Handling of Personal Data for customers and business partners located in the EU and/or the UK region
1.General
We at Idex Auto Japan Co., Ltd. (hereinafter referred to as “we”, “us”, “our” or “Idex”) value your privacy and are committed to take care of your data, and we take this responsibility very serious. Please take the time to carefully read our Privacy Policy, which explains why we collect your Personal Data and how we process it when you:
- ・visit our website https://www.budgetrentacar.co.jp/en/ (see, in particular, Section 3.1)
- ・are a potential customer (see, in particular, Section 3.2)
- ・use our products and/or services such as making a booking with us (see, in particular, Section 3.3)
- ・are our or business partner (see, in particular, Section 3.4)
Controller
Idex Auto Japan Co., Ltd
〒812-0007
4F, Higashihie Business Center Bldg.,
Higashihie, Hakata-ku,Fukuoka-shi , Fukuoka
2.Definitions
Unless otherwise indicated, capitalized terms used in this Privacy Policy are defined in Annex 1. Most of the definitions are derived from the General Data Protection Regulation (GDPR) which you can access from here.
3.How do we process your Personal Data?
We process your data in different ways depending on whether you visit our website, make a reservation with us, express interest in our products and services, or are our business partner.
3.1.Processing of Personal Data relating to visitors of your website
Purpose and legal basis
Like many other websites, we use so-called “cookies”. Cookies are small text files that are stored on your device (laptop, tablet, smartphone, etc.) when you visit our website. If you have given your consent to our use of cookies, we do so to improve the use of our website, analyze our website or to display advertising on our website. You can revoke your consent any time. Please refer to our Cookie Consent Banner for more information on the cookies we use.
In our Cookie Consent Banner, we inform you furthermore on the processing of your Personal Data when you visit the website and consent to the use of cookies.
Further we process your personal data as it is necessary for the functionality and security of our website. It helps us preventing fraud, detect and mitigate potential security threats. This processing is based on our legitimate interest.
Personal Data processed
We mainly process the Personal Data you provide us.
We collect:
Internet information
- ・IP Address
- ・Device information (ID, type of browser plug-ins)
- ・Geolocation
Recipients
We do not disclose this the personal data listed above to any recipients.
Retention period
We will retain your personal data for up to 2 years, whenever you have given consent to such processing (e.g. cookies), as long as such consent is not withdrawn.
Summary
| Purpose | Legal Basis | Recipients | Retention |
|---|---|---|---|
| Providing Website | Legitimate Interest | - | 2 years |
3.2.Processing of Personal Data relating to potential customers
Purpose and legal basis
When you contact us to inquire about our products and/or service, we process the Personal Data you include in such a message, especially the chatbot and the contact form on our website, in emails or collected during phone calls to answer and process such inquiry prior to a booking being made. Such processing is necessary in order to take steps at your request prior to entering into a contract with you and our legal basis for processing such data is Contract Performance. Contract Performance is also the purpose of any processing of your personal when you when you decide to make a reservation with us or book a service.
Furthermore, we may process the data you provide as part of your inquiry for Direct Marketing purposes as we have a Legitimate Interest to provide you with information about our services including those that are the same or similar to the ones you have inquired about. You have the right, at all times, to object to the Processing of your Personal Data for the purpose of Direct Marketing, without being required to state your reasons, and can do so by sending us a letter or emailing us at [email-mailto: info-idex@idex.co.jp]. The Processing of your Personal Data for the purpose of Direct Marketing is not required in order to conduct our contractual relationship.
Personal Data processed
We mainly process the Personal Data you provide to us during as part of your inquiry and any pre-contractual discussions we have with you prior to you making a booking.
We collect:
Identifiers
- ・Name
- ・E-mail address
- ・Content of inquiry
Internet information
- ・IP Address
- ・Device information (operating system, browser type, user-agent)
- ・Access logs
Recipients
To achieve the objectives described above, it may be necessary to disclose your Personal Data to the following Recipients in certain cases. Personal Data may be disclosed by being transferred, disseminated, or provided by other means to:
| Recipient | Data Location | Basis for transfer to third party country |
|---|---|---|
| PENCIL Co., Ltd. | Japan | Adequacy decision |
Retention period
Personal Data collected for purposes related to Contract Performance shall be retained until such contract has been fully performed.
We may be allowed to retain Personal Data for a longer period whenever you have given consent to such processing (e.g. subscription to our newsletter), as long as such consent is not withdrawn. Furthermore, we may be obliged to retain Personal Data for a longer period whenever required to do so for the performance of a legal obligation or upon order of an authority.
Summary
| Purpose | Legal Basis | Recipients | Retention |
|---|---|---|---|
| Answer inquiry | Contract Performance | - | 2 years |
| Direct Marketing | Legitimate Interest | 1 | 2 years |
| Newsletter subscription | Consent | 1 | 2 years |
3.3.Processing of Personal Data relating to use of our products and services
Purpose and legal basis
When you use our products and services such as making a reservation with us, we process your Personal Data. The primary purpose for processing data when you use our products and services such as making a reservation with us is to fulfil the contractual relationship between you and Idex, ensuring that we can provide you the products and services you have requested. We further might process Personal Data to comply with legal obligations, such as for tax reporting purposes.
