Privacy Policy

"Personal Information" refers to "personal information" as defined in the Act on the Protection of Personal Information of Japan, meaning information about a living individual that can identify the specific individual through name, date of birth, address, phone number, contact details, or other descriptions, as well as data that can identify a specific individual on its own (personal identification codes) such as facial features, fingerprints, voiceprints, or insurer identification numbers.

1. The Company may request personal information such as email address, display name, and organization name when Users register for the Service. 2. The Company may collect transaction records and payment information including User personal information from business partners (information providers, advertisers, payment processors, etc.; collectively, "Partners").

The Company collects and uses personal information for the following purposes: (1) To provide and operate the Service. (2) To respond to inquiries from Users (including identity verification). (3) To send emails about new features, updates, and campaigns of the Service in use as well as other services provided by the Company. (4) To contact Users about maintenance, important notices, etc. (5) To identify and refuse use by Users who violate the Terms or attempt to use the Service for unlawful purposes. (6) To allow Users to view, modify, or delete their registration information and view their usage status. (7) To bill Users for fees in paid services. (8) To improve the Service and develop new services. (9) Purposes incidental to the above.

1. The Company may change the purpose of use of personal information only when reasonably deemed related to the purpose before the change. 2. When the purpose of use is changed, the Company shall notify Users of the new purpose or publish it on this website by means specified by the Company.

1. The Company shall not provide personal information to third parties without obtaining prior consent from Users, except in the following cases or as permitted by law: (1) When necessary to protect a person's life, body, or property and obtaining consent is difficult. (2) When particularly necessary for improving public health or promoting healthy development of children and obtaining consent is difficult. (3) When cooperation with a national or local government agency or its contractor is necessary to perform legally prescribed duties and obtaining consent could impede such duties. 2. Notwithstanding the above, the following do not constitute provision to third parties: (1) Outsourcing all or part of personal information handling within the necessary scope to achieve the purpose of use. (2) Provision of personal information accompanying business succession due to merger or other reasons. (3) Joint use of personal information with specific parties when the User has been notified in advance, or such information is readily available, regarding the items, scope, purposes, and responsible party.

1. Data Storage Location Principle The Company processes and stores the personal information of users and survey respondents, in principle, on cloud infrastructure located within Japan (specifically, the Supabase Tokyo (ap-northeast-1) region and the Vercel Tokyo (hnd1) region). Backups and certain incidental processing (authentication email delivery, AI analysis, etc.) may be carried out in the country where the sub-processors described below are located (such as the United States). 2. List of Sub-processors The Company entrusts the handling of personal information to the following sub-processors in providing the Service. When selecting sub-processors, the Company chooses providers with appropriate information management systems and contractually requires safety measures. (1) Supabase, Inc. (headquartered in the United States; data storage: Tokyo (ap-northeast-1) region) — PostgreSQL database, authentication, storage (2) Vercel Inc. (United States; edge delivery and Tokyo (hnd1) region) — hosting, edge functions (3) Resend (Substance Labs, Inc.) (United States) — delivery of inquiry emails and authentication emails (4) Google LLC (United States) — Google Tag Manager, Google Analytics 4 (only where consent has been obtained) (5) Anthropic, PBC (United States) — survey analysis via the Claude API (uploaded survey files are physically deleted after analysis) (6) Stripe, Inc. (United States) — payment processing for paid plans 3. Provision to Third Parties Located in Foreign Countries Some of the sub-processors listed above are located outside Japan (primarily in the United States). When providing personal data to third parties located in foreign countries, the Company takes the measures required by the Act on the Protection of Personal Information (such as obtaining the consent of the data subject or ensuring an equivalent level of protection on an ongoing basis). For the handling of personal data transfers from the EU/EEA/UK, please refer to Article 14 (Supplement for EU Residents) below.

1. When a person requests disclosure of their personal information, the Company shall disclose it without delay. However, if disclosure falls under any of the following, the Company may decline to disclose all or part of the information and shall notify the person without delay of the decision not to disclose. (1) Risk of harming the life, body, property, or other rights or interests of the person or a third party. (2) Risk of significantly impeding the proper conduct of the Company's operations. (3) Cases where disclosure would violate applicable laws. 2. Notwithstanding the above, information other than personal information such as historical and characteristic information shall, in principle, not be disclosed.

1. Users may request correction, addition, or deletion of their personal information held by the Company ("Correction") through procedures specified by the Company if the information is inaccurate. 2. Upon receiving such request and determining that it is necessary to comply, the Company shall make the Correction without delay. 3. The Company shall notify Users without delay of any Corrections made, or of decisions not to make such Corrections.

