PRISM Project General Audition 2022

Privacy Policy (United Kingdom)

PRISM Project General Audition 2022 Privacy Policy

Last Updated: 7th August 2022

I. SUMMARY PRIVACY POLICY

This Summary Privacy Policy ("Summary") explains how we, Sony Music Entertainment (Japan) Inc. (4-5 Rokubancho Chiyoda-ku, Tokyo, 102-8353 Japan) (“SME”) and any legal entities controlled (the term “control” in this context means the direct or indirect ownership of at least fifty percent (50%) of the voting interest in such corporation or the power in fact to control the management decisions of such entity) by SME (“We”, "Us" and "Our") collect, use, disclose and/or store information or data of any kind (e.g., your nickname, email address etc.) about or related to you, even if such information cannot directly identify you on its own but can be used in combination with other information that is stored by Us ("Personal Data") in connection with PRISM Project General Audition 2022 and Our website (https://www.prismproject.jp/audition2022 and https://entry.sonymusic.co.jp/PRISM/prismproject) whether accessed via computer, mobile device or other technology (collectively, the “Online Audition”). It also describes your data protection rights, including your right to object to some of the processing which We carry out. More information about your rights, and how to exercise them, is set out in the Full Privacy Policy below.

1. Scope of Applicability

This Summary and the Full Privacy Policy (together the "Privacy Policy") apply to you if you use the Online Audition.

2. Processing of your Personal Data

We collect and use the following Personal Data related to your use of the Online Audition:

a. Information you provide to Us, such as registration information, e.g., your nickname, email address, country/region of residence.

b. Information that We collect automatically (as the case may be, subject to your consent), such as your IP address or other identifiers for the device you use to access the Online Audition, technologies such as Cookies or Web Beacons.

c. Information We receive from third parties, e.g., service providers that work on Our behalf. Further, We may receive information on how you use the Online Audition or third party websites from third party analytics service providers, ad network providers or social media applications that We make use of and which may process certain Personal Data about you subject to their privacy policies and/or terms of use.

3. Processing Purposes

We collect and use your Personal Data related to your use of the Online Audition (collectively, the "Collected Data") to provide you with features and functions of the Online Audition, and to provide you with other requested content related to Our services and other offerings.

4. Legal Justifications for the Processing of the Collected Data

One of the key privacy law requirements is that any processing of Personal Data has to have a legal justification. We generally use the following legal justifications: the processing is necessary for (i) the performance of a contract (Art. 6 (1) (b) GDPR), (ii) compliance with a legal obligation (Art. 6 (1) (c) GDPR), (iii) realizing a legitimate interest (Art. 6 (1) (f) GDPR), and (iv) if you have provided your prior consent, we also rely on such (Art. 6 (1) (a) GDPR).

5. Data transfers and Recipients including International Data Transfers

In accordance with applicable law, We transfer your Personal Data to Our service providers, third parties (e.g., third party service providers, business partners), and, as the case may be, governmental authorities, courts, external advisors, and similar third parties. Some of the aforementioned recipients are located in jurisdictions outside the European Union / European Economic Area (jointly the "EU") and the United Kingdom such as the United States, Japan, and/or other jurisdictions that may not provide the same level of data protection as your home country/region.

6. Retention periods for and deletion of the Collected Data

The Collected Data will generally be deleted once they are no longer needed for the purposes motivating their original collection or as required by applicable law.

7. Your statutory rights

As set forth by applicable law, you have certain rights with regard to the processing or your Personal Data, each as per the conditions defined in applicable law, such as the right to get access to your data, to get them corrected, erased or handed over. Please refer any of your questions to audition@prismproject.jp.

8. Changes to this Privacy Policy

From time to time, We may have to update this Privacy Policy. We will let you know of any material changes to this Privacy Policy through Our website https://www.prismproject.jp/audition2022.

