Virtual World Expo Application Privacy Notice (“Privacy Notice”)

General information about the collection of personal data

This Privacy Notice ("Privacy Notice") describes the method through which NTT QONOQ, INC., a Japanese company with its registered office located at 11-1 Nagata-cho 2-chome, Chiyoda-ku, Tokyo, Japan and whose representative director is Seiji Maruyama ("QONOQ ", “our”, "we" or "us"), will process information relating to an identified or identifiable natural person ("Data Subject") or household ("Personal Data") collected and processed through our Virtual World Expo Application ("V Expo App") which we provide in conjunction with the World Expo 2025 organized by the Japan Association for the 2025 World Exposition ("Expo Association"). This Privacy Notice consists of a "Summary Notice" (see below at section A.), a "Full Notice" (see below at section B.) and a “California Consumer Privacy Act Disclosures” (see below at section C).
Personal data are any information (such as, for example, an individual’s form of address (title), name, address, email address, telephone number and IP address etc.) relating to an identified or identifiable natural person or household. Personal Data of users’ of V Expo App are processed by us only in accordance with the provisions of the Act on the Protection of Personal Information in Japan (“APPI”), Regulation (EU) 2016/679 (EU General Data Protection Regulation, "GDPR") and other provisions of applicable national data protection laws. References to GDPR in this Privacy Notice include the GDPR and UK GDPR unless otherwise specified.
In addition to the above, “California Consumer Privacy Act Disclosures” in section C applies for California users. For California users, please refer to section C.
Personal Data are processed in compliance with the APPI, the GDPR, and other applicable data protection laws, and only after you have given your consent, or if the processing of such data relies on another legal basis under the GDPR or other applicable data protection laws. The provisions in this Privacy Notice provide you, inter alia, with information about the nature, scope and purpose of the processing of your Personal Data.

A.SUMMARY NOTICE

1.Scope of applicability
This Privacy Notice applies to user of our V Expo App (“User”).

2.Processing of User’s Personal Data (categories of Personal Data)
We process the following of the User’s Personal Data collected during their use of our V Expo App: user IDs issued or collected by us when they use the V Expo App (including those issued by us and Expo IDs issued by the Expo Association), User’s profile information such as nickname, country and date of birth set by the User, IP address, messages exchanged via text and voice chats they used, insofar as necessary for the provision of the messaging function, time and date of their communications with others via chat functionality of V Expo App insofar as necessary for the provision of the messaging function, the category of text and voice chats, the usage status of the function of the chats they used, the number of text and voice chats they used, duration of the chats, operation logs including the amount of data transmitted via the chats, insofar as necessary for the provision of the messaging function, history of the User’s visits to or participation in pavilions or events within the Virtual Expo, estimated location information of the User's device (i.e., location information relative to objects captured by the in-app camera) and spatial scan data of locations captured by the in-app camera, GPS location data (excluding GPS location data of Users under 18 years of age in the U.S.), and any other information relating to any individuals (including other Users) which the User provides to us. For more details see 2. of the Full Notice below.
Our V Expo App also uses cookies. For further information, please read Virtual World Expo Application Cookie Notice (“Cookie Notice”) - which you will find below following this Privacy Notice:

3.Processing purposes
We process User’s Personal Data for the following purposes: user registration to use V Expo App, verifying the User’s identity for providing our services via V Expo App, providing other relevant services to you, to get in contact with the User concerning the User’s queries, security and fraud prevention, developing and improving the quality of our V Expo App, creating statistical information to monitor status of usage of our services and use the information for promotional purposes, and sharing of history of User activities with other businesses participating in the data linkage service provided by the Expo Association. However, for persons under 18 years of age in the U.S., the information will not be used for the purpose of compiling statistical information, sharing statistical information with Expo Association, or sharing history of activities with other businesses participating in the data linkage service. For more details see 3. of the Full Notice below.

