ORPHE Privacy Policy
This Privacy Policy (hereinafter referred to as "this Policy") outlines the handling of information of users (hereinafter referred to as "Users") who use the websites operated, products sold, and applications distributed by ORPHE Inc. (hereinafter referred to as "the Company") (collectively referred to as "the Service"). If a separate agreement exists between the Company and the User regarding information handling, that agreement shall take precedence.
1. Definitions
The terms in this Policy are defined as follows:
(1) Applicable Privacy Laws:
The Act on the Protection of Personal Information (APPI), the General Data Protection Regulation (GDPR) of the EU, and other related national laws, regulations, and guidelines.
(2) EU:
The European Union including member states and the European Economic Area (EEA: Iceland, Liechtenstein, and Norway).
(3) Personal Data:
Information falling under either of the following:
Personal information as defined in Article 2, Paragraph 1 of the APPI.
Information that can identify a natural person, directly or indirectly, through identifiers such as name, identification number, technical data (GPS, IP address, cookie ID, etc.), or other characteristics related to physical, physiological, genetic, mental, economic, cultural, or social identity.
(4) Special Care-Required Personal Information:
Personal data requiring special consideration to prevent unfair discrimination or disadvantage, including data specified in Article 2, Paragraph 3 of the APPI such as race, belief, social status, medical history, criminal record, and crime victim information. If personal data received from the EU includes special categories of personal data as defined by the GDPR (e.g., sexual life, orientation, or union membership), it shall be treated as special care-required personal information.
(5) Data Subject:
A natural person who is identified or identifiable from personal data.
(6) Controller:
A person or entity that determines the purposes and means of processing personal data alone or jointly with others.
(7) Processor:
A person or entity that processes personal data on behalf of the controller.
(8) Recipient:
A person or entity to whom personal data is disclosed. Public authorities obtaining data under EU or member state laws are excluded and must comply with applicable data protection rules.
(9) Processing:
Any operation performed on personal data, whether by automated means or not, such as collection, recording, editing, structuring, storage, modification, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, deletion, or destruction.
(10) Restriction of Processing:
Marking stored personal data to limit its future processing.
(11) Profiling:
Automated processing of personal data to evaluate or predict aspects related to a natural person's performance, economic status, health, preferences, interests, reliability, behavior, location, or movement.
(12) Consent of the Data Subject:
A freely given, specific, informed, and unambiguous indication by which the data subject signifies agreement to personal data processing.
2. Scope of Application
This Policy applies to the use of the Service by Users and the handling of information subject to applicable privacy laws.
The Company is not responsible for the handling of personal information by third-party websites or services accessible through the Service ("External Services"). Users are encouraged to review the privacy policies and terms of such External Services.
3. Controller
The Company is the controller of information and responsible for the Service.
ORPHE Inc.
5-7-5 Yoyogi, Shibuya-ku, Tokyo,
JapanPhone: +81-3-4405-5083
Email: info@orphe.io
4. Methods of Acquisition, Types of Data Collected, Purpose of Use, and Legal Grounds
The following tables describe the personal data items collected, acquisition methods, purposes of use, and legal bases.
If processing is based on contractual necessity and the User does not consent, the Company may not be able to provide the Service.
If processing is based on the data subject’s consent, the User’s agreement to this Policy constitutes consent. For users under age 16, parental consent is required. Data subjects have the right to withdraw consent.
1. When personal data is directly obtained from the User
Personal Data Obtained
Time of Collection
Purpose of Use
Legal Basis
A
Name, email address, phone number
At the time of user registration
To register the user for the Service, enable user authentication, provide the Service, and send notifications or other communications related to the Service
Necessary for the performance of a contract, necessary for the purpose of legitimate interests
B
Name, email address, user account, content of inquiries
When the user makes inquiries regarding the Service
To respond to inquiries
Necessary for the performance of a contract
2. When personal data is indirectly obtained from the User
Information Obtained
Time of Collection
Purpose of Use
Legal Basis
A
Internet domain name, IP address, search query within the site, and other browsing information related to the Service
During use of the Service
To analyze the user’s environment for service improvement, for the development of new services, and to prevent unauthorized use or use in violation of terms
Necessary for the performance of a contract, necessary for the purpose of legitimate interests
B
Cookies related to the use of the Service
During use of the Service
To improve user convenience by saving settings, maintaining and protecting sessions, and facilitating smooth use of the Service by analyzing usage frequency and patterns
Consent from the user, necessary for the purpose of legitimate interests
C
Device information, location data, and sensor data (including step count, stride, pronation, etc. calculated based on it) when using the Service
During use of the Service
To provide the Service, improve the Service, develop new services of the Company (including provision to our partner companies), and improve partner services or develop new services (including provision to said partners)
Consent from the user, necessary for the performance of a contract, necessary for the purpose of legitimate interests
3. When personal data is indirectly obtained from sources other than the User
Information Obtained
Source
Time of Collection
Purpose of Use
Legal Basis
A
Information from external services such as Facebook, as clearly specified when the user authorizes linkage
External services such as Facebook
When the user authorizes linkage while using the Service (data obtained from the external service)
For linking with external services (user registration, user authentication, and integrated use of the external service and the Service)
Consent from the user, necessary for the performance of a contract
B
Payment information provided to payment providers
Payment providers, etc.
