Yomiuri Travel Service GDPR Privacy Policy

1. Our Privacy Statement
 
This privacy policy (this "Privacy Policy) sets our how Yomiuri Travel Service Co., Ltd. ("we", "us" or "our"), acting as the Data Controller, collects, uses, discloses, transfers and otherwise processes the personal data that we obtain from you or through third parties.
We process your personal data in accordance with applicate United Kingdom and European Union data protection laws, including the UK General Data Protection Regulation (the "UK GDPR") and Regulation (EU) 2016/679 (the "EU GDPR" and, together with the UK GDPR, the "GDPR"). If you have any questions or concerns regarding this Privacy Policy, please contact us at inbound@yomiuri-ryokou.co.jp.
 
2. Personal Data We Process
 
In the course of our business operations, we process the following categories of personal data:
 
 ・Identification Data: name, date of birth, gender, nationality, passport information (passport number, expiry data and place of birth) and occupation.
 ・Contact Data: address, telephone number, email address, emergency contact and place of accommodation in Japan.
 ・Ticket-Related Data: (including not only tickets displayed in electronicform, but also redemption information for paper or printed tickets): QR codes and booking reference number
 ・Transaction Date: information concerning the travel services booked or purchased, contract terms, transaction details and history of past transactions.
 ・Payment Data: information as to whether payment has been successfully completed.
 ・Dietary restriction Data: food allergies, religious dietary requirements, health condition and medical history.
 ・Health-Related Data: information necessary to provide assistance.
  ・Online Identifiers: IP address and cookies [(for further information on our use of cookies, please see our Cookie Policy available at ryokou.yomiuri.co.jp/en/pages/cookie_policy)]
 
3. How We Collect Your Personal Data
 
We collect your Identification Data and Contact Data when you submit such data through our travel services booking website, and we collect Ticket-Related Data, Transaction Data and other personal data when you transact with us through that website.
We also operate an enquiry form on our corporate website, through which we collect Identification Data, Contact Data, Transaction Data and similar personal data submitted by you.
In addition, we partner with overseas online travel platform operators ("OTAs") as sales channels for our travel services and related products. Where you book our travel services through such as OTA, we receive your Identification Data, Contact Data and Transaction Data from the relevant OTA.
Furthermore, in the course of arranging travel within Japan on behalf of overseas travel companies (i.e., land operations), we may receive your Identification Data, Contact Data, Dietary Restriction Data and Health-Related Data from the relevant travel company.
In addition, Online Identifiers (such as IP address and cookies) are collected automatically when you visit our website.
 
4. Purpose and Legal Bases for Processing
 
We process your personal data for the purposes set out in this Privacy Policy. We ensure that the personal data proceesed is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed. Where we intend to process your personal data for a purpose other than the purpose for which it was originally collected, we will inform you accordingly.
We process your personal data on the following legal bases and for the following purposes:
Specific Purpose

 

Categories of Personal Data

 

 

Legal Basis

 

 

Booking, sale, arrangement and management of travel services

 

We use personal data for the following purposes:

 

・To arrange and book the travel services that you request and reserve, including bookings of flights, transportation, accommodation and activities;

・To sell tours, activities, flight tickets, transportation tickets, accommodation and other travel services to you;

・To verify your identity and properly deliver the travel services that we provide;

・To arrange insurance in connection with travel services.

 

・Identification Data: name, date of birth, gender, nationality, passport information, occupation

・Contact Data: address, telephone number, email address, emergency contact, place of accommodation in Japan

・Ticket-Related Data: QR codes, booking reference numbers

・Transaction Data: contract terms, information concerning travel services booked on purchased, transaction details, history of past transactions

・Payment Data: information as to whether payment has been successfully completed

Performance of a contract (Article 6(1)(b) GDPR)

 

Provision of appropriate care and support in our travel services to customers who require assistance.

 

Health-Related Data: information necessary to provide assistance

Performance of a contract (Article 6(1)(b) GDPR)

 

Prevention of fraudulent purchases and fraudulent participation in travel (events), including by impersonation

 

We use your personal data to prevent fraudulent purchases, including purchases made by impersonating another person.

For example, we verify your identity on the basis of your passport or other identification document when providing our travel services. 

 

 

・Identification Data: name, date of birth, gender, nationality, passport information, occupation

・Contact Data: address, telephone number, email address, emergency contact, place of accommodation in Japan

・Transaction Data: contract terms, information concerning travel services booked on purchased, transaction details, history of past transactions

・Payment Data: information as to whether payment has been successfully completed

 

 

 

Legitimate interests (Article 6(1)(f) GDPR)

 

Preventing fraud, such as the purchase of travel services by individuals impersonating others, in order to preserve the integrity of our travel services sales process and to secure fair access to travel (events).