4.Legal justifications for the processing of User's Personal Data
One of the key privacy law requirements is that any processing of Personal Data has to have a legal justification. We generally use the following legal justifications: (1) the User has given consent to the processing (Art. 6(1)(a) GDPR or the or the equivalent legal provisions of the applicable data protection laws; “Consent Justification”), or (2) the processing is necessary for (a) the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR or the or the equivalent legal provisions of the applicable data protection laws; “Contract Performance Justification”) (b) compliance with a legal obligation (Art. 6(1)(c) GDPR or the or the equivalent legal provisions of the applicable data protection laws; “Legal Obligation Justification”) and (c) realizing a legitimate interest which prevails the interests of the data subject (Art. 6(1)(f) GDPR or the or the equivalent legal provisions of the applicable data protection laws; “Legitimate Interest Justification”); more information on the balancing test in connection with the Legitimate Interest Justification is available upon request. For more details and the matching of purposes and corresponding legal justifications see 4. of the Full Notice or click here.

5.Data transfers and recipients and legal justification for such transfers
We transfer User’s Personal Data to our service providers, and, in accordance with applicable law, other governmental authorities, courts, external advisors, and similar third parties, some of the aforementioned recipients located in jurisdictions outside the EU or the country where the User is located. For more details see 5. of the Full Notice or click here.

6.Security measures
We provide appropriate security measures to protect User’s Personal Data. For more details see 5. of the Full Notice below.

7.Retention periods for and deletion of User’s Personal Data
User’s Personal Data will be deleted once they are not any longer needed for the purposes motivating their original collection or as required by applicable law. For more details see 7. of the Full Notice below.

8.Your statutory rights
Users have a number of rights with regard to the processing of their Personal Data, each as per the conditions defined in applicable law, such as the right to have access to their Personal Data, to have them corrected, erased or handed over. Please refer any of your questions to support-vexpo-app@ml.nttqonoq.com. For more details see 8. of the Full Notice below.

9.Changes of this Summary and Full Notice as well as further notices
This Summary Notice and Full Notice are subject to change. You will be notified adequately of any such changes. Further, you will be notified adequately through further relevant privacy notices (e.g. for specific purposes) in case such is not covered by this Summary Notice and the Full Notice.

10.How to contact us
If you wish to exercise your data subject rights or if you have any other questions concerning this Summary Notice and Full Notice, please address your request to us, who can be contacted at:
NTT QONOQ, INC. Service Desk concerning Personal Information
Sanno Park Tower 7F, 11-1 Nagata-cho 2-chome, Chiyoda-ku, Tokyo, 100-6150
Email: support-vexpo-app@ml.nttqonoq.com

When you make the request, please clearly indicate that the request concerns V Expo App.

B.Full Notice

We are delighted about your interest in our V Expo App. User’s privacy is important to us. Hereafter, we provide you with detailed information on dealing with User’s personal data on this V Expo App.
This Full Notice is applicable for our processing of User’s Personal Data. Third parties including the Expo Association may have their own privacy policy and be governed by it. Please also note that parts of the V Expo App may contain links to third party websites which may be governed by other privacy policies. This application runs on Google Play Services for AR (ARCore) (https://play.google.com/store/apps/details?id=com.google.ar.core), which is provided by Google (Google LLC and its subsidiaries; same shall apply hereinafter) and governed by the Google Privacy Policy(https://policies.google.com/privacy).

We use cookies to improve the functionality of our V Expo App. Cookies are small text files that may be installed on User’s computer when you visit a website. Cookies are generally used to provide site visitors with additional functionality within the site. Cookies cannot access, read or modify any other data on the User’s computer. For further information please read our Cookie Notice - which you will find below following this Privacy Notice

