Data Processing Agreement (DPA)

1. Definitions and Purpose

The purpose of this Agreement is to ensure the proper handling of personal data provided by the Controller to the Processor in accordance with the Act on the Protection of Personal Information (APPI) and other relevant Japanese regulations. "Personal Data" refers to information relating to a living individual provided for video production that can identify a specific person.

2. Data Subjects and Categories

Processed data is limited to the following scopes:

• Names, contact details, and likenesses (video/photo) of performers and interviewees.
• Interview content and audio recordings.
• Contact information of the Controller's designated representatives.

This data is used exclusively for the purpose of video production, editing, and delivery. For further details, please refer to our Privacy Policy.

3. Processor Obligations and Instructions

The Processor shall process personal data only according to the written or electronic instructions of the Controller. If the Processor determines that an instruction is legally improper, it will promptly notify the Controller to request a modification. The Processor maintains data confidentiality in accordance with this Agreement and the Terms of Service.

4. Sub-processors

To provide the services, the Processor engages the following third parties (including transfers to third parties located abroad):

• GMOインターネットグループ株式会社 (Server Hosting: 〒150-8512 東京都渋谷区桜丘町26番1号 セルリアンタワー)
• FormSubmit (Contact Form Management: USA)

The Processor ensures that these sub-processors are bound by data protection obligations equivalent to those in this Agreement and maintains appropriate oversight.

5. Security Measures

In accordance with the APPI, the Processor implements the following security measures:

• Access Control: Access to data is restricted to essential staff (藤田 隆, 佐藤 恵子, 井上 美咲).
• Technical Measures: Encryption of communications and password-protected storage.
• Organizational Measures: Clear assignment of responsibility via internal regulations.

6. Incident Response

If the Processor detects a leak, loss, or damage of personal data, or a risk thereof, it will promptly notify the Controller and work to prevent further damage and investigate the cause. The Processor will also report the incident to the Personal Information Protection Commission as required by law.

7. Return and Deletion of Data

Upon completion of the services or upon request by the Controller, the Processor will promptly return or delete the personal data. However, backup and archive data may be retained for up to 6 months according to internal policies. After this period, data is deleted using non-recoverable methods. For cancellation and refund rules, please see the Legal Notice.

8. Audit and Jurisdiction

The Controller may request an audit of the Processor's data handling within reasonable limits. Any disputes arising from this Agreement shall be subject to the exclusive jurisdiction of the court of 名古屋市中区 in the first instance.

Supervisory Authority:
Personal Information Protection Commission (個人情報保護委員会)
〒105-0001 東京都港区虎ノ門二丁目2-3 虎ノ門アルセアタワー12階
https://www.ppc.go.jp