Ekitag Privacy Policy

JR East Japan Marketing & Communications, Inc. | Ekitag

This Policy supplements the “JR East Japan Marketing & Communications, Inc. Privacy Policy for Its Websites” (the “Website Privacy Policy”) of JR East Japan Marketing & Communications, Inc. (the “Company”) with respect to the handling of personal information in “Ekitag” (the website and application provided by the Company, collectively, the “Service”). Matters set forth in the Website Privacy Policy, including security control measures, methods for exercising data subjects’ rights, responses to requests for disclosure and other actions, and the point of contact for consultations concerning Personal Information, shall be governed by the Website Privacy Policy. If this Policy conflicts with the Website Privacy Policy, this Policy shall prevail with respect to matters concerning the Service.

Terms used herein shall have the meanings set forth in the Website Privacy Policy.


Chapter 1. Categories and Purpose of Personal Information Collected through the Service

In providing the Service, the Company collects the following Personal Information and uses it for the following purposes.

Categories of Personal Information Collected Purpose
Information Collected from Application Users
  • Identification information: OS, application version, and external ID user identifier (when linked with Google, Apple, or X)
  • Attribute information (optional): prefecture of residence, age group, and gender
  • Survey information (optional): attribute information, reasons for use, etc.
  • Usage history: pages viewed within the application, locations used (such as stations and tourist facilities), and Cookies and other identifiers
  • Location information (optional): current location information and history of location information when an NFC tag is tapped
  • To provide the Service and related after-sales support;
  • To improve and enhance the Service and to develop new features;
  • To provide services in connection with promotional campaigns, including the shipment of promotional products;
  • To consider and develop new products and services, as well as the software, systems, facilities, equipment, and other resources used to provide them;
  • To analyze the use of the Service and conduct market research, product development, and marketing activities tailored to the data subject's interests and preferences (including where such analysis is based on profile information, browsing history, Cookies and other identifiers, information relating to the use of the Service, and the information described in Chapter 1);
  • To detect unauthorized operation or unauthorized access to the App and to implement preventive and remedial measures.
Location Information Collected from Application Users
  • When users use the map function (which allows users to search for stamps and tags near their current location), current location information is collected through GPS. If location access is not permitted, displays based on the user’s current location will not be provided.
  • When an NFC tag is tapped, the location information of the station, facility, etc. where the tag was tapped is stored as history. This movement history is handled as Personal Information.
  • To provide the Service and related after-sales support;
  • To maintain and manage the facilities, equipment, and devices necessary for providing the Service, and to manage their usage;
  • To improve and enhance the Service and to develop new features;
  • To consider and develop new products and services, as well as the software, systems, facilities, equipment, and other resources used to provide them;
  • To analyze the use of the Service and conduct market research, product development, and marketing activities tailored to the data subject's interests and preferences (including where such activities are carried out by analyzing profile information, browsing history, Cookies and other identifiers, information relating to the use of the Service, and the information described in Chapter 1);
  • To detect unauthorized operation or unauthorized access to the App and to implement preventive and remedial measures.
Information Collected When Contacting the Support Center
OS, application version, in-application user identifier, email address, and details of the inquiry.
  • To receive and respond to inquiries, comments, and feedback from users

Chapter 2. Methods of Collecting Personal Information

The Company collects the Personal Information described in the preceding chapter by the following methods.

1. Input by the Data Subject

Information entered by the individual when contacting the support center, responding to a questionnaire survey, etc.

2. Automatic Collection

Information automatically collected when the application is downloaded, when the application is used, or when an NFC tag is tapped.

3. Collection from Third Parties

Identifiers collected from the relevant linked service provider (Google, Apple, or X) when an external ID is linked.



Chapter 3. External Transmission of Information and Information Collection Modules

The Service (application) incorporates the following third-party information collection modules, through which the relevant third parties may collect information in order to achieve the purposes of use specified by the Company.

Module Provider Purpose of Use
Google Analytics SDK Google, Inc. Analysis of usage history within the application
Firebase Google, Inc. Investigation of application crash information
AdMob Google, Inc. Advertising delivery
AppsFlyer AppsFlyer Ltd. Measurement, including setting in-application destinations when QR codes are scanned and directing users to different app stores, etc.

The Service also participates in the Amazon Associates Program, which introduces products associated with particular regions, and, as a participant, places links to product pages on Amazon.co.jp and other Amazon sites. When a user selects a link, the user is redirected to an Amazon site. Because information is not automatically transmitted from the Service, this program is not included in the above table. Information collected by Amazon after a link is selected is handled in accordance with Amazon’s applicable privacy rules.


