Kabushiki Kaisha QuickYadozeicho (株式会社クイック宿税帳) (the “Company”) establishes this Privacy Policy (the “Policy”) regarding personal information and other data collected by the Company in connection with “QuickGuestbook / クイック宿税帳” (the “Service”), related websites, applications, inquiry channels, sales activities, and other operations of the Company.

1. Scope

1. This Policy applies to personal information and other data that the Company collects, uses, or manages in its own capacity.
2. Where the Company processes personal data relating to guests, reservers, companions, or other individuals on behalf of hotels, ryokans, minpaku operators, special-zone minpaku operators, or other lawful lodging business operators (collectively, “Hotel Users”), such processing shall primarily be governed by the applicable contract, terms of service, and data processing agreement (“DPA”) between the Company and the relevant Hotel User.
3. Accordingly, with respect to personal data processed by the Company on behalf of a Hotel User, the relevant DPA and contractual terms shall prevail over this Policy to the extent permitted by applicable law.

2. Role of the Company

1. Through the Service, the Company provides Hotel Users with SaaS functions including lodging tax-related workflows, billing flows, payment UI, notification functions, dashboards, integrations, and related features.
2. Transaction proceeds, fees, and other consideration arising from lodging transactions processed through the Service are, in principle, received by the Hotel User or a Connected Account designated by the Hotel User.
3. Unless otherwise expressly agreed in writing, the Company is not the seller of lodging services, payment processor, fund custodian, collection entity, tax agent, or remitter of lodging tax or similar charges.
4. Where the Company processes personal data on behalf of Hotel Users, the Company acts as a processor or contractor, and the details of such processing are governed by the DPA.
5. By contrast, where the Company collects or uses information for its own contract administration, billing, support, sales, security, legal compliance, or other internal business operations, the Company acts in its own capacity and this Policy applies.

3. Information We Collect

The Company may collect the following categories of information:

1. Information relating to Hotel User personnel and related persons
   Names, departments, job titles, phone numbers, email addresses, postal addresses, billing information, account information, login-related information, and other information necessary for communications and contract administration

2. Contract, application, billing, and payment information
   Application history, contract details, subscribed plans, option usage, invoice history, payment status, transaction information, billing details, and related information

3. Inquiry and support information
   Inquiry details, email, chat, telephone, and other communication records, support history, attached materials, interview notes, configuration information, and other information necessary to provide support

4. Service and website usage information
   IP addresses, cookies, advertising identifiers, device information, operating system information, browser information, access logs, operation logs, browsing history, usage records, error logs, communication identifiers, and other technical information

5. Sales and marketing information
   Document request history, seminar and event participation records, survey responses, interview contents, meeting records, business card information, advertising response data, communications regarding case studies, and other sales or promotional information

6. Identity verification, screening, and compliance information
   Identification materials of representatives or contact persons, licensing information, filing information, corporate information, anti-social-force screening information, and other information necessary for compliance review

7. Information obtained from third parties
   Information lawfully obtained from business partners, third-party payment service providers, authentication providers, analytics providers, advertising providers, cloud vendors, and publicly available sources

8. Information entrusted by Hotel Users
   Information relating to guests, reservers, companions, facility users, inquiry contacts, and other individuals processed through the Service based on instructions from Hotel Users
   To the extent such information is processed by the Company on behalf of Hotel Users, the DPA shall primarily govern such processing.

4. Purposes of Use

The Company may use collected information for the following purposes:

1. to accept applications, conduct screening, verify identity, open accounts, conclude contracts, and administer contracts
2. to provide, operate, maintain, troubleshoot, improve, and update the Service
3. to provide lodging tax-related workflows, billing flows, payment UI, notification functions, integrations, and other Service features
4. to provide inquiries handling, support, onboarding, setup support, data migration, and other customer assistance
5. to conduct billing, payment administration, accounting, receivables management, and related operations
6. to integrate, configure, operate, and maintain third-party payment services, authentication services, cloud services, and other external services
7. to prevent unauthorized use, maintain security, conduct audits, analyze logs, investigate incidents, prevent recurrence, and protect rights and interests
8. to comply with law, respond to authorities, handle disputes and complaints, and satisfy legal obligations
9. to improve the Service and related services, perform research and development, statistical analysis, benchmarking, quality improvement, and product planning
10. to provide information about the Company’s or its partners’ products and services, seminars, events, campaigns, updates, surveys, case studies, sales activities, and other marketing activities
11. to conduct recruitment, partnership management, vendor management, and other business operations of the Company
12. for purposes incidental or related to the foregoing

5. Data Entrusted by Hotel Users

1. The Company processes personal data entrusted by Hotel Users in accordance with the instructions of the relevant Hotel User, the Service configuration, API connections, and other contractually contemplated methods.
2. Except as permitted by law or contract, the Company does not use personal data entrusted by Hotel Users for the Company’s own independent purposes.
3. The Company implements reasonable and appropriate security measures for such entrusted personal data in accordance with applicable law and the DPA.
4. Legal responsibility relating to lodging tax, guest registry obligations, identity verification, consumer handling, refunds, chargebacks, and other matters relating to the Hotel User’s business operations remains, in principle, with the Hotel User.

