Guidelines for Protection of Private Information by JTB Corp.

The JTB Group’s corporate philosophy is to “contribute to harmony and understanding throughout the global society through the creation of multicultural human exchange” based on ‘The JTB Way’, the quintessence of our brand.

Our Group-wide vision statement is “Pioneering ways to bring people, places and possibilities together in a New Era; Our aim is to pioneer new ways to connect people, smiles and possibilities across the globe by remaining aligned with evolving market needs and values and combining digital prowess with the warmth of a human touch.” We consider the safeguarding of personal information and compliance with applicable privacy laws as essential to the achievement of our philosophy and vision. To this end, we have developed the following policies and procedures:

1. We shall create a system and procedures for handling and managing personal information that conform to the standards set forth under JIS Q 15001. All officers and employees of JTB Corp. shall be required to comply with said system and procedures.
2. We shall collect, use, furnish and otherwise handle personal information in accordance with the systems and procedures referenced above. This means that we shall collect personal information through lawful and proper means and shall limit the use, furnishing and handling of personal information to the scope of its intended purpose. Should the need arise to handle personal information in a manner that goes beyond the scope of its specified intended use, we shall do so only after obtaining authorization from our Privacy Officer, furnishing notice to the affected individual regarding the contemplated use of said information, and obtaining the consent of said individual. We shall not utilize personal information for non-intended purposes and shall establish mechanisms to safeguard against such non-intended use. We shall only use and furnish ‘Specific Personal Information’ for its intended purposes as defined under the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures.
3. We shall implement organizationally and technologically reasonable measures to prevent and remedy the risks associated with the unauthorized access, loss, destruction, falsification and breach of personal information handled by JTB Corp.
4. We shall observe applicable laws, regulations, guidelines, social norms and public order relevant to the safeguarding of personal information and the appropriate disposition of Specific Personal Information.
5. Our Customer Hotline has been designated to respond to questions and complaints regarding the manner in which we handle personal information as well as to respond to related requests (for disclosure of personal information, etc.). The contact information for our Customer Hotline shall be made available both within and outside the company. We shall respond promptly and in good faith to all requests received from individuals regarding their own personal information.
6. We shall implement improvements to our personal information management systems and procedures on an ongoing basis by conducting periodic reviews and audits.
7. The provisions set forth in this policy shall be governed by the laws of Japan.

Implemented: January 1, 2004
Amended: December 1, 2020
Tomo Aomi
President and Chief Executive Officer, JTB Corp.

For Inquiries concerning this Policy, please contact our Customer Hotline at:JTB Corp.
Shiodome City Center, 1-5-2 Higashi-Shimbashi, Minato-ku, Tokyo, Japan

How JTB Corp. Handles Your Personal Information

In accordance with the Act on the Protection of Personal Information, the Act on the Use of Numbers to Identify a Specific Individual in Administrative Procedures (hereinafter referred to as the “Individual Numbers Act”) and JTB Corp.’s policies regarding the protection of personal information, we handle and protect personal information as follows.

Personal information we acquire and handle

1. We acquire personal information directly or indirectly in connection with the provision or performance of products or services such as travel related products or services or in connection with the receipt of opinions from customers or other contact with customers, and retain a portion of such information as personal data.
2. We acquire personal information from job applicants and retain it as personal data.
3. We acquire personal information from our business partners (in the case of corporate business partners, its officers and employees) and retain it as personal data.
4. We acquire and retain personal data, such as personal numbers (My Number), relating to our employees and their relatives, as well as individuals with whom we have a continuous contractual relationship in which we prepare payment records, etc. Such personal information will be acquired, managed, used, and provided in accordance with laws, regulations, and our internal regulations, as well as labor, employment management, welfare, health management, and remuneration payment (including tax).

