Privacy Policy (EEA and UK)

Okinawa Convention & Visitors Bureau (hereinafter referred to as “we”, “us” and “our”) take your privacy seriously. When we process your personal data, we commit ourselves to ensure compliance with applicable personal data protection laws, including the Act on the Protection of Personal Information of Japan (the “APPI”), the General Data Protection Regulation of the European Union as applied in the European Economic Area and the said regulation as transposed to and applied as a domestic law in the United Kingdom pursuant to the Data Protection Act 2018 of the said country (the “GDPR”).

This Privacy Policy is intended for our guests from the European Economic Area and the United Kingdom, explaining how we collect, use, disclose and/or store your personal data in connection with your visit and use of our website “OKINAWA MICE NAVI” (https://mice.okinawastory.jp/) (the “Website”). We may, from time to time, amend, add to, or delete part of this policy.

1. How we collect and use your personal data (Purposes)

When you use our Website, we collect and use the following categories of your personal data for the respective purposes on the respective lawful grounds as described below. Provision of the personal data described below is voluntary, and you are not required to provide it. However, please note that not providing us with certain personal data may limit the services we can offer to you.

(1) To respond to your inquiries

When you make inquiries to us through the Website, we collect your personal data from your inputs to respond to your inquiries. The categories of the personal data we may collect include your contact details (e.g., your name, company/association/department name, email address, zip code, address, telephone number), the type of event and number of participants, the file you upload, and the content of your inquiry. We do so on the lawful ground that such processing of your personal data is necessary for the purpose of your and our legitimate interests, namely our legitimate interest in attracting tourists to Okinawa by responding to tourism inquiries, and your legitimate interest in gathering information to organize event. The personal data processed is limited to what is necessary to provide you with the information you have requested, and there is no interest that outweighs these legitimate interests.

(2) To distribute newsletters and other information based on your requests

We collect your personal data to send newsletters and other useful information to you when you subscribe to our newsletter or register as a user of the Website. The categories of the personal data we may collect include your email address, name, username, company/association/department name, and the information you wish to receive. The lawful ground for this data processing is your consent.

(3) To provide services and manage user accounts for registered users

When you register as a user of the Website, we collect your personal data, such as your username, email address, name, company/association/department name, and the information you wish to receive. We process such data to manage registered user accounts and to provide services to them, such as enabling them to download materials about the venues and facilities listed on the Website (e.g. images or proposal sheets). The lawful ground for this data processing is that it is necessary for 1) our legitimate interest in protecting the copyrighted material by limiting downloads to potential customers, thereby preventing uncontrolled access and distribution of the material, and 2) your legitimate interest in being able to use the copyrighted material, including editing and processing, in accordance with the Terms of Use, by registering as a user, thereby contributing to your convenience as an event organizer.

(4) To analyze access to the Website

When you visit the Website and interact with it, we automatically collect your personal data from your device, including your source IP address, browser type/version, operating system/version, the pages served, time, your approximate location (countries), the preceding page views (what web page you come from) and other technical data about your usage of the Website, including unique identifiers by which we could identify the web browser you use to access the Website. We refer to the categories of data described above collectively as the “Automatically Collected Data”.

We analyze the Automatically Collected Data to obtain insights about the usage of the Website, including the demographic composition of our audience and the popularity of each pages, items, and articles. These insights help us deliver content that better meets the needs of our audience. Such processing of your personal data is based on the lawful ground that it is necessary for the purpose of our legitimate interest, namely serving you better by improving the Website. Such processing is by no means aimed at profiling you in order to personalize contents shown to you on the website according to your profile.

(5) To improve the Website security

In addition to the purpose (4) above, we monitor the Website and analyze Automatically Collected Data in order to detect and prevent unlawful use and security breach of the Website. The lawful ground for such processing is that it is necessary for our legitimate interest, namely, to protect you and us from security threats by maintaining the proper functioning of the Website. We do not share personal data with third parties other than certain service providers as set out in Section 3, and we have appropriate security measures in place, so there is little risk of a breach of your personal data. Therefore, the interests of the data subject do not override our legitimate interests.

(6) To provide the My List function on the Website

In order to provide the My Lists feature on the Website, we collect your online identifiers and information registered in your My Lists. The lawful ground for such processing is that it is necessary for our legitimate interest, namely, to manage the My List function on the Website. We do not share personal data with third parties other than certain service providers as set out in Section 3, and we have appropriate security measures in place, so there is little risk of a breach of your personal data. Therefore, the interests of the data subject do not override our legitimate interests.

(7) To conduct digital marketing activities through YouTube

We use YouTube (owned by Google) as our video platform on the Website. YouTube cookies are placed on your browser when you access pages of the Website with YouTube videos. The YouTube cookies are used to assign a unique identifier to your browser on which the video is viewed, enabling YouTube to recognize your browser. YouTube collects the URLs of the videos you watch and your IP address as well as the cookies. Such data collected by YouTube is sent to Google, and Google can use the data to show you relevant advertisements that may be of your interest in other YouTube videos, and to provide us with viewing statistics of our YouTube videos. The lawful ground for this data processing is your consent. Google and we only perform such processing upon your prior and specific consent for use of the Targeting Cookies on our cookie banner or cookie settings on the Website. When the category of Targeting Cookies is turned off, YouTube cookies are not set or are deactivated, and the data is not sent to Google, but you may not be able to play the YouTube videos embedded on our website. Please refer to 2. Cookies and similar technologies section below to see more details, and to control your preference.