1.Contact details of the controller and its representative; contact details of the data protection officer
The Controller is:
NTT QONOQ, INC.
Sanno Park Tower 7F, 11-1 Nagata-cho 2-chome, Chiyoda-ku, Tokyo, 100-6150
Email: support-vexpo-app@ml.nttqonoq.com
Our representative in the EU is:
TMI Avocats & Associés
40 Avenue Niel 75017 Paris, France
Email: NTT_QONOQ_Eurep@tmi.gr.jp
Our representative in the UK is:
TMI Associates London LLP
CityPoint One Ropemaker Street London EC2Y 9SS, United Kingdom
Email: NTT_QONOQ_Ukrep@tmi.gr.jp
The data protection officer (“DPO”) designated pursuant to the GDPR, and other applicable data protection laws, can be reached at:
NTT QONOQ, INC. Data Protection Officer
Sanno Park Tower 7F, 11-1 Nagata-cho 2-chome, Chiyoda-ku, Tokyo, 100-6150
Email: data-protection-officer@ml.nttqonoq.com

2.Categories of Personal Data
We process the following Personal Data about Users; provided, however, that we do not process GPS location data of Users in US under eighteen (18) years old:
(a)User Data:
IDs issued by us to users, nicknames set by Users in the V Expo App, country, date of birth and other profile information entered into the V Expo App by Users, IP addresses, Expo IDs, UUIDs, device terminal information (model, OS version), device IDs, stack traces, performance and other diagnostic data, access logs, and authentication tokens;
(b)Communication Data
Messages exchanged via text and voice chats you used, time and date of User’s communications with others via chat functionality of V Expo App, the category of the chat functionality you used (i.e., whether text or voice chat), and status of User’s use of the chat function, including the number of text and voice chats you used, duration of the chats, the amount of data transmitted via the chats, insofar as necessary for the provision of the messaging function;
(c)User Activity Data:
History of pavilions or events that the User has visited or participated in at the Virtual Expo;
(d)Spatial and Location Data for AR:
Estimated location of User’s device (i.e., location information relative to an object captured by the in-app camera) and spatial scan data of the location captured by the in-app camera;
(e)GPS Location Data:
Absolute location of User's device; and
(f)Communication with Users:
Information provided by User to us through the User’s communications with us (including reports about other Users) and other communications with us.
Certain Personal Data we process, such as Communication Data, Location Data or Personal Data of users under the age of 14, may be considered sensitive data under the applicable laws.

3.Processing purposes
We process User’s Data to the extent permitted or required under applicable law, for the following purposes:
(a)Performance purposes:
To complete User’s registration to V Expo App, to verify User’s identity for providing our services via V Expo App, to manage and administrate User’s account, to enable users to use V Expo App (including displaying profiles and activity information in V Expo App), verifying age of Users to ensure lawful provision of services, provide other relevant services to Users;
(b)Quality Purposes (V Expo App):
To provide the V Expo App in an optimized way for User and to enhance the user experience of the V Expo App;
(c)Safety Purposes
To ensure security and prevent fraud, including receiving, reviewing, and responding to reports from Users regarding suspected violations of applicable laws, regulations, or the terms of use, detecting fraudulent or illegal access with harmful intent and reviewing and responding to such access, for the purpose of ensuring User’s safe and secure use of the V Expo App.
(d)Sharing Purpose
To use it with other businesses participating in the data linkage service explained below and allow such businesses to use the shared Personal Data for the purpose of services that each business independently provides to Users to the extent the User has consented, and to compile statistical data based on user activity data and share the statistical data with the Japan Association for the 2025 World Exposition to allow the association to use in promotional publications. However, for persons under 18 years of age in the U.S., the information will not be used for this purpose.
Data linkage service: The Expo Association provides the data linkage service, where businesses who are involved with the World Expo 2025 and choose to use the service can share selected data they have with other businesses using the service.
(e)Contact Purposes:
To get in contact with you concerning your queries, security and fraud prevention.

