Information referring to personal information (name, address, telephone number, address, email address, gender, date of birth, etc.), information which allows direct identification, and any information belonging to individuals (usage history, usage fee, etc.). In addition, the Company handles every piece of information in the same manner regarding any form of personal data, if there is even a low possibility that by any methods or by combining available data, the identity of the individual can be revealed.

The Company will take all necessary security measures, such as development of a maintenance and management plan for the security system and proper training of the staff, and maintain strict control over personal information in order to keep customer’s personal information accurate and up to date, to prevent unauthorized access to personal information, loss, damage, falsification, leakage, etc.
· Management System
·Employee Training
The company will take all necessary actions to prevent any kind of misuse of personal information. The Company is willing to force the thorough implementation of safety measures and strict management of personal information within the Company.

In order to ensure the proper handling and safety of personal information, the Company has implemented thorough security measures.

• To maintain and to improve current services and to assist the development of new ones
• To provide after-sales services and customer support

All personal information collected is being administered and managed by the Company. Personal information provided to the Company through service is maintained in whole or in part by a server management company to which the Company outsources its services. When outsourcing, the Company discloses information only to the extent necessary to achieve its objective, strictly reviews the handling of information by such service management company, separately executes a confidentiality agreement regarding personal information, and requires such service management company to handle personal information in the same manner as it is handled within the Company.

The Company ensures the proper management of personal information and data deposited by customers and it will not disclose any personal information to any third parties unless it falls under any of the following categories:

• In case of mutual consent
• In case disclosure of the information is required by the law
• In case the Company determines that it is necessary for the protection of human life, health or property to share the information
• In case the Company determines that sharing the information is necessary in order to ensure the cooperation with the government or local public entities or those entrusted
• In case the Company determines that sharing the information is necessary in order to secure the rights of the partners of the Company or the Company itself
• In case the handling of personal information to a certain and well-documented extent is absolutely necessary in order to execute certain corporate and business tasks

The Company will comply with the Japanese laws and regulations applicable to personal information security. The Company is willing to follow the international norms and examples regarding privacy policy and personal information security, and it is willing to review the contents of its policies if necessary and make efforts to improve those.
The Company sustains its right to improve and revise the contents of “privacy policy” due to the amendment of the law, change of our Company’s business, user’s request, etc.In this case, we announce the revised contents beforehand to the user in an easy-to-understand manner and change to the new policies with a grace period prior the new policies would come into effect.

The Company takes reasonable and strict safety measures to avoid and minimize risks such as loss, destruction, alteration, leakage due to unauthorized access of personal information, but the Company does not take responsibility if the loss happens due to reasons such as the followings:
The Company is not responsible for lost, destroyed, altered, leaked, etc. personal information caused by other third parties and companies.

• In case the customer reveals personal information to a third party by using the functions of our services or any other means
• In case personal information is leaked due to information shared, disclosed by the customer in any way while using our service.

