Privacy Policy
for JR East Marketing & Communications, Inc. Websites

日本語はこちら

JR East Marketing & Communications, Inc. (1-5-5 Ebisu-minami, Shibuya-ku, Tokyo; Representative Director and President: Akihiko Ishikawa; “we,” “us,” “our,” or the “Company”) creates communications. Through transactions with advertisers, media companies, business partners and other counterparties, and through our business activities such as research and regional revitalization, we receive and hold valuable information assets relating to living individuals, including names, addresses, telephone numbers, e-mail addresses, images, audio recordings and Individual Numbers, by which a specific individual can be identified, either on its own or by being readily collated with other information.

Recognizing the importance of Personal Information and considering its protection to be a social responsibility, we comply with the Act on the Protection of Personal Information (the “APPI”), the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (the “My Number Act”), other applicable laws and regulations, relevant industry guidelines and other standards, and our internal rules, and appropriately collect, use and manage the Personal Information handled by us.

We respect the rights of individuals in relation to their Personal Information. If we receive a request for disclosure, rectification, suspension of use or similar action, we will respond within a reasonable period and to the extent prescribed by applicable laws and regulations.

We periodically review our procedures for the protection of Personal Information and strive for continuous improvement.

(For purposes of the Privacy Policy (the “Policy”), “Personal Information” includes “Specific Personal Information”.)

Name of the Personal Information Handling Business Operator and Its Representative

The Policy governs the handling of Personal Information (as defined below) on all websites operated by the Company, including websites relating to services provided by the Company (collectively, the “Company Websites”). If a separate privacy policy is established for any Company Website or any individual service provided through a Company Website, that separate privacy policy will prevail with respect to the handling of Personal Information on that website or in connection with that service. Details of external transmissions using cookies and similar technologies on the Website are set out in a separate Cookie Policy.

Definitions

In the Policy, the following terms have the meanings set out below:

• “Personal Information” means personal information as defined in the APPI, namely, information relating to a living individual that can identify a specific individual or that contains an individual identification code.
• “Personal Data” means personal data as defined in the APPI, namely, Personal Information constituting a Personal Information database, etc.
• “Information Related to Personal Information” means information related to Personal Information as defined in the APPI, namely, information relating to a living individual, such as cookies and similar identifiers and browsing history, that is neither Personal Information, Pseudonymously Processed Information nor Anonymously Processed Information.
• “Sensitive Personal Information” means sensitive Personal Information as defined in the APPI, including race, creed, medical history and other information requiring special care in its handling so as to avoid unjust discrimination, prejudice or other disadvantage to the individual.

PART I COLLECTION AND USE

Chapter 1 Categories of Personal Information Collected through the Website

We collect the following Personal Information through the Website to the extent necessary to achieve the relevant purposes of use.

In addition to the purposes of use set forth above, we will use personal information within the scope necessary to achieve the purposes of use that were notified to the individual at the time the personal information was collected.

As a general rule, we do not collect Sensitive Personal Information without obtaining the individual’s prior consent, except where permitted by applicable laws and regulations or otherwise legally authorized.

Chapter 2 How We Collect Personal Information

We collect the Personal Information described in the preceding chapter by any of the following methods:

1. Information entered by you

• Information that you enter in a questionnaire survey, inquiry form, career registration form or similar form on the Website.

2. Automatic collection

• Information automatically collected through cookies, tags and similar technologies when you browse or use the Website. Please see the Cookie Policy for details.

3. Collection from third parties

• Information lawfully and properly provided by business partners or other third parties.

PART II DISCLOSURE, EXTERNAL TRANSMISSION AND TRANSFERS

Chapter 3 Disclosure of Personal Data to Third Parties and Outsourcing

Disclosure to Third Parties

1. General rule

We will not provide Personal Data to a third party without the individual’s prior consent, except in any of the following circumstances:

1. The disclosure is required or permitted by laws and regulations.
2. The disclosure is necessary to protect the life, body or property of an individual and it is difficult to obtain the individual’s consent.
3. The disclosure is particularly necessary to improve public health or promote the sound upbringing of children and it is difficult to obtain the individual’s consent.
4. It is necessary to cooperate with a national government agency, local government, or a person entrusted by either of them in performing duties prescribed by law, and obtaining the individual’s consent is likely to impede the performance of those duties.

Notwithstanding the foregoing, we will not disclose Specific Personal Information to a third party unless the disclosure falls within a stated purpose of use of Specific Personal Information or is otherwise permitted by the My Number Act.

2. Records concerning disclosure to third parties

When we disclose Personal Data to a third party or receive Personal Data from a third party, we verify and record the recipient or source, the categories of Personal Data disclosed and other required matters, and retain the record for the prescribed period, in each case in accordance with applicable laws and regulations.