Intended use of personal information

1. We use your personal information for the following purposes.
   • Arrangement of travel services provided by transportation, accommodation facilities, etc. (as described in the contract document with respect to major transportation and accommodation facilities) and procedures for receipt of such services, procedures for payment of travel expenses, and provide of other travel services in the course of travel for which the customer has applied.
   • For the supply of other products and services of us or our business partners
   • To respond to customer opinions, requests, inquiries, etc., including inquiries about products or services and preparation of contracts.
   • For registration, management, and guidance on various membership programs, etc.
   • For after-sales service relating to products or services
   • For the purpose of conducting questionnaires and other activities such as requests for the provision of opinions and impressions
   • To develop, improve or reform products or services (*1)
   • For the selection, provision, and operation of privileges, prizes, point programs, etc. of us or our business partners
   • To provide information on or distribute advertisements for products, services, various campaigns, events, and other sales promotion activities of us or our business partners (*2)
   • For the preparation of statistical materials
   • For the maintenance and operation of products, services, networks, systems, etc., and prevention of disabilities, defects, incidents, etc., of products, services, networks, systems, etc., and response in the event of such accidents
   • In order to create an environment in which customers can use products or services safety, such as monitoring, preventing, analyzing, and taking countermeasures on or against illegal, fraudulent or any other improper acts
   • For use to the extent permitted by law
   • To provide personal information to a third party in order to achieve each of the above-mentioned purpose of use.
     (※1) We will use Cookie, etc. (including web beacons, UIDs, and other technologies, and hereinafter simply referred to as “Cookie, etc.”) and, by or through Cookie, etc., we acquire customer purchase history, service provision history, browsing and other behavior history, information on terminals used, network information (IP addresses, etc.), analyze these as personal information of customers or information related to customers, and use these information to develop, improve, or reform products or services or advertise or promote or provide information on products or services according to induvial interest, preferences, trends, etc.
     (※2) We may acquire information related to individuals other than personal information (including purchase history, location information, browsing and other behavior history, terminal information, and network information (IP address, etc.) obtained through Cookie, etc.) from a third party and use such information to develop, improve, or reform products and services with personal information held by us, as well as to advertise or promote or provide information on products or services in accordance with individual interest, preferences, or trends, etc..
2. We will use personal information obtained from job applicants within the scope necessary for identification, communication with job applicants, and other recruitment purposes.
3. We will use personal information about our business partners (in the case of corporate business partners, its officers and employees) for business purposes, such as communication, contract fulfillment, business negotiations and management of our business partners.

Provision of personal information to third party

1. We will provide name, ID, gender, age, address, telephone number, e-mail address, passport information, credit card information, information on emergency contacts, and other necessary personal information by electromagnetic means etc., to facilities for transportation, accommodation facilities, service providers, insurance companies, public offices, etc., to the extent necessary for arrangements for the travel services you have applied for and procedures for receipt of such services, to the extent necessary for the procedures for insurance covering our travel contract responsibilities, expenses in the event of an accident, to the extent necessary for providing information relating to safety or health or contacting a customer for confirmation of its safety, etc.
2. We may provide personal data of our customers to souvenir stores or other dealers for the convenience of customers’ shopping at our travel destinations. In this case, personal data pertaining to the customer’s name, passport information, and the flight name to be boarded will be provided by sending in advance by electromagnetic means, etc.
3. In case of illness or accident during a trip, we may ask for personal information to whom we may contact. This personal information will be used if we acknowledge that in the event of illness or other illness, we need to contact the contact person. The customer shall obtain the contact’s consent to provide us with the personal information of the contact.
4. To the extent necessary for the arrangement or provision of the various services that you have applied for, we will provide our business partners, service providers, or public offices with personal information such as your name, ID, gender, age, address, telephone number, e-mail address, and other necessary personal information by electromagnetic means, etc.
5. To the extent necessary for responding to customer opinions, requests, and inquiries, including inquiries about products or services, or preparing contracts, we will provide the customer’s name, ID, gender, age, address, telephone number, e-mail address, credit card information, and other necessary personal information by electromagnetic means, etc to the transportation/accommodation facility, service provider, other related organizations and corporations, etc.
6. We will provide customers’ names, IDs, genders, ages, addresses, telephone numbers, e-mail addresses, purchase information, etc., by electromagnetic means, etc. to our business partners for various points or other privilege granting programs, various campaigns, prizes, events or other sales promotion activities implemented by us or our business partners or for providing customers with information on these programs or activities.
7. In order to prevent or respond to the occurrence of any disability, malfunction, or accident relating to products, services, networks, or systems, we will provide the customer’s name, ID, gender, age, address, telephone number, e-mail address, and other necessary personal information to the relevant authorities or parties by electromagnetic means, etc.
8. We will provide personal data such as your name, gender, age, address, telephone number or e-mail address, passport information, credit card information, and other personal data by electromagnetic means, etc. to the government, public offices, investigative organizations, and business partners to the extent necessary to provide an environment in which you can use products or services safely, such as monitoring, preventing, analyzing, and taking countermeasures on or against illegal, fraudulent or any other improper acts.
9. We will provide the customer’s personal data by electromagnetic means, etc., with the consent of the customer or to the extent permitted by law.

