1. INTRODUCTION

Welcome to ACROBiosystems.com , (and permutation web pages that provide a direct link to this Privacy Policy – collectively the "Sites"), which is owned and operated by ACROBIOSYSTEMS INC. ACROBiosystems is well aware of the importance of personal information to you, and your trust is very important to us. We will take corresponding security protection measures in accordance with the requirements of laws and regulations, and try our best to keep your personal information safe and controllable. In view of this, we have formulated this "Privacy Policy" (Personal Information Protection Policy) (hereinafter referred to as "this Policy"), and remind you that this Policy applies to all products/services provided by ACROBiosystems. If our products/services do not have a separate privacy policy, this policy also applies to those products/services. If the products/services we provide to you have a separate privacy policy, the corresponding privacy policy applies to the corresponding products/services, unless there are other additional statements.

It should be noted that this policy does not apply to the products/services provided by third parties to you, and the products/services provided by third parties to you are subject to their own privacy policies that are separately explained to you.

Before using our products/services, please read and understand this policy carefully, and start using our products/services after confirming that you fully understand and agree to this policy. If you accept the provisions of this Policy, you are agreeing to us processing your Personal Data in the ways that are set out in this Policy.

2. HOW DOES ACROBiosystems COLLECT PERSONAL DATA?

Where possible, we will collect your Personal Data directly from you and secure the relevant consent from you. This may take place in a number of ways, such as:

i. When you register in the Website, you will be asked to provide basic contact information (e.g., country, e-mail address, and so on).

ii. We may collect and retain your information in a variety of ways when you place an order, request email updates or other information, complete a customer survey, submit feedback or contact forms, or provide a resume.

iii. If any third parties provide information to us about you, we may combine that information with other information we have about you, and we will treat that information in accordance with this Privacy Policy.

iv. This Site collects various non-personally identifiable information from you in the course of your navigation of the Site, such as the URL of the site you just came from, the browser version you use, date/time, size of data transferred, pages you visit, etc.. ACROBiosystems also uses "cookies" to enhance your site visit.

v. A cookie is information either temporarily or permanently stored in a file on your computer. You can set your browser to reject cookies, but that may limit your use of some convenience features at this Site.

3. WHO CAN YOU CONTACT IN CASE YOU HAVE QUESTIONS OR REQUESTS?

For any questions or requests or complaints concerning the application of this Policy or to exercise your rights, as described in this Policy, you may contact us at the Data Protection Contact Point: customerservice@acrobiosystems.com

4. WE ADHERE TO THE FOLLOWING KEY PRINCIPLES REGARDING YOUR PERSONAL INFORMATION

• Lawfulness: we will only collect your Personal Data in a fair, lawful and transparent manner.

• Data minimisation: we will limit the collection of your Personal Data to what is directly relevant and necessary for the purposes for which they have been collected.

• Purpose limitation: we will only collect your Personal Data for specified, explicit and legitimate purposes and not process your Personal Data further in a way incompatible with those purposes.

• Accuracy: we will keep your Personal Data accurate and up to date.

• Data security and protection: we will implement technical and organisational measures to ensure an appropriate level of data security and protection considering, among others, the nature of your Personal Data to be protected. Such measures provide for the prevention of any unauthorised disclosure or access, accidental or unlawful destruction or accidental loss, or alteration and any other unlawful form of Processing.

• Access and rectification: we will process your Personal Data in line with your legal rights.

• Retention limitation: we will retain your Personal Data in a manner consistent with the applicable data protection laws and regulations and no longer than is necessary for the purposes for which they have been collected.

• Protection for international transfers: we will ensure that any of your Personal Data transferred is adequately protected.

• Safeguards towards third parties: we will ensure that Personal Data access by (and transfers to) third parties are carried out in accordance with applicable law and with suitable contractual safeguards.

• Lawfulness of direct marketing and cookies: when we send you promotional materials or place cookies on your computer, we will ensure that we do so in accordance with applicable law.

5. PROCESSING OF YOUR PERSONAL DATA: WHICH PERSONAL DATA DO WE COLLECT AND ON WHICH LEGAL GROUNDS

Whenever we require your Personal Data, we will always clearly inform you which of your Personal Data we collect. This information will be provided to you through a separate privacy notice which will, for example, be included in specific services (including communication services), electronic newsletters, reminders, surveys, offers, invitations for events, etc.

Please note that in accordance with applicable data protection law, your Personal Data can be processed if:

• you have given us your consent for the purposes of the Processing (as described in the privacy notice related to that particular Processing). For the avoidance of doubt, you will always have the right to withdraw your consent at any time; or

• it is necessary for the performance of a contract to which you are a party; or

• with such Processing, we pursue a legitimate interest that is not outbalanced by your privacy rights. Such legitimate interest will be duly communicated to you in the privacy notice related to that particular Processing.

• it is required by law.

6. HOW LONG DO WE KEEP YOUR PERSONAL DATA

We will keep your Personal Data in a manner consistent with applicable data protection law. We will only keep your Personal Data for as long as necessary for the purposes for which we process your Personal Data or to comply with the law or. For information on how long certain Personal Data is likely to be kept before being removed from our systems and databases, please contact us at the Data Protection Contact Point (see section  “Who can you contact in case you have questions or requests?”).