4.Legal justification for the processing of User’s Personal Data
Generally, the provision of User’s Personal Data is voluntary except that we need to receive (i) user ID issued by us and Expo ID issued by the Expo Association that identify User in order to carry over the User's previous information when the User logs off and logs back in, (ii) profile information to display the profile in the V Expo App, (iii) Communication Data to provide Users with text or voice chat functionality of the V Expo App. If User does not provide Personal Data, we may not be able to provide all or part of our services to the User.
One of the key privacy law requirements is that any processing of Personal Data has to have a legal justification. We generally use the following legal justifications: (1) User has given the User’s consent to the processing (Art. 6(1)(a) GDPR or the equivalent legal provisions of the applicable data protection laws; “Consent Justification”), (2) the processing is necessary for (a) the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) GDPR or the equivalent legal provisions of the applicable data protection laws; “Contract Performance Justification”) (b) compliance with a legal obligation (Art. 6(1)(c) GDPR or the equivalent legal provisions of the applicable data protection laws; “Legal Obligation Justification”) and (c) realizing a legitimate interest (Art. 6(1)(f) GDPR or the equivalent legal provisions of the applicable data protection laws; “Legitimate Interest Justification”); more information on the balancing test in connection with the Legitimate Interest Justification is available upon request.
We rely on the following legal justifications for the processing of User’s Personal Data:

Processing purposes	Categories of User’s Personal Data involved	Legal basis
Performance purposes	User Data Communication Data Spatial and Location Data for AR GPS Location Data Communication with Users	Contract Performance Justification, digital service requested justification, Consent Justification
Quality Purposes (V Expo App)	Communication Data (except for messages exchanged via text and voice chats) User Activity Data	Legitimate Interest Justification To maintain V Expo App with an optimal user experience
Safety Purposes	User Data Communication with Users User Activity Data	Legitimate Interest Justification To maintain V Expo App ensuring User’s safe and secure use of the app
Sharing Purposes	User Activity Data	Consent Justification
Contact Purposes	User Data Communication with Users	Contract Performance Justification Legitimate Interest Justification

5.Data transfers and recipients and legal justification for such transfers
5.1Recipients
(a)Businesses participating in the data linkage service: We share User Activity Data with businesses participating in the data linkage service provided by the Expo Association to allow them to use the data to provide their own services to Users through the data linkage service provided by the Expo Association based on the User’s consent.
(b)Third parties: We may transfer User’s Personal Data to governmental agencies and regulators, courts, and government authorities, all in accordance with applicable law based on Legal Obligation Justification and to external advisors acting as controllers (e.g., lawyers, accountants, auditors etc.) based on Legitimate Interest Justification or Consent Justification.
(c)Service providers: We contract with third party service providers as part of our normal business operations to provide the V Expo App and related services to you. Such service providers include CRI Middleware Co., Ltd., who provides us with services for our provision of text and voice chat functionality of the V Expo App to you and Google LLC, who provides AR technologies. In addition, for quality and safety maintenance purposes of the V Expo App, we use Firebase Crashlytics provided by Google and New Relic provided by NEW RELIC Corporation and Unity provided by Unity Software Inc., which track user activity, obtain user activity information and provide it to us under our control. For contract performance, quality and security maintenance purposes of V Expo App and contact purposes, we have contracted with Pole to Win, Inc. for provision of user support.
The translation function available in the chat function is a service provided by NTT DOCOMO, Inc. independently of QONOQ. For this translation function, the information is provided directly from the User's device to NTT DOCOMO, Inc. or its subcontractors, and we do not provide them with User's Personal Data.

5.2Cross-Border Data Transfers
(a)We may transfer User’s Personal Data outside of the country where the User is located. Some recipients of User’s Personal Data might be located in a country outside the EEA for which the European Commission has issued a decision that this country ensures an adequate level of data protection (or outside the UK and is recognized as adequate under the UK GDPR) (e.g., Japan). To the extent we transfer User's Personal Data outside of the country where the user is located, we will ensure that there are valid transfer mechanisms in place to provide User's Personal Data with adequate safeguards, according to the applicable data protection laws.
(b)If recipients of User’s Personal Data are located in countries outside the EEA for which the European Commission has not issued such decision, we enter into appropriate data transfer agreements based on Standard Contractual Clauses (such as 2021/914/EU) as referred to in Art. 46(5) GDPR, we have established that all recipients located outside the EEA will provide an adequate level of data protection for User’s Personal Data and that appropriate technical and organizational security measures are in place to protect User’s Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Any onward transfer is subject to appropriate onward transfer requirements as required by applicable law. Such agreements are accessible upon request from support-vexpo-app@ml.nttqonoq.com.
(c)The details of our overseas outsourcing and storage of Personal Data are as follows:

