Privacy Policy

Article 1 (Definition of Personal Data)

"Personal data" refers to personal information as defined by the Personal Information Protection Law, which includes information about living individuals that can identify a specific individual through name, date of birth, address, phone number, email, and other descriptions contained in such information, as well as appearance data, fingerprints, voiceprints, and other personal identification information.

Article 2 (Methods of Collecting Personal Data)

Our school may collect personal data through the following methods.

1. Information provided through the official LINE channel during the required consultation before Form A is sent, including LINE account information and consultation messages
2. Information provided through the non-public formal-application Google Form A sent after the LINE consultation and before acceptance, including the applicant/contracting party's name, postal address, telephone number, email address, the learner's name and age category, relationship to the learner, selected plan, application content, confirmation responses, the name entered in the signature field, response timestamp, and form, response, and application IDs
3. Information provided through the non-public confirmed-conditions Google Form B sent after acceptance, including confirmation and consent responses, requested corrections, the name entered in the signature field, response timestamp, and form, response, application, acceptance-notice, individual-conditions, and version IDs
4. Records created or obtained by us concerning review results, acceptance or rejection, delivery and correction of confirmed conditions, application withdrawal, Stripe payment instructions, and contract formation
5. Information provided by email or similar means for pre- or post-contract communications, rights requests, or other inquiries
6. Information automatically obtained during service use (IP address, browser information, access logs, etc.)
7. Information collected through cookies and similar technologies

Article 3 (Purposes of Collecting and Using Personal Data)

The purposes for which our school collects and uses personal data are as follows:

1. To conduct the required official LINE consultation and receive a formal paid-plan application
2. To verify the applicant, contracting party, learner, age category, and, for a learner under 18, the guardian's authority and relationship to the learner
3. To review eligibility and notify the applicant of acceptance, rejection, or another result
4. To prepare, deliver, and correct confirmed service, price, start, renewal, cancellation, refund, and other conditions and obtain express consent
5. To provide Stripe credit-card payment instructions and administer contract formation, service, renewal, billing, plan changes, cancellation, and refunds
6. To retain evidence of applications, names entered in signature fields, confirmations, consents, applicable versions, delivery, withdrawal, and contract formation
7. To provide and operate our services, send important notices, and respond to inquiries
8. To identify and reject use by customers who violate the terms of service or attempt to use the service for fraudulent or inappropriate purposes
9. To allow customers to view and modify their registration information, delete data, and view usage status
10. To prevent fraud, comply with law, protect rights, and handle inquiries, claims, and disputes
11. For service improvement, marketing analysis, advertising delivery, and ad performance measurement
12. For purposes incidental to those mentioned above

Article 4 (Use of Cookies and Analytics Tools)

1. Our school may use cookies and similar technologies to improve service quality, convenience, and access analysis.
2. The types of cookies we use are as follows:
   • Essential cookies: Necessary for basic service functions
   • Analytics cookies: To understand site usage (Google Analytics, etc.)
   • Advertising cookies: To display and measure advertisements (Google AdSense, etc.)
   • Functional cookies: To remember user preferences
3. Customers can disable cookies through their browser settings. However, if cookies are disabled, some service functions may not work properly.
4. Our school uses Google Analytics for access analysis with cookies and similar technologies. Our page-view events omit referrer URLs, and we do not load Google Analytics when the URL contains a query string or fragment, or on article search and listing pages. We take measures to avoid sending names, email addresses, or authentication information to analytics. Collected data is managed in accordance with Google's privacy policy.
5. This site also displays advertisements through Google AdSense. Google AdSense uses cookies to serve ads based on users' prior visits to this and other websites. For more information on how Google uses cookies, please refer to Google's Privacy Policy. Users can opt out of personalized advertising by visiting Google Ads Settings.
6. This site may also display affiliate advertisements, including A8.net advertisements. When users click advertisement links or when advertising images and tracking images are loaded, advertising service providers may collect information for ad performance measurement.

Article 5 (Changes to Purposes of Use)

1. Our school will only modify the purposes of use of personal data when the modified purpose is considered reasonably related to the original purpose.
2. In case of changes to the purposes of use, we will notify customers or publish the modified purpose on our website in accordance with our established procedures.

Article 6 (Disclosure of Personal Data to Third Parties)

Our school will not provide personal data to third parties without the customer's prior consent, except in the following cases.

1. When required by law
2. When necessary to protect the life, body, or property of a person and it is difficult to obtain the person's consent
3. When especially necessary to improve public health or promote the healthy development of children and it is difficult to obtain the person's consent
4. When necessary to cooperate with a national or local government agency, or a person entrusted by them in executing matters prescribed by law, and obtaining the person's consent may impede the execution of such matters
5. When personal data is provided due to business succession through merger or other reasons

Article 6-2 (Service Providers and Processing)

Within the scope necessary for the purposes stated in this Policy, personal data may be processed by the service providers currently confirmed for our public site and contact channels:

• Stripe: The only customer payment method is credit-card payment processed by Stripe. Stripe processes the contracting party's name, email address, and other information necessary for payment. Card numbers, security codes, expiration dates, and other card data are not collected through Google Forms, LINE, email, or Slack and are processed only by Stripe.
• LINE Yahoo Japan: Processes LINE account information and consultation messages when the official LINE channel is used for a free consultation.
• Google Forms (Google LLC, United States): Formal-application Form A is sent after the required LINE consultation and before acceptance. Confirmed-conditions Form B is sent only after acceptance. The information listed in Article 2 is processed for identity and guardian verification, review, result notification, condition preparation and correction, consent evidence, payment instructions, and contract administration. Depending on Google's contract, settings, and subprocessors, it may be processed in the United States or other countries. The form URLs are not published.
• Slack (provider to be verified against the actual contract and official documents before use): For learners aged 16 or older, Slack may process, as necessary for course communications, questions, submissions, and feedback, the learner's name or display name, email address, messages, attachments, learning records, and device or access information. Slack is not used for learners under 16.
• Email service provider: Processes names, email addresses, and message content sent to info@ada-itschool.com for post-contract communications, rights requests, and other inquiries.
• Google and advertising providers such as A8.net: Process access logs, cookie data, or advertising measurement data to the extent Google Analytics, Google AdSense, or affiliate advertising is used.
• Cloudflare: Processes IP addresses and access logs for site delivery and security.

