VirtualCraft, Inc.// CRAFTING VALUE TOGETHER

Article 1 (Business Information and Data Controller)

The Company is the controller of personal information collected and used under this Policy (the data controller under GDPR).

• Name: Virtual Craft, Inc.
• Address: Banfore Sankei Building 4F, 1-28-10 Takadanobaba, Shinjuku-ku, Tokyo 169-0075, Japan
• Contact: Contact Form

While the Company may not be subject to the obligation to appoint a Data Protection Officer (DPO) under Article 37 of GDPR, we have appointed an internal personal information protection officer for the appropriate management of personal information.

Article 2 (Scope of Application)

1. 1) This Policy applies to personal information collected by the Company in connection with the use of the Service.
2. 2) The handling of information on third-party websites and services linked from the Service (e.g., social media, external cloud services) is subject to the policies of such third parties.
3. 3) Personal information that the Company obtains other than through use of the Service, such as that of job applicants and officers or employees of the Company's business partners, is handled not under this Policy but in accordance with the purposes of use presented individually at the time of collection and other standards separately established by the Company.

Article 3 (Definitions)

1. 1) 'Personal information' means personal data as defined by APPI and GDPR, including information that can identify a specific individual through name, address, telephone number, email address, or other descriptions, or information that can identify a specific individual when easily cross-referenced with other information.
2. 2) 'Personal-related information' means browsing history, identifiers, and other information obtained through cookies that does not identify an individual on its own but may be used as personal data by third parties.
3. 3) 'User' means any individual who views or uses the Service.

Article 4 (Information We Collect)

The Company may collect the following information to provide the Service:

1. 1) Information entered and submitted by users
   　Name, company name, email address, inquiry type, inquiry content, and other information voluntarily entered by users
2. 2) Information automatically collected through use of the Service
   　IP address, browser and device information, OS, access date and time, pages viewed, referring URL, communication logs, device identifiers, etc.
3. 3) Information collected through cookies and similar technologies
   　Cookie identifiers, browsing history, on-site behavior information, etc. (collected within the scope of the consent set out in Article 7)
4. 4) Information generated by the Company to detect unauthorized access
   　Hashed IP address, country of origin, browser information, requested path, and the detection score and blocking status calculated by the Company on that basis (Article 14)

Article 5 (Purpose of Use)

The Company uses collected personal information for the following purposes:

1. 1) Responding to inquiries, communication, identity verification, and necessary procedures
2. 2) Provision, maintenance, protection, and improvement of the Service (including bug fixes, quality improvement, and new feature development)
3. 3) Security assurance, prevention and detection of fraudulent use, access analysis, and incident response
4. 4) Compliance with legal obligations, dispute and trouble resolution, and exercise or defense of rights
5. 5) Service and event notifications (such as email distribution) with user consent
6. 6) Creation of statistical data processed into a form that cannot identify individuals, and use of such data for training and improving AI (artificial intelligence) and other machine learning models. If the Company creates anonymously processed information as defined under APPI, it will publish the categories of information concerning individuals contained therein in accordance with that Act.
7. 7) Purposes incidental to the above

Article 6 (Legal Basis for Processing Personal Information)

Where GDPR applies, the Company processes personal information based on the following legal grounds:

1. 1) Consent: When users have given explicit consent (voluntary and withdrawable at any time)
2. 2) Performance of a contract: When necessary for responding to inquiries, contracts, or pre-contractual measures
3. 3) Legal obligation: When necessary to comply with applicable laws
4. 4) Legitimate interests: When reasonably necessary for service improvement, security assurance, and business operations (to the extent that it does not unduly infringe on users' rights and interests)

Article 7 (Cookies, Access Analysis, and External Transmission)

1. 1) The Company uses cookies and similar technologies to improve convenience and enhance the site.
2. 2) Except for strictly necessary cookies that are essential to providing the Service, the Company uses cookies only where the user has given prior consent. This applies to all users regardless of their location. The Company records and manages consent status through its consent management function, and users may change or withdraw their consent at any time.
3. 3) Users may also disable cookies through their browser settings, but some features of the Service may become unavailable in that case.
4. 4) The matters required to be published under the Telecommunications Business Act regarding external transmission (the transmission of information from the user's device to third-party servers) are set out below.

* Collection of information by Google Analytics can also be disabled using the opt-out add-on provided by Google.

* If the Company adds or changes any of the recipients listed above, it will publish the change in advance by revising this Policy.

Article 8 (Third-Party Provision, Outsourcing, and Joint Use)

1. Third-Party Provision
The Company will not provide personal data to third parties without user consent, except as required by law.

2. Outsourcing
The Company may outsource the handling of personal information to cloud providers, access analysis providers, email distribution and support tool providers, etc., for the operation of the Service. In such cases, the Company appropriately selects contractors and supervises them through contracts and other necessary and appropriate measures. The principal contractors and the countries in which they are located are set out in Article 9.

3. Joint Use
The Company does not currently engage in joint use of personal data. If joint use is conducted, the Company will publish in advance the items to be jointly used, purposes of use, scope of joint use, and responsible manager in this Policy.

4. Third-Party Provision of Personal-Related Information
When cookie-related information obtained by the Company is expected to be used as personal data by third parties, the Company will obtain necessary consent or confirmation in accordance with APPI and other applicable laws.

5. Business Succession
If the Company's business is succeeded through a merger, corporate split, business transfer, or other similar cause, the Company may provide personal data to the successor, on condition that the successor assumes the obligations under this Policy.