Collection of Personal Information

1. We collect personal information of our customers mainly by the following methods.
   • We will obtain information from customers orally (including at the store or by telephone), in writing, by fax, on or through the web, by electronic mail or by other electromagnetic means.
   • When you access our website or use our service, information such as access history on the internet, service usage history, browsing and other action history, information on the terminal used, network information (IP address, etc.) etc. may be automatically recorded on our server, etc., and information recorded on the terminal may be automatically transmitted to us according to the settings of the terminal such as smartphone.
   • When customers use services other than us, such as affiliate programs or other alliances between us and other companies, we may acquire information such as service usage history at the same time or obtain information by receiving such information.
2. We will not use personal information for any purpose other than the purpose of use without the consent of the customer.
3. If you are a minor, we will obtain the consent of the person who has parental authority. Provided, however, that this shall not apply in case of emergency or otherwise permitted by law.
4. Although it is at the customer’s discretion to select the items of personal information that the customer provides to us, if customer chooses not to provide all or part of personal information, we may not be able to contact customers, provide travel services or other services, respond to requests from customers, or accept customers’ applications, requests, or requests.

Joint use of personal information

We will share and jointly use the personal information of our customers/users as follows.

1. Personal Information
   Name, gender, age, address, telephone number, e-mail address, ID or other identification information (including CookieID), purchase history, location information, browsing and other activity history of customers’ personal information
2. Scope of joint users
   Our group companies (Please refer to the following for our group companies)
   https://www.jtbcorp.jp/jp/jtb_group/
3. Purpose of Jointly Use
   The purposes for jointly shall be included within the scope of the purpose of use mentioned in 2 above.
4. Manager in charge of joint use under Japanese law
   JTB Corp.

Consignment of customer personal information

We may entrust all or part of the business including handling personal information of customers to a third party for the purpose of arranging travel, managing travel, travel attendance services, intermediary services at airports, travel services such as payment of travel expenses, and other our services, and for the purpose of use as described in 2 above or for our businesses. In this case, we will select the such third party based on our standards and entrust the personal information after entering into an agreement including confidentiality.

Transfer of personal information to a third party in a foreign country

1. In order to arrange travel services provided by transportation/accommodation facilities in the travel for which the customer applies or for the purpose of use as set forth in 2(1) above, we may, upon informing the customer of the country or region in which the customer’s personal information is to be provided, transfer personal information to transportation/accommodation facilities, service providers, or other third parties in the country or region in which the customer’s personal information is to be provided. In this case, it is as follows.
   • Country or region to which personal information is transferred
     We will inform you orally, pamphlets, brochures, travel terms and conditions documents, notice documents, or websites, e-mails or other electromagnetic means.
   • Systems for the protection of personal information in the said country or region and measures for the protection of personal information to be taken by a third party
     [https://www.jtb.co.jp/privacy/]
     See below.
2. We may transfer personal information to a third party in a foreign country after taking measures such as concluding an agreement with such third party to implement appropriate measures for the protection of personal information.

Safety Management Measures

We have taken necessary and appropriate safety management measures to protect personal data, such as preventing leakage, loss, or damage. The main contents of these measures are as follows

• In order to comply with laws and regulations and ensure proper handling of personal information, we have formulated a personal information protection policies, and based on these policies, we have established this handling rule and other related internal rules concerning the acquisition, use, provision, and disposal of personal information.
• We have appointed our Personal Information Management Officer and a person in charge of the handling of personal information in each department. We have also established a system to report any violations or threats of violation of laws and regulations our internal rules to the Personal Information Management Officer.
• We conduct periodic self-inspections of the status of the handling of personal data and conduct audits by our audit department.
• When outsourcing businesses, including the handling of personal information, we includes clauses related to the handling of personal information in our contracts.
• We provide regular training to our employees on the handling of personal information.
• Matters concerning the confidentiality of personal information are described in our work rules and other internal rules.
• We monitor entering and leaving our facilities, and establish rules for storage and disposal of documents and electronic media containing personal information.
• Measures are taken to prevent theft or loss of equipments such as password setting and remote control measures.
• Access control is implemented to limit the scope of databases handled by employees.
• We have introduced mechanisms to protect the systems from unauthorized access from outside or from unauthorized software.
• We store a part of personal information in some foreign counties such as the U.S, Singapore, etc. We confirm the outline of the personal information protection legislation in such regions and take measures such as concluding a contract on the handling of personal information with a third party to whom we transfer personal information.