9. Contact Information and how to contact Us

If you have any questions regarding this Privacy Policy please contact Our representative in the UK pursuant to Art. 27 (1) of the UK GDPR:

Name: Sony Europe BV

Address: The Heights, Brooklands, Weybridge, Surrey KT13 0XW, The United Kingdom

email: privacyoffice.SEU@sony.com

If you wish to exercise your data subject rights, have a privacy concern, complaint or any other question how We process Personal Data, please contact Us by mail or email:

Name: Sony Music Entertainment (Japan) Inc.

Address: 4-5 Rokubancho Chiyoda-ku, Tokyo, 102-8353 Japan

Email: audition@prismproject.jp

II. FULL PRIVACY POLICY

1. Processing of your Personal Data

We process the following Personal Data related to your use of the Online Audition:

a. Personal Data you provide to Us:

Registration Information:

When you newly register for and/or in the process of the Online Audition, We collect your credential information that you provide to Us, such as your nickname, first and last name, email address, country/region of residence, address, native language, age, gender, social media account ID, your videos/voices, general self-introduction, short essay, relationships with other talent management agencies, application history, and your history of activity as a contents creator/VTuber.

b. Personal Data We collect by technical means:

In addition to any information that you choose to provide to the Online Audition, whenever you visit or interact with the Online Audition, We, as well as any third-party analytics providers or other service providers, may use a variety of technologies that automatically or passively collect information about how the Online Audition is accessed and used, including but not limited to, browser type, operating system, the page served, time on the Online Audition, and the preceding page views, which might be qualified as Personal Data ("Usage Information"). We may also automatically collect your IP address or other unique identifiers ("Device Identifiers") for the computer, mobile device, technology or other device (collectively, "Devices") you use to access the Online Audition. A Device Identifier is a number that is automatically assigned to your Device when you access a property or its servers, and Our computers identify your Device by its Device Identifier. Some mobile service providers may also provide Us or Our third-party service providers with information regarding the physical location of the Device used to access the Online Audition. The technologies used on the Online Audition to collect Usage Information, including Device Identifiers, include:

• Cookies, which may be html files, Flash files or other technology, are small text files that help store user preferences and activity ("Cookies"). A Cookie is placed on a Device when that Device is used to access or visit the Online Audition. Cookies may be used for many purposes, such as remembering you and your preferences, tracking your visits to the Online Audition and customizing your experience on the Online Audition. You may configure your browser or Device to block the use of certain Cookies. However, please note that if you choose to disable Cookies on your Device, some features of the Online Audition and Our online offerings may not function properly.

• Web Beacons, also known as image tags, pixel tags, clear GIFS or web bugs, are small pieces of code used to collect advertising data, such as counting page views, promotion views or advertising responses (“Web Beacons”). Web Beacons or similar technologies may be used for various purposes, including, without limitation, to count visitors to the Online Audition, to monitor how users navigate the Online Audition, to count how many sent emails were actually opened or to determine whether content sent was actually viewed.

• Embedded Scripts: An embedded script is programming code that is designed to collect information about your interactions with the Online Audition, such as the links you click on. The code is temporarily downloaded onto your Device from Our server or a third-party service provider, is active only while you are connected to the Online Audition, and is deactivated or deleted thereafter.

• Ad Serving and Traffic Measurement Services

We may license technology to serve advertisements on the Online Audition. In addition, We may use third party network advertisers to serve advertisements on the Online Audition and third-party analytics service providers (such as Google Analytics) to evaluate and provide Us with information about the use of the Online Audition and viewing of Our content. We do not share the information that you provide to Us, such as your nickname and/or email address with these third parties, but ad network providers, the advertisers, the sponsors, and/or analytics service providers may set and access their own Cookies, Web Beacons and embedded scripts on your Device from the Online Audition. These Cookies, Web Beacons, and embedded scripts may collect personal information or other information about your use of the Online Audition over time and other third-party websites or applications and they may otherwise collect or have access to information about you, including Usage Information. Cookies and Web Beacons, including those set by third-party network advertisers, may be used to, among other things, target advertisements, prevent you from seeing the same advertisements too many times, or conduct research regarding the usefulness of certain advertisements to you.