Outsourcing

We may outsource all or part of the handling of Personal Information to service providers to the extent necessary to achieve the purposes of use. In such cases, we will appropriately select such service providers, enter into agreements with them regarding the handling of Personal Information, prohibit them from using the entrusted information for any purpose other than the performance of the outsourced services, and require them to implement necessary security control measures.

In addition, in order to monitor the handling of Personal Data by such service providers, we will verify their handling practices through periodic reports, audits, or other appropriate means, taking into account factors such as the nature of the outsourced services, the characteristics of the Personal Data handled, and the associated risks.

Chapter 4 Use of Cookies and Other Technologies; External Transmission

The Website may use cookies and similar technologies to transmit information such as browsing history and identifiers from a Website user’s device to external business operators. Such transmission may constitute an external transmission under Article 27-12 of the Telecommunications Business Act.

The types and purposes of cookies and similar technologies, the names of recipient business operators, the information transmitted, purposes of use, methods of consent and opt-out, and other details are described in the separate Cookie Policy.

Chapter 5 Disclosure to Third Parties in Foreign Countries; Understanding the External Environment

We may provide Personal Data to third parties located in foreign countries. Due to the specifications of the cloud services used by the Company, the Company is unable to identify the countries in which the recipients are located or the measures taken by the recipients to protect Personal Information.

PART III MANAGEMENT AND INDIVIDUAL RIGHTS

Chapter 6 Retention and Deletion of Personal Data

We retain Personal Data only for the period necessary to achieve the relevant purpose of use. After the purpose has been achieved or retention is no longer necessary, we promptly delete or anonymize the Personal Data, except where retention is required by laws and regulations. Specific retention periods by category are set out below. For other Personal Data, we determine the retention period by considering the type and purpose of use of the Personal Data, the duration of the relevant contract, statutory retention obligations, the need to address claims or disputes, and any other reasonable necessity for retention.

1. Inquiry information:

• We determine the retention period by taking into account the reasonable necessity of retaining the personal data.

2. Job application and career registration information:

• For five (5) years from the date of collection.

3. Information automatically collected for access analytics and similar purposes with use of the Website:

• We determine the retention period by taking into account the reasonable necessity of retaining the personal data.

Chapter 7 Security Control Measures

We implement the following security control measures in relation to Personal Information that we have collected or seek to collect, in order to prevent leakage, loss or damage of Personal Data and similar incidents (collectively, a “Data Breach”):

1. Formulation of basic policies

   • To ensure the proper handling of Personal Data, we comply with applicable laws, regulations and guidelines and have formulated the Policy and the Basic Policy on the Protection of Personal Information.

2. Development of rules governing the handling of Personal Data

   1. We have established internal rules concerning the handling of Personal Information to ensure its proper collection, use, retention and management, and have clarified handling methods, responsible persons, personnel in charge and their duties at each stage, including collection, use, retention, disclosure, deletion and disposal.

3. Organizational security control measures

   1. We designate a person responsible for the handling of Personal Data, identify the employees who handle Personal Data and the scope of Personal Data handled by them, and maintain a reporting and communication system for notifying the responsible person if a violation, or an indication of a violation, of applicable laws and regulations or handling rules is identified.
   2. We periodically conduct self-inspections of our handling of Personal Data and audits by other departments or external parties.

4. Personal security control measures

   1. We train employees on the handling of Personal Data.
   2. We include confidentiality obligations concerning Personal Data in our work rules.

5. Physical security control measures

   1. In areas where Personal Data is handled, we take measures to prevent unauthorized persons from viewing Personal Data.
   2. We also take measures to prevent theft or loss of devices, electronic media and documents that contain Personal Data.

6. Technical security control measures

   1. We implement access controls to limit the personnel authorized to handle Personal Data and the scope of Personal Information databases and similar resources available to them.
   2. We have introduced mechanisms to protect information systems that handle Personal Data against unauthorized external access and malicious software.

7. Understanding the external environment

   1. If we handle Personal Data in a foreign country, including through the use of an overseas cloud service, we understand the Personal Information protection systems and other relevant circumstances in that country and implement necessary and appropriate security control measures.

8. Supervision of employees

   1. To ascertain how employees handle Personal Data, we conduct an audit or similar review at least once each year to verify that operations conform to applicable laws, regulations and internal rules, and promptly make improvements if any issue is identified.

9. Supervision of outsourcees

   1. We provide necessary and appropriate supervision of outsourcees in accordance with the APPI.

Chapter 8 Handling of Information Related to Personal Information

We may handle behavioral history, identifiers and other information collected through cookies and similar technologies that, by itself, does not identify a specific individual and constitutes Information Related to Personal Information. If we disclose Information Related to Personal Information to a third party and it is anticipated that the recipient will acquire it as Personal Data, we make the disclosure only after confirming, in accordance with applicable laws and regulations, that the recipient has obtained the individual’s consent or has otherwise satisfied the applicable requirements. Specific recipients, information transmitted and purposes of use are described in the Cookie Policy.