1. When a person requests suspension or deletion of personal information ("Suspension") on the grounds that it is being handled beyond the scope of use or was acquired by improper means, the Company shall conduct the necessary investigation without delay. 2. Based on the investigation results, if the Company determines it is necessary to comply, it shall suspend the use of the personal information without delay. 3. The Company shall notify Users without delay of any Suspensions made, or of decisions not to suspend. 4. Notwithstanding the above, when Suspension would require excessive cost or is otherwise difficult, and an alternative measure can be taken to protect the User's rights and interests, the Company shall take such alternative measure.

The Service uses cookies to improve User convenience and the Service. Users may refuse cookies via browser settings, but in that case some features of the Service may become unavailable.

The Service may collect IP addresses, browser type, access timestamps, and similar information for the purposes of preventing abuse, improving service quality, and analyzing usage. Such information is not used to identify individuals.

1. The contents of this Policy may be changed without notice to Users, except for matters otherwise specified by law or this Policy. 2. Unless otherwise specified by the Company, the revised Privacy Policy shall take effect upon being posted on this website.

Inquiries regarding this Policy should be directed to the contact below. Company: TalentCloud, Inc. Address: 171 Ochi-cho, Midori-ku, Chiba-shi, Chiba 267-0055, Japan Representative: Takemi Terashi, CEO Contact: Please use the inquiry form on the Service website.

This article applies only where the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the UK GDPR apply to use of the Service by users residing in the EU/EEA or the United Kingdom ("EU Users"). 14.1 Controller The controller of personal data relating to the Service is TalentCloud, Inc. Contact details are as set out in Article 13. 14.2 EU Representative (Art. 27) At this time, the Company has not designated an EU representative under Art. 27 of the GDPR. EU Users may contact the Company directly using the methods described in Section 14.7 of this article. 14.3 Legal Bases for Processing (Art. 6) The Company processes personal data on one or more of the following legal bases: (1) Performance of a contract (Art. 6(1)(b)): providing the Service, billing, and handling inquiries. (2) Legitimate interests (Art. 6(1)(f)): preventing abuse, improving service quality, and analyzing aggregated usage. (3) Consent (Art. 6(1)(a)): cookies (other than strictly necessary cookies), analytics, and marketing emails. (4) Compliance with legal obligations (Art. 6(1)(c)): responding to requests from laws and supervisory authorities. 14.4 Retention Periods (1) Inquiry content: 2 years after completion of the response. (2) Analytics data (Google Analytics 4): up to 14 months. (3) Other data: for the period necessary to achieve the purpose of use or as prescribed by law. 14.5 Data Subject Rights (Art. 15–22) EU Users have the following rights: (1) Right of access (Art. 15) (2) Right to rectification (Art. 16) (3) Right to erasure / right to be forgotten (Art. 17) (4) Right to restriction of processing (Art. 18) (5) Right to data portability (Art. 20) (6) Right to object (Art. 21) (7) Right not to be subject to automated decision-making (Art. 22) (8) Right to withdraw consent (Art. 7(3)) — withdrawal only affects future processing. 14.6 How to Exercise Your Rights To exercise the rights above, please use the "Contact" form on this site and select the inquiry type "GDPR Data Subject Request". Pursuant to Art. 12(3) of the GDPR, the Company will in principle respond within one month of receipt. For complex requests, this period may be extended by up to two further months, in which case the Company will notify you of the reasons in advance. 14.7 International Transfers and Japan's Adequacy Decision (Art. 44–50) (1) Primary Data Storage Location: The Company processes and stores personal data of users and respondents residing in the EU/EEA/UK, in principle, within Japan (the Supabase Tokyo (ap-northeast-1) region and the Vercel Tokyo (hnd1) region). (2) Japan's Adequacy Decision: Japan benefits from an adequacy decision adopted by the European Commission under Art. 45 of the GDPR (Implementing Decision (EU) 2019/419, in force since 23 January 2019). As a result, transfers of personal data from the EU/EEA to Japan do not, in principle, require additional safeguards such as the SCC, and are deemed to ensure a level of protection equivalent to intra-EU transfers. The United Kingdom likewise recognises Japan as "adequate" under its own adequacy framework. (3) US-based Sub-processors: The Company maintains certain sub-processors in the United States for incidental processing, which may result in transfers from the EU/EEA/UK to the United States. Such transfers are carried out on the basis of the EU Standard Contractual Clauses (SCC, European Commission Decision 2021/914, Module 2: Controller to Processor) and equivalent technical and organisational measures (encryption, access control, etc.). - Vercel Inc. (edge delivery, including US edge locations) - Resend (Substance Labs, Inc.) (email delivery) - Google LLC (Google Tag Manager / Google Analytics 4) - Anthropic, PBC (survey analysis via the Claude API) - Stripe, Inc. (payment processing) 14.8 Sub-processors (with regions) The current sub-processors for svys.net and kicue.com are as follows. The Company will update this Policy if changes occur. (1) Supabase, Inc. (headquartered in the United States; data storage: Japan / Tokyo ap-northeast-1) — PostgreSQL, authentication, storage (2) Vercel Inc. (United States; edge primarily in Tokyo hnd1) — hosting, edge functions (3) Resend (Substance Labs, Inc.) (United States) — email delivery (4) Google LLC (United States) — Google Tag Manager, Google Analytics 4 (only where consent has been obtained) (5) Anthropic, PBC (United States) — survey analysis via the Claude API (6) Stripe, Inc. (United States) — payment processing 14.9 Right to Lodge a Complaint with a Supervisory Authority (Art. 77) EU Users have the right to lodge a complaint about the Company's processing with the supervisory authority of their place of residence, place of work, or the place of the alleged infringement of the GDPR (for example, CNIL in France, BfDI in Germany, AEPD in Spain, CNPD in Portugal, the Korea Personal Information Protection Commission, and others). 14.10 Automated Decision-Making and Profiling The Company does not carry out automated decision-making or profiling on this site that produces legal effects concerning users or similarly significantly affects them. 14.11 Managing Consent Users can review and change their consent settings at any time via the "Cookie Settings" link at the bottom of the page.

