HITOHATA, INC. ("we", "us" or "our") plans, directs, produces and operates projection mapping, immersive art museums, immersive shows and similar experiences, and in doing so engages with many visitors, clients and partners in Japan and overseas. We regard the protection of personal information as an important responsibility in the conduct of our business. We comply with the Act on the Protection of Personal Information of Japan (the "APPI"), the related cabinet orders, rules and guidelines, and the personal information protection laws applicable overseas, and we establish this policy on the handling of personal information (this "Policy") as set out below.

Article 1 (Scope)

This Policy applies to the personal information we obtain through the websites we operate (https://www.hitohata.jp/ and its subdomains, as well as the official websites of "Ukiyo-e Immersive Art Exhibition", "YOKAI Immersive Exhibition" and other events and facilities we plan or produce), our online stores, the events and facilities we host, co-host or operate, our recruitment activities, and our business with clients and partners. For events conducted through an executive committee or council structure, the provisions on joint use in Article 8 apply.

Article 2 (Definition of Personal Information)

"Personal information" in this Policy means personal information as defined in Article 2, Paragraph 1 of the APPI: information relating to a living individual that can identify that individual by name, date of birth, address, telephone number, email address or other description (including information that can be readily collated with other information and thereby identify the individual), and information containing an individual identification code. "Personal data", "retained personal data", "personally referable information", "pseudonymously processed information" and "anonymously processed information" follow the definitions in the same Act.

Article 3 (Information We Obtain and How We Obtain It)

We obtain the following personal information by lawful and fair means.

(1) Inquiries and requests for interviews, lectures or collaboration: company or organisation name, department and title, name, telephone number, email address, and the content of the inquiry

(2) Ticket purchases and reservations for events and facilities: name, telephone number, email address, purchase and reservation details, date and time of visit, and payment-related information (credit card numbers and other payment details are handled by the payment processing provider or the ticket vendor, and we do not retain them)

(3) Online stores: name, address, telephone number, email address, and order, delivery and payment information

(4) Visits to events and facilities: responses to visitor surveys, footage from security cameras installed at venues by us or our contractors, and photographs and video filmed for record-keeping and public relations (which may include the likeness of visitors; please refer to Article 15)

(5) Recruitment: resumes, career histories, portfolios, interview records and other information provided by applicants

(6) Contacts at clients, partners and government agencies: names, affiliations and contact details recorded on business cards, contracts, invoices and emails

(7) Website browsing: cookies, IP address, browser and device information, browsing history, referrer and similar data (please refer to Article 11)

Article 4 (Purposes of Use)

We use the personal information we obtain within the scope of the following purposes.

(1) Responding to inquiries and requests, verifying identity, and related communications

(2) Planning, producing, operating, delivering, invoicing and following up on projects, events and content

(3) Selling tickets and merchandise, managing reservations, processing payments, arranging delivery, managing admission, and related notifications

(4) Safety management at events and facilities, responding to accidents and incidents, and crime prevention

(5) Visitor surveys, evaluation using visitor-flow and behavioural data, service improvement, and the development of new projects

(6) Providing information about our business, events, new works and campaigns (including delivery by email, social media and advertising)

(7) Recording, publicising and promoting the projects and events we produce (including the publication of photographs and video)

(8) Communication with clients, partners and government agencies, and the conclusion and performance of contracts, invoicing and payment

(9) Recruitment screening, communication with applicants, and personnel and labour management after hiring

(10) Responding to laws, guidelines and requests from government agencies

(11) Responding to acts that violate our terms of use and to unauthorised or improper use

(12) Purposes incidental to the above

Purposes of use associated with joint use, outsourcing and provision to third parties are as set out in Articles 6 through 8.

Article 5 (Change of Purpose of Use)

We may change a purpose of use to the extent reasonably deemed to be related to the purpose before the change. If we make such a change, we will announce the revised purpose on this website or notify the individual.

Article 6 (Provision to Third Parties)

Except in the following cases, we do not provide personal data to third parties without obtaining the prior consent of the individual.

