees, contractors and other related parties shall bear no liability whatsoever for damages caused by or relates to leakage of Personal Information despite the reasonable measures implemented by the Company.

14. Amendment

This Policy may be revised pursuant to the amendment to applicable laws and regulations or for any other reasons. If so, the new text will be notified to Users or published on the Revolut app and will become effective at the time of posting.

15. Compliance with Laws and/or Regulations, Improvements and Enhancements

In order to implement this Policy, the Company shall comply with all applicable laws and regulations on Personal Information and will alwaysendeavor to improve and enhance its operations for the handling and protectingPersonal Information.

Issued: 2018 Jul. 26

Revised 2020 June 22