GDPR
-1. Controller of personal data
This website is operated by HOS Corporation, 16-45 Ōge, Tosa-Tomariura, Naruto-chō, Naruto-shi, Tokushima 772-0053, Japan (“we”, “us”, “our” or “hos”).
You can contact us via e-mail to: privacy@hpd-c.co.jp
-2. Purpose
This document outlines the specific information that we are obligated to provide to data subjects in the EU, EEA and UK under the General Data Protection Regulation ((EU) 2016/679 GDPR) established by the EU, and the United Kingdom General Data Protection Regulation (UK GDPR). These regulations specify the rights of data subjects and the protocols for managing personal data.
-3. Scope of this privacy policy
This document covers our processing of your personal data on our website https://www.aoawo-naruto.com/.
-4. Contact information of representatives
4.1 EU representative
Enobyte GmbH
Augustenstr. 49, 80333 Munich, Germany
Email: eurep-hos@enobyte.com
4.2 UK representative
Enobyte GmbH
c/o Regus HQ Bloomsbury 4/4a Bloomsbury Square, London, WC1A 2RP, United Kingdom
Email: ukrep-hos@enobyte.com
-5. Legal grounds of our processing
We will only process your personal data if there is a legal basis to do so. Under GDPR/UK GDPR, there are three legal bases that we use.
(1) Consent (Art. 6 (1) a) GDPR/UK GDPR) – If consent is freely provided by you, we are allowed to process your personal data only for the purpose for which the consent was given.
(2) Contractual obligation (Art. 6 (1) b) GDPR/UK GDPR) – If we have a contract with you, we will need to store and use some information about you. The same is true if we take necessary steps at your request prior to entering into a contract.
(3) Legitimate interest (Art. 6 (1) f) GDPR/UK GDPR) – Legitimate interest allows us to process personal data if it is necessary for our legitimate interests and your interests or fundamental rights and freedoms do not outweigh our interest. We will inform below if we do such processing and what interests we pursue.
-6. Use of this website
When you visit our website, the servers automatically save server log file information sent by your browser. This information includes:
Content data
- Any text you enter or files you upload
Usage data
- Websites visited
- Date and time of your request
Metadata
- Your IP-address
- Your computers time zone
- Your computers date and time
- The website you requested
- Which website you came from
- Information about your browser (version, language, fonts installed)
- Information about your operating system (version, language)
- Potentially other information your browser sends via the HTTP protocol.
Temporary storage of the IP-address by the system is necessary to display website content on your device. The information is used exclusively to maintain the technical operation of the servers and the network and ensure its security. The legal basis is our legitimate interest to provide the website in a secure manner(Article 6 (1) f) GDPR/UK GDPR).
We automatically delete all server-logs within 30 days. We store the logs for this time to see suspicious activities in our server and protect our infrastructure from outside attacks such as DDoS.
6.1 Contact form
If you use our contact form, we will receive and store the information you have entered additional to the information described above. Some fields in the contact form are mandatory, so you have to fill these in to send your message. Others are optional, and you can decide if you want to provide the information. We will use the information you have entered to respond to your message and take any actions you may have requested. We do not use the information for other purposes and delete it as soon as we have completed your request, unless a legal obligation forces us to keep the information for longer.
Our mandatory fields are:
- Name: We use this to personalize our message and to see if you had contacted us before
- Email: We need this to respond to you
- Telephone number
- Your message
If you do not want to give certain information, you can also enter false data. However, in some cases we will not be able to respond to your message if information is missing. Our basis for this processing is our contractual obligation if your message concerns purchasing or services offered by us. If you have a general request, our legal basis is legitimate interest, as we want to give you the best service we can.
6.2 Online Reservation
If you use our online reservation form, we will receive and store the information you have entered. Some fields in the reservation form are mandatory, so you have to fill these in to complete your reservation. Others are optional, and you can decide if you want to provide the information.
