GDPR

How we use your personal information
In addition to the purposes and uses described above, we use information in the following ways:

• Provision of the Services. To create and manage your account, provide, and personalize our Services, process payments, and respond to your inquiries.

• Communicating with you. To communicate with you, including by sending you emails about your transactions and Service-related announcements.

• Promotion. To promote our Services and send you tailored marketing communications about products, services, offers, programs, and promotions of our Services and our partners and measure the success of those campaigns. For example, we may send different marketing communications to you based on your subscription plan or what we think may interest you based on other information we hold about you.

• Advertising. To analyze your interactions with our Services and third parties’ online services so we can tailor our advertising to what we think will interest you. For example, we may decide not to advertise our Services to you on a social media site if you already signed up for paid Services or we may choose to serve you a particular advertisement based on your subscription plan or what we think may interest you based on other information we hold about you.

• Direct marketing. To contact you with information about our products and services. Most marketing messages we send will be by email and we may use personal information we collect about you to help us determine the most relevant marketing information to share with you. If you receive marketing email from us, you may unsubscribe at any time by following the instructions contained within the email. If you opt-out of receiving marketing email from us, it may take up to a month and more  for us to process your opt-out request, and you may receive marketing email from us during that period. Additionally, even after you opt-out from receiving marketing messages from us, you will continue to receive administrative and transactional messages from us regarding your use of the Service.

• Customizing the Services. To provide you with customized services. For example, we use your location information to determine your language preferences or display accurate date and time information.

• Improving our Services. To analyze and learn about how the Services are accessed and used, evaluate, and improve our Services (including by developing new products and services and managing our communications) and monitor and measure the effectiveness of our advertising. We usually do this based on anonymous, pseudonymized or aggregated information which does not focus on you individually. For example, if we learn that most users of paid Services use a particular feature, we might wish to expand on that integration or feature.

• Security. To ensure the security and integrity of our Services. 

• Third party relationships. To manage our vendor and partner relationships.

• Enforcement. To enforce our Terms of Services and other legal terms and policies.

• Protection. To protect our and others’ interests, rights, and property.

• Complying with law. To comply with applicable legal requirements, such as tax and other government regulations and industry standards, contracts, and law enforcement requests.

Although the sections above describe our primary purpose in collecting your information, in many situations we have more than one purpose. For example, if you sign up for Services, we may collect your information to complete that transaction, but we also collect your information as we have a legitimate interest in maintaining your information after your transaction is complete so that we can quickly and easily respond to any questions about your Services. As a result, our collection and processing of your information is based in different contexts upon your consent, our need to perform a contract, our obligations under law, and/or our legitimate interest in conducting our business.
 
How we collect your information
We obtain personal information from various sources. We do this in three main ways:

• When you give it to us. You provide some of it directly such as by registering for an account. We also maintain your marketing preferences and the emails and other communications that you send us or otherwise contribute, such as customer support inquiries or posts to our customer message boards or forums. You might also provide us with information in other ways, including by responding to surveys, submitting a form or participating in contests or similar promotions. If you do not provide personal information when requested, you may not be able to use our Services if that information is necessary to provide you with the service or if we are legally required to collect it.

• When you use our Services. We record some of your information automatically when you use our Services or Applications. We collect information about your activity on and interaction with the Services, such as your IP address(es), your device and browser type, the web page you visited before coming to our Website, what pages on our Website you visit and for how long and identifiers associated with your devices. If you’ve given us permission through your device settings, we may collect your location information in our applications. Some of this information is collected automatically using cookies and similar technologies when you use our Services or Applications, and some is collected automatically through your browser or from your device.

• From Third Parties. We receive some of it from third parties like when you register for an account using a Third-Party Service. If you use a Third-Party Service to register for an account, the Third-Party Service may provide us with your Third-Party Service account information on your behalf, such as your name and email address (we don’t collect or store passwords you use to access Third Party Services). Your privacy settings on the Third-Party Service normally control what they share with us. Make sure you are comfortable with what they share by reviewing their privacy policies and, if necessary, modifying your privacy settings directly on the Third-Party Service.

 
Who we share your personal information with
We will not share, rent, sell or otherwise disclose any of the personal information that we collect about you to unaffiliated third parties. We share your personal information with trusted entities, as outlined below.

• Third-Party Service Providers. We share personal information with certain of our third-party service providers, contractors, and processors subject to contract terms that limit their use of personal information. We have service providers that provide services on our behalf in connection with the Services, such as website hosting, data analysis, marketing service, information technology and related infrastructure, customer service, email delivery, and auditing services. These service providers may need to access personal information to perform their services. We require these contractors to use or disclose this information only as necessary to perform services on our behalf in a manner consistent with this Privacy Policy, or as otherwise required by law.