7. PROTECTING YOUR PERSONAL DATA

We have a set of technical and organisational security measures in place to protect your Personal Data against unlawful or unauthorised access or use, as well as against accidental loss or damage to their integrity. They have been designed taking into account our IT infrastructure, the potential impact on your privacy and the costs involved and in accordance with current industry standards and practice.

Your Personal Data will only be processed by a third party Data Processor if that Data Processor agrees to comply with those technical and organisational data security measures.

a. Maintaining data security means protecting the confidentiality, integrity and availability of your Personal Data:

b. Confidentiality: we will protect your Personal Data from unwanted disclosure to third parties.

c. Integrity: we will protect your Personal Data from being modified by unauthorised third parties.

d. Availability: we will ensure that authorized parties are able to access your Personal Data when needed.

Our data security procedures include: access security, backup systems, monitoring, review and maintenance, management of security incidents and continuity, etc.

8. USE OF COOKIES OR SIMILAR DEVICES

We use cookies on our websites. This helps us to provide you with a better experience when you browse our website and also allows us to make improvements to our site.

For further information about our use of cookies and on how to avoid them, please consult our cookie policy.

9. DISCLOSURE OF PERSONAL DATA

Depending on the purposes for which we collect your Personal Data, we may disclose it to the following categories of recipients, which will then process your Personal Data only within the framework of these purposes:

a. Within our organisations and our brand environment:

• Our authorised staff members;

• Our affiliates and subsidiary companies;

b. Third party business partners:

• Advertising, marketing and promotional agencies: to help us deliver and analyse the effectiveness of our advertising campaigns and promotions;

• Business partners: for example, trusted companies that may use your Personal Data to provide you with the services and/or the products you requested and/or that may provide you with marketing materials (provided that you have consented to receiving such marketing materials). We ask such companies to always act in compliance with applicable laws and this Policy and to pay high attention to the confidentiality of your personal information;

c. Other third parties:

• when required by law or as lawfully necessary to protect Acrobiosystems:

• to comply with the law, requests from authorities, court orders, legal procedures, obligations related to the reporting and filing of information with authorities, etc.;

• to verify or enforce compliance with Acrobiosystems’s policies and agreements; and

• to protect the rights, property or safety of Acrobiosystems and/or its customers;

• in connection with corporate transactions: in the context of a transfer or divestiture of all or a portion of its business, or otherwise in connection with a merger, consolidation, change in control, reorganisation or liquidation of all or part of Acrobiosystems’s business.

Please be aware that third party recipients listed under points b) and c) above –especially service providers who may offer products and services to you through Acrobiosystems services or applications or via their own channels– may separately collect Personal Data from you. In such case, these third parties are solely responsible for the control of such Personal Data and your dealings with them will fall under their terms and conditions.

10. CHOICES AND YOUR RIGHTS

We want to be as transparent as possible with you, so that you can make meaningful choices about how you want us to use your Personal Data.

• Your Personal Data

You may always contact us at the Data Protection Contact Point (see section “Who can you contact in case you have questions or requests?”) to find out what Personal Data we have concerning you and its origin. Under certain conditions, you have the right to receive your Personal Data, which you have provided to us, in a commonly used, structured machine readable format and to transmit your Personal Data to any third party of your choice.

• Your corrections

If you find any mistake in your Personal Data or if you find it incomplete or incorrect, you may also require from us that we correct or complete it.

• Your restrictions

You have the right to request a restriction on the Processing of your Personal Data (for example, while the accuracy of your Personal Data is being checked).

• Your objections

You may also object to the use of your Personal Data for direct marketing purpose (if you prefer, you can also indicate to us through which channel and how frequently you prefer to be contacted by us) or to the sharing of your Personal Data with third party for the same purpose.

You may withdraw your consent at any time to the continued Processing of the Personal Data that you have provided to us by contacting us at the Data Protection Contact Point (see section “Who can you contact in case you have questions or requests?”).

• Moreover, you may require us to erase any data concerning you (except in some cases, for example, to prove a transaction or when required by law).

• Finally, please note that you have the right to file a complaint against the Data Controller with the relevant data protection authority (“DPA”).

11. LEGAL INFORMATION

The requirements of this Policy supplement, and do not replace, any other requirements existing under applicable data protection law. In case of contradiction between what is written in this Policy and requirements in applicable data protection law, applicable data protection law will have priority.

12. DEFINITIONS

In this Policy, the following terms have the following meanings:

a. Data Controller means the organisation which determines the purposes for which, and the manner in which, your Personal Data is processed.

b. Data Processor means the person or organisation which processes your Personal Data on behalf of the Data Controller.

c. Data Protection Contact Point means the contact point (i.e. a person appointed by Toyota in the relevant jurisdiction) where you can address to the Data Controller your questions or requests regarding this Policy and/or (the Processing of) your Personal Data and which will handle such questions and requests. Unless we inform you otherwise, the Data Protection Contact Point can be reached as described in section  “Who can you contact in case you have questions or requests?”).

d. Personal Data is any data relating to you directly or which allows your identification, such as, for example, your name, telephone number, email address, (geo-)location, etc.

e. Processing means the collection, accessing and all forms of use of your Personal Data.