We will use the information you have entered to complete your reservation and take any actions you may have requested. Our basis for this processing is our contractual obligation.
We do not use the information for other purposes and delete it as soon as we have completed your request, unless a legal obligation forces us to keep the information for longer.
(1) Event Reservation
Our mandatory fields are:
- Name
- Telephone Number
- Email Address
(2) Restaurant Reservation
Our mandatory fields are:
- Name
- Telephone Number
- Email Address
(3) Hotel Reservation
Our mandatory fields are:
- Name
- Sex
- Telephone Number
- Email Address
- Address
- Payment Information
(4) 1-Day Trip Reservation
Our mandatory fields are:
- Name
- Telephone Number
- Email Address
For our 1-Day Trip as well as restaurant Reservation we use the service Table Check by TableCheck Inc., located in KR GinzaⅡ5F, 2-15-2 Ginza, Chuo-ku, Tokyo, Japan 104-0061.
To learn more about the data protection at TableCheck Inc., kindly refer to their privacy policy which can be found here: https://www.tablecheck.com/en/policy/privacy/
-7.Cookies on this website
Cookies are small text files that any website can write into your browser. Cookies may be set by ourselves (first party cookies), or by third parties. If we set a cookie in your browser, other websites cannot read it. If other third parties set a cookie in your browser, any other website which uses the same third party can read the information stored in these cookies. This allows for tracking functionality across websites. If we use third party cookies, we will always ask for your consent before placing these cookies.
Below you can see a list of first party cookies which we set:
The following table shows a list of third party cookies we use:
Company | Name | Contents | Purpose | Duration |
webfont.fontplus.jp | FP-DLV | Font loading preference | Loads custom web fonts | Session |
.google.com | NID | Encrypted user ID | Stores user preferences and personalizes Google services | 6 months |
.google.com | SOCS | Consent settings | Stores cookie consent decisions | 13 months |
.youtube.com | VISITOR_INFO1_LIVE | Unique identifier | Estimates user bandwidth for video quality | 6 months |
.youtube.com | VISITOR_PRIVACY_METADATA | Privacy setting | Stores privacy preferences for YouTube | 6 months |
.youtube.com | YSC | Session identifier | Tracks user interaction with embedded YouTube videos | Session |
.google.com | __Secure-ENID | Encrypted user ID | Enhances security and functionality of Google services | 13 months |
.youtube.com | __Secure-ROLLOUT_TOKEN | Security token | Used for YouTube functionalities | 6 months |
Name | Contents | Purpose | Duration |
_ga | Unique identifier | Used to distinguish users | 13 months |
_ga_LSF3J0YYZF | Unique identifier | Used to store and count page views | 13 months |
_trust360_ | Security token | Used for security and trust assessment | 12 months |
ds | Session data | Stores session settings | Session |
ds_access | Authentication token | Authentication and access control | Session |
ds_en | Language preference | Stores language settings (English) | Session |
ds_en_access | Access control token | Access control for English content | Session |
ds_chs | Language preference | Stores language settings (Simplified Chinese) | Session |
ds_chs_access | Access control token | Access control for Chinese content | Session |
ds_cht_access | Access control token | Access control for Traditional Chinese content | Session |
ds_kor | Language preference | Stores language settings (Korean) | Session |
ds_kor_access | Access control token | Access control for Korean content | Session |
scroll | Scroll position data | Stores the user’s scroll position | Session |
-8. Third Parties
On our websites, we may embed tools and contents loaded from the servers of third party service providers. Examples of this may be graphics, videos, social-media buttons, or other functionalities. Whenever you access a website which embeds such contents, your IP-address will be transmitted to these third parties. Occasionally these tools might include so called web beacons, invisible graphics that are used to gather further statistics. If you notice any such web beacon, please notify us and we will strive to remove it from our websites.
Some third-party contents will also set cookies in your browser to store certain information on your usage of the tools and contents.
Occasionally, the third party might connect your information gathered on our websites to other information they have collected in order to build a profile on you.
