Japan EHS Audit Co., Ltd. (hereinafter referred to as "the Company") values the protection of personal data of customers located within the European Economic Area (EEA) (hereinafter referred to as "Data Subjects"). This Privacy Policy explains how we collect, use, share, and protect personal data based on the EU General Data Protection Regulation (GDPR).
The data controller for personal data covered by this Privacy Policy is as follows:
Company Name: Japan EHS Audit Co., Ltd.
Address: Kabutocho 6th Hayama Building 4F, 17-2 Nihonbashikabutocho, Chuo-ku, Tokyo 103-0026, Japan
Email: info@japan-ehs-audit.com
Phone: +81-3-6555-1440
We process your personal data for the following purposes based on specific legal grounds:
Provision of EHS/ESG audit and consulting services, contract performance, and post-contract management
We process names, titles, organization names, contact information (email addresses, phone numbers), and contract-related information to fulfill and manage contracts with customers. The legal basis for this processing is necessity for the performance of a contract (GDPR Article 6(1)(b)).
Response to inquiries, consultations, and quote requests from customers
We process names, titles, organization names, contact information, and inquiry details to respond to inquiries from customers. The legal basis for this processing is our legitimate interest (smooth conduct of business activities) (GDPR Article 6(1)(f)).
Provision of information regarding our services, seminars, etc.
We process names and contact information (email addresses) to deliver information about services and seminars. The legal basis for this processing is the consent of the Data Subject (GDPR Article 6(1)(a)).
Analysis of website usage status and service improvement
We process online identifiers such as cookies, IP addresses, and browsing history to improve website performance. The legal basis for this processing is the consent of the Data Subject (GDPR Article 6(1)(a)).
Compliance with laws and protection of our rights
We may process relevant personal data to comply with legal obligations or respond to legal claims. The legal basis for this processing is compliance with a legal obligation to which the controller is subject (GDPR Article 6(1)(c)) and our legitimate interest (response to legal claims) (GDPR Article 6(1)(f)).
We do not provide personal data to third parties without your consent, except for the following exceptions:
Service Providers: We may disclose personal data to service providers supporting our business, such as IT system providers (hosting, cloud services, etc.) and professional advisors (lawyers, accountants, etc.), within the scope necessary to achieve the purpose.
Google Analytics: Our website uses Google Analytics provided by Google, Inc. Information generated by this is transmitted to and stored by Google. We use this based on your consent.
Legal Obligations: When disclosure of personal data is required based on laws, legal procedures, or requests from government agencies.
The Company is a company based in Japan. Your personal data is processed and stored on servers in Japan. Japan has received an "adequacy decision" from the European Commission recognizing that it provides an adequate level of data protection. As a result, the transfer of personal data from the EEA to Japan is lawfully conducted based on the GDPR.
If some service providers (e.g., Google Analytics) are located in countries that have not received an adequacy decision, such as the United States, we will protect your personal data by taking appropriate protective measures required by the GDPR, such as concluding Standard Contractual Clauses (SCCs).
We retain your personal data only for the period necessary to achieve the purpose for which it was collected. The specific retention period is determined considering the contract period, legal preservation obligations (e.g., accounting books), and the necessity for dispute resolution. Data for which the purpose has been achieved will be promptly erased or anonymized.
Under the GDPR, you have the following rights regarding your personal data:
Right of Access: The right to confirm whether your personal data is being processed and, if so, to request access to that data.
Right to Rectification: The right to have inaccurate personal data rectified without undue delay.
Right to Erasure ("Right to be Forgotten"): The right to have your personal data erased without undue delay under certain conditions.
Right to Restriction of Processing: The right to restrict the processing of your personal data under certain conditions.
Right to Data Portability: The right to receive your personal data held by us in a structured, commonly used, and machine-readable format and to transmit those data to another controller.
Right to Object: The right to object at any time to the processing of personal data based on our legitimate interests.
Right to Withdraw Consent: The right to withdraw consent at any time if personal data is processed based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.
If you wish to exercise these rights, please contact us at the contact information in "2. Data Controller" above.
If you are dissatisfied with our handling of personal data, you have the right to lodge a complaint with the data protection supervisory authority of your residence, place of work, or the place of the alleged GDPR violation.
We do not engage in automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.
We may revise this policy from time to time depending on changes in laws and business content. If there are any significant changes, we will notify you on our website.