Privacy Policy

1. Basic Policy

The Company complies with the Act on the Protection of Personal Information, maintains an appropriate organizational structure, and strives to properly protect personal information.

2. Appropriate Collection of Personal Information

When collecting personal information, the Company does so by fair and appropriate means. The Company does not collect sensitive personal information ("special care-required personal information") except where prior consent has been obtained or where permitted by law.

3. Implementation of Appropriate Measures

1. The Company manages personal information entrusted to it by customers and others appropriately and carefully, and takes necessary and reasonable security measures to prevent leakage, loss, misuse, alteration, and unauthorized access. When collecting personal information via communication networks, the Company works to ensure security through technologies such as SSL (Secure Socket Layer) encrypted communication, to guard against interception by third parties during transmission.
2. Personal information entrusted to the Company is managed strictly in accordance with applicable law.

4. Purpose of Use

The Company collects personal information from data subjects through lawful and fair means, and uses it within the scope necessary to achieve the following purposes: providing the Company's business services; responding to inquiries; handling incidents, accidents, and other troubles; analyzing questionnaires; delivering behavioral-targeting advertisements through advertising providers such as Google and Yahoo; providing information and advertisements about products, services, and campaigns via guidance and e-mail; the Company's sales activities; and recruitment activities. Should it become necessary to use personal information beyond this scope, the Company will announce this on its website or by other means.

5. Categories of Personal Information Collected

(1) Information provided directly by you

Name, address, phone number, e-mail address, social media user ID, date of birth, gender, nationality, passport and visa information, marketing-related information, information you enter into input forms on sites operated by the Company, information entered by Company staff at your instruction, information about previous stays, extended stays, and other services and products you have used, information about your preferences that the Company becomes aware of while you use the Company's services, information you provide to use the Company's services, and other information essential to transactions, including information obtained by business partners and travel agencies from you in connection with various applications and provisions.

(2) Information collected automatically

Device information, log information, anonymous IDs, location information, IP addresses, and device identification information collected through the use of cookies and similar technologies, as well as information collected through security cameras and other security technologies. The Company uses analytics tools such as Google Analytics to understand how you use the Company's website.

(3) Information obtained from third parties

Where the Company indirectly collects personal information from a third party, it confirms with the provider that the information was appropriately collected from you, and obtains personal information within the scope necessary to achieve its purpose of use after making appropriate contractual arrangements.

6. Disclosure and Provision to Third Parties

(1) The Company may entrust personal information to outside service providers to the extent necessary to carry out its operations. In such cases, the Company does so under its strict management, and gives due consideration to the protection of personal information in the terms of the relevant contract.

(2) Except in the following cases, the Company will not provide personal information it holds to third parties:

1. Where you have given your consent.
2. Where disclosure is requested based on laws and regulations.
3. Where your violation of the Terms of Use significantly harms the Company's interests.
4. Where necessary to protect a person's life, health, or property.
5. Where particularly necessary for improving public health or promoting the sound development of children.
6. Where cooperation is necessary for a national or local government body, or a party entrusted by such a body, to carry out affairs prescribed by law, and obtaining your consent would impede the performance of such affairs.
7. Where disclosed or provided to a subcontractor within the scope necessary to provide services to you.
8. Where personal information, or the authority to manage it, is transferred as part of business assets in connection with a merger, company split, or business transfer.

7. Joint Use and Outsourcing

The Company may jointly use your personal information, within the scope of the purposes of use above, with Company group entities. In such cases, the Company acts as the party responsible for supervision.

In addition, the Company may, within the scope of the purposes of use above, outsource part of its operations to partner companies. In such cases, the Company enters into confidentiality agreements with its partner companies and provides appropriate supervision.

8. Anonymized Information

The Company handles anonymized information (as defined under the Act on the Protection of Personal Information) in accordance with applicable law.