Inquiries and Disclosure Regarding Customer Personal Information

If you wish us to notify the purpose of use or disclose, correct, add or delete your personal data, discontinue to use or erase your personal data, or cease to provide it to a third party, please contact the following inquiry desk. Provided, however, that we are unable to comply with your request if such request may seriously interfere with the proper conduct of our business. We will take necessary measures without delay in accordance with laws and regulations and our internal rules. If we are unable to comply with your request in whole or in part, we will explain the reason. Our contact point for handling personal information is as follows.

1. Inquiries and complaints about the handling of personal information, as well as disclosure or deletion of personal data JTB Customer Service Office Address: 2-3-11 Higashi-Shinagawa, Shinagawa-ku, Tokyo
2. In the event of notification of the purpose of use of personal data, correction of the contents, addition, suspension of use, or suspension of provision to a third party, please contact the office where you have applied for the travel.
   (Please confirm that the contact information is included in the application form and contract form.)

Handling of Specific Personal Information

1. We use Individual Numbers only within the scope of the purpose of use stipulated in the Individual Numbers Act.
2. We will not provide to any third party other than the recipients stipulated in the Individual Numbers Act.
3. We will promptly delete or remove the relevant Individual Number upon completion of any Individual Number Administrative Procedures as set forth under the Individual Numbers Act.

Handling of anonymously processed information

We will take appropriate protective measures to prevent the identification of specific individuals and the restoration of such personal information used for production, and will prepare anonymously processed information and provide such information to third parties to the extent permitted by law.

1. How to create anonymously processed information
   When preparing anonymously processed information, we process the information appropriately according to the following in accordance with the standards stipulated by the Personal Information Protection Law and the Rules of the Personal Information Protection Committee.
   1. Deleting a description that identifies a specific individual
   2. Deleting a Individual Identification Code
   3. Eliminating the sign that connects information with each other
   4. Deleting unique descriptions, etc.
   5. Taking other appropriate measures based on the nature of the personal information database, etc.
2. Items included in anonymously processed information
   1. Personal Attribute Information of Customers [Gender and Year of Birth of Representatives]
   2. Information on use of us [Application date (month/year), Stores (prefecture/municipality/type), Travel information (departure date/return date, area, and accommodation facility (name/type), Number of users (by adult, male, female, and child) ・Product grade, product type, product form, travel purpose, and type of participation]
3. Provision of anonymously processed information to a third party
   Items and methods of provision of information included in anonymously processed information prepared by us and provided to third parties are as follows.
   1. Items (1) and (2) in (2) above
   2. We will inform the recipients of such information that such data is anonymously processed information and provide such information after stipulating a contract to prevent improper handling of such information as identifying acts.
   3. To provide anonymously processed information to a third party by a secure electromagnetic manner such as encrypting data files.
4. Other safety management measures for anonymously processed information
   1. Clarify the authority and responsibility of the person handling information such as the processing method.
   2. We have established rules and regulations concerning the handling of such information, such as processing methods, and provide education and supervision to employees who handle such information.

Amendment of these Regulations

These Regulations may be changed or revised from time to time depending on the necessity to comply with changes in laws and regulations and the business necessity. Such changes shall be posted on this website. You are requested to fully confirm the latest contents of these Regulations after any changes, etc., that are posted on this website.

In the event of leakage of personal information

Should a problem arise, such as the leakage of personal information, we will notify customers, ensure safety, suspend our system as necessary, and publicize the facts on our website, etc., in accordance with laws and regulations.

