- 当社の提供する「ブーケ」では、お客様のGoogleフォトのデータを取得する目的でGoogle Photos APIを使用することがあります。ブーケは、お客様が同意した場合に限り、Google Photos APIを使用します。取得するデータは画像、動画、アルバム名などお客様がGoogleフォトに保存された情報であり、取得したデータは端末に保存されます。端末に保存された情報を当社が利用することはありません。
- 当社の提供する「monoca」「kotoca」「道の駅めぐり」及び「Cahoのパスワード管理」では、アプリのデータを保存する目的でGoogle Drive APIを利用することがあります。これらのサービスは、お客様が同意した場合に限り、Google Drive APIを利用します。保存された情報を当社が利用することはありません。
- 当社の提供する「monoca」「kotoca」及び「Cahoのパスワード管理」では、お客様が登録された情報をGoogleカレンダー上に反映するために、Google Calendar APIを利用することがあります。これらのサービスは、お客様が同意した場合に限り、Google Calendar APIを利用します。登録された情報を当社が利用することはありません。
Google社プライバシーポリシー : https://www.google.com/intl/ja/policies/privacy/
The Company establishes certain mechanisms and policies to protect personal information.The Company will promote the protection of personal information by thoroughly
· Management System
The company will take all necessary actions to prevent any kind of misuse of personal information. The Company is willing to force the thorough implementation of safety measures and strict management of personal information within the Company.
- To maintain and to improve current services and to assist the development of new ones
- To provide after-sales services and customer support
- To proceed the selection and recruitment process (in case you applied)
- In case of mutual consent
- In case disclosure of the information is required by the law
- In case the Company determines that it is necessary for the protection of human life, health or property to share the information
- In case the Company determines that sharing the information is necessary in order to ensure the cooperation with the government or local public entities or those entrusted
- In case the Company determines that sharing the information is necessary in order to secure the rights of the partners of the Company or the Company itself
- In case the handling of personal information to a certain and well-documented extent is absolutely necessary in order to execute certain corporate and business tasks
The Company is not responsible for lost, destroyed, altered, leaked, etc. personal information caused by other third parties and companies.
- In case the customer reveals personal information to a third party by using the functions of our services or any other means
- In case personal information is leaked due to information shared, disclosed by the customer in any way while using our service.
Address: 〒101-0021 9F VORT Suehirocho II6-14-3, Sotokanda, Chiyoda-ku, Tokyo101-0021, Japan
The English version is a translation of the original in Japanese for reference purposes only.In case of a discrepancy, the Japanese original shall prevail.
GDPR Compliance Statement 2018.05.25
The EU General Data Protection Regulation (“GDPR”) came into force across the European Union on 25th May 2018 and we are committed complying with its guidelines and regulations.
Our preparation and objectives for GDPR compliance have been summarized in this statement and includes the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.
You may find the original document below.
Data Protection – our main policy and procedure document for data protection have been overhauled to meet the standards and requirements of the GDPR. Accountability and governance measures are in place to ensure that we understand and adequately disseminate and evidence our obligations and responsibilities; with a dedicated focus on privacy by design and the rights of individuals.
Data Retention & Erasure – we have updated our retention policy and schedule to ensure that we meet the ‘data minimization’ and ‘storage limitation’ principles and that personal information is stored, archived and destroyed compliantly and ethically. We have dedicated erasure procedures in place to meet the new ‘Right to Erasure’ or “Right to be Forgotten” obligations and are aware of when this and other data subject’s rights apply; along with any exemptions, response timeframes and notification responsibilities.
Data Breaches – our breach procedures ensure that we have safeguards and measures in place to identify, assess, investigate and report any personal data breach at the earliest possible time. Our procedures are robust and have been disseminated to all employees, making them aware of the reporting lines and steps to follow.
International Data Transfers & Third-Party Disclosures – we are storing user information mostly outside of the EU [Japan], but we ensure our users that we keep and respect the EU regulations and make sure that all the third parties we are working together with are doing their tasks in the exact same manner.
We have robust procedures and safeguarding measures in place to secure, encrypt and maintain the integrity of the data. Our procedures include a continual review of the third parties we are working together with, as well as provisions for binding corporate rules; standard data protection clauses or approved codes. We carry out strict due diligence checks with all recipients of personal data to assess and verify that they have appropriate safeguards in place to protect the information, ensure enforceable data subject rights and have effective legal remedies for data subjects where applicable.
