We recognize that adequate protection of personal information is a serious responsibility; thus we shall only use personal information in accordance with the following policies in order to fulfill this responsibility.
(1) The use of personal information shall be limited to the extent necessary for JRAIA's business activities, and all personal information shall be properly used.
Also, as a general rule, we shall not use personal information for matters beyond achieving our purposes without obtaining the consent of the person in advance. We shall take measures to fulfill this policy.
(2) We shall comply with laws and regulations, guidelines stipulated by the government, and other rules regarding the use of personal information. We shall also comply with General Data Protection Regulation (GDPR), which came into effect on 25 May 2018.
(3) We shall take reasonable safety measures and take necessary corrective action to prevent leakage of personal information that JRAIA holds.
(4) We shall establish contact personnel to deal with complaints and matters regarding the use of personal information.
(5) We shall review our system for personal information protection on a continual basis, and strive to refine and improve it.
However, even regarding the above purposes, if use of the personal information causes any harm we shall not use it.
(3) It is necessary in order to protect someone's life, body or property, and where obtaining the consent of the person is difficult.
(4) National government, local government, the court, police and other parties who have received commission from the aforementioned institutions require cooperation when they perform work prescribed by the laws and regulations and where obtaining the consent of the person might pose a problem for the performance of their work.
Even in the event that we provide personal information to third parties in accordance with the above cases, we shall take necessary measures, including limiting the purpose and method of the usage of the information, as needed.
We shall strictly manage the collected personal information within the scope of the above purposes, and also take corrective and preventive measures for unauthorized access, loss, destruction, tampering and leakage. We shall conduct employee training and take reasonable safety measures in the development of the system, including access restriction.
If we consign the handling of the collected personal information to an external party then we shall select an appropriate agency in accordance with the rules of JRAIA. We shall enter into an outsourcing contract with said agency and clarify the following points: the presence or absence of re-consignment, confidentiality obligations of said agency, the contract period, correspondence in case of an accident, matters regarding return and deletion of personal information at the time of contract termination and contract cancellation in the case of breach of contract by said agency.
If a person has an inquiry, or a request for correction or deletion of personal information that JRAIA holds, we shall answer the inquiry or correct or delete the personal information after the person's identification has been confirmed.