Article 1 (Business Information and Data Controller)

The Company is the controller of personal information collected and used under this Policy (the data controller under GDPR).

• Name: Virtual Craft, Inc.
• Address: Banfore Sankei Building 4F, 1-28-10 Takadanobaba, Shinjuku-ku, Tokyo 169-0075, Japan
• Contact: Contact Form

While the Company may not be subject to the obligation to appoint a Data Protection Officer (DPO) under Article 37 of GDPR, we have appointed an internal personal information protection officer for the appropriate management of personal information.

Article 2 (Scope of Application)

1. 1) This Policy applies to personal information collected by the Company in connection with the use of the Service.
2. 2) The handling of information on third-party websites and services linked from the Service (e.g., social media, external cloud services) is subject to the policies of such third parties.

Article 3 (Definitions)

1. 1) 'Personal information' means personal data as defined by APPI and GDPR, including information that can identify a specific individual through name, address, telephone number, email address, or other descriptions, or information that can identify a specific individual when easily cross-referenced with other information.
2. 2) 'Personal-related information' means browsing history, identifiers, and other information obtained through cookies that does not identify an individual on its own but may be used as personal data by third parties.
3. 3) 'User' means any individual who views or uses the Service.

Article 4 (Information We Collect)

The Company may collect the following information to provide the Service:

1. 1) Information entered and submitted by users
   　Name, email address, telephone number, address, company name, department, job title, inquiry content, and other information voluntarily entered by users
2. 2) Information automatically collected through use of the Service
   　IP address, browser and device information, OS, access date and time, pages viewed, referring URL, communication logs, device identifiers, etc.
3. 3) Information collected through cookies and similar technologies
   　Cookie identifiers, browsing history, site behavior information, advertising identifiers, etc. (may be disabled through user settings)

Article 5 (Purpose of Use)

The Company uses collected personal information for the following purposes:

1. 1) Responding to inquiries, communication, identity verification, and necessary procedures
2. 2) Provision, maintenance, protection, and improvement of the Service (including bug fixes, quality improvement, and new feature development)
3. 3) Security assurance, fraud prevention, access analysis, and incident response
4. 4) Compliance with legal obligations, dispute and trouble resolution, and exercise or defense of rights
5. 5) Service and event notifications (such as email distribution) with user consent
6. 6) Creation of statistical data or anonymized information that cannot identify individuals, and use of such data for training and improving AI (artificial intelligence) and other machine learning models
7. 7) Purposes incidental to the above

Article 6 (Legal Basis for Processing Personal Information)

Where GDPR applies, the Company processes personal information based on the following legal grounds:

1. 1) Consent: When users have given explicit consent (voluntary and withdrawable at any time)
2. 2) Performance of a contract: When necessary for responding to inquiries, contracts, or pre-contractual measures
3. 3) Legal obligation: When necessary to comply with applicable laws
4. 4) Legitimate interests: When reasonably necessary for service improvement, security assurance, and business operations (to the extent that it does not unduly infringe on users' rights and interests)

Article 7 (Cookies, Access Analysis, and External Transmission)

1. 1) The Company uses cookies and similar technologies for convenience improvement and site enhancement. In accordance with the Telecommunications Business Act and other regulations, when information is transmitted from users' devices to third-party servers (external transmission), the Company will appropriately notify or publish the items of information transmitted, destinations, and purposes of use.
2. 2) Users may disable cookies through browser settings, but some features of the Service may become unavailable in that case.
3. 3) The Company may use access analysis tools (e.g., Google Analytics). These tools collect access information using cookies, and the Company receives the analysis results to improve the Service.
4. 4) For users accessing from the EEA (European Economic Area), the Company obtains prior explicit consent for non-essential cookies. The Company records and manages consent status through a Cookie Consent Management Platform (CMP), and users may change or withdraw their consent at any time.

Article 8 (Third-Party Provision, Outsourcing, and Joint Use)

1. Third-Party Provision
The Company will not provide personal data to third parties without user consent, except as required by law.

2. Outsourcing
The Company may outsource the handling of personal information to cloud providers, access analysis providers, email distribution and support tool providers, etc., for the operation of the Service. In such cases, the Company appropriately selects contractors and supervises them through contracts and other necessary and appropriate measures.

3. Joint Use
The Company does not currently engage in joint use of personal data. If joint use is conducted, the Company will publish in advance the items to be jointly used, purposes of use, scope of joint use, and responsible manager in this Policy.

4. Third-Party Provision of Personal-Related Information
When cookie-related information obtained by the Company is expected to be used as personal data by third parties, the Company will obtain necessary consent or confirmation in accordance with APPI and other applicable laws.

Article 9 (International Data Transfers)

1. 1) As a general rule, the Company stores and manages customers' personal information on servers located in Japan. Japan has received an adequacy decision from the European Commission, recognizing it as having an adequate level of data protection under the EU General Data Protection Regulation (GDPR).
2. 2) When the Company transfers personal information to third parties located in third countries (outside the EEA and Japan) that have not received an adequacy decision, or when contractors are located in such third countries, the Company will implement appropriate safeguards required by law, such as concluding Standard Contractual Clauses (SCC) under Article 46 of GDPR.

Article 10 (Representative within the EEA)

If the Company is required to appoint a representative under Article 27 of GDPR, such as when continuously providing services to users within the EEA, the Company will appoint a representative within the EEA and publish their contact information in this Policy.

Article 11 (Retention Period)

The Company retains personal information only for the period necessary to achieve the purposes of use, and when no longer needed, takes measures such as deletion or anonymization using methods that make recovery difficult. The following periods are set as guidelines:

1. 1) Inquiry information: 3 years after completion of response
2. 2) Transaction-related information: Period required by laws and regulations
3. 3) Access logs: 1 year (may be extended within a reasonable scope when necessary for security investigations, etc.)

Article 12 (Security Measures)

The Company implements reasonable security measures to prevent leakage, loss, or damage of personal information. Examples include access control, authority management, log auditing, encryption, vulnerability countermeasures, employee training, and contractor management.

Article 13 (Security Incident Response)

In the event of a personal information breach, the Company will, in accordance with applicable laws, investigate the facts, prevent damage from spreading, implement measures to prevent recurrence, report to relevant authorities, and provide necessary notifications.

Article 14 (User Rights and Request Procedures)

1. 1) Users to whom GDPR applies have rights under the law, including access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. The Company does not currently engage in decision-making based solely on automated processing (including profiling).
2. 2) Users to whom APPI applies may request disclosure, correction, addition, deletion, suspension of use, erasure, and cessation of third-party provision regarding retained personal data.
3. 3) Request Procedures
   Please contact the inquiry office in Article 15 to make a request. For identity verification purposes, we may ask you to provide additional information (e.g., registered email address) within a reasonable scope. Please note that we may charge a fee equivalent to actual costs within the scope permitted by law.

Article 15 (Contact Information)

For questions or requests regarding this Policy, please contact us at:

• Virtual Craft, Inc. Personal Information Protection Office
• (Responsible Manager: Takeharu Kodera, Representative Director)
• Contact: Contact Form

* For identity verification purposes, we may request submission of copies of official identification documents.

Article 16 (Changes to This Policy)

The Company may revise this Policy in response to legal amendments or changes in service content. In case of significant changes, the Company will notify users through posting on the Service or other methods deemed appropriate by the Company.