• Third Party Plugins and Social Networks. We may share personal information with website plugins, social media platforms or similar Third-Party Services to improve your experience, at your direction, or when you intentionally interact with the plug-in. For example, when you use a Third-Party Service to create or log in to your account, we may share your personal information with that Third Party Service.

• Business Partners and Resellers. We share personal information with our business partners and value-added resellers or channel partners to facilitate sales in situations where we do not directly sell our products and Services due to location, industry type or any other reason as determined solely by us.

• Law enforcement or protecting rights and interests. We disclose your personal information if we determine that such disclosure is reasonably necessary to comply with the law, protect our or others' rights, property, or interests (such as enforcing our Terms of Services) or prevent fraud or abuse of our Services or our Customers. We may disclose your personal information in response to lawful requests by public authorities, such as to meet national security or law enforcement requirements. We reserve the right to release information that we collect to law enforcement or other government officials, as we, in our sole and absolute discretion, deem necessary or appropriate.

• Fraud Prevention. We share personal information for the purposes of fraud protection, preventing fraud and minimizing associated risk for us (our Services), its Partners and others using the Services.

• Affiliates and Acquisitions. If we’re involved in a reorganization, merger, acquisition, or sale of our assets, your data may be transferred as part of that deal. We share personal information with our corporate affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If another company acquires, or plans to acquire, our company, business, or our assets, we will also share information with that company, including at the negotiation stage. We may also share personal information about you as part of a bankruptcy, corporate reorganization, merger, acquisition or other sale or transfer of our assets or business. 

• Other disclosures with your consent. We may ask if you would like us to share your information with other unaffiliated third parties who are not described elsewhere in this Privacy Policy. 

 
Your choices and rights
You can make the following choices regarding your personal information:

• Access to your personal information. You may request access to your personal information by contacting us at the address described below. If required by law, upon request, we will grant you reasonable access to the personal information that we have about you. We will provide this information in a portable format, if required. Note that California residents may be entitled to ask us for a notice describing what categories of personal information (if any) we share with third parties or affiliates for direct marketing.

• Changes to your personal information. We rely on you to update and correct your personal information. Our Website allows you to modify or delete your account profile. If our Website does not permit you to update or correct certain information, please contact us as set forth in the Contact us section of this Privacy Policy in order to request that your information be modified. Note that we may keep historical information in our backup files as permitted by law.

• Deletion of your personal information. As described in this Privacy Policy, we retain your personal information for the period necessary to provide the Services, unless a longer retention period is required or permitted by law. You may, however, request that we delete your personal information by contacting us at the address described below. If required by law we will grant a request to delete information, but you should note that in many situations we must keep your personal information to comply with our legal obligations, resolve disputes, enforce our agreements, or for another one of our business purposes.

• Objection to certain processing. You may object to our use or disclosure of your personal information by contacting us at the address described below.

• Promotional emails. You may choose to provide us with your email address for the purpose of allowing us to send free newsletters, surveys, offers, and other promotional materials to you, as well as targeted offers from third parties. You can stop receiving promotional emails by following the unsubscribe instructions in e-mails that you receive. If you decide not to receive promotional emails, we may still send you service-related communications.

• Revocation of consent. If you revoke your consent for the processing of personal information, then we may no longer be able to provide you services. In some cases, we may limit or deny your request to revoke consent if the law permits or requires us to do so, or if we are unable to adequately verify your identity. You may revoke consent to processing (where such processing is based upon consent) by contacting us at the address described below.

Exercising your rights. Please address written requests and questions about your rights to info@xinc.co.jp               Depending on where you reside, we may ask you to prove your identity as required by certain jurisdictions laws. We may verify your identity by phone call or email, or, depending on the request, we will ask for information such as your name or other account information. We may also ask you to provide a signed declaration confirming your identity. Following a request, we will use reasonable efforts to supply, correct or delete personal information about you in our files.  We cannot respond to your request or provide you with personal information if we cannot verify your identity and confirm that the personal information relates to you.  In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will provide a brief explanation. 
Please see the Other jurisdictions section below for additional information that may apply to you based on where you reside.
 
