プライバシー ポリシー
Privacy Policy
制定:2013年6月25日
改訂:2013年6月25日
Sola株式会社
Sola株式会社(以下「当社」)は、以下のとおり個人情報保護方針を定め、個人情報保護の仕組みを構築し、全従業員に個人情報保護の重要性の認識と取組みを徹底させることにより、個人情報の保護を推進致します。安心・安全・信頼のサービスを提供するに当り、ユーザー皆様の全ての個人に関する情報の取り扱いについて規定を定め、個人情報の適切な保護に努めてまいります。
個人情報の定義
個人情報とは、それによって直接個人が特定され得る情報(氏名や住所・電話番号・住所・emailアドレス・性別・生年月日など)とその個人に属する情報(利用履歴・利用料金など)を指しております。またこれ以外にもそれ単体では直接個人が特定出来ずとも、複合する事により個人情報となり得る情報についても、同様の取扱いを行います。
個人情報の管理
当社は、お客さまの個人情報を正確かつ最新の状態に保ち、個人情報への不正アクセス・紛失・破損・改ざん・漏洩などを防止するため、セキュリティシステムの維持・管理体制の整備・社員教育の徹底等の必要な措置を講じ、安全対策を実施し個人情報の厳重な管理を行ないます。
個人情報の安全対策
当社は、個人情報の正確性及び安全性確保のために、セキュリティに万全の対策を講じています。
個人情報の利用目的
- ご利用いただいているサービスの提供
- 改良や新たなサービス開発のため
個人情報の第三者への開示・提供の禁止
当社は、お客さまよりお預かりした個人情報を適切に管理し、次のいずれかに該当する場合を除き、個人情報を第三者に開示いたしません。
- お客様の事前の同意・承諾を得た場合
- 法令により情報の開示が求められる場合
- 人の生命、身体または財産の保護のために必要があると当社が判断した場合
- 国の機関もしくは地方公共団体またはその委託を受けた者が法令の定める事務を遂行することに対して協力することその他公共の利益のために特に必要があると当社が判断した場合
- ご登録者様または当社の権利の確保のために必要であると当社が判断した場合
- 業務遂行に必要な限度で個人情報の取扱いを委託する場合
法令、規範の遵守と見直し
当社は、保有する個人情報に関して適用される日本の法令、その他規範を遵守するとともに、本ポリシーの内容を適宜見直し、その改善に努めます。当社は法改正や当社事業内容の変更、利用者の要望等により、「プライバシー・ポリシー」の内容を改善・改定する事があります。この場合には事前に改定内容を利用者に分かりやすい形で告知し、一定期間の猶予期間を持って新たな内容に変更します。
免責事項
当社では、個人情報の不当なアクセスによる紛失、破壊、改ざん、漏洩などのリスクに対して、合理的かつ厳正な安全対策を講じておりますが、以下の事由など当社の責に帰すべからざる事由を原因とする個人情報の紛失、破壊、改ざん、漏洩などに関しては、当社では責任を負いかねますので、ご注意ください。
- お客様自身が当社サービスの機能または別の手段を用いて第三者に個人情報を明らかにした場合
- お客様自身が当社サービス上にて開示した情報等により、個人情報が漏洩した場合
Google Photos APIの利用にかかるプライバシーポリシー
ブーケはGoogle Photos APIを利用しており、お客さまの許可のうえで、Googleフォトのデータを取得することができます。取得するデータは画像、動画、アルバム名などお客さまがGoogleフォトに保存された情報であり、取得したデータは端末に保存されます。端末に保存された情報を当社が利用することはありません。
お問い合せ
当社の個人情報の取扱に関するお問い合せは下記までご連絡ください。
https://www.sola-air.com/contact/
https://www.sola-air.com/contact/
Published on 2013.06.25
Revised on 2018.06.08
Sola K.K.
Sola Corporation (here and after referred to as the “Company”) establishes its personal information protection policy as described below.
