GDPR Privacy Policy

This GDPR PRIVACY POLICY (this “Privacy Policy”) states the policy for processing of personal data obtained from persons (the “Participant” or “Participants”) residing in EU and/or the United Kingdom (“UK”) that participate in events (the “Events”) organized by Startup Ecosystem Association (一般社団法人スタートアップエコシステム協会) (the “Association”) independently or jointly with a third party (the “Co-organizers”). Upon the Participant’s agreement to this Privacy Policy, the Participant shall be deemed to have given a voluntary and express consent to the subject matters of the Participant’s consent stipulated in this Privacy Policy (including, without limitation, the purposes of processing of personal data and transfer of personal data to third countries).

1. Definitions

The following terms as used herein shall have the meanings as set forth below. Definitions of the terms that are not defined herein shall be subject to the applicable definitions provided in GDPR.

(1) “EU” means European Union that includes the member states of European Union, as well as Iceland, Lichtenstein and Norway under Agreement on the European Economic Area (EEA).

(2) “GDPR” means REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC（General Data Protection Regulation）.

(3) “Applicable Privacy Laws” means applicable privacy laws including GDPR, REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation) and domestic laws related thereto of relevant countries.

(4) “personal data” means “personal data” as defined in GDPR.

(5) “processing” means “processing” as defined in GDPR.

(6) “Controller” means “controller” as defined in GDPR.

(7) “Representative” means “representative” as defined in GDPR.

2. Scope of this Privacy Policy

This Privacy Policy shall be applied to the processing of the personal data of the Participants in relation to the Events that shall be governed by the Applicable Privacy laws.

3. Participants under the age of 16

If any Participant under the age of 16 participates in the Events, it shall make sure to obtain the guardian’s consent to this Privacy Policy or to give the consent to this Privacy Policy under the guardian’s permission thereto.

4. Controller

The Controller for the processing of the personal data shall be the Association, whose contact details are as follows.

Startup Ecosystem Association (一般社団法人スタートアップエコシステム協会)

Representative Director Ayumi Fujimoto

15th Floor, Toranomon Hills Business Tower, 1-17-1 Toranomon, Minato-ku, Tokyo 105-6415, Japan

info@kyotodeep.tech

5. Personal Data to be Collected

5.1 The Association may obtain the following personal data from the Participants.

(1) Name

(2) Affiliation and position

(3) Email address

(4) Country / region of residence

(5) LinkedIn profile URL

(6) Gender (optional)

(7) Profile photograph and company logo (optional)

(8) Program preferences, dietary requirements and travel schedule

(9) Photographs and video recordings taken at the Events

5.2 The Association may collect the personal data in the following cases.

(1) When the Participant applies to participate in the Events

(2) When the Participant otherwise participates in the Events

6. Purpose and legal basis of Data Processing

6.1 The Association shall process the personal data only for the purposes as set forth below.

(1) Performance of contract, or response to requests of Participants prior to executing contract

The Association may process the personal data of the Participant entering into a contract with the Association regarding the Events, for the purpose of performing the contract. The Association may also process the personal data of the Participant prior to entering into such contract, for the purpose of taking steps in response to the Participants requests.

(2) Event management and others

The Association may use the personal data of the Participant for the purpose such as providing information about the Events, managing the Events, and responding to inquiries. The Association may use the personal data of the Participant for the purpose such as providing personal information to the Co-organizers of the Events. Such processing of the personal data is (i) necessary for performance of contracts or legitimate interests pursued by the Association, namely, for performing the Association’s normal operation including management of the Events, or (ii) based on the Participant’s prior consent.

(3) Communication and others

The Association may use the personal data of the Participant for the purpose of (i) communication regarding the Events, (ii) notification of information important for the participation in the Events, (iii) responding to complaints, and (iv) providing any other customer services. Such processing of the personal data is necessary for performance of contracts or legitimate interests pursued by the Association, namely, for performing the Association’s normal operation.

(4) Participant information and name badges

The Association may share the Participant’s name, affiliation, position, LinkedIn profile URL, profile photograph and company logo with other Participants of the Events, and use them to prepare name badges. Such processing of the personal data is based on the Participant’s prior consent.