Besides that, we use your contact information to send you information on our products and services as a form of Direct Marketing. Your email address might be added to a contact list of those who may receive email messages containing information of commercial or promotional nature as a result of signing up to our website or after making a reservation.
The processing activity related to Direct Marketing is based on Legitimate Interest. You have the right, at all times, to object to the Processing of your Personal Data for the purpose of Direct Marketing, without being required to state your reasons, and can do so by sending us a letter or emailing us at info-idex@idex.co.jp. The Processing of your Personal Data for the purpose of Direct Marketing is not required in order to conduct our contractual relationship.
Processed Personal Data
We mainly process the Personal Data you provide us with.
We collect:
Identifiers
- ・Name
- ・Company Name
- ・Gender
- ・Nationality
- ・E-mail address
- ・Telephone number and other contact information
- ・Address
- ・Payment data, account information
- ・Credit/Debit card number
- ・Flight number
- ・Inquiry information and history
- ・Contract information
- ・Membership information
Internet information
- ・IP address and IP location
- ・Information on website usage
Recipients
To achieve the objectives described above, it may be necessary to disclose your Personal Data to the following Recipients in certain cases. Personal Data may be disclosed by being transferred, disseminated, or provided by other means to:
| Recipient | Data Location | Basis for transfer to third party country | |
|---|---|---|---|
| 1 | Tax and Legal Consultants | Japan | Adequacy Decision |
| 2 | Government and Law Enforcement Agencies | Japan | Adequacy Decision |
| 3 | Insurance Agencies | Japan | Adequacy Decision |
| 4 | Marketing Agencies | Japan | Adequacy Decision |
| 5 | Online Travel Agencies | Japan | Adequacy Decision |
| 6 | Car Rental Agencies | Japan | Adequacy Decision |
| 7 | Accountants | Japan | Adequacy Decision |
Retention period
All data necessary for tax purposes, especially contracts, invoices and other bookkeeping documents as well as relevant correspondence in relation to our contractual relationship we store for a period of 2 years to comply with legal obligations or upon order of an authority.
Furthermore, we may be allowed to retain Personal Data whenever you have given consent to such processing (e.g. subscription to our newsletter), as long as such consent is not withdrawn.
Summary
| Purpose | Legal Basis | Recipients | Retention |
|---|---|---|---|
| Reservation and Service | Contract Performance | 4-5 | 2 years |
| Communication | Contract Performance | - | 2 years |
| Invoicing | Contract Performance | 1 | 2 years |
| Insurance sales | Contract Performance | 3 | 2 years |
| Accounting | Legal Obligation | 1-2,7 | 2 years |
| Tax obligation | Legal Obligation | 1-2 | 2 years |
| Audit/Compliance | Legal Obligation | - | 2 years |
| Direct Marketing | Legitimate Interest | 4 | 2 years |
| Newsletter subscription | Consent | 4 | 2 years |
3.4.Processing of Personal Data relating to business partners
Purpose and legal basis
Your Personal Data is processed, first and foremost, for the purpose of Contract Performance regarding Idex’s products and services. This includes our business partners who market our services and products. The purpose of processing your Personal Data is the performance of our legal relationship.
Processed Personal Data
We mainly process the Personal Data you provide us with.
We collect:
Identifiers
- ・Name
- ・Telephone number
- ・Birthday
- ・E-mail address and other contact details
- ・Address
Professional or employment-related information
- ・Company name
- ・Role and function in the company
- ・Company address
- ・Bank account information
If your company details include a name of an individual, we may be required that you provide us with your Personal Data to enable us to enter into a business relationship with you.
Recipients
To achieve these desired objectives, it may be necessary to disclose your Personal Data to the following Recipients in certain cases. Personal Data may be disclosed by being transferred, disseminated, or provided by other means to:
| Recipient | Registered Office (Country) | Basis for transfer to third party country | |
|---|---|---|---|
| 1 | Tax and Legal Consultants | Japan | Adequacy Decision |
| 2 | Government and Law Enforcement Agencies | Japan | Adequacy Decision |
| 3 | Accountants | Japan | Adequacy Decision |
Retention period
All Personal Data necessary for tax purposes, especially contracts, invoices and other bookkeeping documents as well as relevant correspondence in relation to our contractual relationship we store for a period of 2 years.
Summary
| Purpose | Legal Basis | Recipients | Retention |
|---|---|---|---|
| Cooperation | Contract Performance | - | 2 years |
| Debt Collection | Contract Performance | 1-2 | 2 years |
| Invoicing | Contract Performance | 3 | 2 years |
| Audit/Compliance | Legal Obligation | - | 2 years |
| Accounting | Legal Obligation | 1-3 | 2 years |
4.Data security
We handle Personal Data only as permitted by data protection regulations. We use a variety of technical and organizational measures to help protect your Personal Data from unauthorized access, disclosure, modification, loss or destruction in accordance with applicable data protection laws.