Recipient of Personal Data	Personal Data transferred	Country of transfer	Time and method of transfer	Purpose of use by recipient	Duration of use by recipient
Google (dpo-google@google.com)	Relevant User data collected	United States and other countries	Continuously via the Internet	See Section 5.1(c) above	Within the retention periods set out in this Privacy Notice, until the service contract is terminated
New Relic (privacy@newrelic.com)
Unity Software Inc.(dpo@unity3d.com)

For more details about the countries of transfer, please refer to the privacy notices of each service provider below:
Google https://policies.google.com/privacy/frameworks
New Relic https://newrelic.com/termsandconditions/privacy#international_data_transfers
Unity Software Inc. https://unity.com/legal/game-player-and-app-user-privacy-policy (see section 9. Transfers out of Country of Collection)

6.Security measures
We provide appropriate security measures to protect User’s Personal Data including establishment of necessary rules to protect personal data, conducting trainings to our employees and taking other appropriate organizational, physical and technical security measures. Despite our diligent efforts to safeguard User’s Personal Data, certain risks such as unauthorized access or misuse may still exist. For details of the security measures we take, please contact us by using the contact details provided in section 10 of the Summary Notice.

7.Retention periods for and deletion of User’s Personal Data
7.1 User’s Personal Data processed for the purposes hereunder will be stored only to the extent necessary. If a judicial or disciplinary action is initiated, User’s Personal Data may be stored until the end of such action, including any potential periods for appeal, and will then be deleted or archived as permitted by applicable law.

7.2 In principle, we will retain User’s Personal Data, as specified in Section 2, as long as required as set out below or as permitted by applicable law. Afterwards, we will remove User’s Personal Data from our systems and records and/or take steps to properly anonymize it so that the User can no longer be identified from it.
(a)User data: Will be deleted within two weeks after World Expo 2025 has ended.
(b)Communication Data: Chat data will be deleted immediately once it has been sent by the sender and received and read by the User receiving the message.
(c)User Activity Data: Will be deleted within two weeks after World Expo 2025 has ended.
(d)Spatial and Location Data for AR: Will be deleted immediately after the User has finished using the AR functionality.
(e)GPS Location Data: Will be deleted immediately after the GPS Location has been used.
(f)Communication with Users: Will be deleted immediately after the User’s communication with us has ended. In the event that there is no response from the User, all communication will be deleted two weeks after the last communication with the User.

8.Automated decision-making
No automated decision-making takes place.