Please note that third parties may collect personal information about your online activities over time and across different websites when you visit or use the Online Audition or other online websites and services. For example, some third parties' embedded content or plugins on the Online Audition, such as social media sharing tools, allow their operators to learn that you have visited or interacted with the Online Audition, and they may combine this information with other, identifiable information they have collected about your visits to other websites or online services. These third parties may handle this information, and other information they directly collect through their content and plugins, pursuant to their own privacy policies.

Online Tracking. Some web browsers incorporate a “Do Not Track” feature that signals to websites that you visit that you do not want to have your online activity tracked. How browsers communicate the Do Not Track signal is not yet uniform. For this reason, the Online Audition do not respond to such signals, except where required by law.

c. Personal Data We Receive from Third Parties

(1) Service providers acting on Our behalf:

We may receive Personal Data about you from service providers working on Our behalf. In addition, if you use another property and you opt-in to receive information from Us, that property may forward to Us your email address and other Personal Data so that We may contact you as requested. We may also supplement the Collected Data with outside records from third parties to enhance Our ability to serve you. We may combine the Personal Data We receive from these third parties with the Collected Data. In those cases, We will apply this Privacy Policy to any Personal Data received, unless We have disclosed otherwise.

(2) Social Media Applications that Provide Personal Data to Us:

Functionality on the Online Audition may permit interactions between the Online Audition and third-party properties, such as Facebook and Twitter. Such functionality enables you to “like” a product or online content, “share” content to other properties, and otherwise link the Online Audition with another third-party property. If you choose to “like” or “share” content or to otherwise post information from or via the Online Audition to a third-party property, that information may become public and the third-party property may have access to your Personal Data and information regarding your use of the Online Audition.

You may also choose to participate in a third-party application or feature (such as Facebook applications or a similar application or feature on a third-party property, or otherwise linking the Online Audition with another property) through which you allow Us to collect (or the third party to share) your Personal Data. When you choose to participate, you may be opting to link your activity on the Online Audition with that third-party property, which may then collect information about your visits to the Online Audition and may publish that activity as you request to your "profile" or similar feature with that third party (such as if you choose to share content you find on one of the Online Audition with your "connections" on the third party's property). The Personal Data We collect is subject to this Privacy Policy. However, the Personal Data collected and stored by the third party remains subject to the third party's privacy practices, including whether the third party continues to share information with Us or with other third parties, the types of information shared, and your choices regarding what is visible to others on that third party's property. The third party may allow you to remove an application or feature, in which case We will no longer collect Personal Data about you through the application or feature, but We may retain the Personal Data previously collected in accordance with this Privacy Policy.

2. Processing Purposes

We will use the Collected Data for the following purposes:

a. Registration for PRISM Project General Audition 2022: We use your credential information to register you as an applicant for PRISM Project General Audition 2022;

b. Service Provision: We use the Collected Data to operate, maintain, enhance and provide features and functions of the Online Audition, including processing your registration;

c. Communications: We use the Collected Data to communicate with you about the Online Audition for administrative and informational purposes. Examples of said communications include notifications related to the Online Audition, responses to your inquiries or requests, customer support-related communications and changes to any of Our terms & conditions or policies;

d. Service Improvement and Development: We use the Collected Data to optimize and improve Our services, including the Online Audition, and to develop new products, contents, services, features and functions by analyzing and understanding the usage trends and preferences of Our users;

e. Compliance with Law: We use the Collected Data to ensure compliance with Our internal policies, agreements with Our stakeholders, applicable laws and regulations, court orders, government and law enforcement requests. We also use the Collected Data to enforce or defend Our legal rights or the terms and conditions of any Our service, or to retain and store your Personal Data to comply with specific legal retention requirements, regulatory audits, and other record keeping purposes (including to meet internal and external audit requirements);

f. Fraud prevention and investigation: We will use the Collected Data to comply with monitoring, prevention, detection and investigation obligations, laws associated with the identification and reporting of illegal and illicit activity, including fraud and anti-money laundering, and financial reporting obligations;

g. Security: We will use the Collected Data to maintain the integrity and security of Our websites, contents and services and preventing and detecting security threats, fraud or other criminal or malicious activity that might compromise your Devices; and

h. Other: In any other way, with your consent or permitted under applicable law.