(5) Photography and filming

The Association may take photographs and video recordings at the Events and use them in event reports, on websites and on social media. Such processing of the personal data is based on the Participant’s prior consent.

6.2 In cases where the Association intends to further process the personal data for a purpose other than that for which the personal data were collected, the Association shall provide the Participant prior to that further processing with information on that other purpose.

7. Provision of Information

Personal data of the Participants will be provided to authorized persons of the Association for pursuing the purpose of processing. The Association may provide the personal data of the Participants to the following parties, to the extent necessary for pursuing the purpose of processing. As set forth in Section 8.2, such third parties may include parties residing or located in countries outside EU or UK.

(1) Accountants, lawyers and other professional advisers

(2) Providers of the services related to the Events, including, without limitation, data storage, maintenance and payment service

(3) The Co-organizers

8. Transfer of Personal Data to Third Countries

8.1 When the Association receives personal data from the Participant, the personal data are transferred from EU or UK region to Japan.

8.2 In addition to the foregoing, the Association may, to the extent necessary for pursuing the aforementioned purposes of processing, transfer personal data of the Participants to countries outside EU or UK, including, without limitation, Japan, and further process the same. The Participant may not have the right as a data subject same as that under GDPR in countries outside EU or UK, and the Association shall take steps regarding the Participant’s personal data in accordance with the Applicable Privacy Laws, by means such as execution of standard contractual clauses under GDPR.

8.3 Upon the Participants agreement to this Privacy Policy, the Participant shall be deemed to have given a voluntary and express consent to the transfer of personal data to third countries set forth in this Section 8.

8.4 Japan, to which the transfer stipulated in this Section 8 is made, has obtained an adequacy decision by European Commission

9. Storage Period

The Association shall store the personal data of the Participants to the extent necessary for the purpose of processing thereof, and delete the personal data when the storage becomes unnecessary for such purpose.

10. Disclosure, Modification, Deletion, etc. of personal data

10.1 If a Participant that is the subject of the personal data requires any of the following, please notify the contact address of the Association of that effect. The Association will properly respond to that request pursuant to the Participant’s right under the Applicable Privacy Laws.

(1) Access to personal data

(2) Modification of personal data

(3) Deletion of personal data

(4) Restriction on processing of personal data

(5) Objection to processing

(6) Exercise of right to data portability

10.2 For the request under Section 10.1, please submit the following documents by email.

(1) Request form specified by the Association

(2) Document for identification of the Participant as specified by the Association

(3) Document for identification of the representative of the Participant as specified by the Association

10.3 To avoid undue modification, divulge, etc. of the personal data of the Participant by a third party, the Association will response to the request by mail or email, only if the identity confirmation is made by the submitted documents. Although the Association will make effort to promptly respond, please note that it may takes time until response, for the confirmation of the applicable registered personal data and for assuring accuracy.

10.4 The Association will not return the request form or identification documents received from the Participant or its representative. Please understand that the Association will keep the request form properly, and delete the identification documents in an appropriate manner when the purpose of use thereof is achieved.

11. Withdrawal of Consent

For the processing of the personal data based on the Participant’s consent, the Participant shall have the right to withdraw the consent for the personal data at any time.

12. Lodgment of Complaint with Supervisory Authority

In addition to the aforementioned rights, the Participant may lodge a complaint with a supervisory authority at any time. However, the Association appreciates a notification to the Association prior to contacting the supervisory authority, so that the Association may have the opportunity to respond to the complaint of the Participant.

13. Necessity of Provision of Personal Data

Since the personal data to be provided by the Participant is necessary for the Association for the management of the Events, the Participant who does not provide such data may be unable to participate in the Events.

14. Inquiries

For questions or complaints, or for the exercise of the rights under Sections 10 and 11, please contact this or contact details of the Controller set forth in Section 4.

15. General Provisions

15.1 The Association shall retain the right to regularly amend this Privacy Policy. The Participant shall regularly check and confirm the applicable provisions at its responsibilities.

15.2 In the event of conflict between the Applicable Privacy Laws and any provision of this Privacy Policy, the provision shall be deemed replaced by a provision of the same meaning that reflects the original intention, to the maximum extent permitted by laws. In that case the remaining provision hereof shall continue to be applied without change.