6. Disclosure to Third Parties

1. The Company does not disclose personal information collected in its own capacity to third parties except in the following cases:
   (1) with the individual’s consent;
   (2) where required by law;
   (3) where necessary to protect life, body, or property;
   (4) where especially necessary for public health or the sound development of children;
   (5) where cooperation with governmental or public authorities is required; or
   (6) where otherwise permitted under applicable law, including business succession.
2. Notwithstanding the foregoing, the Company may outsource the handling of personal information to external service providers to the extent necessary to achieve the purposes of use.
3. Where the Company processes personal data on behalf of Hotel Users, the treatment of third-party disclosure and subprocessing shall be governed by the DPA and the relevant contract.

7. Outsourcing and External Services

1. For operation of the Service and the Company’s business, the Company may engage external service providers for cloud infrastructure, hosting, email delivery, authentication, monitoring, analytics, sales support, customer support, payment integration support, and other services.
2. The Company shall exercise necessary and appropriate supervision over such service providers in accordance with applicable law.
3. The Service may integrate with third-party payment services. Such services may include, for example, Stripe and other payment-related services, but are not limited thereto.
4. As a general rule, the Company is not the primary holder of complete payment instrument data directly collected and stored by a third-party payment service.
5. The handling of information by third-party payment services and other external services is also subject to the applicable terms, privacy policies, and other conditions of such third parties.

8. Cookies and Similar Technologies

1. The Company may use cookies, SDKs, tags, advertising identifiers, analytics tools, and similar technologies in connection with the Service and related websites.
2. These technologies may be used for convenience, session management, usage analysis, feature improvement, advertising delivery, marketing analytics, security maintenance, fraud prevention, and related purposes.
3. Users may restrict or disable cookies and similar technologies through browser settings or other means; however, doing so may affect availability of certain features of the Service or related websites.

9. Use of Aggregated, Statistical, and Anonymized Information

1. To the extent permitted by law and contract, the Company may convert collected information or information entrusted by Hotel Users into aggregated, statistical, anonymized, or de-identified form that does not directly identify any individual or any specific Hotel User.
2. The Company may use such information for service improvement, incident analysis, quality assessment, research and development, market analysis, benchmarking, sales materials, marketing materials, and other legitimate business purposes.
3. Where the Company handles anonymized processed information or similar information under applicable law, the Company shall comply with applicable legal requirements, including publication obligations, security handling requirements, and prohibitions on re-identification.

10. Joint Use

If the Company engages in joint use of personal information, the Company shall separately publish or notify the required matters under applicable law, including the items of personal information subject to joint use, the scope of joint users, the purposes of use, and the responsible party for management.

11. International Processing

1. The Company may process personal information outside Japan, or permit access to such information from outside Japan, due to the use of cloud services, external contractors, support structures, or similar circumstances.
2. In such cases, the Company shall provide necessary information and implement reasonable protective measures in accordance with applicable law.
3. With respect to personal data entrusted by Hotel Users, the relevant DPA and contractual provisions regarding international processing shall also apply.

12. Security Measures

The Company implements organizational, personnel, physical, and technical security measures to address risks such as leakage, loss, destruction, unauthorized access, and unauthorized use of personal information. Such measures include permission management, access controls, personnel training, confidentiality obligations, log management, vendor supervision, vulnerability response, incident response structures, and other reasonable measures.

13. Retention Period

The Company retains personal information for the period necessary to achieve the purposes of use, for the period necessary under contract, or for the period required by law, and thereafter deletes, disposes of, or anonymizes such information by appropriate means.
The Company may retain information for a reasonable additional period for backup purposes, legal compliance, dispute handling, fraud prevention, audit response, or other legitimate purposes.

14. Rights of Individuals

1. With respect to personal information held by the Company in its own capacity, individuals may request disclosure, correction, addition, deletion, suspension of use, suspension of third-party provision, and other rights in accordance with applicable law.
2. With respect to personal data processed by the Company on behalf of a Hotel User, the relevant Hotel User will generally serve as the primary point of contact for data subject requests.
3. To the extent permitted by law, the Company may provide reasonable cooperation to Hotel Users in responding to such requests.

15. Information Relating to Minors

Where the Company collects personal information relating to minors, the Company shall, in accordance with applicable law, obtain parental or legal guardian consent or take other necessary measures where required.

16. Changes to this Policy

1. The Company may amend this Policy as necessary due to changes in law, changes in business operations, changes in Service content, operational needs, or other reasons.
2. In the event of a material amendment, the Company shall provide notice by posting within the Service, publishing on the website, sending email, or by other appropriate means.
3. Unless otherwise specified by the Company, the amended Policy shall become effective upon publication or notice.

17. Contact Information

Contact details for inquiries, complaints, consultation, and requests relating to this Policy or the handling of personal information are as follows:

• Company Name: Kabushiki Kaisha Quick Yadozeicho (株式会社クイック宿税帳)
• Service Name: QuickGuestbook / クイック宿税帳
• Address: [30-1 Aza Tenjinndo Hanabuchihama Shichigahamamachi Miyagigunn Miyagi Japan]
• Privacy Contact: [Department of Legal]
• Email Address: [inquiry@quickguestbook.jp]

18. Language

1. This Policy may be prepared in Japanese and English.
2. The Japanese version and the English version shall have equal legal effect.
3. In the event of any wording difference, inconsistency, or interpretive ambiguity between the two versions, the relevant provisions shall be interpreted in good faith in light of the nature of the Service, the purpose of this Policy, the structure of the DPA and related agreements, and the reasonable common intent of the parties and relevant persons.
4. Neither language version shall automatically prevail over the other solely by reason of language.