Chapter 2. Handling of personal information of EEA and UK residents
1. Introduction
This Chapter 2 provides additional information about the handling of personal information of customers and other individuals in the European Economic Area (“EEA”) and/or the United Kingdom (“UK”) in accordance with EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK Data Protection Act 2018 (“DPA 2018”) and other national and international data protection and privacy laws (together, “Data Protection Laws”).
Please note that the UK’s laws are similar to those in the EEA, and customers from both jurisdictions have very similar rights. Accordingly, references to the GDPR in this Chapter should also be read as references to corresponding UK law.
A guardian’s consent or permission must be obtained in the event that a customer under the age of 16 uses Wabi Corporation’s service and consents to this Privacy Policy. The data subject’s consent to this Privacy Policy must be obtained in the event that a person such as family member applies for Wabi Corporation’s service on behalf of the data subject.
In the event that any provisions of this Chapter 2 contradict those of Chapter 1, the provisions of this Chapter 2 shall prevail.
2. The controller of personal information
The controller of your personal information is Wabi Corporation.
Wabi Corporation protects personal information which is collected and used by controllers (who make decisions about how and why your personal
information is used) and processors (who act on the controller’s written instructions) on the basis of Data Protection Laws.
3. Our lawful basis for processing personal information
Wabi Corporation protects your personal information by ensuring that it can only be used to the extent necessary for specific purposes (as set out in Part 3 of Chapter 1 of this Privacy Policy) and by requiring that there is a lawful basis for each processing activity on the basis of Data Protection Laws.
Wabi Corporation may process customer personal data on one or more of the following lawful bases:
When your consent is obtained to the processing (Article 6(1)(a) GDPR)
Consent will usually only be relied upon for promotional and marketing related processing, or in some cases, in relation to sensitive personal data.
When processing is necessary in order to perform or take steps to enter into a contract (Article 6(1)(b) GDPR).
This is typically why we process customer information which is essential to providing our services, including a customer’s identity, contact, payment, etc.
Wabi Corporation needs to process the information to comply with a lawful obligation (Article 6(1)(c) GDPR). This includes the requirement to share personal information with customs and immigration authorities or law enforcement, as well as Wabi Corporation’s legal duties towards its staff and customers.
The information is required to protect your, or a third party’s, vital interests (Article 6(1)(d) GDPR), for example in the event of a medical emergency.
It is in Wabi Corporation’s or a third party’s legitimate interests to process the personal data, and these interests are not overridden by your rights under Data Protection Laws (Article 6(1)(f) GDPR). This includes the use of personal information necessary to operate Wabi Corporation’s business and also to maintain, develop and improve its products and services and provide the best possible customer experience.
4. Request about processing of personal information
(1) Data Protection Laws provide you with the following legal rights:
1.Request for disclosure
You can request copies of your personal information and details of how we process it.
2.Request for correction or updating
Corrections or updates to personal information will be undertaken wherever possible after due review of the request.
3.Request for erasure
You may request that we delete all or part of the personal information Wabi Corporation hold about you. We will consider your request and, where the information is no longer required or the law does not permit us to continue to retain it, we will delete it.
4.Transferring your personal information
You can request a copy of your personal information in a structured, common, machine-readable format. This only applies to personal information which we obtain from you and process on the basis of your consent or in order to perform a contract, and which is processed by automated means.
5.Objecting to processing
You can object to processing which is carried out on the basis of our or a third party’s legitimate interests or for the purpose of direct marketing. Wabi Corporation will stop processing your information unless we have a strong reason to continue which overrides your objection. If your objection is to direct marketing, we will always stop.
6.Restricting how your personal information is processed
You can limit how we process your personal information in certain circumstances. Where this applies, any processing of your personal information (other than storing it) will only be lawful with your consent or where required for legal claims, protecting certain rights or important public interest reasons.
7.The right to withdraw consent
If we are relying on consent to process your personal information, you have the right to withdraw that consent at any time.
Please note, the rights set out above are not absolute and do not apply in every situation. There are also legal exemptions which apply in some situations and mean a request may be refused. Of course, if a request is refused we will inform you of the reasons for this when we respond.
Records of requests made to Wabi Corporation will be retained so that we can ensure we have complied with our legal obligations.
(2) Method for submitting request
You can exercise your rights free of charge (except in the case of unreasonable, excessive or repeated requests in which case we may charge a fee or refuse the request). The method for submitting a request and contact information are as follows.
(Website)
Please send the required documents via webform listed on CHAKAISEKI AKIYOSHI’s website run by Wabi Corporation.
(3) Responding to a request
Wabi Corporation will respond without delay and usually within three months. We may, in some cases, ask for identification or (if you are making the request on behalf of a third party) proof of your authority to submit a request. If your request is particularly complex or you have made a number of requests, it may take longer to provide a detailed response. Please also bear in mind that there are exceptions to the rights above and some situations where they do not apply.
If you are not satisfied with our response to a data protection request or if you think your personal information has been mishandled, then you have the right to complain to a supervisory authority. Please see Part 9 of this Chapter 2 (“Lodging a complaint with an authority”) for further details.
5. Data sharing which is necessary to provide products or services
Wabi Corporation’s products and services are provided with the assistance of other companies and organizations and often Wabi Corporation will need to share personal information with third parties in order to run its business. These third parties include:
(1) Wabi Corporation Group Companies
(2) Organizations with which Wabi Corporation is legally required to share personal information
including: government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.
(3) Service providers
including: various service providers, providers with whom Wabi Corporation have a marketing partnership, etc.
Where Wabi Corporation instructs companies, contractors or service providers to process data on its behalf, then it will ensure that it does so pursuant to a contract which meets the requirements of applicable Data Protection Laws.
6. Marketing communications
Wabi Corporation sends out marketing communications from time to time to notify interested persons of news and provide details of products and services which may be of interest to them. Wabi Corporation will only do this if the recipient has consented to receive marketing or if they are an existing customer who purchased products or services from Wabi Corporation and were given the opportunity to opt-out from marketing at the time but chose not to do so.
7. Where your personal information is stored and transferred
Wabi Corporation is located in Japan and many of the service providers and other organizations with whom we share your personal information will be located in jurisdictions outside the EEA and UK. It should be noted that Japan has been recognized by the European Commission as providing adequate protection for personal information.
When transferring personal information to third parties Wabi Corporation will ensure that it complies with the requirements of Data Protection Laws, including the onward transfer requirements of the EU-Japan adequacy decision and related Japanese laws. However, you should be aware that recipients outside the EEA and UK may be subject to national laws which do not necessarily provide equivalent protection for your personal data. If you would like more information regarding where your personal information is stored and transferred please contact Wabi Corporation using the details set out in Part 13 of this Chapter 1 (“Submission of request for disclosure, etc.”).
8. Retention of personal information
Wabi Corporation retains customers’ personal information until the purpose of use is achieved. Particularly, Wabi Corporation has set the retention period for personal information as follows. For most other personal information, the appropriate retention period will be determined based on the nature of the information and the purpose for having it by reference to legal and accounting requirements and our business needs.
9. Lodging a complaint with an authority
Customers have the right to lodge a complaint on the processing of their personal information with the data protection authority having jurisdiction over their residence.
(1) EEA residents: Please contact your national supervisory authority, details of which can be found on the European Data Protection Board’s website（https://edpb.europa.eu/about-edpb/board/members_en）
(2) UK residents: Please contact the Information Commissioner’s Office www.ico.org.uk）
10. The contact information of the controller of personal information
Controller
CHAKAISEKI AKIYOSHI
Address: 59 rue Letellier, 75015 Paris FRANCE