This article sets out the handling of personal data of end users ("Respondents") who answer surveys conducted by our customers using svys.net. 15.1 Controller / Processor Relationship The entity conducting the survey (the customer of the Company who creates and distributes the survey using svys.net) acts as the "Controller" under the GDPR, and the Company acts as the "Processor", processing personal data on the Controller's instructions. The Company processes response data only within the scope of the terms of service entered into with the Controller and any separate Data Processing Agreement (DPA). 15.2 Personal Data Collected on the Response Screen The items, purposes, and retention periods of personal data collected from survey respondents are governed by the Privacy Notice that the Controller (the entity conducting the survey) presents on the response screen. The Company will not use such data for any purpose outside the Controller's instructions (except for anonymised aggregation for statistical analysis and service improvement). Please see Article 14, Section 14.8 (Sub-processor list) for the cloud infrastructure and sub-processors we use. 15.3 Consent Acquisition and Audit Logs The Controller is responsible for displaying its Privacy Notice and, where required, obtaining explicit consent before the response begins. Records of the Respondent's consent (consent timestamp, language displayed, snapshot of the Privacy Notice content, response session ID, etc.) are retained by the Company as audit logs linked to the corresponding response data. Such consent logs are retained for a maximum of the data retention period + 1 year (if the Controller deletes the response data early, the consent log is also deleted simultaneously) and are promptly deleted thereafter. This approach addresses both the storage limitation principle under GDPR Art. 5(1)(e) and the obligation to demonstrate consent under Art. 7(1). 15.4 Exercise of Respondent Rights Where a Respondent wishes to exercise the right of access, rectification, erasure, restriction of processing, data portability, the right to object, or similar rights, the first point of contact is the entity conducting the survey (the Controller). The Company will provide technical assistance (such as extraction, deletion, or export of the relevant data) through the Controller or in accordance with the Controller's instructions. If a Respondent is unable to identify the Controller's contact details, they may contact the Company via the inquiry form, and the Company will, to a reasonable extent, facilitate communication with the Controller. 15.5 Sub-processors Sub-processors used for processing Respondent personal data are listed in Article 6 and Article 14, Section 14.8. 15.6 Retention Period and Deletion Procedures The retention period for response data follows the Controller's instructions; data will be deleted upon expiry of the period specified by the Controller or upon termination of the agreement. Upon receiving a request to exercise the right to erasure (GDPR Art. 17), the Company sends an acknowledgment notice (e.g., email) stating: "Deletion from the production database will be performed within 7 days of receipt; full deletion from encrypted backups may take up to 30 days based on our backup retention policy." Data on backups is operationally not restored or accessed after a deletion request is received. 15.7 International Transfers Response data is, in principle, processed and stored within Japan (the Supabase Tokyo region and the Vercel Tokyo region). Transfers from the EU/EEA/UK to Japan benefit from the adequacy decision described in Section 14.7. Where incidental processing involves US-based sub-processors (such as Anthropic), the SCC and equivalent safeguards apply.