Article 9 (Location of Stored Personal Data and International Data Transfers)

1. 1) In operating the Service, the Company uses the cloud services of the following providers, and personal data is stored and processed on facilities managed by those providers.
   • ・Cloudflare, Inc. (United States): delivery infrastructure for the Service, and storage of cookie consent records, access logs, and security-related information
   • ・Google LLC (United States): receipt and storage of inquiry content, and access analysis
   • ・microCMS, Inc. (Japan): management and delivery of news articles and images
2. 2) As stated above, the Company outsources part of its handling of personal data to providers located in the United States, and personal data is therefore transferred outside Japan. The Company appropriately selects these contractors, supervises them as necessary and appropriate through contracts and other means, and implements security measures having ascertained the personal information protection regime of that country (Article 12).
3. 3) Where GDPR applies and the Company transfers personal data to a third country that has not received an adequacy decision, the Company will implement appropriate safeguards required by law, such as concluding Standard Contractual Clauses (SCC) under Article 46 of GDPR. Japan has received an adequacy decision from the European Commission, recognizing it as having an adequate level of data protection under GDPR.
4. 4) If the Company changes any of the contractors listed above, it will publish the change by revising this Policy.

Article 10 (Representative within the EEA)

The Company does not currently conduct business activities directed at continuously offering goods or services to, or monitoring the behavior of, individuals within the EEA (European Economic Area). If the appointment of a representative becomes required under Article 27 of GDPR, the Company will appoint a representative within the EEA and publish their contact information in this Policy.

Article 11 (Retention Period)

The Company retains personal information only for the period necessary to achieve the purposes of use, and when no longer needed, takes measures such as deletion or anonymization using methods that make recovery difficult. The following periods are set as guidelines:

1. 1) Inquiry information: 3 years after completion of response
2. 2) Transaction-related information: Period required by laws and regulations
3. 3) Access logs and cookie consent records: 1 year (may be extended within a reasonable scope when necessary for security investigations, etc.)
4. 4) Information relating to detection of unauthorized access (Article 14): up to 1 year after the block is lifted

The Company operates a process to periodically delete information that has passed the periods set out above.

Article 12 (Security Measures)

The Company implements reasonable security measures to prevent leakage, loss, or damage of personal information.

1. 1) Organizational measures: Appointment of a personal information protection officer, recording and review of handling status, and establishment of a response framework for incidents such as leakage
2. 2) Human measures: Regular employee training and clarification of confidentiality obligations
3. 3) Physical measures: Measures to prevent theft or loss of equipment and electronic media
4. 4) Technical measures: Access control and authority management, encryption of communications, log collection and auditing, vulnerability countermeasures, and detection and blocking of unauthorized access
5. 5) Supervision of contractors: Appropriate selection of contractors and supervision through contracts and other means
6. 6) Ascertainment of the external environment: As set out in Article 9, the Company outsources the handling of personal data to providers located in the United States, and implements the security measures above having ascertained the personal information protection regime of that country.

Article 13 (Security Incident Response)

In the event of a personal information breach, the Company will, in accordance with applicable laws, investigate the facts, prevent damage from spreading, implement measures to prevent recurrence, report to relevant authorities, and provide necessary notifications.

Article 14 (Automated Detection and Blocking of Unauthorized Access)

1. 1) To prevent unauthorized access, attacks, and fraudulent use of the Service, the Company automatically detects and evaluates the content of access and, where defined criteria are met, temporarily blocks connections from the source of that access without human involvement.
2. 2) For the purposes of the preceding paragraph, the Company records the hashed IP address, country of origin, browser information, requested path, and the detection score based on them. The Company uses this information solely for detecting and blocking unauthorized access, and does not use it to analyze users' interests or preferences or to deliver advertising.
3. 3) The legal basis for the processing under this Article is the Company's legitimate interest in protecting and securing the Service (Article 6(1)(f) of GDPR where that regulation applies).
4. 4) A user who is blocked despite legitimate use may request that the block be lifted through the contact point in Article 16. The Company will have the request reviewed by its personnel and will promptly lift the block if it determines that the block was made in error.

Article 15 (User Rights and Request Procedures)

1. 1) Users to whom GDPR applies have rights under the law, including access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent.
2. 2) Users to whom APPI applies may request notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, erasure, and cessation of third-party provision regarding retained personal data.
3. 3) Request Procedures
   Please contact the inquiry office in Article 16 to make a request. For identity verification purposes, we may ask you to provide additional information (e.g., registered email address) within a reasonable scope.
4. 4) Fees
   The Company does not charge a fee for requests for notification of the purpose of use or for disclosure.

Article 16 (Contact Point and Complaints)

For questions regarding this Policy, requests for disclosure and the like, and requests to lift a block, please contact us at:

• Virtual Craft, Inc. Personal Information Protection Office
• (Responsible Manager: Takeharu Kodera, Representative Director)
• Address: Banfore Sankei Building 4F, 1-28-10 Takadanobaba, Shinjuku-ku, Tokyo 169-0075, Japan
• Contact: Contact Form

* For identity verification purposes, we may request submission of copies of official identification documents.

If you are not satisfied with the Company's response to a complaint regarding its handling of personal information, you may file a complaint with the Personal Information Protection Commission of Japan.

Article 17 (Changes to This Policy)

1. 1) The Company may revise this Policy in response to amendments to laws and regulations or changes in the content of the Service.
2. 2) The revised Policy takes effect when it is posted on the Service. However, where a change materially affects users' rights, the Company will set an effective date and give notice a reasonable period in advance by posting on the Service or by other methods the Company deems appropriate.
3. 3) The Company publishes the revision history of this Policy and its past versions on the Service so that the course of revisions can be confirmed.

Article 18 (Governing Language)

The Japanese version of this Policy is the authoritative text, and versions in English and other languages are reference translations. In the event of any discrepancy between the Japanese version and a version in another language, the Japanese version prevails.