Privacy Notice

1. Introduction

Technica Zen Co., Ltd. (“Technica Zen,” “we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Notice explains how we collect, use, disclose, and safeguard your personal data when you interact with our website, use our services, or work with us. It also sets out your rights regarding your personal data and how you can contact us about our privacy practices.

This Privacy Notice applies to all personal data processed by Technica Zen in its role as a data controller, including personal data from customers, prospects, business partners, employees, contractors, candidates, and website visitors (“you”), regardless of your country of residence.

For the purposes of this Privacy Notice:

• Personal Data means any information relating to an identified or identifiable individual.
• Processing of Personal Data refers to any operation performed on personal data, whether or not by automated means, such as obtaining, recording, using, consulting, modifying, storing, restricting, disposing of, erasing, disclosing, aggregating, anonymizing, or de‑identifying personal data.
• Controller of Personal Data means the entity that determines the purposes and means of processing personal data, in this case, Technica Zen Co., Ltd.

Back to Contents▲

2. Identity and contact details of the data controller

The data controller responsible for the processing of your personal data is:

Technica Zen Co., Ltd., Head Office

Back to Contents▲

3. Categories of personal data we collect, purposes of processing and legal basis

We may collect the following categories of personal data directly from you:

We may process your personal data where necessary to comply with legal obligations or in our legitimate interests, including for the purposes of responding to judicial proceedings, law enforcement requests, or inquiries from governmental authorities.

We may collect certain categories of personal data about you through automated technologies such as internet or other electronic network activity information, cookies, and web beacons. These may include:

• Technical data (e.g., IP address, device details, operating system, browser type)
• Usage data (e.g., interactions with our website, pages viewed, time spent on pages, and service usage statistics)

We use this information, with your consent, to:

• Measure the effectiveness and open rate of our newsletters;
• Analyze and improve the performance, functionality, and user experience of our website.

Back to Contents▲

4. Data retention

We retain your personal data only for as long as necessary to fulfill the purposes described in this Privacy Notice and to comply with applicable legal and regulatory requirements.

To ensure transparency, we set specific retention periods depending on the purpose for which it was collected. These retention periods are outlined in the table below. Once a retention period expires, or if the data is no longer required for the stated purpose, we will securely delete, or anonymize your personal data, unless a longer retention period is required by law.

Back to Contents▲

5. Data sharing

We may share your personal data with the following categories of recipients:

Trusted service providers and other third parties

We engage carefully selected service providers to support us in delivering our services, such as IT security providers, cloud computing providers, SaaS solutions, consultants, lawyers, accountants, and other professional advisers who assist with business operations, contractual arrangements, or tax obligations. We may also share personal data with payment service providers and financial institutions to process transactions, with training or certification bodies to manage registrations and issue certifications.

These providers are contractually required to implement appropriate confidentiality, privacy, and security measures and promptly notify us in case of any data breach. In addition to these measures, we apply internal policies and procedures designed to ensure that personal data sharing with third parties is kept to the minimum necessary to achieve the stated purposes.

Business partners

In some cases, we may provide services together with selected business partners (please see the list here). Where personal data needs to be shared for such joint activities, we will ensure that:

• you are informed in advance and, we do not share your personal data with partners for their independent use without your prior consent;
• appropriate contractual and organizational safeguards are implemented to protect your personal data.

Regulatory authorities, courts, and law enforcement

Where disclosure is legally required in order to comply with applicable laws, or regulations.

Other third parties in the event of corporate transactions

If our business undergoes a significant change, such as a merger, acquisition, reorganization, bankruptcy, dissolution, or the sale of all or part of our assets or shares, your personal data may be transferred as part of the transaction. In such cases, we will ensure that:

– the recipient is bound by appropriate confidentiality and data protection obligations;
– you are informed of any material changes in the way your personal data is processed as a result of the transaction.

Back to Contents▲

6. Cross border data transfer

While the primary processing of your personal data takes place in Japan, some of our service providers and business partners may process personal data in other countries. These may include countries that do not provide the same level of data protection as Japan (for example, the United States or Canada).

In such cases, we ensure that your personal data is protected in accordance with this Privacy Notice and applicable legal requirements. This includes requiring our overseas service providers and partners to apply privacy and security measures equivalent to those required under the Act on the Protection of Personal Information (APPI).

When transferring your personal data to a foreign country, we will inform you of:

• the name of the country concerned,
• the data protection framework applicable in that country, and
• the safeguards we have applied to ensure the protection of your personal data.

You may request additional information on these safeguards at any time by contacting us (see the “Contact us” section below).

Where your consent is required for an overseas transfer, we will provide you with clear information on the risks involved if the destination country does not have a data protection regime equivalent to that of Japan.

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, we transfer your personal data based on:

• Adequacy decisions issued by the European Commission or other competent authorities,
• Standard Contractual Clauses approved by relevant authorities, or
• Other legally recognized data transfer mechanisms, as required under applicable data protection laws.