Shiodome City Center, 1-5-2 Higashi-Shimbashi, Minato-ku, Tokyo, Japan
JTB Corp.
Tomo Aomi, President and Chief Executive Officer
Title and contact address of the Personal Information Management Officer
Senior Manager of Legal Affairs
(Contact address: same as above)

GDPR Privacy Policy

The protection of your personal data is of great importance to JTB Group1. This Privacy Policy therefore intends to inform you about how the JTB Group, whose entities may act as data controllers or processors, collect and processes your personal data that you submit or disclose to us, in the case where the General Data Protection Regulation (“GDPR”) applies to such collection or processing.

JTB Group routinely collects, uses, stores and transfers a variety of data, including Personal Data. JTB Group is committed to ensure the privacy of Personal Data throughout its global business, and make sure its employees and business partners also take the necessary measures to protect Personal Data.

This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us. Our Privacy Policy applies to you in the case where the GDPR applies to such collection or processing and is available on our website and through other channels. In all your dealings with us you must ensure that others you may represent are aware of the content of our Privacy Policy and consent to you on their behalf.

We encourage you to read this Privacy Policy carefully. If you do not wish your personal data to be used by us as set out in this Privacy Policy, please do not provide us with your personal data. Please note that in such a case, we may not be able to provide you with our services, and your customer experience may be impacted.

Your Personal Data

This refers to a combination of personal data such as your name, address, telephone number, email address, travel preference and special needs/disabilities/dietary requirements that you supply us or is supplied to us, including your social preference, activities and any information about other persons you represent such as those on your booking. Your personal data is collected when you contact us, make a booking, use our website(s)/apps, link to or from our website(s)/apps, connect with us via social media and any other engagement we or our business partner have with you.

Processing of Your Personal Data

Data processes

We may collect and process your personal data for the purposes set out below and disclose your personal data to the JTB Group companies for business purposes and also to our service providers who act as ‘controller’ or ‘processor’ on our behalf. These purposes include:

1. Fulfilling the contract with you and legal obligations (Articles 6(1)(b) and (c) of the GDPR: In order for you to travel abroad, it may be mandatory as required by government authorities at the point of departure and/or destination to disclose and process your personal data for immigration, border control and/or any other purposes. Also we need to provide airlines/accommodation providers with your name, passport number, contact details, and other related information in accordance with their terms and conditions. If you do not provide us with this personal data, we might not be able to offer our services to you.
2. Fulfilling your and our legitimate interests (Article 6(1)(f) of the GDPR): Where it is in both your and our benefit that we further process your personal data as part of our business administration, maintaining service quality, customer care, business management, risk assessment/management, security, and operation purposes.
3. Consent: For marketing purposes and other similar data processes that may require your authorization for their processing (Article 6(1)(a) of the GDPR). We will usually inform you before collecting your data if we intend to use your data for such purposes or if we intend to disclose your personal data to any third party for such purposes. You can exercise your right to prevent such processing by checking certain boxes on the forms we used to collect your data.
4. Explicit consent (Article 9(2)(a) of the GDPR): Information such as health or religion may be considered ‘sensitive personal data’ under the GDPR. This personal data might include information necessary to arrange bookings and travel plans, including your allergies, disabilities, and other relevant health information. We collect it to provide you with our services, cater to your needs or act in your interest, and we are only prepared to accept sensitive personal data on the condition that we have your positive consent.

We will process your data for as long as possible in order to fulfil our service to you and comply with the applicable fiscal, tax, securities and commercial law regulations on retention of business and financial documentation.

Children

Our products and services are intended for adult customers. However, we may knowingly collect and process personal data on children under sixteen (16). On these occasions, we will take account of this event when processing the personal data of children and implementing the legal basis for such processing. For example, where the processing of personal data of children is based on their consent such as the processing of his/her sensitive personal data, we will seek the consent of parents, tutors, or other adults holding parental responsibility over children, if required under the GDPR.

Links to other sites

We may propose hypertext links from our websites to third-party websites or Internet sources. We do not control and cannot be held liable for third parties’ privacy practices and content. Please read carefully their privacy policies to find out how they collect and process your personal data.

Data transfers

JTB Group

When we process your personal data, we will store it on our systems located within the European Economic Area (EEA), which comprises the Member States of the EU, Norway, Iceland and Lichtenstein, as well as outside the EEA. In the event of a merger, reorganization, acquisition, joint venture, assignment, spin-off, transfer, or sale or disposition of all or any portion of our business, including in connection with any bankruptcy or similar proceedings, we may transfer any and all personal data to the relevant third party. Your data may also be processed by staff operating outside the EEA who work for us or for one of our suppliers (e.g., travel guides, transportation services). Such staff may be engaged in, among other things, the provision of support services.