How we secure your personal information
We have adopted appropriate physical, electronic and managerial procedures to safeguard and secure the personal information we process. We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. Your account is protected by password for your privacy and security. We periodically review our information collection, storage and processing practices, including physical security measures, to guard against unauthorized access to systems.
As the internet is not a completely secure environment, we cannot warrant the security of any information a user transmits to us or guarantee that information on the Services may not be accessed, disclosed, altered, and/or destroyed by breach of any of our physical, technical and/or managerial safeguards. You are responsible for maintaining the secrecy of your unique password and account information, and for controlling access to emails between a user and us, at all times. You should limit access to your computer and/or mobile device and/or browser and sign off after you have finished accessing your account. We are not responsible for the functionality, privacy and/or security measures of any other organization and are not responsible for the practices employed by any websites and/or services linked to and/or from the Services, including the information and/or content contained therein.
 
How we retain your personal information
Generally, we will hold your personal information for as long as you are a customer and use Services to ensure accuracy and to help maintain quality of service or if we are obliged to retain such information for legal, regulatory, fraud prevention and legitimate business purposes.
The precise periods for which we keep your personal information vary depending on the nature of the information and why we need it. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use and/or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymize your personal information (so that it can no longer be associated with you) for research, statistical or other business purposes. We may use this aggregated, anonymized, or de-personalized information indefinitely without further notice.  We may retain personal information for a commercially reasonable time for backup, archival, audit purposes, and/or to comply with legal obligations, resolve disputes and enforce agreements. 
International Data Transfers
We are a global business, with our primary location in Japan. The personal information (or personal data) which we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”) including Japan, the US and other countries. You acknowledge the transfer to, and storing, or processing outside of the EEA or UK of your personal data as set out in this Privacy Policy.
 
Other important information
Links to third-party websites, apps or services. This Privacy Policy only addresses the use and disclosure of personal information collected from you by us. You should be aware that when you are using the Services, you may also use or be directed to other websites, applications or services of third parties that are beyond our control, and we are not responsible for the privacy practices of third parties or the content of their websites, applications or services. We encourage you to read the posted privacy policy whenever interacting with any third-party website, application or service.
Updates to this Notice. We will from time to time update this Privacy Policy as we adopt new privacy practices and policies in response to updates in the law, to align with changing industry best-practices, and to reflect our product enhancements. We reserve the right to change this Privacy Policy at any time. Any changes to the Privacy Policy will be either posted on this page or communicated to you in writing by us, where we are legally required to do so. Changes to this Privacy Policy shall be applicable on the effective date set out in the updated Privacy Policy. The latest version of this Privacy Policy will be available to view on our Website.
Children. The Website and Services are not directed at children, and we do not knowingly collect personal information directly from users under the age of 13 or from other websites or services directed at children. Consistent with the Federal Children’s Online Privacy Protection Act of 1998 (“COPPA”), we will not knowingly request or collect personal information from any child under age 13 without obtaining the required parental consent.
Conflict between this privacy notice and our Terms of Services or other terms. Where there is a conflict between this Privacy Policy and an explicit provision of the Terms of Services, this Privacy Policy will prevail over those other Terms.
Accessibility. If you are visually impaired, you may access this notice through your browser’s audio reader.
Information from other sources. We may receive information about you, including personal information, from third parties, and may combine this information with other personal information we maintain about you. If we do so, this Privacy Policy governs any combined information that we maintain in a personally identifiable format.
Collection and processing of sensitive information. The Services do not collect, or process ‘sensitive information’ as defined by certain Data Privacy Laws. As such, you shall not provide any such information as part of your user profile, as part of any correspondence, when you upload images, or by any other means with your use of the Service.
Aggregated Information. We may use information from images scanned and processed in an aggregated form for analytics and machine learning. The results of these activities do not contain or disclose any personal information that is identifiable to you. The Services are not designed or intended to collect personal information from your images, and you are responsible for any personal information depicted in the imagery. You should refrain from capturing any personal information if you object to the processing as described in this Privacy Policy. If personal information is captured in images that you have uploaded to us this information may be publicly displayed if you choose to display the underlying imagery publicly through the Service. If you do not wish to publicly display personal information depicted in the images you submit, you should either refrain from capturing such personal information in your images. 
Automated decision-making and profiling. Automated decision making refers to a decision that is taken solely on the basis of automated processing of your personal information, for example using software, artificial intelligence or other rating or scoring algorithms. Profiling uses automated processing which sometimes results in automated decision making, and in some cases does not.  When you sign up to use the Services, we may use certain personal information, for example your first name, last name, address and IP address to verify you are eligible to use the Services and to restrict your access if you are not, for example if you are resident in a country or region that is subject to a U.S. government embargo. We will also restrict access by use of automated decision-making and profiling to anyone on or, directly or indirectly, owned, in whole or part, by any person or persons on the U.S. Treasury Department’s List of Specially Designated Nationals and Blocked Persons or any other U.S. government list of parties with respect to transactions that are forbidden or restricted.
You have the right to not be subject to decision making which is solely based on automated processing and profiling, but only when that decision results in legal effects or otherwise significantly affects you. If you believe we have incorrectly made a decision based on automated decision-making and profiling, please contact us using info@xinc.co.jp. Your right not to be subject to automated decision making and profiling does not apply if the decision was necessary for entering into or performing a contract with you or is authorized by law and there are suitable safeguards for your rights and freedoms. However, in these situations, you can still obtain human intervention in the decision-making process and will make sure there are methods in place for you to express your point of view.
 