When the user makes a payment related to the Service and the payment is processed by a provider
For processing, billing, and collecting payments for the Service
Necessary for the performance of a contract
C
Device information and location data when the user uses the Service
Location information service providers of the relevant device
During use of the Service
To provide the Service tailored to the user’s device and location
Necessary for the performance of a contract, necessary for the purpose of legitimate interests
5. Restriction of Processing
The Company shall not process personal data beyond the scope necessary to achieve the stated purposes unless:
(1) The data subject has provided consent
(2) It is necessary to protect a person’s life, body, or property and it is difficult to obtain the data subject’s consent
(3) It is particularly necessary for improving public health or promoting the sound growth of children and it is difficult to obtain the data subject’s consent
(4) It is necessary to cooperate with a government or local authority in performing duties prescribed by law, and obtaining consent could interfere with those duties
(5) Otherwise permitted or required by law
The Company shall not process special care-required personal information without the data subject’s consent, except in cases specified in Article 17, Paragraph 2 of the APPI.
6. Provision to Third Parties
The Company will not provide personal data to third parties except in the following cases:
(1) The data subject has provided consent
(2) The Company outsources handling of personal information within the scope necessary to achieve the purposes of use
(3) Disclosure to agents or contractors with confidentiality obligations within the necessary scope to achieve the purpose of use
(4) Statistical information is provided in a format that does not identify individuals
(5) Personal information is provided to external services for linkage or authentication
(6) Personal data is transferred due to business succession, such as through a merger
(7) Otherwise permitted or required by law
When outsourcing the processing of personal data, the Company will enter into necessary agreements with processors and supervise them to ensure proper handling.
When providing personal data to a third party in a foreign country, the Company will obtain the data subject’s prior consent unless permitted under the law, such as in Article 24 of the APPI.
The Company may transfer personal data, including Users’ data, from within the EU to its business operations in Japan. Such transfers are based on Japan’s adequacy decision for cross-border data transfer.
7. Rights of the Data Subject
Under applicable privacy laws, Users have the following rights:
(1) Right to information:
The Company must provide certain information when collecting personal data.
(2) Right of access:
The data subject can request access to their personal data held by the Company and receive a copy.
(3) Right to rectification:
The data subject may request correction of inaccurate personal data.
(4) Right to erasure:
The data subject may request deletion of their personal data under certain conditions.
(5) Right to restrict processing:
The data subject may request restriction of processing of their personal data.
(6) Right to notification:
In cases of rectification, deletion, or restriction of processing, the Company must notify relevant recipients and, upon request, inform the data subject.
(7) Right to data portability:
The data subject may receive their personal data in a structured, commonly used, machine-readable format and request its transfer to another controller.
(8) Right to object:
The data subject may object to processing based on legitimate interests.
(9) Right not to be subject to automated decision-making:
The data subject has the right not to be subject to decisions based solely on automated processing, including profiling, that significantly affect them.
(10) Right to withdraw consent:
The data subject may withdraw their consent at any time.
8. Cookies, Google Analytics, and Emails
About Cookies
The Service uses technologies called cookies to store basic settings, facilitate login and account authentication, enhance user convenience, and for marketing purposes. The Service is designed to function based on the use and acceptance of cookies.
You can manage cookie settings by changing your browser settings. For more details, please refer to your browser’s “Help” menu.
Please note that if you disable cookies, some or all features of the Service may not be available.
About Google Analytics
The Company uses Google Analytics to analyze access trends and usage of the Service. Google Analytics collects information about the use of the Service in a form that does not personally identify individuals via cookies.
For details on how data is collected and used, please refer to the Google Analytics Terms of Service and Google Privacy Policy.
If you do not wish to use Google Analytics, you can install the browser add-on from the link below:
About Emails from the Company
The Company may send marketing emails, including information related to the Service. If you do not wish to receive such emails, you can change your preferences using the link provided in the email.
9. Data Retention Period
Personal data will be retained for the statutory retention period of each EU member state or Japan. After this period, personal data will be safely and promptly deleted unless required for contract fulfillment or processing purposes.
10. Security Measures
The Company strives to maintain accurate and up-to-date personal data and will delete it when no longer needed.
The Company implements appropriate technical and organizational measures to prevent loss, destruction, falsification, and leakage of personal data.
The Company educates and supervises its employees to ensure the secure handling of personal data.
Disclosure, Correction, and Suspension of Use:
Upon request from the data subject, the Company will verify the request and respond promptly with disclosure, correction, addition, deletion, or suspension of use of personal data in accordance with applicable laws. A processing fee of JPY 1,500 may apply per request.
11. Disclaimer
The Company shall not be responsible for acquisition of personal data by third parties in the following cases:
When the data subject voluntarily discloses personal data to third parties using the Service
When an individual is identified based on information input by the data subject into the Service
12. Revisions
This Policy may be revised in whole or in part without prior notice. Any revisions will be announced within the Service.
13. Contact Information
For inquiries regarding the handling of personal data, please contact:
ORPHE Inc.
Corporate Departmen
Email: info@orphe.io
Supplementary ProvisionsEnacted:
July 1, 2019
Revised: December 18, 2020