9.Data subject’s statutory rights
To the extent provided under the conditions set out under applicable law (including, but without limitation the APPI and the GDPR), User may have the following rights:
9.1 Right of access: User may have the right to obtain from us confirmation as to whether or not Personal Data concerning the User is being processed, and, where that is the case, to request access to the Personal Data. The access information includes – inter alia – the purposes of the processing, the categories of Personal Data concerned, and the recipients or categories of recipients to whom the Personal Data have been or will be disclosed.
User has the right to obtain a copy of the Personal Data undergoing processing.
9.2 Right to rectification: User may have the right to obtain from us the rectification of inaccurate Personal Data concerning the user. Depending on the purposes of the processing, User has the right to have incomplete Personal Data concerning the user completed, including by means of providing a supplementary statement.
9.3 Right to erasure, anonymization or blocking (right to be forgotten): User may have the right to ask us to erase, anonymize or block the User’s Personal Data, where the processing activities infringe applicable data protection laws.
9.4 Right to limitation and restriction of processing: User may have the right to request the limitation and restriction of processing the User’s Personal Data. In this case, the respective data will be marked and may only be processed by us for certain purposes.
9.5 Right to data portability: User may have the right to receive the Personal Data concerning the User which the User has provided to us in a structured, commonly used and machine-readable format and the User has the right to transmit those Personal Data to another entity without hindrance from us.
9.6 Right to object:Subject to certain preconditions, User may have the right to object, on grounds relating to their particular situation, at any time to the processing of the User’s Personal Data by Us and We can be required to no longer process the User’s Personal Data. In general, User has the right to object to our processing of the User’s personal data for direct marketing purposes, including profiling. If User has a right to object and the User exercises this right, the User’s Personal Data will no longer be processed for such purposes by Us. Exercising this right will not incur any costs.
9.7 Right to withdraw consent: User may have the right to withdraw any consent previously granted for the processing at any time (withdrawing User’s consent does not affect the lawfulness of processing based on the User’s consent before the withdrawal). In some circumstances, withdrawal of consent may prevent us from providing services to the User.
9.8 Right to lodge a complaint or grievance: In case of complaints or a grievance, User also has the right to lodge a grievance with a grievance officer at the email address provided below or a complaint with a supervisory authority, in particular in the EU Member State of the User’s habitual residence or alleged infringement of the GDPR.
Please note that the aforementioned rights might be limited under the applicable national data protection law. We remain the universal point of contact for your execution of these rights.

Please refer any of your questions, complaints, or grievances to the following:
NTT QONOQ, INC. Service Desk concerning Personal Information
Sanno Park Tower 7F, 11-1 Nagata-cho 2-chome, Chiyoda-ku, Tokyo, Japan
support-vexpo-app@ml.nttqonoq.com

Right to review automated decisions. User may have the right to review decisions made solely on the basis of automated processing of their Personal Data that affect their legal interests, including those decisions aimed at defining personal, professional, consumer and credit profile, or personality's aspects.

10.Changes of this Summary and Full Notice as well as further notices
This Full Notice is subject to change. You will be notified adequately of any such changes. Further, you will be notified adequately through further relevant privacy notices (e.g. for specific purposes) in case such is not covered by the Full Notice. Your continued use of the V Expo App after any changes to this Full Notice and after receiving a notice of such changes indicates your acceptance and consent to such changes.

C.California Consumer Privacy Act Disclosures

These disclosures are provided by NTT QONOQ, Inc. ("Company") and apply solely to residents of the State of California ("consumers" or "you") with respect to personal information Company processes as a business. Any terms defined in the California Consumer Privacy Act of 2018, as amended from time to time, including by the California Privacy Rights Act of 2020 and its implementing regulations ("CCPA") have the same meaning when used in these disclosures. These disclosures do not reflect our collection, use, or disclosure of California residents' personal information, or data subject rights, where an exception or exemption under the CCPA applies. You can download a pdf version of these disclosures https://contents.ssv.virtualexpo.expo2025.or.jp/app/ccpa.pdf.

1.Notices at Collection
We have set out below categories of personal information about California resident app users. The California Consumer Privacy Act Privacy Policy is in section 2 of these disclosures.
We disclose certain personal information collected about app users to World Expo Association and businesses who participates in the data linkage service operated by the association to provide app users with more interesting and customized information, promotions, and advertising, which is considered "selling" and "sharing" under the CCPA. Please go to “setting” menu to see our notice of right to opt out of selling and sharing.
1.1 What Categories of Personal Information Do We Collect?
(a)Non-Sensitive Personal Information:
(i)Identifiers such as unique personal identifiers (including those issued by the Company), nickname, country that the user registers within the app, date of birth set by the user, online identifier, Internet Protocol address, or account name.
(ii)Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet application.
(iii)Geolocation data which is captured by using a spatial scan data of the location captured by the user’s camera in the V Expo Application.
(iv)Audio, electronic, visual, or similar information such as user activity information, including, but not limited to a history of pavilions or events which the consumer has visited or participated in at the Virtual Expo; and the date and time, duration, data used, and number of text and voice messages which have been sent by the consumer to other users through the V Expo Application and any information provided by the consumer to the Company in the communications, including, but not limited to complaints and reports regarding other consumers of the V Expo Application.
(v)Inferences drawn from any personal information which a consumer registers within the V Expo Application to create a profile about the consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
(b)Sensitive Personal Information
(i)A consumer’s V Expo Application account log-in and password.
(ii)A consumer’s precise geolocation.
(iii)The contents of a consumer’s text and voice messages.