Other jurisdictions
Personal information that you submit through the Services may be transferred to countries other than where you live. Your personal information may be transferred to countries that do not have the same data protection laws as the country in which you initially provided the information. The following provisions may apply to you depending on where you are located. If you chose to access services from somewhere other than your home country, you are responsible for compliance with local laws.
European Economic Area (EEA) and the United Kingdom (UK). If you are located in the EEA, the UK we comply with applicable laws to provide an adequate level of data protection for the transfer of your personal data to Japan.

• Transfers outside the EEA and UK. Where applicable law requires that a data transfer have legal mechanism, we use one or more of the following: Standard Contractual Clauses with a data recipient outside the EEA or the UK (or additionally, in the case of the UK, the International Data Transfer Agreement (IDTA) or Addendum to the Standard Contractual Clauses issued by the ICO), verification that the recipient has implemented Binding Corporate Rules, or other legal method available to us under applicable law.  

• Complaints. If you are a resident of the EEA, and believe we process your information in scope of the General Data Protection Regulation (GDPR), you may direct your questions or complaints to the Office of the Data Protection Commissioner. If you are a resident of the UK, you may direct your questions or concerns to the UK Information Commissioner’s Office. 

 
United States
California – California Consumer Privacy Act (“CCPA”).  This Section applies solely to all visitors, users, and others who reside in the State of California, and only applies to personal information for which we  are  a “Business” (as defined in the CCPA). This does not apply to personal information we collect from you during our provision of Services to you where you are an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, non-profit or government agency. It applies to personal information we collect from California Residents on or through our Services and through other means (such as information collected offline or in person). Any terms defined in the CCPA have the same meaning when used in this notice.

• Important Note. We do not “sell” personal information as most people would typically understand that term. However, we do allow certain third-party partners and providers to collect information about consumers directly through our Services for purposes of analyzing and optimizing our Services and advertisements (ads), providing content and ads that are more relevant, measuring statistics and the success of ad campaigns, and detecting and reporting fraud.

• Rights and choices for California Residents. In addition to those privacy rights described in “Your choices”, if you reside in the state of California, you have the following additional privacy rights:

  • Personal information sales rights. You have the right to direct us not to sell your personal information. 

  • Non-discrimination right. You have the right not to be discriminated against when you exercise any of the rights under the CCPA. Unless permitted by the CCPA, we will not deny you goods or Services or actually charge, or suggest we charge you different prices or rates, or provide different levels of quality for goods and Services.

• Exercising your rights. To exercise your rights please submit your request to info@xinc.co.jp. As mandated by CCPA, we will acknowledge receipt of your request within 10 days and will respond within 45 days of receipt of your request, but if we require more time (up to an additional 45 days) we will let you know. In some cases, you may designate an authorized agent to submit requests to exercise certain privacy rights on your behalf.  We will require verification that you provided the authorized agent permission to make a request on your behalf. You must provide us with a copy of the signed permission you have given to the authorized agent to submit the request on your behalf and verify your own identity directly with us. If you are an authorized agent submitting a request on behalf of an individual, you must attach a copy of: (a) A completed written notice indicating that you have authorization to act on the consumer’s behalf signed by you and the consumer; and (b) if you are a business, proof that you are registered with the appropriate Secretary of State to conduct business in California. If we do not receive both pieces of information, the request will be denied.

• Right to Know Disclosures. During the past 12 months we have collected the categories of information described in . This includes information about visitors, end users, workers, vendors, suppliers and any other person interacting with us either online or offline. Not all information is collected about all individuals. For instance, we may collect different information from applicants for employment than from customers. 

 
Contact us
If you have any questions or comments about this Privacy Policy, you may contact us by email at info@xinc.co.jp 
If you are located in the European Union, pursuant to Article 27 of the General Data Protection Regulation (GDPR), we have appointed European Data Protection Office (DPO) as its GDPR representative. You can contact DPO regarding matters pertaining to the GDPR by:

• contacting: info@xinc.co.jp