This Policy applies to the processing of personal data by Hanatour Japan Co., Ltd. ("we", "us," or "our") in connection with providing and encouraging our travel services for tourists overseas visiting Japan (the "Services") as well as your visiting our websites. We are responsible for the processing of your personal data. Please see Section 9 below for our identity and contact details.
We may collect your personal data directly from you or indirectly through travel agencies and OTAs. We may collect your name, phone number, email address, postal address, gender, passport number, date of birth and any other personal data necessary to provide our Services (e.g., personal data contained in your inquiries and complaints). The use of our Services may require the provision of certain personal data. You may refuse to provide personal data to us; however, in such cases, access to the Services may be limited.
Where applicable data protection laws require processing of your personal data based on a legal basis, we will process your personal data based on either of the legal bases set forth below and similar concepts permitted under applicable data protection laws.
(1) Contract: Where it is necessary to process your personal data for performance of the contract entered into between you and us (including the terms of use of the Services), or in order to take steps at your request prior to entering into a contract.
(2) Legitimate interests: Where it is necessary for us to process your personal data to pursue our legitimate interests or those of a third party (e.g., responses to your inquiries and complaints), and your interests or fundamental rights do not prevail over the aforementioned interests.
(3) Consent: Where we obtain your consent to the processing of your personal data.
(4) Legal obligation: Where it is necessary for us to process your personal data for purposes of compliance with legal obligations, pursuant to the laws and regulations of your country of residence.
We will process your personal data only to the extent that it is necessary to fulfill the following purposes based on the legal basis below:
(1) To provide the Service to you (legal basis: contract or legitimate interests);
(2) To respond to your inquiries and complaints (legal basis: contract or legitimate interests);
(3) To analyze the use of the Service for marketing and advertising purposes (legal basis: legitimate interests or consent);
(4) To improve the quality of Services, develop new Services, and conduct surveys and analysis (legal basis: legitimate interests);
(5) To provide announcement of our Services and enhance the functionality of our websites (legal basis: legitimate interests); or
(6) To comply with applicable laws and regulations, or to respond to court orders and legal procedures (legal basis: legitimate interests or legal obligations)
We may disclose your personal data to IT service providers (e.g., data server and cloud service providers), marketing and advertising service providers, email delivery service providers, data analytics service providers, and our affiliates to the extent necessary to fulfil the purposes referred to in Section 3.
We may also disclose your personal data to third parties, including but not limited to travel agencies, hotels, restaurants, guide service companies, transportation (e.g. buses and trains) service companies, and any other service providers composing tours or model courses, as well as public authorities, if such disclosure is required to cooperate with relevant governmental authorities and agencies, or to establish, exercise, or defend against legal claims.
Your personal data may be transferred to third parties outside your resident country or territory. Where we transfer your personal data to third parties located in countries or territories outside those in which you are located, we comply with applicable data protection laws by methods such as ensuring either of the items below, or obtaining your consent thereto.
(1) The recipient destination is designated as countries and territories that ensure an adequate level of protection for the rights and freedoms that you possess with respect to personal data under the applicable data protection laws.
(2) The recipient enters into a contract with us as required by applicable data protection laws.
(3) We take other measures as required by data protection laws or regulations of your resident country.
You may confirm additional details about the protection given if your personal data is transferred to outside your residence country or territory by contacting us using the contact details in Section 9 below.
We will store your personal data for the period necessary for the purposes of use of the relevant personal data. Specifically, your personal data shall be stored for 24 months from the end of use of the Services provided by us.
However, this does not apply if we are required by laws or regulations to retain your personal data for a longer period of time, in which case, we will retain it for the period required by such laws or regulations. We will delete your personal data when it is no longer required for the purposes of processing. If there is any information that we are unable, for technical reasons, to delete entirely from our systems, we will take appropriate measures to prevent any further processing or use of your personal data.
You have several legal rights in relation to personal data that we hold about you. These rights may vary depending on where you are located and which data protection laws apply to the relationship between you and us, but typically will include the following rights:
(1) the right to obtain information regarding the processing of personal data about you and to access personal data about you that we hold;
(2) the right to request that we correct your personal data if it is inaccurate or incomplete;
(3) the right to request that we erase your personal data in certain circumstances;
(4) the right to request that we restrict our processing of your personal data in certain circumstances;
(5) the right to object to our processing of your personal data;
(6) the right to receive any personal data in a structured, commonly used, and machine-readable format and/or to request that we directly transmit that personal data to a recipient, where doing so is technically feasible; and
(7) If we process your personal data on the basis of your consent, the right to withdraw your consent to our processing of your personal data at any time, provided however withdrawal of consent does not affect the lawfulness of processing of personal data before its withdrawal.
You may exercise any of your rights by contacting us at the contact details set forth in Section 9 below. You also may lodge a complaint with the relevant data protection authority if you believe that we have infringed any of your rights.
In addition to establishing rules on the processing of personal data, we take necessary and appropriate measures to prevent any leaks or loss of, or damage to your personal data to be processed, and otherwise to control the security of personal data, such as periodic self-inspection of the status of processing personal data, periodic training of employees regarding the processing of personal data, management of employee access and restriction of the equipment brought into areas where personal data is processed, prevention of unauthorized individuals from viewing personal data, prevention of theft or loss of equipment, electronic media, and documents containing personal data, encryption or password protection of such equipment, electronic media and documents, access controls to limit the scope of employees and personal data, and protection of IT systems processing personal data from unauthorized access or malicious software etc. We also exercise appropriate supervision over our contractors and employees who process personal data.
By contacting us using contact details set forth in Section 9 below, you may confirm additional details about security control measures implemented by us with regard to the processing of personal data.
If you have any questions about this Policy, your rights, or any other matter relating to the protection of personal data, please contact us at the following contact information:
Hanatour Japan Co., Ltd.
Toranomon Waiko Building 8F, 12-1 Toranomon 5-chome, Minato-ku, Tokyo
Contact Details (Company Main Number): (+81) 03-6629-4760
Updated 26 March 2026