8.1 Google Tag Manager
This website uses Google Tag Manager, a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), which allows us to manage website tools via a single interface. Google Tag Manager itself does not process personal data, however it is used to load further tools and contents which may process personal data.
8.2 Google Analytics
If you have given your consent, this website uses Google Analytics, a web analytics service provided by Google LLC. The controller for users in the EU/EEA and Switzerland is Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). The legal basis for this data processing is your consent (Article 6 (1) a) GDPR/UK GDPR).
Google Analytics uses cookies that enable an analysis of your use of our websites. The information collected by means of the cookies about your use of this website is generally transferred to a Google server in the USA and stored there.
Google Analytics 4 has IP anonymization enabled by default. Due to IP anonymization, your IP-address will be shortened by Google within Member States of the EU or in other states party to the Agreement on the EEA. Only in exceptional cases will the full IP-address be transferred to a Google server in the USA and shortened there. According to Google, the IP-address transferred by your browser as part of Google Analytics will not be merged with other Google data. During your website visit, your user behavior is recorded in the form of "events". Events can be:
- Page views - First visit to the website
- Start of session
- Web pages visited
- Your "click path", interaction with the website
- Scrolls (whenever a user scrolls to the bottom of the page (90%))
- Clicks on external links - Internal search queries
- Interaction with videos
- File downloads
- Seen Ads / clicked Ads
Also recorded:
- Your approximate location (region)
- Date and time of your visit
- Your IP
-address (in shortened form)
- Technical information about your browser and the end devices you use (e.g. language setting, screen resolution) - Your internet service provider
- The referrer URL (via which website/advertising medium you came to this website)
On behalf of the operator Google will use this information to evaluate your use of the website and to compile reports on website activity. The reports provided by Google Analytics 4 serve to analyze the performance of our website.
Recipients of the data are/may be
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (as processor under Art. 28 DSGVO),
- Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
- Alphabet Inc, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA
For the USA, the European Commission adopted a news adequacy decision on 10 July 2023. Google LLC is certified under the EU-US Privacy Framework. Since Google servers are distributed worldwide and a transfer to third countries (for example to Singapore) cannot be completely ruled out, we have also concluded the EU standard contractual clauses with the provider to establish an appropriate level of data protection in those countries.
The data sent by us and linked to cookies are automatically deleted after 12 months. The maximum lifespan of Google Analytics cookies is 2 years. The deletion of data whose retention period has been reached occurs automatically once a month.
You can withdraw your consent at any time with effect for the future by accessing the cookie settings and changing your selection there. The lawfulness of the processing carried out on the basis of the consent until revocation remains unaffected.
You can also prevent the storage of cookies from the outset by setting your browser software accordingly. However, if you configure your browser to reject all cookies, this may result in a restriction of functionalities on this and other websites. You can also prevent the collection of data generated by the cookie and relating to your use of the website (including your IP-address) by Google, and the processing of this data by Google, by
- not giving your consent to the setting of the cookie or
- downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout.
For more information about Google and how Google handles data, please refer to the following link:
- Term of use: https://marketingplatform.google.com/about/analytics/terms/us/
- Data protection: https://support.google.com/analytics/answer/6004245?hl=en
- Use of cookies: https://support.google.com/analytics/answer/11397207?hl=en&utm_source=chatgpt.com
- Privacy policy: https://policies.google.com/privacy?hl=en
8.3 Google Fonts
We use Google Fonts provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) on our website to create a unified experience and deliver a modern looking website. These fonts are loaded from third parties to speed up loading processes in your browser, or due to licencing restrictions from the font provider. Our legal ground is our legitimate interest to provide our website with fonts securely, efficiently and maintenance free. When you load our website, Google will learn which website you accessed and what your IP-Address is. The information collected will only be used to show the embedded fonts as well as keep statistics on the popularity of fonts. For more information please reference the following links:
FAQ:
https://developers.google.com/fonts/faq#what_does_using_the_google_fonts_api_mean_for_the_privacy_of_my_users
8.4 Google Translation
We use Google Translation, a service provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”), on our website to provide language translation functionality. This service allows us to offer multilingual content to improve accessibility and create a better user experience. Our legal basis for using Google Translation is our legitimate interest in making our website accessible to a broader audience and enhancing usability.
