Privacy Policy

rinna Co., Ltd (the "Company") sets forth this Privacy Policy (this “Policy”) with regard to the treatment of personal data, including personal information, in the course of the performance of Service provided by the Company (the “Service”) as follows;

Personal Data to be Collected and Method of Collection
For the purposes of this Policy, “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, that are collected by the Company pursuant to this Policy.
The Personal Data that the Company may collect in the course of the Service is as follows, depending on the method of collection.
1. Information provided from another service, based on the user's consent for the Service to associate with such another service in relation to the user's use of the Service
  If the user permits the Service to associate with other services such as social networking services in relation to the user's use of the Service, the Company may collect the following information from the said other services in accordance with the conditions agreed by the user at the time of such permission:
  - account name, icon image and status message used by the user for the said other service, as well as internal identifier assigned by the service operator of the said other services
  - other information for which the user, in the privacy settings in the said other service, permits the disclosure to its associated services;
2. Information automatically collected by the Company in the course of the user's use of the Service
  The Company may collect information regarding the content of the user's post to the other services set forth in (1) above, the content of the user's post to the feedback on the Company's website, and access to or use of the Service by the user. The information includes the followings;
  1. referrer
  2. IP address
  3. Information regarding server access logs
  4. cookies
  5. ADID, IDFA and other identifiers
  6. location information

Purposes of Processing and Legal Bases

The Company will only process the Personal Data for specific, explicit and legitimate purposes. The Company shall not process the Personal Data for any further purposes than the ones the data was originally intended for, unless the new purpose is compatible with the original one. In the absence of compatibility, the processing of Personal Data for further purposes is subject to the user's prior explicit consent.

The following lists the purposes for which the Company process the user's Personal Data and the legal bases it relies on;

Purpose:	- providing, maintaining, protecting and improving the Service
	Legal Bases:	- performance of a contract
		- legitimate interests: ensuring the efficient and secure running of the Company's business
Purpose:	- producing statistics related to the Service in a form which does not allow the identification of individuals
	Legal Bases:	- performance of a contract
		- legitimate interests: improving the Company's services and identifying ways to grow the Company's business
Purpose:	- guidance and response to inquiries relating to the Service
	Legal Bases:	- performance of a contract
		- legal or regulatory obligation
		- legitimate interests: ensuring that the user is provided with the best client services the Company can offer
Purpose:	- responding to acts that violate the Company's rules, regulations or policies relating to the Service (the “Rules”)
	Legal Bases:	- performance of a contract
		- legal or regulatory obligation
		- legitimate interests: ensuring that the Company does not deal with proceeds of criminal activities or assist in any other unlawful or fraudulent activities
		- public interest
Purpose:	- notice of modification to the Rules or related matters
	Legal Bases:	- performance of a contract
		- legal or regulatory obligation
		- legitimate interests: ensuring the Company can notify the user about changes to the terms of business or this policy
Purpose:	- distribution, display and measuring effect of advertisements
	Legal Bases:	- legitimate interests: promoting the Company's services, identifying ways to grow the Company's business

Method of Requiring Discontinuance of Use
The user may request the Company to discontinue the collection or processing of the all or a part of the Personal Data by choosing the applicable setting as prescribed in the Service, and promptly upon such request the Company shall discontinue such collection or processing in accordance with the rules set forth separately by the Company. Certain Personal Data is necessary to be collected or processed for providing the Service, and the Company shall discontinue such collection or processing of the Personal Data only if the user withdraws from other services in Clause 1 (1) above pursuant to the procedures as set forth separately by the service providers to which it relates, and/or only if the user withdraws from the Service pursuant to the procedures as set forth separately by the Company.
Disclosure of Personal Data to Third Parties
Except as permitted by applicable laws or regulations, the Company shall not disclose Personal Data to any third party without the use's consent, excluding to the following third parties:
1. third parties which provides services for or on behalf of the Company regarding the processing Personal Data in whole or in part to the extent necessary for the achievement of the purposes of processing set forth above;
2. third parties in connection with merger or other busines succession;
3. third parties in which it is necessary to cooperate with any state or local government, or any party which provides services for or on behalf of such government under applicable laws and regulations and in which obtaining the consent of the user would interfere with the performance of duties; or
4. third parties when required by law or as lawfully necessary to protect Company to comply with the law, requests from authorities, court orders, legal procedures.
Rights regarding Personal Data
The Company reminds the user that it can at any time exercise following certain data protection rights as long as the applicable laws allow.
- The right to request access to Personal Data, which includes the right to obtain confirmation from the Company as to whether or not Personal Data concerning the user is being processed, and where that is the case, access to the Personal Data and information related to how it is processed. The user may always contact the Company at the Data Protection Contact Point (see Section 7) to find out what Personal Data the Company has concerning the user and its origin.
- The right to rectification or erasure of Personal Data, which includes the right to have incomplete Personal Data completed, including by means of providing a supplementary statement, certain rights to request us to erase the user's Personal Data without undue delay.
- The right to restrict or object to processing concerning Personal Data, which includes restricting the Company from continuing to process the user's Personal Data under certain circumstances (e.g., where the user contests the accuracy of the use's Personal Data, processing is unlawful, its Personal Data is no longer needed for the purposes of processing, or the user has otherwise objected to processing related to automated individual decision-making).
- The right to data portability, which includes certain rights to have its Personal Data transmitted from the Company to another controller.
- Where data processing is based on the user's consent, the right to withdraw consent at any time.
- The right to lodge a complaint with a data protection supervisory authority.
Any requests related to the above rights can be made by sending an email to the Data Protection Contact Point set forth below. The user will not have to pay a fee to access its Personal Data (or to exercise any of the other rights). However, the Company may charge a reasonable 80,000 Indonesian rupiah fee if the user's request is clearly unfounded, repetitive or excessive. Alternatively, the Company may refuse to comply with the use's request in these circumstances.
The Company may need to request specific information from the user to help the Company confirm the user's identity and ensure the user's right to access its Personal Data (or to exercise any of the use's other rights).
Data Controller and Data Protection Contact Point
For the purpose of this Policy
rinna Co., Ltd.
Shibuya Square 39F WeWork, 24-12 Shibuya 2-chome Shibuya-ku,
Tokyo 150-6139, Japan
is responsible for the processing of the user's Personal Data as Data Controller.
For comments, questions, complaints, and other inquiries regarding the application of this Policy or for exercising the user's rights, as described in this Policy, the user can contact the Company at the Data Protection Contact Point
Data Protection Contact Point
Address: Shibuya Square 39F WeWork, 24-12 Shibuya 2-chome Shibuya-ku, Tokyo 150-6139, Japan
Department in charge of the Company: Privacy & Security Department
E-mail: privacy@rinna.co.jp
Amendment to this Policy
The Company will review the operation of Personal Data from time to time and strive for continuous improvement, and may make changes to this Policy as necessary. In the case of changes to the content of this Policy that are legally required to be agreed to by the user, this Policy will only apply to the user who has given consent to the changes by the method prescribed by the Company. In the event that this Policy is changed, the Company shall notify the user of timing and content of this Policy through posting on the Company's website or other appropriate method, or notifying the used of the change.

October 20, 2020