Privacy Notice

BrainPad is committed to protecting and respecting your privacy. This Privacy Notice tells you how BrainPad lnc. (“BrainPad”, “we”, “us”) processes your personal data when you visit, download, or contact our customer that uses our product “Rtoaster” (“Customer”) in relation to, our Customer’s websites and apps that refer to this Privacy Notice. This Privacy Notice also describes your personal data protection rights, including a right to object to some of the processing that BrainPad carries out. More information about your rights, and how to exercise them, is set out in the “Your Choices and Rights” section.

We may also provide you with additional information when we collect personal data, where we feel it would be helpful to provide relevant and timely information.

What Personal Data We Collect

We process the following types of personal data:

• Technical details of your visit to the Customer’s Content: such as your IP address and operating system, browser type (for visits to our website), details of the device you are using (e.g. your device token, anonymous unique identifier) and technical and event based data in relation to your usage of your device (e.g. session duration.)

Why We Collect, Use and Store this Personal Data

We collect, use and store your personal data for the reasons set out below.

• Where you have given consent.
  For example, to provide you with direct marketing or recommendation from our Customer including information about goods and services which may be of interest to you by push notification and online. Our Customer will always offer a chance to unsubscribe from direct marketing or recommendation.
• Where necessary to protect BrainPad’s legitimate interests and legal rights, and where our interests and not overridden by your data protection rights.
  Protecting our legitimate business interests and legal rights. This includes, but is not limited to, use in connection with compliance, regulatory, auditing, legal claims (including disclosure of such information in connection with legal process or litigation) and other ethics and compliance reporting requirements.

BrainPad and Customer will use your unique online identifier to identify your browser or application directly or indirectly.

After our Customer stores data (such as gender, address, purchasing history, etc.) as serial number in our “Rtoaster service”, we processes our Customer’s data and calculates segmentation and their recommendation of products and/or service of our Customer. The automated processing does not produce legal effects concerning you or does not similarly significantly affect you, as segmentation and recommendation themselves doesn’t produce legal effects and affect you.

How We Share Your Personal Data

1. Transfers to companies providing services under contract
   Your personal data will be shared with companies providing services under contract to the BrainPad, such the companies set out below:
   • IT hosting (current provider: IDCF, Google, Amazon)
2. Transfers to other organisations
   
   • Transfers to third parties if we are under a duty to disclose your personal data in order to comply with a legal obligation or if we consider this is necessary for us to protect the rights, property or safety of BrainPad, our Customers or others.
   • Transfers to government authorities and/or law enforcement officials if mandated by law or if required for the protection of our legitimate interests in compliance with applicable laws.
   • Transfers to prospective or actual buyers in the event that BrainPad, or any part of the BrainPad Group, sells any of its business or assets which includes personal data.

Your Choices and Rights

1. Your general Rights and Choices
   
   • You have the right to ask BrainPad for a copy of your personal data; to correct, delete or restrict processing of your personal data; and to obtain the personal data you provide in a structured, machine readable format.
   • You can object to the processing of your personal data in some circumstances (in particular, where we don’t have to process the data to meet a contractual or other legal requirement).
   • Where our Customer have asked for your consent, you may withdraw consent at any time. If you ask to withdraw your consent to our Customer processing your data, this will not affect any processing which has already taken place at that time.
   These rights may be limited, for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.
2. Your Right to Complain to a Supervisory Authority
   You also have the right to complain to a supervisory authority for data protection. The supervisory authority could be in the place where you live, or where you work, or where a breach of data protection obligations has occurred.

Data Retention

We will retain your personal data only for as long as our Customer’s request to cease our all services. At the end of the retention period, we will take steps to delete your personal data.

EU General Data Protection Regulation Representative

Pursuant to Article 27 of the EU General Data Protection Regulation (GDPR), BrainPad has appointed DataRep as it’s GDPR representative in the EU. DataRep can be contacted in addition to BrainPad in matters pertaining to our compliance to the GDPR in the following ways:

Sending an email to datarequest@datarep.com quoting <BrainPad Inc.> in the subject line,
contacting us on our online webform at www.datarep.com/data-request , or mailing your inquiry to DataRep at the most convenient of the addresses in the subsequent pages.

PLEASE NOTE: when mailing inquiries, it is ESSENTIAL that you mark your letters for ‘DataRep’ and not ‘BrainPad Inc.’, or your inquiry may not reach us. Please refer clearly to BrainPad Inc. in your correspondence. On receiving your correspondence, BrainPad Inc. is likely to request evidence of your identity, to ensure your personal data and information connected with it is not provided to anyone other than you.

Updates to this Privacy Notice

This Privacy Notice may be updated periodically. We will update the date at the top of this Privacy Notice accordingly and encourage you to check for changes to this Privacy Notice, which will be available on the BrainPad Online Content. On some occasions, we may also actively advise you of specific data handling activities or significant changes to this Privacy Notice, as required by applicable law.

Contact Us

The BrainPad Online Content is controlled by BrainPad which is the data controller for personal data collected via javascript of Rtoaster.

If you have any questions about this Privacy Notice, please contact us at rtoaster-dpo@brainpad.co.jp. Our data protection officer can also be contacted at rtoaster-dpo@brainpad.co.jp

List of the EU/UK General Data Protection Regulation Representative