Privacy Policy

01Information We Collect

We may collect the following categories of information.

Client and enquiry information

• Name, company name, department and job title
• Email address, telephone number and postal address
• The content of enquiries and information provided in the course of discussions and engagements

Business data entrusted to us

• Business metrics of our clients, such as sales, costs, inventory and advertising performance
• Data held in the systems and services our clients use in their operations
• Documents and records provided or connected by our clients to the extent necessary to perform the engagement

Data obtained through advertising platform APIs

In order to provide advertising operation support and reporting to our clients, and based on the client’s explicit authorisation (for example through OAuth), we may obtain the following data through the APIs made available by advertising platforms.

• Configuration information for advertiser accounts, campaigns, ad groups, ads and creatives
• Aggregated performance data such as impressions, clicks, spend and conversions
• The access tokens and refresh tokens required to obtain the above

What we obtain is limited to aggregated performance data and configuration information. We do not obtain, through these APIs, any information that identifies an individual viewer of an advertisement or any other end user.

Website usage information

• IP address, browser type, referring source, pages viewed and date and time of access
• Identifiers generated by cookies and similar technologies

02Purposes of Use

We use the information we collect only for the following purposes.

• Responding to enquiries and communicating with the person concerned
• Providing consulting, operational support, system development and other services
• Producing analyses, reports and improvement proposals relating to an engagement
• Concluding and performing contracts, invoicing and other administrative processing
• Improving the quality of our services and developing new services
• Responding to obligations under applicable laws and regulations

We do not use the information beyond the purposes set out above. We do not use data entrusted to us for advertising targeting or profiling on behalf of ourselves or any third party, nor do we compile it into mailing lists or sell it.

03Disclosure to Third Parties

We do not disclose the information we collect to third parties except in the following cases.

1. Where the individual or the client has given consent
2. Where disclosure is required by applicable laws or regulations
3. Where disclosure is necessary to protect the life, body or property of a person and it is difficult to obtain the consent of the individual
4. Where cooperation with a national or local government body performing its statutory duties is required

We never disclose or share the data of one client with another client. Data belonging to different clients is not commingled in storage or processing; it is kept and handled separately for each client.

04Subcontractors and External Services

We may entrust the handling of information to external contractors, or use external services, to the extent necessary to achieve the purposes of use. In such cases we verify the suitability of the contractor or service and exercise necessary and appropriate supervision.

The principal external services we use in our operations are as follows.

Some of these services operate on servers located outside Japan. Where a transfer constitutes provision to a third party in a foreign country, we provide the required information and obtain consent in accordance with applicable law.

05Security Measures

We take the following measures to prevent leakage, loss or damage of information and to otherwise manage it securely.

• Appointing a person responsible for data handling and limiting access to those who require it for their work
• Keeping access tokens, API keys and credentials separate from source code, and managing them in encrypted environment variables or a credential store
• Applying multi-factor authentication to devices and cloud services
• Promptly deleting data and credentials that are no longer required
• Entering into confidentiality and security agreements with subcontractors

06Retention and Deletion

We retain information only for the period necessary to achieve the purposes of use. Upon termination of a contract, data entrusted to us and API access tokens are deleted within three months of termination, except where retention is required by law.

Clients may revoke the connection to our application at any time from the administration console of the advertising platform concerned. From the moment of revocation we cease obtaining any new data through that API. Where a client requests deletion of data, we delete it promptly and confirm that we have done so.

07Cookies and Analytics

Our website uses Google Analytics 4 to understand how the site is used and to improve it. That service collects data using cookies, but the data does not include information that identifies an individual. You may refuse the use of cookies through your browser settings. For how the collected information is handled, please refer to Google’s privacy policy.

https://policies.google.com/privacy

08Requests for Disclosure, Correction or Suspension of Use

Where an individual requests notification of the purpose of use, disclosure, correction, addition or deletion of the content, suspension or erasure of use, or suspension of provision to third parties, of their retained personal data, we respond without delay in accordance with applicable law after verifying the identity of the requester. Please direct such requests to the contact point below.

09Changes to This Policy

We may revise this Privacy Policy in response to changes in law or in our business. Where we do so, we will publish the revised policy and the date of revision on this page.

10Contact