The Company establishes certain mechanisms and policies to protect personal information.The Company will promote the protection of personal information by thoroughly
The Company establishes certain mechanisms and policies to protect personal information.The Company will promote the protection of personal information by thoroughly
Definition of Personal Information
Information referring to personal information (name, address, telephone number, address, email address, gender, date of birth, etc.), information which allows direct identification, and any information belonging to individuals (usage history, usage fee, etc.). In addition, the Company handles every piece of information in the same manner regarding any form of personal data, if there is even a low possibility that by any methods or by combining available data, the identity of the individual can be revealed.
Management of Personal Information
The Company will take all necessary security measures, such as development of a maintenance and management plan for the security system and proper training of the staff, and maintain strict control over personal information in order to keep customer’s personal information accurate and up to date, to prevent unauthorized access to personal information, loss, damage, falsification, leakage, etc.
· Management System
·Employee Training
The company will take all necessary actions to prevent any kind of misuse of personal information. The Company is willing to force the thorough implementation of safety measures and strict management of personal information within the Company.
· Management System
·Employee Training
The company will take all necessary actions to prevent any kind of misuse of personal information. The Company is willing to force the thorough implementation of safety measures and strict management of personal information within the Company.
Safety Measures for the Protection of Personal Information
In order to ensure the proper handling and safety of personal information, the Company has implemented thorough security measures.
Purposes of Collecting Personal Information
- To maintain and to improve current services and to assist the development of new ones
- To provide after-sales services and customer support
Prohibition of disclosure and provision of personal information to third parties
The Company ensures the proper management of personal information and data deposited by customers and it will not disclose any personal information to any third parties unless it falls under any of the following categories:
- In case of mutual consent
- In case disclosure of the information is required by the law
- In case the Company determines that it is necessary for the protection of human life, health or property to share the information
- In case the Company determines that sharing the information is necessary in order to ensure the cooperation with the government or local public entities or those entrusted
- In case the Company determines that sharing the information is necessary in order to secure the rights of the partners of the Company or the Company itself
- In case the handling of personal information to a certain and well-documented extent is absolutely necessary in order to execute certain corporate and business tasks
Observance and Review of Laws and Norms
The Company will comply with the Japanese laws and regulations applicable to personal information security. The Company is willing to follow the international norms and examples regarding privacy policy and personal information security, and it is willing to review the contents of its policies if necessary and make efforts to improve those.
The Company sustains its right to improve and revise the contents of “privacy policy” due to the amendment of the law, change of our Company’s business, user’s request, etc.In this case, we announce the revised contents beforehand to the user in an easy-to-understand manner and change to the new policies with a grace period prior the new policies would come into effect.
The Company sustains its right to improve and revise the contents of “privacy policy” due to the amendment of the law, change of our Company’s business, user’s request, etc.In this case, we announce the revised contents beforehand to the user in an easy-to-understand manner and change to the new policies with a grace period prior the new policies would come into effect.
Disclaimer
The Company takes reasonable and strict safety measures to avoid and minimize risks such as loss, destruction, alteration, leakage due to unauthorized access of personal information, but the Company does not take responsibility if the loss happens due to reasons such as the followings:
The Company is not responsible for lost, destroyed, altered, leaked, etc. personal information caused by other third parties and companies.
The Company is not responsible for lost, destroyed, altered, leaked, etc. personal information caused by other third parties and companies.
- In case the customer reveals personal information to a third party by using the functions of our services or any other means
- In case personal information is leaked due to information shared, disclosed by the customer in any way while using our service.
Inquiries
For inquiries on handling personal information please contact us or the person in charge of personal information protection and management.
https://www.sola-air.com/informations/contact
Address: 〒101-0021 5F VORT Suehirocho II6-14-3, Sotokanda, Chiyoda-ku, Tokyo101-0021, Japan
The English version is a translation of the original in Japanese for reference purposes only.In case of a discrepancy, the Japanese original shall prevail.
GDPR Compliance Statement 2018.05.25
The EU General Data Protection Regulation (“GDPR”) came into force across the European Union on 25th May 2018 and we are committed complying with its guidelines and regulations.
