特定非営利活動法人難民支援協会 (Japan Association for Refugees, hereinafter referred to as “we”, “us” or “our”) recognizes the importance of personal information learned through our activities, and has established the following “Privacy Policy” in order to safely and appropriately manage and use such information.
Please note: If you are residing in the European Economic Area, the additional information in the Part 2 – GDPR applies to you.
1. Acquisition of personal information
When we obtain personal information, we will clearly indicate the purpose of use, comply with laws and regulations, and use lawful and appropriate means.
2. Purpose of Use of Personal Information
We use the acquired personal information for the following purposes.
- To communicate and provide information on various matters with related parties necessary for the operation of our activities (support activities, research, policy recommendations, public relations) and organizational operations
- To respond to inquiries made to us
- To deliver information that we publish to the general public and registered members via direct mail, e-mail, etc.
- To confirm, contact, and solicit donations, volunteer support, etc. to us
- To conduct research, analysis and improvement regarding our association’s business, information dissemination, support guidance, etc.
- To simplify the process of entering information on our website
- To request cooperation in surveys or participation in events, etc.
- To deliver and display online advertisements tailored to those who visit our website
- To resolve any problems that may arise in relation to our activities or operations
In addition, when acquiring or collecting personal information for purposes other than those listed above, we will clearly state such purposes at the time of acquiring or collecting the information.
3. Provision of personal information to third parties
We may provide personal data (as defined under the Act on the Protection of Personal Information) to a third party if any of the following applies:
- When prior consent has been obtained from the individual subject to such personal information
- When entrusting the handling of personal information to our contractor (including a subcontractor) within the scope consistent with the purpose of use of the personal information.
- When it is necessary for the protection of a person’s life, body, or property and it is difficult to obtain the individual’s consent
- In the event of business succession through merger, corporate split, business transfer, or other reasons
- When required by law
When outsourcing personal information handling operations, we may provide personal data to a third party in a foreign country, store the personal data in their system, or ask them to engage in other activities. In this case, we will confirm that the third party will comply with the personal information protection regulations of the relevant country and ensure sufficient protection of personal information.
The foreign countries in which we may provide personal data to the third party are the United States and Canada. For information on the personal information protection legislation of each country, please refer to the Personal Information Protection Commission’s website at https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku .
4. Security measures for safe management
In order to prevent the loss, alteration, leakage, and unauthorized access of personal information, we will take necessary and appropriate security measures, such as appointing a person responsible for handling personal information, providing training to employees, restricting access to data, encrypting data, and managing and supervising external contractors.
5. Regarding joint use
We may engage in the following joint use of personal information within the scope of the intended purposes.
(1) Items of personal data to be jointly used
- Personal information of donors in relation to donations (including in-kind donations)
- Personal information of participants at our events
- Personal information of product purchasers in affiliate services
(2) Scope of joint users
- Japan Association for Refugees , donation site and service management organizations, payment-related companies, second-hand purchase companies, event reception service management companies, event co-sponsoring organizations, etc.
(3) Purpose of joint use
- To accept donations and goods, hold events, sell products, etc.
(4) Name, address and representative name of the person responsible for managing the personal data
- Japan Association for Refugees (Click here for address and representative)
6. Procedures for disclosure, correction and suspension of use
If you request the disclosure, correction, or suspension of use of your personal information, we will respond after verifying your identity.
For inquiries, please contact the “Personal Information Inquiry Desk” listed below.
7. Revision of Privacy Policy
We may revise this policy in order to protect personal information and to respond to changes in laws, regulations, etc. If we revise this policy, we will announce it by updating the content posted on our website, or other means.
8. Personal Information Inquiry Desk
For inquiries regarding the handling of personal information, contact us from the link below.
(Part 2) Additional information for users in the European Economic Area
1. Who is the controller of your personal information?
We, 特定非営利活動法人難民支援協会(Japan Association for Refugees), will be the controller of the personal information that we collect about you. This means that we determine and are responsible for how that personal information is used.
Japan Association for Refugees has its address at 〒101-0065 TAS Building 4F 2-5-2 Nishikanda Chiyoda-ku Tokyo.
If you would like to contact us, you can email us at info@refugee.or.jp.
2. How use your personal information
You are not legally or contractually required to provide us with your information. However, without such information, we may not be able to enter contracts, provide our services or otherwise engage with you.
We do not engage in automated decision making regarding your person, where a decision is made by automated means that has legal or similar effect.