When handling Personal Data, our employees are obliged to comply with the regulations of the GDPR.
5.What are your rights with respect to Processing of Personal Data?
The GDPR and other applicable data protection laws protect certain rights for Data Subjects. In particular:
Right of Access - right to obtain confirmation of which of your Personal Data is processed and information about it, for instance, which are the purposes of the Processing, what are the conservation periods, among others.
Right to Erasure or "right to be forgotten" - right to erase your Personal Data, provided that there are no valid grounds for its retention, for example in cases where we have to keep the Personal Data to comply with legal obligation or because a court case is in progress.
Right to Data Portability - right to receive the Personal Data you have provided us in a digital format of current use and automatic reading or to request the direct transmission of your Personal Data to another entity that becomes the new responsible for your Personal Data, however only if technically possible.
Right of Rectification - right to request modification of your Personal Data that is inaccurate or request incomplete Personal Data, such as the address, VAT, email, telephone contacts, or others.
Right to object and ADM - When the Processing of Personal Data, including the Processing for the definition of profiles, is exclusively automatic (without human intervention) and may have effects in your legal sphere or significantly affect it, you shall have the right not to remain subject to any decision based on such automatic Processing, except as otherwise provided by law and shall have the right that we take appropriate measures to safeguard its rights and freedoms and legitimate interests, including the right to have human intervention in decision making by us, the right to express its point of view or contest the decision taken on the basis of automated individual information Processing.
Right to Withdraw Consent or Right of Opposition - right to object or withdraw consent at any time to Processing, for example in the case of Processing for marketing purposes, provided that no Legitimate Interests exist prevailing over your interests, rights and freedoms, such as defending a right in a judicial process.
Right of Limitation - right to request the limitation of the Processing of your Personal Data, in the form of: (i) suspension of Processing or (ii) limitation of the scope of Processing to certain categories of Personal Data or purposes of Processing.
Right to complain - right to complain to the supervisory authority, in addition to us.
The period for handling a request is 30 days unless it is a particularly complex request.
Once the retention period expires, Personal Data shall be deleted. Therefore, the right to access, the right to erasure, the right to rectification and the right to data portability cannot be enforced after expiration of the retention period.
6.Processing data related to children
Our services are not intended for and may not permissibly be used by individuals under the age of 18.
7.Changes to our data protection provisions
We reserve the right to modify this Privacy Policy, so it is always in compliance with the current legal requirements or to implement changes to services in the Privacy Policy, e.g., when introducing new services. In this case, your future visits to our website will be subject to the updated Privacy Policy.
If you have additional questions regarding the processing of your Personal Data, please feel free to contact us directly, either by email at info-idex@idex.co.jp or via mail to Idex Auto Japan Co., Ltd, 〒812-0007 4F, Higashihie Business Center Bldg., Higashihie, Hakata-ku, Fukuoka-shi , Fukuoka.
8.Contact information
8.1.General
If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data, your choices and rights regarding such use please do not hesitate to contact us:
| Email: | info-idex@idex.co.jp |
| Postal Address: | 〒812-0007 4F, Higashihie Business Center Bldg., Higashihie, Hakata-ku, Fukuoka-shi , Fukuoka |
8.2.Data Subject Requests from EU Data Subjects according to the GDPR
We value your Data Subject Rights under GDPR and therefore appointed [company : DataRep], [address：please check here] as representative according to Art 27 GDPR to provide you with an easy way to submit us privacy related request like a request to access or erase your personal data.
For more information, check here.
| ADM | means Automated decision-making; |
|---|---|
| Consent of the Data Subject | means any freely given, specific, informed and unambiguous indication of the Data Subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the Processing of Personal Data relating to him or her; |
| Contract Performance | means concluding, maintaining, and completing of a contract concluded between the Controller and a Data Subject, including Processing activities which take place at the request of the Data Subject before entering into a contractual relation; |
| Controller | means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the Processing of Personal Data; where the purposes and means of such Processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law; |
| Data Subject | is any natural person whose Personal Data is being collected, held or processed. Examples of a Data Subject can be an individual, a customer, a prospect, an employee, a contact person, etc; |
| Direct Marketing | means personal data processed to communicate a marketing or advertising message. This definition includes messages from commercial organisations, as well as from charities and political organisations; |
| General Data Protection Regulation (GDPR) | is a regulation in EU law on data protection and privacy in the European Union (EU) and the European Economic Area (EEA); Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) https://eur-lex.europa.eu/eli/reg/2016/679/oj ; |
| Legitimate Interest | means the Controller’s interest to process Personal Data in order to carry out tasks related to the Controller‘s business activities. The processing of Personal Data in that context may not necessarily be justified by a legal obligation or carried out to execute the terms of a contract with a Data Subject; |
| Personal Data | means any information relating to an identified or identifiable natural person ('Data Subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. |
| Processing | means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction; |
| Processor | means a natural or legal person, public authority, agency or other body which processes Personal Data on behalf of the Controller; |
| Recipient | means a natural or legal person, public authority, agency or another body, to which the Personal Data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as Recipients; the Processing of those Personal Data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the Processing; |