Back to Contents▲

7. Data security

We are committed to safeguarding your personal data from loss, misuse, unauthorized access, disclosure, alteration, or destruction. To achieve this, we implement a combination of technical, organizational, and administrative measures, as defined below.

Governance and policies

As a privacy, security, and governance consulting firm, we apply our expertise internally. We maintain a comprehensive Privacy Policy and an Information Security Policy that define how personal data and information assets are handled throughout their lifecycle. Our internal rules cover the collection, use, provision, storage, deletion, and disposal of personal data.

Organizational controls

• Processing responsibilities and scope are clearly defined, and data processing occurs only after approval by the responsible person.
• Regular training foster a strong culture of privacy awareness and compliance.
• Vendors and business partners are subject to pre‑evaluation and continuous monitoring to ensure compliance with our privacy and security standards.

Personnel measures

• All employees receive training on data protection upon joining and at least annually thereafter.
• Daily discussions reinforce awareness of data privacy obligations.
• Every employee signs a confidentiality and non‑disclosure agreement (NDA) that includes clauses on personal data protection.

Physical security

• Access to our premises is strictly limited to authorized personnel.
• Use of removable storage media is prohibited.
• Company files can only be accessed from authorized, encrypted devices.
• Personal data on physical and electronic media is irreversibly deleted or destroyed when no longer needed.

Technical safeguards

We maintain a comprehensive information security framework, including:

• VPN environment and SSL communication for secure data transmission;
• Strict access management and role‑based permissions;
• Password management software and mandatory multi‑factor authentication;
• Endpoint security management and installation of antivirus software;
• Encryption and key management for data protection;
• System usage approval system to control internal access;
• Implementation of regular backups to prevent data loss.

Ongoing risk management

• Information assets, including personal data, are classified according to risk, with tailored security measures applied to each classification.
• We continuously monitor changes in data protection and cybersecurity laws worldwide through our membership‑based privacy network and collaboration with international experts.
• Our internal policies and procedures are regularly updated to reflect evolving risks and regulatory requirements.

Back to Contents▲

8. Your rights

Depending on your place of residence, you may have certain rights in relation to your personal data. These may include the right to:

• Access your personal data and obtain a copy;
• Correct inaccurate or incomplete personal data;
• Request deletion of your personal data, where applicable;
• Restrict or object to the processing of your personal data;
• Receive your data in a portable format (data portability, where legally applicable);
• Withdraw your consent at any time, where processing is based on consent;
• Lodge a complaint with a competent supervisory authority if you believe your rights have been infringed.

If you live in Japan, you may also have the right to:

• Request suspension of use of your personal data;
• Request deletion or cessation of disclosure to third parties of your personal data, where certain conditions are met;
• Request disclosure of records of transfers of your personal data to third parties;
• Request notification of the purposes of use of your personal data.

How to exercise your rights

You may exercise your rights at any time by contacting us as described in the Contact Us section below.

• We will verify your identity or the authority of your representative before processing your request. Depending on the content, we may require you to complete a designated application form.
• We will respond to your request without undue delay and, in principle, within one month of receipt, in accordance with applicable data protection laws.
• Our response will be provided through a method agreed with you, including electronic means.
• Requests are free of charge unless they are excessive or manifestly unfounded. In such cases, we may charge a reasonable fee or refuse to act.

Limitations and exceptions

In certain circumstances, we may not be able to fulfill your request, including when:

• responding could harm the rights, freedoms, or safety of you or a third party;
• fulfilling the request would infringe on our own rights or legitimate interests;
• disclosure would violate laws or regulations; or
• special procedures are prescribed by applicable law.

Any personal data collected in connection with a rights request will be used only to process that request and will be securely deleted once the process is complete.

Complaints

Japan
If you are not satisfied with our response after contacting us, you may file a complaint or inquiry with the Personal Information Protection Commission (PPC):

• Website: https://www.ppc.go.jp/
• Consultation Hotline: https://www.ppc.go.jp/personalinfo/pipldial
• Phone: +81‑3‑6457‑9849
• Hours: 9:30 – 17:30 (excluding weekends, national holidays, and New Year holidays)

European Economic Area (EEA), United Kingdom, and Switzerland
If you are located in the EEA, the UK, or Switzerland, you may lodge a complaint with your local supervisory authority.

• A full list of EEA authorities is available here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en
• United Kingdom: ICO – https://ico.org.uk/
• Switzerland: FDPIC – https://www.edoeb.admin.ch/en

Back to Contents▲

9. Automated decision-making, including profiling

We do not use personal data for automated decision-making, including profiling, that produces legal or similarly significant effects on individuals, without providing appropriate safeguards.

Back to Contents▲

10. Contact us

If you have any questions or concerns about this Privacy Policy or how we handle your personal data, please contact us at:

Technica Zen Co., Ltd.

General inquiries should go via the “Contact Us” page on our website.

Back to Contents▲