Subject Access Request (SAR) – we have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate.
We have made our SAR services available in both English and Japanese.
Legal Basis for Processing – we are reviewing all processing activities to identify the legal basis for processing and ensuring that each basis is appropriate for the activity it relates to. Where applicable, we also maintain records of our processing activities, ensuring that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Bill are met.
Obtaining Consent – we have revised our consent mechanisms for obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information. We have developed stringent processes for recording consent, making sure that we can evidence an affirmative opt-in, along with time and date records; and an easy to see and access way to withdraw consent at any time.
Direct Marketing – we have revised the wording and processes for direct marketing, including clear opt-in mechanisms for marketing subscriptions; a clear notice and method for opting out and providing unsubscribe features on all subsequent marketing materials.
Processor Agreements – where we use any third-party to process personal information on our behalf (i.e. Payroll, Recruitment, Hosting etc), we have drafted compliant Processor Agreements and due diligence procedures for ensuring that they (as well as we), meet and understand their/our GDPR obligations. These measures include initial and ongoing reviews of the service provided, the necessity of the processing activity, the technical and organizational measures in place and compliance with the GDPR.
Special Categories Data – where we obtain and process any special category information, we do so in complete compliance with the Article 9 requirements and have high-level encryptions and protections on all such data. Special category data is only processed where necessary and is only processed where we have first identified the appropriate Article 9(2) basis or the Data Protection Bill Schedule 1 condition. Where we rely on consent for processing, this is explicit and is verified by a signature, with the right to modify or remove consent being clearly signposted.
Data Subject Rights
In addition to the policies and procedures mentioned above that ensure individuals can enforce their data protection rights, we provide easy to access information via our website and contact lines of an individual’s right to access any personal information that Sola K.K. (株式会社, Kabushiki Kaisha) processes about them and to request information about:
• What personal data we hold about them
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom the personal data has/will be disclosed
• How long we intend to store your personal data for
• If we did not collect the data directly from them, information about the source
• The right to have incomplete or inaccurate data about them corrected or completed and the process for requesting this
• The right to request erasure of personal data or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use
• The right to lodge a complaint or seek judicial remedy and who to contact in such instances
Information Security & Technical and Organizational Measures
Sola K.K. takes the privacy and security of individuals and their personal information very seriously and take every reasonable measure and precaution to protect and secure the personal data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorized access, alteration, disclosure or destruction and have several layers of security measures, including: –
Access Control Measures
Password Policy and Encryption
GDPR Roles and Employees
We have designated Keisuke Yoshimura as our Data Protection Officer (DPO) he is responsible for promoting awareness of the GDPR across the organization, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures, and measures.
We understand that continuous employee awareness and understanding is vital to the continued compliance of the GDPR and have involved our employees in our preparation plans. We have implemented an employee training program specific to the which will be provided to all employees prior to May 25th, 2018, and forms part of our induction and annual training program.
9F VORT Suehirocho II
6-14-3, Sotokanda, Chiyoda-ku, Tokyo
TEL ： 03-6860-8482
E-Mail ： email@example.com
The App "Bouquet" may use Google Photos API, which allows us to retrieve data from Google Photos with the customer's permission. The acquired data includes images, videos, album names, and other information saved by the customer in Google Photos, and the acquired data is stored on the customer's device. The Company do not use the information stored on the device.
The App "monoca", "kotoca", "Michi no Eki Meguri" and "Caho's Password Management" may use Google Drive API for the purpose of storing application data. Google Drive API will only be used when a user gives consent. The Company will not use the stored information.
The App "monoca", "kotoca" and "Caho's Password Management" may use Google Calendar API to reflect user's registered information on Google Calendar. Google Calendar API will only be used when a user gives consent. The Company will not use the registered information.
The app "Bouquet" we provide may use the Instagram Basic Display API for the purpose of retrieving the customer's images, videos, and album data. Bouquet will use the Instagram Basic Display API only if the customer agrees to it. The acquired data will be stored on the customer's device and will only be used to create mosaic art in the app. To delete the stored data, the customer can uninstall the application.
When the customer requests deletion of the personal information, upon deeming it necessary to comply with the request, we will delete the personal information after confirming that the request is made by the customer, and notify the customer of the deletion. When we receive a request for deletion of personal data provided by the Instagram Basic Display API via the inquiry form, we will promptly deal with the request in accordance with the terms and conditions.