(1) Where required by law

(2) Where necessary to protect a person's life, body or property and it is difficult to obtain the individual's consent

(3) Where particularly necessary to improve public health or promote the sound growth of children and it is difficult to obtain the individual's consent

(4) Where it is necessary to cooperate with a national government body, a local government or a party commissioned by either in performing duties prescribed by law, and obtaining the individual's consent is likely to impede the performance of those duties

(5) In joint research with an academic research institution, where permitted by the APPI

(6) Where personal data is provided in connection with the succession of a business

Provision to the contractors referred to in Article 7 and to the joint users referred to in Article 8 does not constitute provision to a third party.

Article 7 (Outsourcing)

We may outsource all or part of the handling of personal data to external providers to the extent necessary to achieve the purposes of use. Examples of such providers: ticket sales and reservation management, payment processing, product delivery, website production, operation and hosting, form and email delivery, cloud storage, analytics and advertising delivery, visitor surveys and effectiveness measurement, applicant tracking systems, and event operation and security. In selecting contractors we confirm their security control systems for personal information and exercise necessary and appropriate supervision by contract.

Article 8 (Joint Use)

In events and projects carried out through an executive committee or council formed with local governments, owners of cultural properties, media organisations, companies and others, we may jointly use personal data as follows.

(1) Items of personal data jointly used: names and contact details of ticket purchasers, persons holding reservations and visitors; purchase, reservation and attendance information; survey responses; and the content of inquiries

(2) Scope of joint users: the organisations named on the official website or announcement materials of each event or project as members (hosts or co-hosts) of that event's or project's executive committee or council

(3) Purposes of use: operation of the event or project, visitor support, safety management, effectiveness measurement, and notice of future editions

(4) Party responsible for management: HITOHATA, INC. (address and representative as set out in Article 21). However, where the official website of the relevant event separately designates a party responsible for management, that designation applies.

Article 9 (Provision to and Outsourcing to Third Parties in Foreign Countries)

We may provide personal data to, or outsource its handling to, third parties in foreign countries in the following cases.

(1) Where we use services of providers located in the United States or other countries (such as Google LLC and Meta Platforms, Inc.) for website hosting, cloud storage, email, analytics, advertising delivery and similar purposes

(2) Where, in carrying out events and projects overseas, we provide necessary information to our overseas base (HITOHATA MILANO S.R.L., Italy) or to local contractors and co-hosts

An outline of the personal information protection regimes of these countries is published on the website of the Personal Information Protection Commission of Japan. We provide such data after confirming that the recipient has established a system conforming to the standards prescribed by the APPI, or that the individual's consent has been obtained. Transfers of personal data from the EU and the United Kingdom to Japan are made on the basis of the adequacy decisions of the European Commission and the UK Government.

Article 10 (Security Control Measures)

We take the following measures to prevent the leakage, loss or damage of the personal data we handle and otherwise to control its security.

(1) Formulation of a basic policy: we have established this Policy and internal rules, and have made clear our compliance with relevant laws and guidelines.

(2) Organisational security control measures: we have appointed a personal information protection manager and have established systems for inspecting the status of handling and for reporting and responding to incidents such as leakage.

(3) Human security control measures: we provide training to our personnel on the handling of personal information and obtain confidentiality undertakings from them.

(4) Physical security control measures: we manage entry to and exit from our offices and venues, store documents and equipment under lock, restrict removal from the premises, and take measures on disposal.

(5) Technical security control measures: we manage access privileges, keep access logs, use anti-virus measures, encrypt communications, and implement measures against unauthorised external access.

(6) Understanding the external environment: where we handle personal data in a foreign country, we take necessary measures after understanding that country's regime.

Article 11 (Cookies, Analytics and Advertising Delivery)

Our websites use cookies and similar technologies to improve convenience, analyse browsing activity and optimise advertising delivery. The information obtained through these technologies does not, in principle, identify any specific individual.

(1) Analytics: Google Analytics (Google LLC). Please refer to Google's policies regarding the acquisition and processing of data. Collection can be stopped using the Google Analytics Opt-out Add-on.

(2) Advertising delivery and measurement: tags and pixels of providers such as Google Ads (Google LLC) and Meta advertising (Meta Platforms, Inc.) may be used to deliver and measure advertising based on browsing history (including remarketing). You can opt out from each provider's ad settings page.

(3) External content: embedded content from YouTube, Instagram and similar services, and Google reCAPTCHA on our inquiry form, may cause the respective providers to obtain cookies and similar data.

(4) Where it is anticipated that a third party such as an advertising provider will obtain cookie or similar information we have collected as personal data, we will carry out the confirmations and obtain the consents required by law.