Authentication when you use tickets relating to our services

 

・Ticket-Related Data: QR codes, booking reference numbers

・Transaction Data: contract terms, information concerning travel services booked on purchased, transaction details, history of past transactions

・Payment Data: information as to whether payment has been successfully completed

 

Performance of a contract (Article 6(1)(b) GDPR)

 

Authentication of purchase information (including vouchers used for ticket issuance) for you to receive purchased tickets

 

 

・Ticket-Related Data: QR codes, booking reference numbers

・Transaction Data: contract terms, information concerning travel services booked on purchased, transaction details, history of past transactions

・Payment Data: information as to whether payment has been successfully completed

 

Performance of a contract (Article 6(1)(b) GDPR)

Responding to enquiries from purchasers of travel servfices

 

We use personal data to respond to enquiries, questions or concern raised by you in connection with the sale of travel services (including the sale of tickets through our travel services sales website), ana to handle any issues or disputes that may arise in that context.

 

・Identification Data: name, date of birth, gender, nationality, passport information, occupation

・Contact Data: address, telephone number, email address, emergency contact, place of accommodation in Japan

・Ticket-Related Data: QR codes, booking reference numbers

・Transaction Data: contract terms, information concerning travel services booked on purchased, transaction details, history of past transactions

・Payment Data: information as to whether payment has been successfully completed

 

Legitimate interests (Article 6(1)(f) GDPR)

 

Responding to enquiries arising from the purchase of travel services and handling issues and disputes in order to provide effective customer support, ensure customer satisfaction and maintain the smooth operation of our services.

Provision of information relating to travel content (including the holding of events), such as cancellations, postponements, other changes and details concerning refunds of purchased products

 

・Identification Data: name, date of birth, gender, nationality, passport information, occupation

・Contact Data: address, telephone number, email address, emergency contact, place of accommodation in Japan

・Ticket-Related Data: QR codes, booking reference numbers

・Transaction Data: contract terms, information concerning travel services booked on purchased, transaction details, history of past transactions

・Payment Data: information as to whether payment has been successfully completed

 

Legitimate interests (Article 6(1)(f) GDPR)

 

Prompt and accurate provision of information relating to travel content (including the holding of events) helps to maintain customer satisfaction, reduces the number of enquiries and complaints and contributes to more efficient operations.

 

Provision of meal services to individuals with dietary restrictions

 

We may, on instruction from partner travel companies, make restaurant reservations on your behalf in Japan, in which case we communicate your dietary restrictions to the relevant restaurant or similar establishment.

 

Dietary Restriction Data: food allergies, religious dietary requirements, health condition, medical history

Performance of a contract (Article 6(1)(b) GDPR)

Explicit consent (Article 9(2)(a) GDPR)

 

5. Retention Periods

 

Except where a legal or statutory requirement other wise applies, we retain your personal data only for the period necessary to process it for the ourposes set out above.

Even after a transaction has been completed, in the context of our business activities and in accordance with EU and other applicable laws, we may need to retain your personal data for a specified period, as set out in the table below.

 

Category of Personal Data

 

Retention Period

Identification Data: name, date of birth, gender, nationality, passport information, occupation

 

For up to two (2) years after the termination of our services, or two (2) years after the expiry of the tickets included in the travel services, whichever applies. However, date of birth and passport information will be retained for three (3) months after the termination of our services or after the expiry of the tickets included in the travel services.

 

Contact Data: address, telephone number, email address, emergency contact, place of accommodation in Japan

 

For up to two (2) years after the termination of our services, or for up to two (2) years after the expiry of the tickets included in the travel services, as applicable.

 

Ticket-Related Data: QR codes, booking reference numbers

 

Four up to two (2) years after the termination of our services, or for up to two (2) years after the expiry of the tickets included in the travel services, as applicable.

 

Transaction Data: contract terms, information concerning travel services booked on purchased, transaction details, history of past transactions

 

For up to nine (9) years after the termination of our services, or for up to nine (9) years after the expiry of the tickets included in the travel services, as applicable.

 

Payment Data: information as to whether payment has been successfully completed

 

For up to nine (9) years after the termination of our services, or for up to nine (9) years after the expiry of the tickets included in the travel services, as applicable.

 

Dietary Restriction Data: food allergies, religious dietary requirements, health condition, medical history

 

For up to three (3) months after the termination of our services, or for up to three (3) months after the expiry of the tickets included in the travel services, as applicable.

 

Health-Related Data: information necessary to provide assistance

 

For up to three (3) months after the conclusion of the event for which the ticket was purchased, or for up to three (3) months after the expiry of the ticket, as applicable.

 

Online Identifiers: IP address, cookies

 

For the period necessary for the relevant data processing.

 

 

6. Sharing of Your Personal Data
 
・In the course of processing payments for travel services purchased through our services, we may disclose Identification Data, Contact Data, Transaction Data and Payment Data to our external payment service providers (for example, credit card companies, payment processors and any other payment platforms that we may introduce in the future). Such disclosures are made for the purposes of verifying the validity of the payment method you have selected, authenticating and setting transactions, and detecting and preventing fraud.
 
