Group companies of Hokkaido Railway Co., Ltd.

• The Company will comply with privacy protection laws.
• The Company will establish internal rules regarding privacy protection and will respect such rules.
• The Company will periodically conduct an internal audit to ascertain whether or not personal information is being handled appropriately, and will address any issues should they be discovered.
• The Company will seek cooperation from all companies in our Group, and its business partners to achieve the objectives of the internal rules.
• This privacy policy shall be made available to the public at all times, by posting it on the Company's website
  (http://www.jrh-rentacar.jp/phpapp/english_web/) or by any other appropriate method.

• Preparing Internal Governance Systems
  The Company will assign administrators for each category of personal information, and will manage all such information appropriately.
• Obtaining Personal Information
  The Company will specify the purpose of use for and obtain personal information by appropriate means.
• Use of Personal Information
  In using personal information, the Company fully acknowledges the importance of privacy protection, and will only use personal information for the stated purposes.
• Appropriate Management of Personal Information
  The Company will implement all necessary safety measures in managing personal information.
• Respecting Personal Rights
  The Company acknowledges and will respect the rights of individuals whose personal information is held by the Company. If any such individual requests that their personal information be disclosed or revised, or that the Company cease use of such information, the Company will do so within a reasonable period of time in accordance with the relevant laws and regulations.
• Continuous Improvements
  The Company will continually endeavor to improve its protection of personal privacy.

• Personal data you give us when you book our rent-a-car services and when you sign the rental contract at our office

  (A) Personal data you submit to us to register to create a reservation on the online booking website

  ・ We collect your name, telephone number, e-mail address and reservation number as your reservation information.

  (B) Personal data related to inquiries on the status of rent-a-car reservations on the website

  ・ We collect your reservation number, name, and e-mail address as the inquiry information.

  (C) Personal data that we collect when you sign the rental contract at our office

  ・ We collect your name, gender, birthdate, address, telephone number, nationality, passport number, driver's license information, contact details in Japan, reservation number, credit card number, and other information relating to the rent when you come to our office to conclude the contract.

  (D) Personal data that we receive from online travel agencies

  ・ We also receive from online travel agencies such as Rentalcars.com, Cartrawler.com, C-trip.com, your personal data, including your name, nationality, telephone number, e-mail address and reservation number, etc. as your reservation information.

• Personal data we automatically collect when you use our online (website) services

  (A) Personal data related to the use of our web site

  ・ We use cookies and collect action history (accessed URLs, content, orders, etc.), IP address, device information, OS information, browser information, and referrer as the access information.

  * A cookie is technology that allows sites to store information in the browser of your computer, etc. which can be retrieved later. There is some content using cookies on our web site. If you are concerned about having cookies on your computer, it is possible to disable cookies in your browser settings at any time, but in this case there may be some content which cannot function properly or be shown correctly.

  ・ We use Google Analytics. For more information about the data collecting and processing using Google Analytics, please visit the Google's page below, "How Google uses data when you use our partners' sites or apps" : https://policies.google.com/technologies/partner-sites?hl=en

• Business contact information we collect when attending events

  (A) Personal data related to exchanged business cards

  ・ We collect your name, telephone number, e-mail address, company name, and address as the business contact information.

• Personal data you give us when you book our rent-a-car services and when you sign the rental contract at our office

  (A) For the conclusion and performance of a contract, including provision of car rental and associated services, and for the management of a contract and the after-sales services of the provided services.

  (B) For the communications necessary to provide car rental business and associated services.

  (C) For the billing and protection of account receivables concerning the rent-a-car business and other associated services (including the case of requesting a credit company for credit card payment, etc.)

  (D) For receiving and responding to your inquiries and requests.

• Personal data we automatically collect when you use our online (website) services

  (A) For market research on our rent-a-car business, or other research or surveys.

  (B) For business analysis related to our rent-a-car business.

  (C) For ensuring the security of our customers and employees.

  (D) For research and development of security software, systems, equipment, devices etc.

  (E) For the operation and maintenance of facilities, equipment and devices and the management of their usage.

  (F) For analyzing our website usage.

• Business contact information we collect when attending events

  (A) For providing information on car rental and other information related to our business activities.

  (B) For the conclusion and performance of a contract with business partners, and the management of a contract

(A) When the processing is necessary for the performance of a contract to which you are party or in order to take steps at your request prior to entering into a contract

(B) When the processing is necessary for compliance with a legal obligation to which we are subject (e.g. when following an information disclosure order from government/court based upon laws and regulations announced by government agencies/courts).

(C) When the processing is necessary in order to protect your vital interests or those of another individual.

(D) When it is considered appropriate to investigate, prevent, or take measures against illegal or suspicious acts.

(E) When the processing is necessary for the purpose of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your privacy related rights, interests, and freedoms. The legitimate interests which may be pursued by us or a third party are as follows:

・Enhancing customer satisfaction;

・Improvement of our services;

・Prevention of illegal acts;

・Regular communication with business partners and others; and

・Protection of assets (security) of our customers and our company.

• Personal data you give us when you book our rent-a-car services and when you sign the rental contract at our office

  ・Our group companies:

  -Rent-a-car service vendors located in Japan

  ・External business partners:

  -Rent-a-car service vendors located in Japan

  -Information service vendors for the development, operation, maintenance, and management of our system located in Japan

• Personal data we automatically collect when you use our online (website) services

  ・External business partners:

  -Information service vendors for the development, operation, maintenance, and management of our system located in Japan

• Business contact information we collect when attending events

  ・Our group companies:

  -Rent-a-car service vendors located in Japan

(A) Right to request disclosure

This is a right that allows you to request disclosure of your personal data retained by us. However, we may decide not to disclose your personal data in the following cases.

(1) cases in which there is a possibility of harm to your or a third party's life, body, fortune or other rights and interests;

(2) cases in which there is a possibility of serious interference with the proper implementation of our business; or

(3) cases in which disclosure would cause a violation of other laws or regulations

(B) Right to request a correction, deletion or addition

This right allows you to request a correction, addition, or deletion of your personal data retained by us when your personal data contradicts reality.

(C) Right to request discontinuance of use or erasure

This right allows you to request discontinuance of use or erasure of your personal data when your personal data is handled in breach of the purposes of use, or when your personal data has been acquired improperly.

(A) Right to access to your personal data and related information

(B) Right to rectification of your inaccurate personal data when it is inaccurate or incomplete

(C) Right to erasure of your personal data

For example, you may request erasure of your personal data when it is no longer necessary for us to retain your personal data for the purposes for which we collected it, or when we are only entitled to process your personal data with your consent, and you withdraw your consent.

(D) Right to restriction of processing of your personal data

For example, you may request restriction when you dispute the accuracy of your personal data (but only for the period of time necessary for us to verify its accuracy), or when you object to our processing your personal data for our legitimate interests (but only for the period of time necessary for us to assess whether our legitimate interests override your own interests, rights and freedoms).

(E) Right to data portability

This is a right to receive your personal data which you provided to us in a commonly used and machine-readable format, and to transmit that data to another controller without hindrance.

(F) Right to object

This is a right to object to the processing of your personal data based on the performance of a task carried out in the public interest, or on legitimate interests. You may also object to the processing of your personal data when your data is processed for direct marketing purposes.

(G) Right to withdraw your consent at any time regarding the processing of personal data based on your consent (The withdrawal does not affect the lawfulness of the processing of personal data based on consent before its withdrawal.)