GDPR Privacy Policy

J.S.B. Co., Ltd. GDPR Privacy Policy

1. Scope of application

This privacy policy prescribes matters related to the processing of personal data by J.S.B. Co., Ltd. (“J.S.B.”, “us” or “we”) of individuals to whom the below mentioned regulations apply (referred to as a “Data Subject” or “you” throughout this privacy policy): the regulations of the EEA and the UK relating to data protection, in particular the General Data Protection Regulation 2016/679 (the “GDPR”) and the GDPR as it is incorporated into UK law by the European Union (Withdrawal) Act 2018 and as amended by the Data Protection, Privacy and Electronic Communications (EU Exit) Regulations 2019 (the “UK GDPR”). Matters not prescribed in this privacy policy are governed by our “Personal Information Protection Policy” and “Purpose of Use (Handling) of Personal Information” (collectively, the “J.S.B. Personal Information Protection Policy”). If there is any discrepancy between this privacy policy and the J.S.B. Personal Information Protection Policy, this privacy policy will prevail.

2. Categories of personal data we collect and process

We collect the following personal data from Data Subjects.
“Personal data” in this privacy policy has the meaning set out in the GDPR and the UK GDPR. Essentially, personal data is any information about an individual, from which that individual is either directly identified or can be identified. It does not include ‘anonymous data’ (i.e., information where the identity of an individual has been permanently removed).

For the Paris gallery business
For artists who will display their works in solo exhibitions	Identity data: first name, surname and national identification and/or passport number. Contact data: address (home/office), telephone number, fax number and e-mail address. Financial data: bank account information.
For gallery users	Identity data: first name, surname and face photographs (optional). Contact data: address (home/office), telephone number, fax number and e-mail address.
For the Japanese language school business
For enrolled students/prospective students	Identity data: first name, surname, student number, passport number, residence card (zairyu card) information, driver’s license information, car insurance information and face photographs. Contact data: address, location of legal domicile, telephone number, fax number and e-mail address. Biographical Data/Talent management information: date of birth, location of birth, gender, nationality, academic history, professional/employment history, professional qualifications, post-graduation intentions, application history information and personal statement. Employment Data: name of employer, address of employer, telephone number of employer, part-time employment information, income status, income and information regarding applications for permission to engage in activity other than that permitted under the status of residence previously granted. Financial data: bank account information and bank account balance. Health care and Medical Data: information about medical conditions, medical examination result information and information regarding accidents (including traffic accidents and water leak accidents, etc.) caused by the student while enrolled. Related persons data: family composition.
For agents	Identity data: first name and surname. Contact data: address, telephone number and e-mail address. Social media data: information about social media accounts. Role and Employment Data: name of companies to which agents are affiliated, the name of the representatives of those companies and their position in those companies.

There are cases where we process personal data necessary for our business other than the personal data listed above after separately providing the Data Subject with the relevant privacy policy. If you do not provide the above personal data, we may be unable to provide our services to you.

3. Legal bases for processing

We use your personal data only as permitted by law, for the purposes for which we collected it as listed below. In respect of each of the purposes for which we use your personal information, the GDPR and the UK GDPR require us to ensure that we have a “legal basis” for that use. Most commonly, we will rely on one of the following legal bases:

• Where we need to perform a contract we are about to enter into or have entered into with you (“Contractual Necessity”).
• Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests (“Legitimate Interests”). More detail about the specific legitimate interests pursued in respect of each purpose we use your personal data for is set out in the table below.
• Where we need to comply with a legal or regulatory obligation (“Compliance with Law”).
• Where we have your specific consent to carry out the processing for the purpose in question (“Consent”).

• When processing is required for performing an agreement to provide services to you:
  We process your personal data for the following purposes because it is necessary to do so in order to perform an agreement to provide services to you.

  For the Paris gallery business	For essential communications with artists who will display their works in solo exhibitions and gallery users relating to the opening and operation of solo exhibitions
  For the Japanese language school business	For enrollment selection of prospective students and necessary communications therewith For administration and communications necessary for school operations

• When your consent is obtained in advance:
  If we have obtained your consent in advance, we will also acquire and process your personal data for the following purposes.

  For the Paris gallery business	For direct marketing to artists who will display their works in solo exhibitions and gallery users
  For the Japanese language school business	For direct marketing to prospective students, enrolled students, and agents

  You have the right to withdraw your consent at any time by the method communicated to you by us at the time we seek your consent. However, your withdrawal of consent will not affect the legality of processing conducted based on your consent before its withdrawal.

• When processing is required for the pursuit of legitimate interests:
  We process your personal data for the following purposes because it is necessary to do so in order to pursue our legitimate interests. (Please send inquiries regarding the balancing test for our legitimate interests using the contact information listed at the end of this privacy policy.)

  For the Paris gallery business	To improve gallery business operations To comply with applicable Japanese laws and regulations and laws and regulations other than those of the EU and the UK
  For the Japanese language school business	To improve school operations To comply with applicable Japanese laws and regulations and laws and regulations other than those of the EU and the UK

• When processing is required for compliance with our legal obligations:
  There are times when we process your personal data for the following purposes if it is necessary to do so in order to comply with the EU and UK legal obligations we are subject to.

• Special Categories of Personal Data:
  In addition, we process your personal data under the following special categories on the basis of explicit consent referred to in Article 9(2)(a) of the GDPR.