You can disable cookies through your browser settings, but some functions of the website may then become unavailable.

Article 12 (Retention Period)

We retain personal information only for the period necessary to achieve the purposes of use and for any period during which retention is required by law, and we delete or dispose of personal data without delay once it is no longer needed.

Article 13 (Requests for Disclosure and Other Rights Concerning Retained Personal Data)

An individual or their agent may request that we notify them of the purpose of use of retained personal data, disclose it (including the disclosure of records of provision to third parties), correct, add to or delete its content, suspend its use or erase it, or suspend its provision to third parties. Please submit such requests to the contact point set out in Article 21. We will respond without delay in accordance with law after verifying identity by the method we prescribe. For disclosure and notification of the purpose of use, we may charge a fee of 1,000 yen per request. Where we cannot comply with a request under the provisions of law, we will notify the individual to that effect together with the reason.

Article 14 (Pseudonymously Processed Information, Anonymously Processed Information and Statistical Information)

We may process data such as visitor numbers, attributes and behaviour so that no specific individual can be identified, and use it for effectiveness measurement, business improvement, reporting to hosts and cooperating institutions, and publication. Where we create or provide pseudonymously or anonymously processed information, we do so in accordance with the provisions of law.

Article 15 (Filming and Footage at Events and Facilities)

At events and facilities we host, co-host or operate, we, our co-hosts, our contractors or media covering the event may take photographs and video for the purposes of record-keeping, public relations, promotion and safety management, and may publish them on websites, social media, printed materials, broadcasts and news coverage. We give notice that the likeness of visitors may be included by means of signage at the venue, the ticket terms or the official website. If you do not wish a published photograph or video in which you appear to remain public, please contact the point set out in Article 21; we will respond within a reasonable scope. Security cameras may also be installed at venues for safety management; the footage is used only for safety management and for responses required by law, and is deleted after a set period.

Article 16 (Personal Information of Minors)

If you are a minor, please provide personal information with the consent of a parent or guardian. If it becomes apparent that we have obtained personal information from a minor, we will confirm the consent of a parent or guardian as necessary.

Article 17 (Personal Information of Job Applicants)

Personal information provided in connection with an application is used only for recruitment screening, communication with the applicant, and personnel and labour management after hiring, and is not provided to anyone other than the officers and employees involved in the screening and any recruitment support providers we engage. Documents and data submitted are not returned; we manage them appropriately and destroy or delete them after a reasonable period following the conclusion of the screening. If you do not provide the personal information we specify, we may be unable to carry out the screening.

Article 18 (Additional Provisions for Residents of the EU, the United Kingdom and Other Countries and Regions)

Personal data of residents of the EU, the EEA and the United Kingdom is handled under the GDPR and the UK GDPR on the legal bases of performance of a contract, consent, legitimate interests and compliance with legal obligations. Such residents have the rights of access to their personal data, rectification, erasure, restriction of processing, data portability, objection to processing, withdrawal of consent, and lodging a complaint with a supervisory authority. For residents of other countries and regions, we also accept the exercise of rights recognised under the laws of the relevant country or region at the contact point set out in Article 21.

Article 19 (Structure for Personal Information Protection and Continuous Improvement)

Our Representative Director serves as the personal information protection manager. We provide training to our personnel, inspect the status of handling and maintain procedures for responding to incidents, and we continuously review and improve this Policy and our internal structure in light of changes in law, society and technology.

Article 20 (Amendment of This Policy)

We may amend this Policy in response to amendments to laws, changes in our business and similar circumstances. The amended Policy takes effect from the time it is posted on this website. Where we make a material change, we will give notice on this website.

Article 21 (Contact Point and Business Operator Handling Personal Information)

For the handling of personal information, requests for disclosure and other rights, and complaints or consultations, please contact the point below.

HITOHATA, INC. (business operator handling personal information)

Takeaki Higashiyama, Representative Director (personal information protection manager)

Nagono Campus 3F 3-2, 2-14-1 Nagono, Nishi-ku, Nagoya, Aichi 451-0042, Japan

Email: info@hitohata.jp

Inquiry form: https://www.hitohata.jp/contact (please select "Other Inquiries" as the inquiry category)

We are not a business operator subject to an accredited personal information protection organisation.

Established July 1, 2019

Revised April 1, 2025

Revised July 1, 2026