When you use the translation feature on our website, Google may collect information about your interaction with the service, including your IP address and the page you are visiting. This information is necessary for the functionality of the translation service and may also be used by Google for performance and analytics purposes.
For more information about Google’s data processing practices, please refer to the following links:
8.5 YouTube
On some of our web pages, you will find a “Watch Video” button under certain images, which links to YouTube, offered by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). If you click on this button and visit YouTube, your IP address will be transmitted to Google, and Google will become aware that you have watched the video. If you are logged into YouTube, this information may be associated with your user account (you can prevent this by logging out of YouTube before watching the video). To store additional information about your interaction with the video (for example, when you paused), Google may store a cookie in your browser.
Our legal grounds for embedding videos is our legitimate interest in the modern communication and promotion of our products.
For more details on how Google processes personal data and how to adjust your advertising settings (including turning off personalized ads), please visit Google's Privacy and Terms page at the following link: https://policies.google.com/privacy
8.6 Google Maps
To provide you with directions to our dealers and our company, we use Google Maps, a service offered by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). When you access a webpage that embeds Google Maps, Google will collect your IP-Address, date and time of your visit, which website you visited and potentially any interaction you have with Google Maps, including your location if you use the route planner functions. If you use a mobile device, Google may collect your location data if you have consented to this via your device settings.
Our legal ground for embedding maps is our legitimate interest to keep us and our dealerships easily accessible to any customer.
-9. Social Media
We operate social media pages for the purpose of self-marketing and promotion of our products. We are present on Facebook, Instagram, TickTok, X, YouTube and Printerest.
When you visit our sites, the platforms will collect data about your behavior and interests and might provide us with an anonymized analysis of our user groups and interactions. We have no influence over the creation and display of these analyses and cannot stop the collection or processing of your data for this matter.
We might receive the following data, separated into categories of users:
- Total number of visits,
- Interactions with our posts,
- Comments, - Proportion of male and female visitors,
- Origin of the visit,
- Clicks on certain contents such as maps or contact information,
- Reach of our posts
If you directly interact with our content (such as “Liking” or “Reposing” it), we will be able to directly identify you. Should you wish to restrict this linking of your account and our social media page, please use the functionality offered on each platform to unfollow us.
We use these data and our presence on social media to present ourselves in a modern way to a large audience. The usage of this data, as well as the operation of the page is based on our legitimate interest for efficient, effective and interactive promotion acc. to Art. 6 (1) f) of GDPR/UK GDPR.
Furthermore, the platforms might use your data for their own purposes for market research and advertisement. Cookies might be stored on your computer, which will analyze our usage behavior. Other information on your devices, internet connection and more can be collected and connected to your account. The platforms might create a profile on you, even if you are not logged in or have no account. These profiles can be used to show you targeted advertisement on different platforms.
In some cases, your data will be processed outside of the European Union. Specifically a data transfer to the US cannot be ruled out. For these cases, we have concluded Standard Contractual Clauses (SCCs) approved by the European Commission with the platform operators.
You have the right to enforce your rights regarding our social media pages and the Page-Insights at any time against us or the platform. However, we advise you that in any case, the platform will deal with the request. Should you have any questions, you may contact us via the contact details mentioned above.
Further information on the platforms:
(1) Facebook and Instagram
Facebook and Instagram are Social Media platforms, offered by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Irland with the parent company based in 1 Hacker Way, Menlo Park, California 94025, United States.