Our Commitment
We are committed to ensuring the security and protection of the personal information that we process and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place which complies with existing Japanese and international laws and abide by the data protection principles. However, we recognize our obligations in updating and expanding our privacy policy in order to meet the demands of the GDPR.
Our preparation and objectives for GDPR compliance have been summarized in this statement and includes the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.
You may access this updated document from any of our applications from the settings menu under the privacy policy tab (monoca, accoca, kotoca).
Privacy Policy Objectives in accordance with GDPR
We already have a consistent level of data protection and security across our organization, however, it is our aim to be fully compliant with the GDPR, therefore we have updated both our privacy policy and inside mechanisms for data protection.
You may find the original document below.
Data Protection – our main policy and procedure document for data protection have been overhauled to meet the standards and requirements of the GDPR. Accountability and governance measures are in place to ensure that we understand and adequately disseminate and evidence our obligations and responsibilities; with a dedicated focus on privacy by design and the rights of individuals.
Data Retention & Erasure – we have updated our retention policy and schedule to ensure that we meet the ‘data minimization’ and ‘storage limitation’ principles and that personal information is stored, archived and destroyed compliantly and ethically. We have dedicated erasure procedures in place to meet the new ‘Right to Erasure’ or “Right to be Forgotten” obligations and are aware of when this and other data subject’s rights apply; along with any exemptions, response timeframes and notification responsibilities.
Data Breaches – our breach procedures ensure that we have safeguards and measures in place to identify, assess, investigate and report any personal data breach at the earliest possible time. Our procedures are robust and have been disseminated to all employees, making them aware of the reporting lines and steps to follow.
International Data Transfers & Third-Party Disclosures – we are storing user information mostly outside of the EU [Japan], but we ensure our users that we keep and respect the EU regulations and make sure that all the third parties we are working together with are doing their tasks in the exact same manner.
We have robust procedures and safeguarding measures in place to secure, encrypt and maintain the integrity of the data. Our procedures include a continual review of the third parties we are working together with, as well as provisions for binding corporate rules; standard data protection clauses or approved codes. We carry out strict due diligence checks with all recipients of personal data to assess and verify that they have appropriate safeguards in place to protect the information, ensure enforceable data subject rights and have effective legal remedies for data subjects where applicable.
Subject Access Request (SAR) – we have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate.
We have made our SAR services available in both English and Japanese.
Legal Basis for Processing – we are reviewing all processing activities to identify the legal basis for processing and ensuring that each basis is appropriate for the activity it relates to. Where applicable, we also maintain records of our processing activities, ensuring that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Bill are met.
Privacy Notice/Policy – we have revised our Privacy Policy to comply with the GDPR, ensuring that all individuals whose personal information we process have been informed of why we need it, how it is used, what their rights are, who the information is disclosed to and what safeguarding measures are in place to protect their information.
Obtaining Consent – we have revised our consent mechanisms for obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information. We have developed stringent processes for recording consent, making sure that we can evidence an affirmative opt-in, along with time and date records; and an easy to see and access way to withdraw consent at any time.
Direct Marketing – we have revised the wording and processes for direct marketing, including clear opt-in mechanisms for marketing subscriptions; a clear notice and method for opting out and providing unsubscribe features on all subsequent marketing materials.
Processor Agreements – where we use any third-party to process personal information on our behalf (i.e. Payroll, Recruitment, Hosting etc), we have drafted compliant Processor Agreements and due diligence procedures for ensuring that they (as well as we), meet and understand their/our GDPR obligations. These measures include initial and ongoing reviews of the service provided, the necessity of the processing activity, the technical and organizational measures in place and compliance with the GDPR.
Special Categories Data – where we obtain and process any special category information, we do so in complete compliance with the Article 9 requirements and have high-level encryptions and protections on all such data. Special category data is only processed where necessary and is only processed where we have first identified the appropriate Article 9(2) basis or the Data Protection Bill Schedule 1 condition. Where we rely on consent for processing, this is explicit and is verified by a signature, with the right to modify or remove consent being clearly signposted.