Service providers

For the purpose of providing you with our services, including your booking of flight, hotel, security, incident/accident management etc., we may disclose and process your personal data outside of the EEA countries. In order for you to travel abroad, it may be mandatory as required by government authorities at the point of departure and/or destination to disclose and process your data for immigration, border control and/or any other purposes. Also we need to provide airlines/accommodation providers with your name, passport number, contact detail, etc. in accordance with their terms and conditions.

Legal compliance and security

It may be necessary for us － by law, legal process, litigation, and/or requests from public and governmental authorities within or outside your country of residence － to disclose your personal data. We may also disclose your personal data if we determine that, due to purposes of national security, law enforcement, or other issues of public importance, the disclosure is necessary or appropriate.
We may also disclose your personal data if we determine in good faith that disclosure is reasonably necessary to protect our rights and pursue available remedies, enforce our terms and conditions, investigate fraud, or protect our operations or users.

Safeguards to protect your personal data

Where we share your data with a data processor, we will put the appropriate legal framework in place in order to cover such transfer and processing (Articles 26, 28 and 29). Furthermore, where we transfer your data from EEA to any entity outside the EEA, we will put appropriate legal frameworks in place, notably Binding Corporate Rules (Article 47 GDPR), controller-to-controller (2004/915/EC) and controller-to-processor (2010/87/EU) Standard Contract Clauses approved by the European Commission, in order to cover such transfers (Articles 44 ff. GDPR), or we will share your data based on rules of the GDPR.
By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, in particular, by adopting Binding Corporate Rules (for transfers among certain JTB companies) and Standard Contract Clauses (for transfers among certain JTB companies and with third-parties) where possible.

Our Records of Data Processes

We handle records of all processing of personal data in accordance with the obligations established by the GDPR (Article 30), both where we might act as a controller or as a processor. In these records, we reflect all the information necessary in order to comply with the GDPR and cooperate with the supervisory authorities as required (Article 31).

Security Measures

We process your personal data in a manner that ensures their appropriate security, including protection against unauthorised or unlawful processing, accidental loss, destruction or damage. We use appropriate technical or organisational measures to achieve this level of protection (Article 25(1) and 32 GDPR).
We will retain your personal information for as long as it is necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Notification of Data Breaches to the Competent Supervisory Authorities

In case of breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed, we have the mechanisms and policies in place in order to identify it and assess it promptly. Depending on the outcome of our assessment, we will make the requisite notifications to the supervisory authorities and communications to the affected data subjects, which might include you (Articles 33 and 34 GDPR).

Processing Likely to Result in High Risk to your Rights and Freedoms

We have mechanisms and policies in place in order to identify data processing activities that may result in high risk to your rights and freedoms (Article 35 of the GDPR). If any such data processing activity is identified, we will assess it internally and either stop it or ensure that the processing is compliant with the GDPR or that appropriate technical and organisational safeguards are in place in order to proceed with it.
In case of doubt, we will contact the competent Data Protection Supervisory Authority in order to obtain their advice and recommendations (Article 36 GDPR).

Your Rights

You have the following rights:

• Access to personal data: You have the right to be provided full information about your personal data that we hold.
• Data correction: You have the right to require that we correct any incorrect information we hold about you.
• Data deletion: You may also have the right to ask that we delete your personal data. Please note that certain conditions may apply to the exercise of this right.
• Restriction on processing of personal data: You may have the right to ask that we restrict the use of your personal data. Please note that certain may conditions apply to the exercise of this right.
• Object to processing of personal data: You may have the right to object to the use of your personal data by us. Please note that certain conditions may apply to the exercise of this right.
• Portability of personal data: You may have the right to receive your personal data in a structured and commonly used format. Please note that certain conditions may apply to the exercise of this right.
• You also have the right to obtain from us a copy of the Binding Corporate Rules or of any Standard Contract Clauses that we use if we transfer your personal data outside the EEA and take such arrangement.
  To exercise your rights, or if you require further information about how your personal data is used by us, you can contact the staff member in charge of your travel or write to us at: private@jtb.com.
  Following is the procedure when you want to execute these rights;
  1. Upon receiving your request, we will contact you to confirm the request is being handled, and we will indicate the reasonable timeframe for us to respond.
  2. Our special team will make an initial assessment of the request to decide whether it is a valid request and whether confirmation of identity is required.
  3. If no further action from you is required, we will proceed with the processing of your request.
  4. At the end of our assessment and internal procedure, we will provide a confirmation as to our compliance or processing of your request.
  5. For any unfounded or excessive (e.g., further repeated) requests, we may charge a reasonable fee based on administrative costs.