We have concluded a joint controller agreement with Meta which you may reference here:
https://www.facebook.com/legal/terms/page_controller_addendum You can read the essential contents of the agreement here:
https://www.facebook.com/legal/terms/information_about_page_insights_data You have the right to enforce your rights regarding our Facebook page and the Page-Insights at any time against us or the platform. However, we advise you that in any case, the platform will deal with the request. Should you have any questions, you may contact us via the contact details mentioned above.
You can reference the privacy policy of Facebook here:
https://www.facebook.com/about/privacy/
Should you have an account with Facebook, you may Opt-Out of processing for advertising purposes here:
https://www.facebook.com/settings?tab=ads
(2) TikTok
TikTok is a social media platform provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland, with the parent company based at ByteDance Ltd., 43rd Floor, One Island East, Taikoo Place, Quarry Bay, Hong Kong.
You can reference the privacy policy of TikTok here:
You can find information on the privacy settings offered by TikTok here:
To adjust your preferences regarding personalized ads, you can refer to the following page:
If you have any questions regarding data privacy or wish to exercise your rights under applicable data protection laws, you may contact us via the details provided above or reach out directly to TikTok Technology Limited.
(3) X
X is a social media platform, provided by X Corp., One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland with the parent company Twitter, Inc., 1355 Market Street #900, San Francisco, California 94103.
You can reference their privacy policy of X here:
https://x.com/en/privacy
You can find information on the privacy settings offered by X here:
https://help.x.com/en/safety-and-security/x-privacy-settings
To adjust your privacy options regarding ads, follow the information here:
https://help.x.com/en/safety-and-security/privacy-controls-for-tailored-ads
(4) YouTube
YouTube is a video platform, provided by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland with the parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043.
You can reference their privacy policy here:
https://policies.google.com/privacy
To change your setting for ads and turning of personalized ads, please follow the link below:
https://adssettings.google.com/authenticated
(5) Pinterest
Pinterest is a social media platform provided by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland, with the parent company based at Pinterest, Inc., 505 Brannan Street, San Francisco, California 94107, United States.
You can reference the privacy policy of Pinterest here:
You can find information on the privacy settings offered by Pinterest here:
To manage your ad personalization preferences, you can visit:
If you have any questions regarding data privacy or wish to exercise your rights under applicable data protection laws, you may contact us via the details provided above or reach out directly to Pinterest Europe Ltd.
-10. Transfer of personal data to third countries
In order to fulfill the contract with the customer or to carry out the procedure according to the request of the customer prior to the conclusion of the contract,we may transfer personal data to a third country (including those countries where the adequate level of data protection have not been qualified). We shall use appropriate security and confidentiality measures in accordance with this Privacy Policy and laws when transferring customer’s personal data.
-11. Retention periods of personal data
We will generally delete your personal data as soon as we no longer require it for the purposes for which we collected it. If any legal obligation stops us from deleting your information for a certain time, we will stop access to this information, store it securely and delete it after our legal obligation has ended.
-12. Your right
At any time you can exercise your rights by contacting us or our representatives directly. Please be aware that we might ask for some sort of verification of identity in order to safeguard other data subjects. These verification will be made as non-intrusive as possible. You have the following rights:
(1) Right of access
(2) Right to rectification and erasure
(3) Right to restriction of processing
(4) Right to data portability
(5) Right to withdraw your consent
-12.1 Right to lodge a complaint
At any time, you may lodge a complaint about our data processing activities with a supervisory authority.
-12.1.1 EU
A list of supervisory authorities can be found here:
https://edpb.europa.eu/about-edpb/board/members_en
-12.1.2 UK
Information of Commissioner’s Office
Website: https://ico.org.uk/
12.2 Right to object
You have the right to object to any processing we do on grounds of our legitimate interest, if your particular situation challenges our balance of interests.
Unless we can demonstrate legitimate grounds for processing which overrides your interests, rights, and freedoms, and if we do not need your personal data for the establishment, exercise of defense of legal claims, we will no longer process your personal data.