Privacy Policy

SUI Inc. (the "Company") recognizes that appropriately protecting the personal information and personally related information of Users is an important responsibility in providing the online karate dojo service "KARATE ONLINE SUI" (the "Service"). Accordingly, the Company establishes this Privacy Policy (the "Policy") as follows.

This Policy has been prepared with consideration for Japan's Act on the Protection of Personal Information (APPI), the European Union's General Data Protection Regulation (GDPR), other applicable data protection laws and regulations, and internationally recognized privacy standards.

Article 1 (Personal Information We Collect)

The Company collects the following information in connection with providing the Service.

1.1 Basic Information

• Full name and nickname
• Gender, region of residence, country of residence, and nationality
• Address, telephone number, and email address
• Primary and secondary languages (optional)
• Date of birth and age
• Details of inquiries

Users under the age of 18 must obtain the consent of a parent or legal guardian.

1.2 Dojo and Karate-Related Information (Optional)

• Dojo name and style
• Kyu or Dan rank and years of experience
• Kata the User is most proficient in

1.3 Information Collected Automatically

• Access logs
• IP address
• Identifiers collected through cookies and similar technologies
• Device, operating system, and browser information
• Usage and activity history

1.4 Information Collected Through the Use of Service Features

Live Online Training

• Booking information and participation history
• Recordings made for internal quality-control purposes

Daily Video Training

• Self-recorded training videos in which the User's face may be visible
• Training history and progress information

Online Demonstration Events

• Submitted videos
• Evaluation information, including "likes"
• Assessments by instructors and the Company
• Award results

1.5 Payment Information

Payments are processed by external payment service providers. The Company does not retain sensitive payment information such as credit card numbers. The Company receives only the minimum information necessary to verify transactions.

1.6 Social Media Integration Information (Optional)

If social media integration is introduced as a future feature and a User chooses to use it, the Company may obtain Account information, posts, user IDs, and similar information within the scope of the User's public settings and permissions.

Article 2 (Purposes of Using Personal Information)

The Company uses collected information for the following purposes:

1. To provide and operate the Service
2. To register Accounts and verify and authenticate Users
3. To operate Daily Video Training and Online Demonstration Events
4. To conduct and manage Kyu and Dan grading examinations and issue official certificates
5. To book, conduct, and manage Live Online Training
6. To provide User support and respond to inquiries
7. To improve the Service and its quality and to develop new features
8. To prevent unauthorized use and unauthorized access
9. To provide important notices and other communications
10. For marketing, informational, and promotional purposes where consent has been obtained
11. To publish Content on social media where the User's prior, separate, and express consent has been obtained
12. To comply with laws and fulfil legal obligations
13. For other necessary purposes

Article 3 (Personal Information of Users Under 18)

1. Users under the age of 18 may use the Service only with the consent of a parent or legal guardian.
2. The Company takes particular care in managing the personal information of Users under the age of 18.
3. The parent or legal guardian shall be responsible for the minor User's use of the Service and the handling of the minor User's personal information in connection with such use.

Article 4 (Disclosure of Personal Information to Third Parties)

The Company does not disclose a User's personal information to third parties except in the following circumstances:

1. Where the User has consented
2. Where disclosure is required by law
3. Where disclosure is necessary to protect a person's life, physical safety, or property and obtaining consent is difficult
4. Where disclosure is particularly necessary to improve public health or promote the sound development of children
5. Where cooperation with a national or local government authority is required in the performance of its legally prescribed duties
6. Where information is disclosed to a service provider to the extent necessary to operate the Service

The Company enters into agreements concerning the protection of personal information with its service providers, requires them to implement appropriate security controls, and supervises them appropriately.

Article 5 (Outsourcing the Processing of Personal Information)

1. The Company may outsource system operation, payment processing, cloud storage, customer support, and other operations to external service providers.
2. Service providers may process personal information only within the scope of the Company's instructions and may not use it for any other purpose.
3. The Company enters into agreements concerning the protection of personal information with its service providers and supervises them appropriately.

Article 6 (Security Measures for Personal Information)

The Company implements the following measures to prevent the leakage, loss, alteration, unauthorized access, or other improper handling of personal information.

Technical Security Measures

• Access controls
• Encryption of communications using TLS/SSL
• Log monitoring
• Detection of unauthorized access
• Regular vulnerability assessments and remediation

Organizational Security Measures

• Appointment of a person responsible for personal information management
• Establishment of internal rules and procedures
• Management of access privileges
• Employee education and training
• Establishment of incident-response procedures

Physical Security Measures

• Access control for offices and other restricted areas
• Device management
• Appropriate destruction of documents and storage media

Article 7 (Cookies and Similar Technologies)

1. The Company uses cookies and similar technologies to maintain login sessions, improve the Service, analyze usage, and for other related purposes.
2. Information collected through cookies may include browsing history, activity history, IP addresses, and identifiers.
3. Users may control cookies through their browser settings. However, restricting cookies may make some features of the Service unavailable.
4. Where necessary, the Company may provide cookie-related information to third parties, such as analytics service providers. In such cases, the Company implements appropriate contractual and supervisory controls.

Article 8 (Handling of Information Relating to Live Online Training, Daily Video Training, and Online Demonstration Events)

Live Online Training

The Company retains booking information, participation history, and recordings made for internal use.

Recordings are used only for internal quality-improvement purposes and are not disclosed externally.

Daily Video Training

The Company records and stores self-recorded videos filmed and submitted by Users.

Such videos are not published externally unless the User has granted permission.

Online Demonstration Events

The Company processes submitted videos, "likes" from other Users, assessments by instructors and the Company, and award results.

Submitted videos are made available within the Service during the event period.

The Company obtains the User's express consent before using a submitted video in advertising, on social media, or for any other external purpose.

Article 9 (Users' Rights)

Users may submit the following requests to the Company:

1. Disclosure of personal information
2. Correction or addition of personal information
3. Deletion of personal information
4. Suspension of use
5. Suspension of provision to third parties

These rights may be restricted where there are legitimate grounds, such as the protection of life or property, or where restrictions are permitted or required by law.

Requests concerning a User under the age of 18 require the consent of the User's parent or legal guardian.

Article 10 (Rights of Users Subject to the GDPR)

Users located in the European Union or European Economic Area have the following rights under the GDPR, subject to the conditions and limitations prescribed by applicable law:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object
• Right not to be subject to certain automated decision-making
• Right to lodge a complaint with a supervisory authority
• Right to withdraw consent

Article 11 (International Data Transfers)

1. The Company may transfer and store the personal information of Users located outside Japan in Japan or in a country where one of the Company's service providers is located.
2. The Company implements appropriate contractual arrangements and safeguards for such transfers.

Article 12 (Data Retention Period)

1. Personal information is retained for as long as necessary to fulfil the purposes for which it was collected.
2. The Company may retain personal information for a certain period after membership cancellation to comply with legal obligations and prevent fraud.
3. After the applicable retention period expires, personal information is deleted or anonymized.

Article 13 (Changes to This Privacy Policy)

1. The Company may revise this Policy as necessary.
2. If a revision materially affects Users' rights, the Company will provide prior notice or obtain Users' consent.
3. Minor revisions shall take effect upon being announced on the Company's website or within the Service.

Article 14 (Contact Information)

SUI Inc.

Email: online-karate@sui-okinawa.jp