When you want to complain about your personal data

We have appointed appropriate staff with management support to oversee and ensure compliance with the GDPR.
You can bring complaints in writing by contacting the JTB Data Protection Team at private@jtb.com.
You can also contact the JTB Data Protection Team members or other employees to complain about the way we handle your personal data. The employees to have been confronted with the complaint will inform you about the contract details to file a complaint in accordance with the present procedure or pass the complaint to the JTB Data Protection Team whichever appropriate.
After receiving the complaint the Data Protection Team will send an acknowledgement of receipt within one week to you. The confirmation may include further questions necessary for the clarification of the issues. The Data Protection Team or local Human Resources Department will provide an answer to you as soon as reasonably practicable, but no later than one month upon receiving the complaint. If, due to complexity of the complaint, a substantive response within one month cannot be provided, you will be notified with a reasonable estimate of the timeframe, but not exceeding two months from the notice.
You may also raise the complaint to the relevant Data Protection Authority or lodge a claim with a court of competent jurisdiction.

Changes to our Privacy Policy

We may revise or update this Privacy Policy from time to time. Any changes we may make to our Privacy Policy in the future will be posted on this webpage. If we make changes which we believe are significant, we will inform you through the website to the extent possible and seek your consent where applicable.

Contact

Questions, comments and requests regarding this Privacy Policy are welcomed and should be addressed to
JTB Data Protection Team
JTB Corp.
Shiodome City Center, 31st Floor, 1-5-2 Higashi-Shimbashi
Minato-ku, Tokyo
JAPAN
Email: private@jtb.com

About Cookie

JTB uses cookie information to provide better services, secure security, analyze and distribute appropriate advertisements to customers. Third-party companies may distribute advertisements or obtain behavioral information for the purpose of advertising their company. Third-party companies use cookies only for advertisement distribution purposes and acquire information. If you wish to invalidate this function, please disable (opt out) from the site of the corresponding company below.
※ If you change browser, delete cookie, etc., you need to set opt-out and opt-in again.

Google LLC	http://www.google.co.jp/policies/technologies/ads/
Google Analytic Opt-out	https://tools.google.com/dlpage/gaoptout?hl=ja
Yahoo Japan Corporation	http://btoptout.yahoo.co.jp/optout/preferences.html
MicroAd,Inc.	http://send.microad.jp/w3c/
MicroAd,Inc (SmartPhone)	http://www.microad.jp/smart/optout.html
Criteo SA	http://www.criteo.com/jp/privacy/
Platform ID,Inc.	http://www.xrost.ne.jp/contents/policy/privacy.html
KYOCERA Communication Systems Co.,Ltd.	http://www.kccs.co.jp/policy/optout.html
Facebook, Inc.	https://www.facebook.com/help/cookies/update
CyberAgent, Inc.	https://www.dynalyst.jp/legal/policy/optout.html
FreakOut, inc.	http://js.fout.jp/info/privacy.html
AMoAd, Inc.	http://www.amoad.com/guideline/#optout
LINE Corporation	http://terms.line.me/line_rules/?lang=ja
Twitter, Inc.	https://support.twitter.com/articles/20170346?lang=ja#

Exhibit

A.JAPAN

• JTB Corp.
• OKINAWA JTB Corp.
• JTB Inbound Trip Corp.
• JTB Global Marketing & Travel Inc.
• JTB Business Travel Solutions, Inc.
• JTB Business Transformation Corp.
• JTB DATA SERVICE, INC.
• Travel Plaza International, Inc.
• JTB GAIAREC, Inc.
• JTB Tourism Research & Consulting Co.
• JTB BUSINESS INNOVATORS Corp.
• JTB Communication Design, Inc.
• JTB Publishing, Inc.
• PULS Inc.
• CHUGOKU TERMINAL SERVICE CO.,LTD
• JTB Trading, Inc.
• GoodFellows JTB Corp.
• JTB ASSET MANAGEMENT Corp.
• JTB GLOBAL ASSISTANCE, INC.
• Nightley Inc.
• Japan Health & Research Institute
• Educational Institution JTB International Cultural Academy
• KUONI TUMLARE JAPAN, INC.

