This Data Protection Notice (the "Notice") describes the data processing activities in connection with your use of the following Software developed and offered by Shimano Inc.

• E-TUBE PROJECT Professional PC (the "Software").

This Notice also informs you about the most relevant aspects of the arrangement concluded between the Shimano entities responsible for the data processing activities in connection with the Software.

Personal Data means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental economic, cultural or social identity of that natural person ("Personal Data").

Special categories of personal data include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health or data concerning a natural person's sex life or sexual orientation (also referred to as "Sensitive Data").

We process your Personal Data only for specified, explicit and legitimate purposes and provided that we have a legal basis to rely on. Your Personal Data will not be processed for any purpose other than the one they were originally collected, unless the new purpose is compatible with the initial one or in the event you give us your consent.

We have summarized the purposes for which we process your Personal Data and the legal bases we justify the processing with in the list below:

• User identification:

  We use your Personal Data to enable you to register an account and to log into it, if you want to use the Software with login.

  The processing of your Personal Data for this purpose is necessary for the performance of the contract concluded with you for the use of the Software, see Art. 6 (1)(b) General Data Protection Regulation ("GDPR").

• Use of the Software:

  The Software offers you the option of using the Software without logging in. In case of using the Software with user log-in (only possible for OEMs and distributors), the Software operates on the basis of the user profile you have created. We use your Personal Data to manage the bike and bike parts information associated with your user account. Our aim is to offer you a seamless experience by enabling you to access your data from any place and any device. We base the processing of your Personal Data for the above purposes on the performance of a contract to which you are party, see Art. 6 (1)(b) GDPR.

  We rely on your consent to process any Personal Data you have freely chosen to provide us with, see Art. 6 (1)(a) GDPR. In case you withdraw your consent, for example, by updating your user profile, we will stop processing your Personal Data for this purpose.

• Communication with you:

  We use your Personal Data to contact you, either upon your request, or when you have allowed us to do so, for example, to obtain feedback from you in order to improve our Services and the products.

  We base the processing of your Personal Data on your consent, as well as on the performance of a contract to which you are party and our legitimate interests to provide customer support, to improve the quality of our services and to grow as a business, see Art. 6 (1)(a), (b) and (f) GDPR.

• Product development:

  We process your Personal Data for quality improvement purposes, e.g. to detect and analyze problems in our products, to carry out predictive maintenance and calculate the necessary product replacement timing, to introduce new products and test their compatibility, etc.

  We base the processing of your Personal Data on our legitimate interests to improve the quality of our products and services, for product development research and to expand and grow as a business, see Art. 6 (1)(f) GDPR.

• Software user measurement and usage analysis:

  We analyze the performance of our Software and Services content in order to understand how users interact with them and improve them accordingly.

  We rely on your consent to process your Personal Data for this purpose, see Art. 6 (1)(a) GDPR. In case you withdraw your consent, we will stop processing your Personal Data for this purpose.

• Detect and avoid misuse of the Software:

  We analyze technical data gathered via the Software to detect and avoid misuse thereof, for example, by a breach of the terms of use of the software license agreement.

  We base the processing of your Personal Data on the performance of a contract to which you are party, as well as on our legitimate interests in prosecuting any misuse of our Software which could affect Shimano and could have legal consequences, see Art. 6 (1)(b) and (f) GDPR.

We share your Personal Data with the following recipients:

• Service providers acting on our behalf. We engage service providers to assist us in our daily business such as IT support and maintenance providers, web server providers. All service providers are legally and contractually required to respect and comply with applicable data protection legislation. Our service providers include:
  Sonix Co., Ltd, 7-9-5, Nishigotanda, Shinagawa-ku, Tokyo 141-0031, Japan (maintenance and data analysis provider)

The transfer of your Personal Data to recipients located in third countries outside of the European Economic Area ("EEA") is subject to the provisions set out in Section 8 below ("international data transfers").

All data collected the Software will be stored centrally in the European Union (“EU”). As data controller, SIC will have access to that database. Accordingly, your Personal Data will be transferred and/or disclosed to recipients located outside of the EEA in Japan which has been recognized by the European Commission in its adequacy decision (Commission Implementing Decision 2019/419 of 23 January 2019) as providing for an adequate level of data protection.

We will not process your Personal Data longer than necessary for the purpose for which it was originally collected.

Subject to statutory retention periods, we will delete your Personal Data:

• after a period of 5 years after the last login; and/or
• when you request the deletion.

Under applicable data protection law, you have certain rights with regard to the processing of your Personal Data by us:

• Right of access to your Personal Data;
• Right to rectification of inaccurate or incomplete Personal Data;
• Right to erasure of your Personal Data;
• Right to restriction of processing;
• Right to data portability, when the processing of your Personal Data is based on your consent or on a contract, and the processing is carried out by automated means;
• Right to withdraw consent with effect for the future
• Right to lodge a complaint with a supervisory authority; and
• Right to object to the processing of your Personal Data on grounds relating to your particular situation, and right to object to the processing of your Personal Data for direct marketing purposes.

We have implemented standard industry practices internally and with our service providers to maintain the security of your Personal Data depending on its sensitivity and to avoid disclosure of such Personal Data unpermitted under this Notice.

We do not knowingly process Personal Data from individuals under the age of 16 without parental or guardian consent. If you are the parent or the guardian of a child and you believe that we have processed Personal Data about him or her, please contact our DPO using the contact details described above in Section 3.

This Notice may be revised from time to time to reflect and comply with changes in applicable legislation. We will inform you about any updates in an appropriate manner, e.g. via email or a message in the Software. The date of the last update is available at the top of this Notice.