Information we collect from others
We collect certain information about you from others when you use our services, if you communicate with us through social media or use your social media account to log in to our services. We collect the following information in this way:
| Personal information we collect | How we use it | Lawful basis we rely on |
| Contact information we obtain from our partners, such as your name, e-mail address, mailing address, phone, nationality, and personal start number. | We will use that information to select the charity runners, to facilitate the donation process, and to provide the relevant services and information required to participate. | The processing is necessary for the performance of a contract between you and us, namely to enable your participation. |
| Your date of birth | We use this information to verify that you are old enough to use our services. | The processing is necessary for the performance of a contract between you and us, namely to enable your participation.. |
| Your t-shirt size | We use this information to order and provide a t-shirt to you. | The processing is necessary for the performance of a contract between you and us, namely to provide you with a event t-shirt. |
| Your (employers) company name, if you are a corporate applicant. | We will use that information to select the charity runners, to facilitate the donation process, and to provide the relevant services and information required to participate. | The processing is necessary for the performance of a contract between you and us, namely to enable your participation. |
| Your sex and gender | This information will be used to include you in the correct group regarding the results and to address you the right way when communicating with you. | The processing is necessary for the performance of a contract between you and us, namely to enable your participation. |
| Your comments for application | We use this information to select the charity runners, and to respond to your support requests and feedback. | The processing is necessary for the performance of a contract between you and us, namely to enable your participation. |
| The url and password for “My charity” page | This information will be provided from the Tokyo Marathon Foundation. We use this information to check the status of your application process | The processing is necessary for the performance of a contract between you and us, namely to enable your participation. |
| Pictures (taken at the event site) | We use this information to promote our services and the participation in events. This may include publishing the pictures. | Our legitimate interest, namely in promoting our cause and our services. |
| We share these pictures with you. | The processing is necessary for the performance of a contract between you and us, namely to provide you with pictures of your participation. | |
| Payment information(payment type: e.g. credit card, amount of donation) | Process donations | The processing is necessary for the performance of a contract between you and us, namely to process donations. |
If you interact with our services through social media networks, such as if you “like” us, or follow us or share our content on Facebook, Instagram, X, or other social networks, we may receive some information about you that you permit the social network to share with third parties. The data we receive is dependent upon your privacy settings with the social network, and may include your gender, age range, country, and any other information you permit the social network to share with third parties. You should always review and, if necessary, adjust your privacy settings on third-party websites and social media networks and services before sharing information and/or linking or connecting them to other services.
We use this information to measure the performance of our social media strategy, as well as to communicate directly with you. The processing is necessary for our legitimate interests, namely informing and implementing our social media strategy.
Information we collect automatically from your device
We also collect the following personal information about you and about how you access our electronic services, such as our website:
| Personal information we collect | How we use it | Lawful basis we rely on |
| Usage Information. We collect information about your activity on our website, for instance how you use them (e.g., date and time of your visit, used features, searches, clicks and pages you have visited, referring webpage address). | We use this information to provide you with access to the electronic services. | The processing is necessary for our legitimate interests, namely the provision of our website. |
| We use this information to identify fraudulent or malicious use of our services. | The processing is necessary for our legitimate interests, namely detecting and preventing fraud. | |
| We use this information to analyse the performance of our website to identify errors and ways in which we can improve our website.Please note: For this purpose, we will share your information with Google (Analytics) and Microsoft (Clarity). Google and Microsoft may use your data as a separate controller. | We will only process your personal information in this way to the extent you give us your consent to do so. | |
| We use this information to measure the effectiveness of our marketing campaigns and identify ways in which we can improve our marketing strategy.Please note: For this purpose, we will share your information with Google (Analytics) and Microsoft (Clarity). Google and Microsoft may use your data as a separate controller. | We will only process your personal information in this way to the extent you give us your consent to do so. | |
| Device information. We collect information from and about the device(s) you use to access our services, including hardware and software information such as IP address, device ID and type, device-specific settings and characteristics, browser type, version and language, operating system, time zones, identifiers associated with cookies or other technologies that may uniquely identify your device or browser (e.g., Google ID), device battery level and available memory, mobile carrier. | We use this information to provide you with access to the website. | The processing is necessary for our legitimate interests, namely the provision of our website. |
| We use this information to identify fraudulent or malicious use of our services. | The processing is necessary for our legitimate interests, namely detecting and preventing fraud. | |
| We use this information to analyse the performance of our website to identify errors and ways in which we can improve our website or newsletter. | We will only process your personal information in this way to the extent you give us your consent to do so. |
3. Cookies and similar technologies
We use cookies and similar technologies, such as mobile SDKs, to provide certain functionalities on our website as well as to monitor and improve our electronic services in general.
For more information about the cookies and similar technologies we use, as well as how to control your preferences in relation to those cookies and similar technologies, please see our Cookie Notice.
4. How long we keep your personal information
Unless a longer period is required under applicable law, we will keep your personal information for the following periods:
| Personal information | How long we keep it for | When we might keep it for longer |
| Usage and device information | We will keep this information for 14 months after collection. | · In case of a cyberattack or similar event; or if we need the data in relation to establishing legal claims or defending our and others’ rights. |
| Information in relation to events you signed up for. | We will keep this information for up to 16 months after the relevant event has ended | · In case you also participate in the next years event, we will keep your data for an additional period; or · if we need the data in relation to establishing legal claims or defending our and others’ rights. |
| Pictures | We will keep this information for up to 16 months after the relevant event has ended | · In case you also participate in the next years event, we will keep your data for an additional period; or · if we need the data in relation to establishing legal claims or defending our and others’ rights. |
| Contact information | We will keep this information for up to 16 months after the relevant event has ended | · In case you also participate in the next years event, we will keep your data for an additional period; or if we need the data in relation to establishing legal claims or defending our and others’ rights. |
| Comments and feedback | We will keep this information for up to three years after the relevant event has ended | If we need the data in relation to establishing legal claims or defending our and others’ rights. |
Please note that we might keep you information for a longer period should we be required to do so by law or binding authority request.