3. Legal Justifications of the Processing of your Personal Data

For the purpose of this Privacy Policy, “EU” includes the United Kingdom, even though the United Kingdom has left the EEA following Brexit, and, where applicable, Switzerland. We rely on the following legal bases for processing the Collected Data. If you are in the United Kingdom, references to Articles of the GDPR in this Privacy Policy shall also mean the equivalent provisions under the GDPR as incorporated into the laws of the United Kingdom (“UK GDPR”):

a. Performance of Contract, Art 6 (1) (b) GDPR: We use the Collected Data to provide you with the Online Audition. Such use is necessary to carry out the Online Audition.

b. Legitimate Interest, Art 6 (1) (f) GDPR: We, or a third party, have legitimate interest in using the Collected Data. In particular, We have a legitimate interest in using the Collected Data to improve and develop Our products, contents and services and to improve the safety, security, and performance of the Online Audition. When We process the Collected Data for Our legitimate interests, We make sure to consider and balance any potential impact on you, and your interests, rights and freedom under any applicable laws. We will not use the Collected Data for any processing where Our interests are overridden by the impact on you, unless We have your consent for Our processing, or otherwise required by law. You have the right to object to processing that is based on Our legitimate interests, as indicated in Section 7 below.

c. Legal Obligation, Art. 6 (1) (c) GDPR: We have a legal obligation under EU and/or Member State Law to use the Collected Data, such as the obligation to monitor, prevent, detect and investigate illegal and illicit activity, including fraud and anti-money laundering, and the obligation to provide financial reporting.

d. Consent, Art. 6 (1) (a) GDPR: Where Our processing is made based on your consent, you have the right to withdraw your consent at any time, as indicated in Section 7 below. For example, where you give Us consent to place Cookies and to use similar technologies, you will be able to opt-out of those materials in accordance with the instructions made in Our communication.

The table below summarizes the Personal Data processed for the respective purposes as well as the applicable legal basis.

4. Data transfers and recipients and legal justification for such transfers

We will make the Collected Data available to third parties as follows:

a. (Third-Party) Service providers

We may use service providers to process the Collected Data, some of which may be internal (i.e., part of SME) or external (third party) service providers. In any case, the service providers are engaged for the purposes of pursuing the activities outlined in this Privacy Policy. Some of the service providers are acting on Our behalf as data processors pursuant to Art. 28 GDPR. However, We may also transfer to other third-party service providers acting as independent controllers (e.g., lawyers, accountants, auditors, etc.) in accordance with applicable law pursuant to GDPR.

b. Business transfer

In the event that We sell or transfer a portion or all of Our business, the Collected Data may be transferred by Us to the purchasing or acquiring entity as part of the transaction. We will continue to ensure the confidentiality of the Collected Data before such transaction occurs, and after such transaction, We will delete the Collected Data as soon as reasonably practicable. To the extent, We transfer the Collected Data for such purposes, the transfer is based on GDPR.

c. Compliance and enforcement

We will retain, use and/or disclose any of the Collected Data as required or permitted by law, regulation or order, including to the police or other appropriate authorities, to investigate complaints made by or against you, or to protect or defend Ourselves, or others, against illegal, criminal or harmful activities. To the extent We transfer the Collected Data for such purposes, the transfer is based on GDPR.