  For the Paris gallery business	N/A
  For the Japanese language school business	For enrolled students and prospective students: information on their medical conditions and their medical examination result information

4. Sources of personal data

We acquire your personal data from the following sources:

For the Paris gallery business

For artists who will display their works in solo exhibitions: direct acquisition of personal data from the artists themselves and indirect acquisition of personal data from corporations which have a contractual relationship with the artists For gallery users: direct acquisition of personal data from the gallery users themselves

For the Japanese language school business

For prospective and enrolled students: direct acquisition of personal data from the prospective and enrolled students themselves and indirect acquisition of personal data from agents that have a contractual relationship with those prospective and enrolled students For agents: direct acquisition of personal data from the agents themselves and indirect acquisition of personal data from their affiliated agencies

5. Retention period for personal data

We retain personal information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for compliance and protection purposes.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal information we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible. If we anonymize your personal information (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.

6. Sharing and disclosure of personal data

We share and disclose your personal data to the following third parties in accordance with the GDPR and the UK GDPR for the purposes stated in this privacy policy.

For the Paris gallery business	Electronic mail service subcontractors
For the Japanese language school business	Mutual enterprises (All Japanese Educational Institution Mutual Aid Cooperative Association, agency: FANCL Insurance Service Corp.) Message service operators (Tencent: WeChat, Microsoft: Skype, Facebook, Inc.: Messenger, Google: Meet ) Electronic mail service subcontractors

As a result of the aforementioned sharing and disclosure, in some cases your personal data will be transferred to the following third countries outside the EEA and the UK:

• [Country names]
• Japan
• The United States
• China
• (if you are in the EEA) the United Kingdom
• (if you are in the United Kingdom) the EEA

In such circumstances, the processing of your personal data will involve a transfer of your personal data to countries based outside the EEA and the UK. Whenever we transfer your personal data outside the EEA or the UK, we try to ensure a similar degree of protection is afforded to it by making sure that at least one of the following mechanisms is implemented:

We may transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission and the UK Government from time to time. For further details, see European Commission: Adequacy of the protection of personal data in non-EU countries. For transfer to Japan, we will transfer your personal data based on adequacy decision (Article 45 of the GDPR and the UK GDPR).

We may transfer your personal data to countries that have not been deemed to provide an adequate level of protection for personal data by the UK Government and by the European Commission ? provided that, in these cases:

• We may use specific appropriate safeguards approved by the European Commission, the UK Government or UK ICO, which are designed to give personal data the same protection it has in the EEA and in the UK (for example, requiring the recipient of personal data to enter into the relevant form of the so-called ‘Standard Contractual Clauses’ issued or approved from time to time); or
• In very limited circumstances, we may rely on an exception, or ‘derogation’, which permits us to transfer your information to such country despite the absence of an ‘adequacy decision’ or ‘appropriate safeguards’ for example, reliance on your explicit consent to that transfer.

For more information about the mechanisms we implement, please contact us using the contact details shown in section 9 below.

7. Your rights

The GDPR and the UK GDPR give you certain rights regarding your personal data.
You may ask us to take the following actions regarding your personal data obtained and processed by us:

• Access to your personal data:
  You have the right to obtain from us confirmation as to whether personal data concerning you are being processed, and, if so, the right to access the personal data and certain related information.
• Rectification of your personal data:
  You have the right to have us correct inaccurate personal data concerning you without undue delay and the right to have us complete any incomplete personal data.
• Deletion of your personal data:
  You have the right to have us delete personal data concerning you without undue delay.
• Restriction on processing of your personal data:
  You have the right to have us restrict processing of personal data concerning you.
• Objection to processing of your personal data:
  You will have the right to object to our reliance on our legitimate interests as the legal basis of our processing of personal data concerning you that impacts your rights.
• Withdrawal of your consent:
  This right only exists where we are relying on consent to process your personal data. In particular, you have an absolute right to opt-out of direct marketing, or profiling we carry out for direct marketing at any time.
• Data portability:
  You have the right to receive personal data concerning you in a structured, commonly used, and machine-readable format and the right to transfer those data to another controller without hindrance from us.

These rights may be limited where they would infringe the rights of a third party (including our rights), for example if fulfilling your request would reveal personal data about another person, or if you ask us to delete information which we are required by law to keep or have compelling legitimate interests in keeping.
Relevant exemptions are included in the GDPR, the UK GDPR and in local data protection laws.
We will inform you of relevant exemptions we rely upon when responding to any request you make.

If you intend to exercise any of the aforementioned rights, please contact us using the contact details at the end of this privacy policy.
If you object to direct marketing, you can opt-out of communications conducted using electronic messages by following the instructions within that electronic message.
We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

If you would like to make a complaint regarding this privacy policy or our practices in relation to your Personal Data, please contact us using the contact details at the end of this privacy policy. We will reply to your complaint as soon as we can.

You can also lodge a complaint in relation to our processing of your personal data directly to the relevant Supervisory Authority here if you are in the EEA or to the Information Commissioner’s Office if you are in the UK.

8. Amendment to this privacy policy

We amend this privacy policy from time to time.
If necessary, we will contact you through this website and by e-mail when we make any substantive or material amendments.

9. Contact details

For questions or inquiries regarding this privacy policy, please contact the data controller set out below.

Established on January 14, 2022
Revised on April 1, 2022