9. Requests for Disclosure, Correction, etc.

Where the Company receives a request based on the Act on the Protection of Personal Information for disclosure, correction, addition, deletion, suspension of use, or erasure of personal information it holds, the Company will respond in accordance with the Act, after confirming that the request is made by the data subject themselves. To make such a request, please contact us using the details in Section 10 below.

10. Contact

For inquiries regarding this Privacy Policy or requests under the preceding section, please contact us at the following:

Address
6F Prime Takadanobaba 4-chome Building, 4-39-7 Takadanobaba, Shinjuku-ku, Tokyo, Japan

Company Name
Kasoku Co., Ltd.

Representative Director
Keisuke Arai

11. Use of Cookies and Google Analytics

The Company uses cookies. You may restrict the use of cookies through your browser settings; however, please note that doing so may limit certain functions of the Company's services and website. The Company also uses Google Analytics to understand website usage. For details on how Google Analytics collects and processes data, please refer to the following:

• https://marketingplatform.google.com/about/analytics/terms/jp/
• www.google.com/intl/en/policies/privacy/
• www.google.com/intl/en/policies/privacy/partners/

12. Retention Period

The Company retains your personal information only for as long as necessary to achieve the purposes set out in Section 1, and promptly erases it once such necessity no longer applies. Even after you discontinue use of the Company's services, the Company may retain and use your personal information for a certain period where necessary to comply with legal obligations or to handle business-related communications.

13. Additional Provisions for Users in the European Economic Area (EEA), the United Kingdom, and Switzerland (GDPR)

Where the Company processes personal data of individuals located in the EEA, the United Kingdom, or Switzerland in connection with the offer of goods or services or the monitoring of behaviour, the following additional provisions apply, in accordance with the EU General Data Protection Regulation ("GDPR") and equivalent UK and Swiss legislation.

(1) Data controller

Kasoku Co., Ltd. (contact details in Section 10) acts as the data controller for the personal data described in this Privacy Policy.

(2) Legal basis for processing

The Company processes personal data on the following legal bases: performance of a reservation or other contract with you; the Company's legitimate interests (for example, service improvement, fraud prevention, and direct marketing, which you may object to at any time); your consent (for example, for analytics or advertising cookies); and compliance with the Company's legal obligations.

(3) International data transfers

Personal data collected in connection with your stay is transferred to and processed by the Company in Japan. The European Commission has recognised Japan as ensuring an adequate level of protection of personal data under a mutual adequacy arrangement in effect since January 2019, and the United Kingdom has extended equivalent recognition to Japan. Accordingly, such transfers may generally take place without additional safeguards such as Standard Contractual Clauses, although the Company will implement such safeguards where required by applicable law.

(4) Your rights

Subject to the conditions set out in the GDPR, you have the right to: request access to your personal data; request rectification of inaccurate data; request erasure of your data; request restriction of processing; request portability of your data; object to processing based on legitimate interests or for direct marketing; and withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before such withdrawal. To exercise any of these rights, please contact us using the details in Section 10.

(5) Right to lodge a complaint

You have the right to lodge a complaint with the data protection supervisory authority in your country of habitual residence, place of work, or the place of the alleged infringement, if you consider that the Company's processing of your personal data infringes applicable data protection law.

(6) EU/UK representative

The Company's processing of personal data of individuals in the EEA and UK is occasional and limited in scale. The Company will appoint a representative in the EEA and/or UK under Article 27 of the GDPR (and equivalent UK legislation) if and when required to do so based on the nature, scope, and regularity of such processing.

Note: This section reflects common practice among internationally-facing hotels and lodging providers, drafted as a starting point for review. Implementation can proceed first — please have your legal/compliance team confirm the final content after launch, at your convenience, in particular the Article 27 GDPR representative assessment in (6), and whether a cookie-consent mechanism is required for EEA/UK/Swiss visitors under Section 11.

14. Changes to this Privacy Policy

The Company may revise this Privacy Policy as necessary.