1.2 For What Purposes Do We Collect and Use Personal Information?
We use personal information about our app users as reasonably necessary and proportionate to:
•Allow users to complete user registration in the V Expo Application and identify the user;
•Manage and administer the user’s accounts, including but not limited to, displaying the user’s profile and activity within the V Expo Application, and provide other related services;
•Perform the services or provide the goods reasonably expected by our app users and make any improvements to the V Expo Application;
•Ensure the safety of our services and prevent fraudulent activity, including by not limited to maintaining the safety and security of the V Expo Application by reviewing and responding to any suspected violations of any applicable laws or regulations or Terms of Use;
•Share user activity with other operators who are participating in the data linkage service provided by the Japan Association for the 2025 World Exposition to provide more interesting and customized information, promotions, and advertising to consumers; and to enable operators to efficiently guide consumers through the services provided by other operators who will be participating in the 2025 World Exposition.
•Compile statistical data based on user activity data and share the statistical data with the Japan Association for the 2025 World Exposition to allow the association to use in promotional publications.
•Contact users regarding any inquiries received.
•We do not use or disclose sensitive personal information that is subject to Cal. Civil Code 1798.121 for purposes other than those specified in Cal. Civil Code 1798.121(a).

1.3 What Criteria Do We Consider When Retaining Personal Information?
In general, with respect to each category of personal and sensitive personal information about app users, we retain each category for the longer of: as long as needed or permitted in light of the purpose(s) for which it was obtained and any additional time periods necessary for the compliance with laws, exercise or defense of legal rights, and archiving, back-up and deletion processes.

2.California Consumer Privacy Act Privacy Policy
Last Updated: 27 March 2025
2.1 Our Personal Information Handling Practices
We have set out below categories of personal information about California residents we have collected, and as applicable disclosed, for a business purpose in the preceding 12 months. All the collection and disclosure in the table concern personal information we collected in relation to Twipet, which was discontinued in 2024. The table is followed by a description of the purposes for which we collected personal information. If we process de-identified information, we will maintain the information in a deidentified form and not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether deidentification processes used satisfy legal requirements.

We have not collected sensitive personal information, nor have we sold or shared consumers’ personal information in the preceding 12 months.

Category of personal information	Did we collect? If so, from what source?	Did we disclose? If so, to whom and for what purpose?
Personal Information
Identifiers such as unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.	•Directly from consumers or their devices •Indirectly (e.g., from vendors)	•To advertising service providers to analyze the effectiveness of advertising. •To third party platforms for third parties to provide services on our behalf.
Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, credit card number. (The categories of personal information described in the California Customer Records Act (Cal. Civ. Code § 1798.80(e))		•To advertising service providers to analyze the effectiveness of advertising. •To third party platforms for third parties to provide services on our behalf.
Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.		•To third party platforms for third parties to provide services on our behalf.
Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement.		•To analytic service providers to improve the consumer's experience on our app and develop our app.
Audio, electronic, visual, thermal, olfactory, or similar information.		•To third party platforms for third parties to provide services on our behalf.