B.EUROPE

• Travel Plaza (Europe)B.V.
• JTB Europe Ltd.
• City Circle UK Ltd.
• JTB Italy s.r.l.
• JTB Germany GmbH
• JTB Viajes SPAIN S.A.
• Travel Plaza Netherlands B.V.
• Kuoni Global Travel Services (Schweiz) AG
• Kuoni Travel Investments Limited
• Net Service Holding Ltd
• Tumlare Corporation Inc.
• Tumlare Corporation AS
• OY Tumlare Corporation AB
• Tumlare Corporation A/S
• Tumlare Corporation Hungary Kft.
• Tumlare Corporation Croatia D.O.O.
• Tumlare o.o.o.
• Tumlare Corporation Estonia OÜ
• TUMLARE CORPORATION SWEDEN AB
• Europa Mundo Vacaciones S.L.
• Kuoni Global Travel Services (UK) Ltd.
• Kuoni GTS (France) SAS
• Kuoni Destination Management Austria GmbH
• Kuoni Destination Management s.r.o.
• Conference & Touring GmbH

C.ASIA/PACIFIC

• JTB PTE LTD
• Tour East Singapore (1996) Pte Ltd
• JTB (Thailand) Ltd.
• JCB International Holding (Thaitand) Co., Ltd.
• JAPAN TRAVEL BUREAU (MALAYSIA) SDN. BHD.
• PT. JTB INDONESIA
• PT Panorama JTB Tours Indonesia
• PT Mitra Panorama International (MPI)
• PT Chan Brothers Travel Indonesia
• PT Citra Wahana Tirta Indonesia
• PT Jati Piranti Travelindo Pratama
• PT Octraves Technology Indonesia
• PT Andalan Wisata Benua
• PT Smartravelindo Perkasa
• PT Turez Indonesia Mandiri
• PT. Kura Kura Indonesia
• PT Misi Pelayanan Mandiri
• JTB-TNT Co., Ltd.
• PT Dwi Ratna Pertiwi
• Tumlare Software Service Pvt. Ltd., New Delhi
• Big S’ Holiday Pte. Ltd.
• JTB OCEANIA PTY LIMITED
• JTB AUSTRALIA PTY LIMITED
• JTB New Zealand Limited
• JTB ASIA PACIFIC PHIL. CORP.
• JTB India Private Limited
• Tour East (T.E.T) Ltd
• 佳天美香港有限公司
• 上海佳途国際旅行有限公司
• PT Kuoni GTS Indonesia
• KGTS (Hong Kong) Ltd
• Kuoni Global Travel Services (India) Pvt. Ltd
• Kuoni GTS (Singapore) Pte Ltd
• Kuoni Tumlare (Thailand) Ltd.
• Kuoni GTS (Taiwan) Limited
• Kuoni Tumlare Travel Sdn. Bhd.

D.U.S.A.

• JTB Americas, Ltd.
• JTB USA, Inc.
• Kuoni Tumlare Canada Ltd.
• JTB International (Canada), Ltd.
• Tourland Travel Ltd.
• Sunrise Plaza Transportation of Nevada, Inc.
• Sunrise Plaza Transportation Co.
• JTB Finance Americas Inc.
• JTB Hawaii, Inc.
• JTB Hawaii Travel, LLC.
• Honolulu Festival Foundation
• Travel Plaza, LLC.
• Travel Plaza Transportation, LLC.
• Tachibana Enterprises, LLC.
• JTB Global Travel Service, LLC.
• MC & A, Inc.
• Imprint HC, LLC
• JTB Goodwill Foundation
• JTB Cultural Exchange Corporation
• Quickly Travel Agência de Viagens e Turismo Ltda.
• Quickly Concierge Servicos Administrativos Ltda.

1 JTB Corp. and its affiliates listed in Exhibit.