For inquiries on handling personal information please contact us or the person in charge of personal information protection and management.
https://www.sola-air.com/informations/contact
Address: 〒101-0021 5F VORT Suehirocho II6-14-3, Sotokanda, Chiyoda-ku, Tokyo101-0021, Japan
The English version is a translation of the original in Japanese for reference purposes only.In case of a discrepancy, the Japanese original shall prevail.
GDPR Compliance Statement 2018.05.25
The EU General Data Protection Regulation (“GDPR”) came into force across the European Union on 25th May 2018 and we are committed complying with its guidelines and regulations.
Our Commitment
We are committed to ensuring the security and protection of the personal information that we process and to provide a compliant and consistent approach to data protection. We have always had a robust and effective data protection program in place which complies with existing Japanese and international laws and abide by the data protection principles. However, we recognize our obligations in updating and expanding our privacy policy in order to meet the demands of the GDPR.
Our preparation and objectives for GDPR compliance have been summarized in this statement and includes the development and implementation of new data protection roles, policies, procedures, controls and measures to ensure maximum and ongoing compliance.
You may access this updated document from any of our applications from the settings menu under the privacy policy tab (monoca, accoca, kotoca).
Privacy Policy Objectives in accordance with GDPR
We already have a consistent level of data protection and security across our organization, however, it is our aim to be fully compliant with the GDPR, therefore we have updated both our privacy policy and inside mechanisms for data protection.
You may find the original document below.
Data Protection – our main policy and procedure document for data protection have been overhauled to meet the standards and requirements of the GDPR. Accountability and governance measures are in place to ensure that we understand and adequately disseminate and evidence our obligations and responsibilities; with a dedicated focus on privacy by design and the rights of individuals.
Data Retention & Erasure – we have updated our retention policy and schedule to ensure that we meet the ‘data minimization’ and ‘storage limitation’ principles and that personal information is stored, archived and destroyed compliantly and ethically. We have dedicated erasure procedures in place to meet the new ‘Right to Erasure’ or “Right to be Forgotten” obligations and are aware of when this and other data subject’s rights apply; along with any exemptions, response timeframes and notification responsibilities.
Data Breaches – our breach procedures ensure that we have safeguards and measures in place to identify, assess, investigate and report any personal data breach at the earliest possible time. Our procedures are robust and have been disseminated to all employees, making them aware of the reporting lines and steps to follow.
International Data Transfers & Third-Party Disclosures – we are storing user information mostly outside of the EU [Japan], but we ensure our users that we keep and respect the EU regulations and make sure that all the third parties we are working together with are doing their tasks in the exact same manner.
We have robust procedures and safeguarding measures in place to secure, encrypt and maintain the integrity of the data. Our procedures include a continual review of the third parties we are working together with, as well as provisions for binding corporate rules; standard data protection clauses or approved codes. We carry out strict due diligence checks with all recipients of personal data to assess and verify that they have appropriate safeguards in place to protect the information, ensure enforceable data subject rights and have effective legal remedies for data subjects where applicable.
Subject Access Request (SAR) – we have revised our SAR procedures to accommodate the revised 30-day timeframe for providing the requested information and for making this provision free of charge. Our new procedures detail how to verify the data subject, what steps to take for processing an access request, what exemptions apply and a suite of response templates to ensure that communications with data subjects are compliant, consistent and adequate.
We have made our SAR services available in both English and Japanese.
Legal Basis for Processing – we are reviewing all processing activities to identify the legal basis for processing and ensuring that each basis is appropriate for the activity it relates to. Where applicable, we also maintain records of our processing activities, ensuring that our obligations under Article 30 of the GDPR and Schedule 1 of the Data Protection Bill are met.
Privacy Notice/Policy – we have revised our Privacy Policy to comply with the GDPR, ensuring that all individuals whose personal information we process have been informed of why we need it, how it is used, what their rights are, who the information is disclosed to and what safeguarding measures are in place to protect their information.
Obtaining Consent – we have revised our consent mechanisms for obtaining personal data, ensuring that individuals understand what they are providing, why and how we use it and giving clear, defined ways to consent to us processing their information. We have developed stringent processes for recording consent, making sure that we can evidence an affirmative opt-in, along with time and date records; and an easy to see and access way to withdraw consent at any time.
Direct Marketing – we have revised the wording and processes for direct marketing, including clear opt-in mechanisms for marketing subscriptions; a clear notice and method for opting out and providing unsubscribe features on all subsequent marketing materials.
Processor Agreements – where we use any third-party to process personal information on our behalf (i.e. Payroll, Recruitment, Hosting etc), we have drafted compliant Processor Agreements and due diligence procedures for ensuring that they (as well as we), meet and understand their/our GDPR obligations. These measures include initial and ongoing reviews of the service provided, the necessity of the processing activity, the technical and organizational measures in place and compliance with the GDPR.
Special Categories Data – where we obtain and process any special category information, we do so in complete compliance with the Article 9 requirements and have high-level encryptions and protections on all such data. Special category data is only processed where necessary and is only processed where we have first identified the appropriate Article 9(2) basis or the Data Protection Bill Schedule 1 condition. Where we rely on consent for processing, this is explicit and is verified by a signature, with the right to modify or remove consent being clearly signposted.
Data Subject Rights
In addition to the policies and procedures mentioned above that ensure individuals can enforce their data protection rights, we provide easy to access information via our website and contact lines of an individual’s right to access any personal information that Sola K.K. (株式会社, Kabushiki Kaisha) processes about them and to request information about:
• What personal data we hold about them
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom the personal data has/will be disclosed
• How long we intend to store your personal data for
• If we did not collect the data directly from them, information about the source
• The right to have incomplete or inaccurate data about them corrected or completed and the process for requesting this
• The right to request erasure of personal data or to restrict processing in accordance with data protection laws, as well as to object to any direct marketing from us and to be informed about any automated decision-making that we use
• The right to lodge a complaint or seek judicial remedy and who to contact in such instances
Information Security & Technical and Organizational Measures
Sola K.K. takes the privacy and security of individuals and their personal information very seriously and take every reasonable measure and precaution to protect and secure the personal data that we process. We have robust information security policies and procedures in place to protect personal information from unauthorized access, alteration, disclosure or destruction and have several layers of security measures, including: –
SSL
Access Control Measures
Password Policy and Encryption
Authentication
GDPR Roles and Employees
We have designated Keisuke Yoshimura as our Data Protection Officer (DPO) he is responsible for promoting awareness of the GDPR across the organization, assessing our GDPR readiness, identifying any gap areas and implementing the new policies, procedures, and measures.
We understand that continuous employee awareness and understanding is vital to the continued compliance of the GDPR and have involved our employees in our preparation plans. We have implemented an employee training program specific to the which will be provided to all employees prior to May 25th, 2018, and forms part of our induction and annual training program.
If you have any questions regarding our privacy policy and GDPR, please contact:
5F VORT Suehirocho II
6-14-3, Sotokanda, Chiyoda-ku, Tokyo
101-0021, Japan
TEL ： 03-6860-8482
E-Mail ： contact@sola-air.com

Bouquet uses the Google Photos API, which allows us to retrieve data from Google Photos with the customer's permission. The acquired data includes images, videos, album names, and other information saved by the customer in Google Photos, and the acquired data is stored on the customer's device. We do not use the information stored on the device.