2.2 Business or Commercial Purpose for Collecting Personal Information
Purpose for which we collected personal information in relation to Twipet, which was discontinued in 2024
•To provide you with the APP, including services for displaying AR contents.
•To improve your experiences on the App and develop the App.
•To analyze the effectiveness of advertising
•To determine if you are a paid subscriber of the App.
Purposes for which we collect personal information in relation to V Expo App
•To provide users with V Expo Application and other related services, including services to display Augmented Reality contents;
•To develop the V Expo Application and other related services and improve the user experience on the V Expo Application;
•To analyze the effectiveness of advertising;
•For users to complete user registration in the V Expo Application and verify the identity of the user in case where the verification is necessary to process the user’s requests or questions;
•Manage and administer the user’s accounts, including but not limited to, displaying the user’s profile and activity within the V Expo Application, and provide other related services;
•To perform the services or provide the goods reasonably expected by our app users and make any improvements to the V Expo Application;
•To share user activity with other operators who are participating in the data linkage service provided by the Japan Association for the 2025 World Exposition.
•To contact users regarding any inquiries received.
We do not have actual knowledge that we sell or share for cross context behavioural advertising, the personal information of California residents under 16 years of age.

2.3 CCPA Rights
As a California resident, you have the following rights under the CCPA:
•The right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. You may only exercise your right to know twice within a 12-month period.
•The right to delete personal information that we have collected from you, subject to certain exceptions.
•The right to correct inaccurate personal information that we maintain about you.
•The right to opt out of the sale or sharing of your personal information by us. We disclose California residents' personal information to advertising business partners for the purposes of supporting our advertising efforts and, as such, we "sell" and "share" personal information as these terms are defined under the CCPA. Please note that we do not monetize personal information in the sense of disclosing your personal information in exchange for money. Please also note that, if you exercise your right to opt-out of the “sale” and "sharing" of your personal information, we may still disclose your personal information to third parties for purposes other than cross-contextual behavioral advertising, as described in our privacy disclosures.
•The right to limit our use and disclosure of sensitive personal information to purposes specified in Cal. Civil Code 1798.121(a). We do not use or disclose sensitive personal information that is subject to Cal. Civil Code 1798.121 for purposes other than those specified in Cal. Civil Code 1798.121(a).
•The right not to receive discriminatory treatment by the business for the exercise of privacy rights conferred by the CCPA, in violation of California Civil Code § 1798.125, including an employee's, applicant's, or independent contractor's right not to be retaliated against for the exercise of their CCPA rights.

2.4 How to Exercise CCPA Rights
Methods of Submission and Instructions: To submit a request to exercise your rights to know, delete or correct, please submit a verifiable consumer request to us by contacting us via the information in “Contact Information for Inquiries and Complaints."
Verification: Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. You may designate an authorized agent by taking the steps outlined under "Authorized Agent" further below. In your request or in response to us seeking additional information, you, or your authorized agent, must provide sufficient information to allow us to reasonably verify that you are, in fact, the person whose personal information was collected which will depend on your prior interactions with us and the sensitivity of the personal information being requested. We may ask you for information to verify your identity and, if you do not provide enough information for us to reasonably verify your identity, we will not be able to fulfil your request. We will only use the personal information you provide to us in a request for the purposes of verifying your identity and to fulfill your request.
Authorized Agents: You can designate an authorized agent to make a request under the CCPA on your behalf if:
•The authorized agent is a natural person or a business entity and the agent provides proof that you gave the agent signed permission to submit the request; and
•You directly confirm with Company that you provided the authorized agent with permission to submit the request.
If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA.

Contact Us
If you have any questions or comments about these disclosures or our practices, please contact us at:
NTT QONOQ, INC. Service Desk concerning Personal Information
Sanno Park Tower 7F, 2-11-1 Nagata-cho, Chiyoda-ku, Tokyo, 100-6150
e-mail: support-vexpo-app@ml.nttqonoq.com

Additional Clauses
The Privacy Notice is effective from March 27th, 2025 . Incidentally, we may change the Privacy Notice along with the establishment and amendment of laws, regulations and various guidelines. We will publish any changes to the Privacy Notice on our V Expo App.