Data Subject Rights
In addition to the policies and procedures mentioned above that ensure individuals can enforce their data protection rights, we provide easy to access information via our website and contact lines of an individual’s right to access any personal information that Sola K.K. (株式会社, Kabushiki Kaisha) processes about them and to request information about:
• What personal data we hold about them
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom the personal data has/will be disclosed
• How long we intend to store your personal data for
• If we did not collect the data directly from them, information about the source
• The right to have incomplete or inaccurate data about them corrected or completed and the process for requesting this
• The right to request erasure of personal data or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use
• The right to lodge a complaint or seek judicial remedy and who to contact in such instances
Information Security & Technical and Organizational Measures
Sola K.K. takes the privacy and security of individuals and their personal information very seriously and take every reasonable measure and precaution to protect and secure the personal data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorized access, alteration, disclosure or destruction and have several layers of security measures, including: –
SSL
Access Control Measures
Password Policy and Encryption
Authentication
GDPR Roles and Employees
We have designated Keisuke Yoshimura as our Data Protection Officer (DPO) he is responsible for promoting awareness of the GDPR across the organization, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures, and measures.
We understand that continuous employee awareness and understanding is vital to the continued compliance of the GDPR and have involved our employees in our preparation plans. We have implemented an employee training program specific to the which will be provided to all employees prior to May 25th, 2018, and forms part of our induction and annual training program.
If you have any questions regarding our privacy policy and GDPR, please contact:
5F VORT Suehirocho II
6-14-3, Sotokanda, Chiyoda-ku, Tokyo
101-0021, Japan
TEL : 03-6860-8482
E-Mail : contact@sola-air.com
https://www.sola-air.com/informations/contact
Address: 〒101-0021 5F VORT Suehirocho II6-14-3, Sotokanda, Chiyoda-ku, Tokyo101-0021, Japan
The English version is a translation of the original in Japanese for reference purposes only.In case of a discrepancy, the Japanese original shall prevail.
GDPR Compliance Statement 2018.05.25
The EU General Data Protection Regulation (“GDPR”) came into force across the European Union on 25th May 2018 and we are committed complying with its guidelines and regulations.
Our Commitment
We are committed to ensuring the security and protection of the personal information that we process and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place which complies with existing Japanese and international laws and abide by the data protection principles. However, we recognize our obligations in updating and expanding our privacy policy in order to meet the demands of the GDPR.
Our preparation and objectives for GDPR compliance have been summarized in this statement and includes the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.
You may access this updated document from any of our applications from the settings menu under the privacy policy tab (monoca, accoca, kotoca).
Privacy Policy Objectives in accordance with GDPR
We already have a consistent level of data protection and security across our organization, however, it is our aim to be fully compliant with the GDPR, therefore we have updated both our privacy policy and inside mechanisms for data protection.
You may find the original document below.
Data Protection – our main policy and procedure document for data protection have been overhauled to meet the standards and requirements of the GDPR. Accountability and governance measures are in place to ensure that we understand and adequately disseminate and evidence our obligations and responsibilities; with a dedicated focus on privacy by design and the rights of individuals.
Data Retention & Erasure – we have updated our retention policy and schedule to ensure that we meet the ‘data minimization’ and ‘storage limitation’ principles and that personal information is stored, archived and destroyed compliantly and ethically. We have dedicated erasure procedures in place to meet the new ‘Right to Erasure’ or “Right to be Forgotten” obligations and are aware of when this and other data subject’s rights apply; along with any exemptions, response timeframes and notification responsibilities.
Data Breaches – our breach procedures ensure that we have safeguards and measures in place to identify, assess, investigate and report any personal data breach at the earliest possible time. Our procedures are robust and have been disseminated to all employees, making them aware of the reporting lines and steps to follow.
International Data Transfers & Third-Party Disclosures – we are storing user information mostly outside of the EU [Japan], but we ensure our users that we keep and respect the EU regulations and make sure that all the third parties we are working together with are doing their tasks in the exact same manner.