Chapter 9 Requests for Disclosure and Other Action

For consultations and complaints concerning our handling of Personal Information and for information concerning requests under the APPI for notification of the purpose of use of Retained Personal Data; disclosure, rectification, addition or deletion of Retained Personal Data; suspension of use or disclosure to third parties; or disclosure of records of disclosure to third parties (collectively, “Disclosure Requests”), please contact the desk specified in the next chapter by mail or through the inquiry form. We will individually explain the procedure for a Disclosure Request. After carrying out the necessary identity verification procedures, we will respond within a reasonable period and to the extent prescribed by applicable laws and regulations.

Please note that you may be required to bear actual costs such as postage for communicating the response to you.

Chapter 10 Privacy Information Desk

Corporate Planning Division
JR East Marketing & Communications, Inc.
1-5-5 Ebisu-minami, Shibuya-ku, Tokyo 150-8508, Japan

Inquiry Form

PART IV REGIONAL SUPPLEMENT

Chapter 11 Additional Provisions for Individuals in the EU/EEA and the UK (GDPR and UK GDPR)

This chapter applies in addition to the other provisions of the Policy only where the EU General Data Protection Regulation (“GDPR”) or the UK GDPR applies because, for example, we offer services or products to residents of the EU/EEA or the UK in those regions or monitor their behavior there. This chapter supplements the Policy and prevails in the event of any conflict with another provision of the Policy.

1. Controller; EU representative; UK representative

The controller for processing to which this chapter applies is the Company. We appoint DP-Dock GmbH (address: Ballindamm 39, 20095 Hamburg, Germany; contact: jeki@gdpr-rep.com) as our representative in the EU under Article 27 of the GDPR. We appoint DP Data Protection Services UK Ltd. (address: 16 Great Queen Street, Covent Garden, London WC2B 5AH, United Kingdom; contact: jeki@gdpr-rep.com) as our representative in the UK under Article 27 of the UK GDPR. Website users and supervisory authorities in the EU/EEA may contact us or our EU representative, and Website users and supervisory authorities in the UK may contact us or our UK representative, concerning matters addressed in this chapter.

2. Legal basis for Processing

The purposes of processing, legal bases and retention periods for the Personal Data that we collect are, as follows:

We may collect Personal Data about an individual indirectly from third parties, including through the following sources:

• Business partners: name, company name/affiliation, title/position, address, telephone number, e-mail address, details of inquiries and requests, etc.

If the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, you are required to provide that Personal Data. If you do not provide it, we may be unable to provide the products or services that you request.

Except where permitted by laws and regulations or with consent, we do not collect or use sensitive information concerning racial or ethnic origin, political opinions, religion or beliefs, trade-union membership, genetic data, biometric data, health data, or a person’s sex life or sexual orientation.

We do not use Personal Data for profiling activities or processes and do not use automated decision-making processes.

3. International transfers and safeguards

Within the relevant purposes of use, we may transfer Personal Information of individuals in the EEA or the UK to third parties in countries outside the EEA or the UK. In 2019, the European Commission and the UK Government granted adequacy decisions in respect of Japan.

Some third-country recipients may be located in countries that the European Commission has not recognized as having data protection laws that ensure a level of protection equivalent to that in the EEA and the UK. In such cases, we implement appropriate safeguards required for international data transfers, such as the EU Standard Contractual Clauses.

4. Your rights

Individuals to whom this chapter applies have rights to access, rectification, erasure, restriction of processing, data portability, objection to Processing, and not to be subject to a decision based solely on automated Processing, including profiling. They may also withdraw consent at any time. These rights may be exercised through the EU representative or the UK representative specified in Chapter 11.

5. Response to a Data Breach

If a Data Breach involving Personal Data to which this chapter applies occurs, we assess the risk and, in accordance with the GDPR, in principle report the breach to the supervisory authority within 72 hours and notify affected individuals without undue delay where required.

6. Right to lodge a complaint with a supervisory authority

An individual has the right to lodge a complaint concerning the Processing of their Personal Data with a data protection supervisory authority in the place of their habitual residence, place of work, or place of the alleged GDPR infringement, including the Information Commissioner’s Office (ICO) in the UK, as applicable.

PART V SUPPLEMENTARY PROVISIONS

Chapter 12 Updates of the Policy

We may amend the Policy from time to time in response to amendments to applicable laws and regulations, changes in our business, or other circumstances. We will announce material changes on the Website.

Established November 1, 2026

日本語はこちら