The Website uses Google Tag Manager (GTM) to implement Google Analytics (GA4).

Module Provider Purpose of Use
Google Analytics (GA4) Google, Inc. Understanding and analyzing access status

For details regarding the types and purposes of cookies, etc., the names of recipient businesses, the information transmitted and purposes of use, methods for giving and changing consent, and other matters, please refer to the separately established “Cookie Policy.”


Chapter 4. Provision of Personal Data to Third Parties and Entrustment

Except as provided in Chapter 3 or as required by laws and regulations (including the Act on the Protection of Personal Information and other relevant laws and regulations), the Company will not provide Personal Information to any third party without obtaining the data subject’s prior consent.

Entrustment

The Company entrusts the following operations to external service providers and exercises necessary and appropriate supervision over such providers in accordance with the APPI:

Payment Information

Payment information for merchandise sold through the Service is held directly by the payment services provider, Stripe, and is not held by the Company. For purchases of digital content through in-app payments, the Company obtains only the information necessary to determine whether a purchase has been completed and does not obtain information identifying the user.

Provision as Statistical Information

In providing the Service, the Company may provide railway operators, etc. that manage the relevant stations or facilities with statistical information regarding use of stations, facilities, and similar locations that has been processed so that data subjects cannot be identified, such as the number of users by station and usage trends by attribute. This is provision of statistical information that does not constitute personal information and therefore does not constitute provision to a third party.


Chapter 5. Disclosure to Third Parties in Foreign Countries and Understanding the External Environment

1. Disclosure to third parties in foreign countries

If the Company provides Personal Data to a third party in a foreign country, the Company will, in accordance with applicable laws and regulations, provide the individual in advance with information concerning the name of the foreign country, the system for the protection of Personal Information in that country, and the measures taken by the recipient third party to protect Personal Information.


2. Understanding the External Environment

Where the Company processes Personal Data in a foreign country (including through the use of overseas cloud services), the Company will understand the Personal Data protection regime and other relevant circumstances of the relevant country and implement necessary and appropriate security measures.


Chapter 6. Retention and Deletion of Personal Data

The Company retains Personal Information only for the period necessary to achieve the purposes of use and, when it is no longer necessary, deletes the relevant Personal Information without delay, except where retention is required by laws or regulations. The specific retention periods for each category are as follows:

The retention period for other Personal Information will be determined by taking into account the type of Personal Information and the purposes, the duration of the contractual relationship, applicable statutory retention obligations, the need to respond to claims or disputes, and any other reasonable necessity for retaining the Personal Information.


Chapter 7. Personal Information of Children (Minors)

The Service may be used by minors. A minor who uses the Service must obtain the prior consent of a person with parental authority or another legal representative.


Chapter 8. Campaign Pages Displayed through WebView

When a user is redirected through a WebView within the App, we may use Cookies to verify that such access originates from the Service.

We may also use Cookies when collecting personal information, such as shipping information, in connection with campaign entries.


Chapter 9. Additional Provisions for Residents of the EU and the United Kingdom (GDPR and UK GDPR)

Where the Company targets persons located in the EU/EEA or the UK in providing services, monitors their behavior, or otherwise engages in activities, including campaigns that include EU/EEA or UK residents as eligible participants, this Chapter applies in addition to the other provisions of this Policy. This Chapter supplements the other provisions of this Policy and prevails to the extent of any conflict.

The controller, EU representative, and UK representative are as set forth in Chapter 11 of the Website Privacy Policy (EU representative: DP-Dock GmbH; UK representative: DP Data Protection Services UK Ltd.).

1. Legal Bases for Processing (Article 6 GDPR)

The purposes of processing, legal bases and retention periods for the Personal Data that we collect are, as follows:

Categories of Personal Data Purpose of Processing (Chapter 1) Legal Basis Retention Period
  • Profile information and survey information, including name, company/affiliation, title/position, address, telephone number and email address
  • external ID user identifiers
  • NFC tag tap history (location information)
 To provide the Service and after-sales services Performance of a contract (including pre-contract) to which the data subject is party.
  • Retained for as long as the user continues to use the Service and deleted upon the user's withdrawal from the Service.
  • NFC tag interaction records are retained for the duration of the provision of the Service. GPS location history is retained during the relevant event period and is deleted after the event has concluded.
Name, company/organization, position, address, telephone number, email address, details of inquiries or requests, etc. To receive and respond to inquiries and comments Performance of a contract (including pre-contract) to which the data subject is party. Retained for two (2) years from the date of the inquiry.
Name, company/affiliation, position, address, telephone number, email address, etc. To maintain and manage facilities, equipment, and devices and management of their usage status Pursuit of the Company’s legitimate interests in maintaining and managing facilities, equipment, and devices
  • Retained for as long as the user continues to use the Service and deleted upon the user's withdrawal from the Service.
Name, company/organization, position, address, telephone number, email address, details of inquiries or requests, etc. To improve and enhance the Service and development of new functions Pursuit of the Company’s legitimate interests in improving and enhancing its services Determined by considering the type and purpose of the Personal Data, contract duration, statutory retention obligations, the need to address claims or disputes, and other reasonable retention needs.
Name, address, telephone number, email address, etc. To provide campaign services, including shipment of promotional products Performance of a contract to which the data subject is party (pursuant to the Campaign Terms and Conditions). Deleted upon completion of the delivery and fulfillment process.
Name, contact details, survey responses, URLs of viewed pages, referrer, IP address, device and browser type, cookie or similar identifiers, website behavioral history, etc. To consider and develop new products and services Pursuit of the Company’s legitimate interests in considering and developing new products and services
  • Profile information and survey responses: Retained for the duration of the provision of the Service and deleted upon the user's withdrawal from the Service.
  • Information other than the above: The retention period is determined based on the type of Personal Data and the purposes for which it is used, the duration of the contractual relationship, applicable legal retention requirements, the need to respond to claims or disputes, and any other legitimate and reasonable necessity for retaining the Personal Data.
URLs of viewed pages, referrer, IP address, device and browser type, cookie or similar identifiers, website behavioral history, etc. To conduct usage analysis, market research, and marketing tailored to the individual’s interests and preferences Consent, obtained through a consent management platform Determined by considering the type and purpose of the Personal Data, contract duration, statutory retention obligations, the need to address claims or disputes, and other reasonable retention needs.
URLs of viewed pages, referrer, IP address, device and browser type, cookie or similar identifiers, website behavioral history, etc. To detect unauthorized operation or unauthorized access and to implement preventive and remedial measures. Pursuit of the Company’s legitimate interests and compliance with legal obligations Determined by considering the type and purpose of the Personal Data, contract duration, statutory retention obligations, the need to address claims or disputes, and other reasonable retention needs.

If the provision of Personal Data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, you are required to provide that Personal Data. If you do not provide it, we may be unable to provide the products or services that you request.

Except where permitted by laws and regulations or with consent, the Company does not collect or use sensitive information, concerning racial or ethnic origin, political opinions, religion or beliefs, trade-union membership, genetic data, biometric data, health data, or a person’s sex life or sexual orientation.

For the marketing activities described in Chapter 1, we may analyze Personal Data in order to identify or infer an individual's interests, preferences, behavioral tendencies, and other characteristics.

2. International Transfers and Safeguards

Within the scope of the purposes of use, the Company may transfer Personal Data of persons in the EEA or the UK to third parties in countries outside the EEA and the UK. In 2019, the European Commission and the UK Government granted adequacy decisions in respect of Japan.

Google Analytics (GA4), Firebase, AdMob, and AppsFlyer used by the Service are all services provided by businesses outside the EU/EEA. Information of EU/EEA or UK residents collected through these services may be transferred outside those regions.

Some third-country recipients may be located in countries that the European Commission has not recognized as having data protection laws that ensure a level of protection equivalent to that in the EEA and the UK. In such cases, the Company implements appropriate safeguards required for international data transfers, such as the EU Standard Contractual Clauses.


3. Rights of Data Subjects

Persons to whom this Chapter applies have the rights of access, rectification, erasure, restriction of processing, data portability, objection to processing, not to be subject to a decision based solely on automated processing, including profiling, and withdrawal of consent. Requests to exercise these rights will be accepted through the contact point specified in Chapter 12 of the Website Privacy Policy.

For other matters, including responses to Personal Data breaches and the right to lodge a complaint with a supervisory authority, Chapter 13 of the Website Privacy Policy applies.


Chapter 10. Amendments to this Policy

The Company may amend this Policy from time to time in response to amendments to laws and regulations, changes to the Service, addition of new modules, or similar circumstances. The Company will provide notice through the Service when making any material change.