・We also share the personal data we collect the following parties as follows:
(1) We operate our travel services booking website using the "JTB Bókun" platform. Accordingly, we share your Identification Data, Contact Data, Ticket-Related Data, Transaction Data and Payment Data with JTB Corporation. In this case, personal data is transferred to Japan or Iceland, where the servers for JTB Bókun are located. The privacy policy of JTB Corporation, the provider of JTB Bókun, is available at: https://www.jtbcorp.jp/jp/privacy/jtb/ 
(2) In order to operate the tours that we organise, we may share your Identification Data, Contact Data and Ticket-Related Data with passenger transport operators, including bus operators.
(3) In order to enable you to use the accommodation, restaurants, activity venues and other facilities arrange by us in connection with our travel services, we share your Identification Data, Contact Data, Dietary Restriction Data and Health-Related Data with the companies that operate such accommodation, restaurants and other facilities.
(4) In the course of selling our travel services (organised tours, tickets products and similar products), we receive your Identification Data, Contact Data and Ticket-Related Data from the overseas OTAs with which we partner.
(5) We share Tickets-Related Data with the organisers of events and operators of facilities to which the relevant tickets relate, for the purpose of authenticating those tickets.
(6) We share your Identification Data in order to arrange insurance necessary for your use of activities and other travel services.
(7) We use a hosting service provided by Six Apart Ltd. to operate the enquiry form on our website, and any Identification Data and Contact Data that you submit through that form is stored on the servers of that provider located in Japan. The privacy policy of Six Apart Ltd. is available at: https://www.sixapart.jp/privacy/.
 
7. Transfers of Your Personal Data Outside the EU or the UK
 
We are established in Japan, and your personal data is processed in Japan. Japan is the subject of an adequacy decision adopted by the European Commission (Commission Implementing Decision of 23 January 2019) and is covered by adequacy regulations made by the UK Government. Accordingly, transfers of your personal data to Japan benefit from an adequate level of protection within the meaning of Article 45 GDPR.
 
8. Disclosure to Public Authorities and Courts
 
Where we are required to do so by order of a public authority or a court, we may need to disclose your personal data to public authorities or courts in the context of investigations or legal proceedings. We may also disclose your personal data where we determine, in good faith, that such disclosure is reasonably necessary to protect our rights and pursue available remedies.
 
9. Your Rights
 
You have the following rights in respect of the personal data we process about you:
 ・Right to be informed: you have the right to obtain from us all necessary information concerning the processing activities relating to your personal data.
 ・Booking Right of access: you have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed and, where that is the case, access to such personal data and to certain related information.
 ・Right to rectification or erasure: you have the right to obtain from us, without undue delay, the rectification of inaccurate personal data concerning you and to have incomplete personal data complete. Subject to certain conditions, you may also have the right to obtain from us, without undue delay, the erasure of personal data concerning you.
 ・Right to restriction of processing: subject to certain conditions, you have the right to obtain from us the restriction of processing of your personal data. 
 ・Right to object to processing: subject to certain conditions, you have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you. For example, if you do not wish to receive marketing communications from us, please contact us at inbound@yomiuri-ryokou.co.jp.
 ・Right to data portability: subject to certain conditions, you have the right to receive your personal data on a structured, commonly used and machine-readable format and to transmit that data to another controller without hindrance from us.
 ・Right to withdraw consent: you may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. To withdraw your consent, please contact us at inbound@yomiuri-ryokou.co.jp. Upon receipt of your notice of withdrawal, we will cases processing the relevant personal data for the purposes for which you originally provided your consent.
 
10. Dietary Restriction Data and Health-Related Data (Special Categories of Personal Data)
 
We may collect and process Dietary Restriction Data and Health-Related Data, each of which constitutes a special category of personal data under the GDPR, solely for the purpose of providing reasonable accommodations. We process such data to the extent necessary for the performance of our contract with you (Article 6(1)(b) GDPR) and on the basis of your explicit consent in accordance with Article 9(2)(a) GDPR.
You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before such withdrawal. Please note, however, that the withdrawal of your consent may limit our ability to continue to provide certain accommodations. If you wish to withdraw consent or exercise any of your other data protection rights, please contact us at inbound@yomiuri-ryokou.co.jp.
 
11. Updates to this Privacy Policy
We may revise or update this Privacy Policy from time to time. Any changes to this Privacy Policy will take effect when the revised Privacy Policy is posted on our website.
 
12. Contact
For any questions or requests regarding this Privacy Policy, please contact us at:
 
Yomiuri Travel Service Co., Ltd.
Marronnier Gate Ginza 3, 2-3-12 Ginza, Chuo-ku, Tokyo 104-0061, Japan
 
EU Representative
Valentina Giarrusso
Corso Venezia No. 6, 20121 Milan, Italy
Phone:+39 338 899 5349
 
UK Representative 
Dr. Salvatore Fasciana
98 North Road, Brighton and Hove, BN11YE
Phone:+44 7882 074554