2. Cookie and similar technologies

We and certain third parties deploy cookies and other similar technologies on the Website, where we use data processing or storing capabilities of your browser or we read data from your browser, in order to collect some of the Automatically Collected Data for the purposes described above. Except where the use of these technologies is strictly necessary to provide you with services you requested, we ask for your prior consent thereto. You can find the full information about how we deploy these technologies here. You can, at any time, withdraw your consent or customize your cookie settings here.

3. Who we share your personal data

We disclose your personal data to the following third parties:

(1) Web analytics service provider

We engage web analytics service providers to collect and analyze the Automatically Collected Data and disclose such data to such providers for the purpose (4) above.

(2) YouTube (Google)

Where, based on your consent, we allow YouTube to place cookies on your browser and to collect the data such as a unique identifier, the URLs of the videos you watch and your IP address for the purpose (7) above.

(3) Other service providers

We may use third-party service providers to process your personal data for purpose(s) as described above, and disclose your personal data to such providers. They act as processors in the meaning of the GDPR, and are bound by contracts with us to process your personal data only on our instruction and only for the purpose designated by us, commit themselves to confidentiality, and have appropriate security measures in place.

(4) Business successors

In the event that we sell or transfer a portion or all of our business, your personal data we have collected may be transferred by us to the purchasing or acquiring entity as part of the transaction. We will continue to ensure the confidentiality of your personal data before such transaction occurs, and after such transaction, we will delete your personal data we have collected as soon as reasonably practicable after such transaction.

(5) Competent public authorities

We may be obliged to disclose your personal data we have collected, as required by law, regulation or order, to investigative, judicial, and regulatory authorities. We may also be required to disclose your personal data we have collected to competent data protection authorities in order for them to investigate privacy complaints filed by you or any data breach incidents involving your personal data.

(6) Other third parties

Where necessary for the purposes described above, for example, where we need to ask for advice or further information in order to respond to your inquiry, we may disclose your personal data to relevant third parties. Where we find it out of your reasonable expectation to disclose your personal data to particular third parties, we ask for your consent thereto before we do so.

4. How long we use your personal data

We will continue to retain your personal data for as long as necessary for each purpose specified above. When we no longer require your personal data for the purpose, we will destroy them or irreversibly anonymize them so that the processed data could never be used to identify you.

5. International transfer of your personal data

We regularly transfer your personal data as described above to the following entities (the “Recipients”) for the purposes described above, which are located outside of the European Economic Area and the United Kingdom:

Our analytics service providers (Google Analytics);

Our video platform (YouTube);

Other service providers.

Where the Recipients are located in Japan, your personal data is protected in accordance with the APPI. The European Commission and the United Kingdom have decided that Japan ensures an adequate level of data protection (the “Adequacy Decisions”) and that personal data can be lawfully transferred to Japan without requiring any specific authorization.

Where we need to transfer your personal data to countries or territories that are not covered by the Adequacy Decisions, we will protect your personal data by virtue of data transfer contracts with the concerned Recipients in line with the appropriate standard data protection clauses adopted the European Union or the United Kingdom depending on where you are located pursuant to the GDPR.

6. Data security

We systematically assess information security risks of the Website, establish and implement appropriate security control to avoid or mitigate such risks, and periodically review and improve its implementation to ensure effective protection of your personal data.

7. Children’s privacy

We are committed to complying with all applicable laws and regulations regarding the collection, storage and use of personal data concerning children. The Website is intended for a general audience; it is not directed to children and we do not knowingly collect personal data from anyone under the age of 16. If you are a parent or guardian and are concerned that your child has provided his/her personal data to us without your consent, you should contact us, so that we can immediately destroy such data.

8. Sensitive personal data

We usually do not collect or use sensitive personal data as defined in Article 9 and 10 of the GDPR. Where we collect and use sensitive categories of your personal data, we will obtain your prior and explicit consent thereto, unless we are required to do so in order to perform our statutory obligations or to protect vital interest of you or another person in emergency.

9. Your legal rights

Subject to certain conditions, you have the following legal rights with respect to our processing of your personal data:

Revocation of consent – You can at any time revoke your consent to our processing of your personal data.

Right to access – You have the right to inquire about, review and request copies of your personal data we hold

Right to correction – You have the right to request us to correct or complete any of your personal data that we hold which you believe is inaccurate or incomplete.

Right to erasure – You have the right to request that we erase your personal data, subject to certain conditions.

Right to restrict processing – You have the right to request that we restrict the processing of your personal data, subject to certain conditions.

Right to object to processing – You have the right to object to our processing of your personal data, subject to certain conditions as set out in Section 10.

If you wish to exercise your right, please contact us.

10. Right to Object to Processing

You have the right to object at any time to the processing of your personal data on the basis of our legitimate interests. Please contact us if you wish to exercise this right.

11. Complaint

You can lodge complaints about how we process your personal data with data protection supervisory authorities. You can find your local supervisory authority at the following link:
https://edpb.europa.eu/about-edpb/board/members_en

12. Contact Information

If you have any privacy concern, complaint or inquiry, or if you wish to exercise your legal rights, please contact the following:

(1) Data Controller

Name: Okinawa Convention & Visitors Bureau.
Office: Okinawa Industrial Support Center 2nd Floor, 1831-1 Oroku, Naha City, Okinawa, Japan 901-0152
E-mail: micenavi@ocvb.or.jp
Phone: (+81)098-859-6130

(2) Representative

Our representative in the EEA countries and the United Kingdom:
Name: Data Protection Representative Limited
Office: DataRep, BPM 335368, 372 Old Street, EC1V 9AU, London, United Kingdom
E-mail: datarequest@datarep.com