5. Recipients of personal information
As required in accordance with how we use your personal information, we may share your personal information as follows:
| Recipient | Why we share it | Lawful basis we rely on |
| With our service providers and partners. | We may share your personal information with companies that provide technical services to us, such as data hosting, maintenance, analytics, customer care and security. | These recipients will use your personal information as processors on our instructions. They may also aggregate and anonymise personal information they receive for their own product development and improvement. |
| Social media. | When we interact with you through a social media app, that social media app will receive and process the personal information contained in such communications.Social media apps will use the personal information they collect in accordance with their privacy notices. | The lawful basis we rely on for transferring this personal information is that the processing is necessary for our legitimate interests, namely communicating with you and other users through social media, and promoting our work. |
| Business partners, such as the Tokyo Marathon Foundation. | Your personal information may be disclosed to third parties in connection with events provided and services performed by us.These recipients will use your data as controllers, determining the means and purposes of the processing. We there | The lawful basis we rely on for transferring this personal information is that the processing is either necessary to perform a contract you have entered into with us, or it is necessary for our and the third party’s legitimate interests, namely offering events and services. |
| Law enforcement, regulators and other parties for legal reasons. | We may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements; and/or (iii) exercise or protect the rights, property, or personal safety of Japan Association for Refugees, its users or others.These recipients will use your personal information in the performance of their regulatory or law enforcement role, or to advise us in connection with a potential claim or regulatory enforcement action. | The lawful basis we rely on for sharing personal information with these recipients is that the processing is either necessary to comply with a legal obligation to which we are subject or is necessary for our legitimate interests, namely enforcing our rights or complying with requests from regulatory authorities. |
6. International transfers of your personal information
We use service providers in the USA to process personal information. We may also share personal information with companies that have the same ownership as us in China as described above.
These international transfers of your personal information will be made pursuant to appropriate safeguards in accordance with applicable law:
| Where we may transfer your personal information | Safeguards that apply to that transfer |
| United States | The transfers are made:to organisations that participate in the EU-U.S. Data Privacy Framework and (where applicable) the UK extension to the Data Privacy Framework, in which case they are deemed to provide an adequate level of protection for personal data by the European Commission and (where applicable) under the UK Data Protection Act 2018; orin accordance with agreements that incorporate standard contractual clauses issued by the European Commission and, where applicable, the approved addendum to those standard contractual clauses issued under the UK Data Protection Act 2018, as well as additional protective measures, where necessary. |
| Japan | The laws in this jurisdiction are deemed to provide an adequate level of protection for personal data by the European Commission and (where applicable) under the UK Data Protection Act 2018. |
| Canada | The laws in this jurisdiction are deemed to provide an adequate level of protection for personal data by the European Commission and (where applicable) under the UK Data Protection Act 2018. |
We will also continually monitor the circumstances surrounding such transfers in order to ensure that these maintain, in practice, a level of protection that is essentially equivalent to the one guaranteed by the UK GDPR and EU GDPR.
If you wish to enquire further about the safeguards we use, including obtaining a copy of any Standard Contractual Clauses we have in place with recipients outside the EEA or UK, please contact us using the details in section 1 (Who is the controller of your personal information?).
7. Your rights
In accordance with the GDPR you may have the following rights in respect of your personal information that we hold:
- Right of access. The right to obtain:
- confirmation of whether, and where, we are processing your personal information;
- information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods;
- information about the categories of recipients with whom we may share your personal information; and
- a copy of the personal information we hold about you.
- Right of portability. The right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
- Right to rectification. The right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
- Right to erasure. The right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.
- Right to restriction. The right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
- Right to withdraw consent. If you have given us your consent to process your personal information in a particular way, you have the right to withdraw that consent. Withdrawing consent will not affect the lawfulness of any processing of your personal information prior to that withdrawal. You can change your consent preferences at any time by going to the “Settings” section in the app.
You have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case.
If you are located in France, in addition to the rights set out above, you have the right to provide instructions regarding the retention, deletion and disclosure of your personal information after your death. In the absence of instructions from you, your successors may request the disclosure or deletion of your personal information by contacting us using the contact details set out in section 1 (Who is the controller of your personal information?).
If you wish to exercise one of these rights, please contact us using the details set out in section 1 (Who is the controller of your personal information?).
You also have the right to lodge a complaint with your supervisory authority. If you are in the EEA, to find out how to contact your local regulator, please visit https://edpb.europa.eu/about-edpb/about-edpb/members_en. If you reside in the UK, please visit https://ico.org.uk/make-a-complaint/ for more information about how to contact the Information Commissioner’s Office.