5. International Transfer of the Collected Data

The Collected Data will be processed, stored and transferred for the purposes outlined in this Privacy Policy from your country/region of residence to various countries/regions outside your country/region of residence, including Japan and the United States. The Collected Data will be processed by staff operating outside your country/region of residence who work for Us or for one of Our service providers and may be disclosed to such staff in those countries/regions. We take appropriate measures to ensure that all transfers of the Collected Data from the EU to countries/regions outside the EU meet the requirements of applicable EU and UK data protection legislation and to ensure that appropriate technical and organizational security measures are in place to protect Personal Data against accidental or unlawful destruction, accidental loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Where information is transferred outside the EU, and where this is to a stakeholder or vendor in a country/region that is not subject to an adequacy decision by the EU Commission or adequacy regulations under the UK GDPR (i.e., a country/region that does not provide the same level of data protection as your country/region of residence), data is adequately protected by EU Commission approved standard contractual clauses (2010/87/EU and/or 2004/915/EC, which are accessible via the contact details provided in I. 9. above), or a vendor's Processor Binding Corporate Rules. Any onward transfer is subject to appropriate onward transfer requirements as required by applicable law. Nonetheless, this may impact your data subject rights in your local jurisdiction and also in the applicable overseas jurisdiction(s). These overseas jurisdictions may also need to disclose your Personal Data to a third party, e.g., an overseas authority. If you have any questions or concerns about Our data transfer arrangements, please contact Us (see I. 9. above).

6. Retention periods for and deletion of the Collected Data

We will continue to retain the Collected Data for 12 months after the completion of PRISM Project General Audition 2022 unless local law tells Us to keep it for longer. Please note that We may be required to retain certain information by law. In principle, We will retain the Collected Data only as long as required or permitted by applicable law, in particular as long as the Collected Data may be needed to fulfill or defend against claims that are not yet time-barred. Where We no longer require the Collected Data, it will be destroyed or de-identified in line with Our policies. When We say de-identified, We mean that We will remove information that could be used to identify you from the Collected Data.

7. Your statutory rights

Under the conditions set out under applicable law (i.e., the GDPR), you have the following rights:

a. Right of access: You have the right to obtain from Us confirmation as to whether or not Personal Data concerning you is being processed, and, where that is the case, to request access to the Personal Data. The access information includes – inter alia – the purposes of the processing, the categories of Personal Data concerned, and the recipients or categories of recipients to whom the Personal Data have been or will be disclosed.

b. You have the right to obtain a copy of the Personal Data undergoing processing. For additional copies requested by you, We may charge a reasonable fee based on administrative costs.

c. Right to rectification: You have the right to obtain from Us the rectification of inaccurate Personal Data concerning you. Depending on the purposes of the processing, you have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.

d. Right to erasure (right to be forgotten): You have the right to ask Us to erase your Personal Data.

e. Right to restriction of processing: You have the right to request the restriction of processing your Personal Data. In this case, the respective data will be marked and may only be processed by Us for certain purposes.

f. Right to data portability: You have the right to receive the Personal Data concerning you which you have provided to Us in a structured, commonly used and machine-readable format and you have the right to transmit those Personal Data to another entity without hindrance from Us.

g. Right to object:

You have the right to object, on grounds relating to your particular situation, at any time to the processing of your Personal Data by Us and We can be required to no longer process your Personal Data. If you have a right to object and you exercise this right, your Personal Data will no longer be processed for such purposes by Us. Exercising this right will not incur any costs. Such a right to object may not exist, in particular, if the processing of your Personal Data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

h. Right to withdraw consent: Where Our processing is based on your consent, you can withdraw your consent at any time without giving reasons with effect for the future. Until then, We process your Personal Data legally.

Please note that the aforementioned rights might be limited under the applicable national data protection law. Please refer any of your questions to audition@prismproject.jp. In case of complaints, you also have the right to lodge a complaint with the competent supervisory authority, in particular in the Member State of your habitual residence or alleged infringement of the GDPR, or if you are in the United Kingdom, the Information Commissioner’s Office (“ICO”).