We have robust procedures and safeguarding measures in place to secure, encrypt and maintain the integrity of the data. Our procedures include a continual review of the third parties we are working together with, as well as provisions for binding corporate rules; standard data protection clauses or approved codes. We carry out strict due diligence checks with all recipients of personal data to assess and verify that they have appropriate safeguards in place to protect the information, ensure enforceable data subject rights and have effective legal remedies for data subjects where applicable.
Subject Access Request (SAR) – we have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate.
We have made our SAR services available in both English and Japanese.
Legal Basis for Processing – we are reviewing all processing activities to identify the legal basis for processing and ensuring that each basis is appropriate for the activity it relates to. Where applicable, we also maintain records of our processing activities, ensuring that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Bill are met.
Privacy Notice/Policy – we have revised our Privacy Policy to comply with the GDPR, ensuring that all individuals whose personal information we process have been informed of why we need it, how it is used, what their rights are, who the information is disclosed to and what safeguarding measures are in place to protect their information.
Obtaining Consent – we have revised our consent mechanisms for obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information. We have developed stringent processes for recording consent, making sure that we can evidence an affirmative opt-in, along with time and date records; and an easy to see and access way to withdraw consent at any time.
Direct Marketing – we have revised the wording and processes for direct marketing, including clear opt-in mechanisms for marketing subscriptions; a clear notice and method for opting out and providing unsubscribe features on all subsequent marketing materials.
Processor Agreements – where we use any third-party to process personal information on our behalf (i.e. Payroll, Recruitment, Hosting etc), we have drafted compliant Processor Agreements and due diligence procedures for ensuring that they (as well as we), meet and understand their/our GDPR obligations. These measures include initial and ongoing reviews of the service provided, the necessity of the processing activity, the technical and organizational measures in place and compliance with the GDPR.
Special Categories Data – where we obtain and process any special category information, we do so in complete compliance with the Article 9 requirements and have high-level encryptions and protections on all such data. Special category data is only processed where necessary and is only processed where we have first identified the appropriate Article 9(2) basis or the Data Protection Bill Schedule 1 condition. Where we rely on consent for processing, this is explicit and is verified by a signature, with the right to modify or remove consent being clearly signposted.
Data Subject Rights
In addition to the policies and procedures mentioned above that ensure individuals can enforce their data protection rights, we provide easy to access information via our website and contact lines of an individual’s right to access any personal information that Sola K.K. (株式会社, Kabushiki Kaisha) processes about them and to request information about:
• What personal data we hold about them
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom the personal data has/will be disclosed
• How long we intend to store your personal data for
• If we did not collect the data directly from them, information about the source
• The right to have incomplete or inaccurate data about them corrected or completed and the process for requesting this
• The right to request erasure of personal data or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use
• The right to lodge a complaint or seek judicial remedy and who to contact in such instances
Information Security & Technical and Organizational Measures
Sola K.K. takes the privacy and security of individuals and their personal information very seriously and take every reasonable measure and precaution to protect and secure the personal data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorized access, alteration, disclosure or destruction and have several layers of security measures, including: –
SSL
Access Control Measures
Password Policy and Encryption
Authentication
GDPR Roles and Employees
We have designated Keisuke Yoshimura as our Data Protection Officer (DPO) he is responsible for promoting awareness of the GDPR across the organization, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures, and measures.
We understand that continuous employee awareness and understanding is vital to the continued compliance of the GDPR and have involved our employees in our preparation plans. We have implemented an employee training program specific to the which will be provided to all employees prior to May 25th, 2018, and forms part of our induction and annual training program.
If you have any questions regarding our privacy policy and GDPR, please contact:
5F VORT Suehirocho II
6-14-3, Sotokanda, Chiyoda-ku, Tokyo
101-0021, Japan
TEL : 03-6860-8482
E-Mail : contact@sola-air.com
Privacy Policy Regarding Use of Google Photos API
Bouquet uses the Google Photos API, which allows us to retrieve data from Google Photos with the customer's permission. The acquired data includes images, videos, album names, and other information saved by the customer in Google Photos, and the acquired data is stored on the customer's device. We do not use the information stored on the device.