Before adopting another service for student handling, we will confirm its purpose, data categories, overseas processing, and necessary settings, and provide any notice or obtain any consent required by law.

Article 6-3 (Overseas Processing)

1. Some service providers are located outside Japan or may process data using facilities outside Japan. The processing country, applicable legal system, and safeguards depend on the service, contract, and settings actually used.
2. Before using an overseas-processing service for student handling, we will confirm the recipient, processing country, relevant legal system, contractual or technical safeguards, and available settings.
3. Based on that confirmation, we will provide information, obtain consent, supervise the provider, or take other measures required by applicable law. If the necessary confirmation or measures cannot be completed, student personal data will not be transferred to that service.
4. The providers actually used and their privacy policies can be confirmed in the enrollment or service instructions or on the relevant service screen.
5. Information entered in formal-application Form A and confirmed-conditions Form B may be processed in the United States or other countries depending on Google's contract, settings, facilities, and subprocessors. When each form is sent individually, we will provide information about the processing and Google's privacy policy where necessary.
6. Before using Slack, we will verify the provider, actual contract terms, storage and processing regions, subprocessors, installed apps and external integrations, any overseas transfer, and applicable safeguards. Until that review and all required notices, consents, contracts, and settings are complete, we will not invite a learner or enter learner personal data into Slack.

Article 7 (Security Management of Personal Data)

We apply the following controls to the extent they can be confirmed and implemented for the information and services actually used.

1. The public website uses HTTPS for communications.
2. Access to personal data is limited to people who need it for their work, and sharing is kept to the minimum necessary.
3. Authentication, permission controls, and other available security settings are configured according to the actual contract and features of each service.
4. If a possible leak or similar incident is identified, we will restrict access, assess the impact, notify affected persons, and take other action required by law and the circumstances.
5. Before a minor uses Slack, we will verify separation between learners; direct-message rules; the roles of guardians, a second responsible adult, instructors, and contractors; apps; Slack Connect; external invitations; public links; file sharing; access removal when personnel leave; and the availability of records needed for incident review. If the required separation and permission controls cannot be implemented, Slack will not be used for minors.

Article 7-2 (Use of External Generative AI Services)

1. External generative AI is not used to answer students, review their work, summarize meetings, or otherwise handle students.
2. For internal research or general drafting only, we may use public information or information that has been sufficiently anonymized and abstracted so that no individual, school, company, or repository can be identified and no confidential information remains.
3. Names, contact details, age, school information, meeting content, chat content, learning records, work product, non-public source code, authentication information, third-party information, and any other personal or confidential information must not be transferred to or entered into external generative AI services.
4. Before considering future use for student handling, we will first determine and disclose the vendor, purpose, data categories, retention, training use, processing country or region, security measures, deletion method, and any explanation or consent required from the student or guardian, and update this Policy and our procedures.

Article 8 (Personal Data Retention Period)

We retain personal data only for as long as necessary for the relevant purpose. The main criteria are:

• Contracting-party, student, and learning records: As needed to perform the contract and handle post-termination inquiries, claims, or disputes.
• Inquiry information: As needed to answer and provide reasonable follow-up.
• Contract, consent, payment, billing, and accounting records: For the period required by tax and other applicable laws.
• Rejected applications or applications withdrawn before successful payment: Deleted or anonymized when no longer needed, except to the extent retention is required by law or necessary for fraud prevention, inquiries, claims, or disputes.
• Access logs: As needed for site operation, security review, and the settings of the relevant provider.

A period may be extended to meet a legal retention obligation or as necessary for a claim, dispute, incident, fraud investigation, or protection of rights. When information is no longer needed, it will be deleted or anonymized within a reasonable period. Data in backups is isolated from normal use, is not reused except where needed for recovery, and is removed according to each service's overwrite or expiration cycle.

Under Slack's current free-plan rules, eligible data from the most recent 90 days is available for viewing and search. If we adopt the one-year retention setting, data older than 90 days may become unavailable without being immediately deleted, and data older than one year is permanently deleted on a rolling basis. If we adopt the 90-day deletion setting, covered data is deleted after 90 days. The actual setting and its application to messages, files, canvases, and lists will be provided in the individual conditions or service instructions before use; no learner personal data will be entered before verification.

For an ordinary cancellation, Slack access is stopped by member removal or another method at the contract end date and time. Removal does not immediately delete posts or files. Information in Slack follows our selected retention settings, our available permissions, and Slack's features. Separately managed contract, consent, payment, billing, accounting, dispute, incident, fraud-investigation, and rights-protection records are retained for the period required for each purpose.

Article 9 (Disclosure of Personal Data)

When a person requests disclosure of their personal data, our school will provide it without delay. However, we may choose not to disclose all or part in the following cases, and will notify without delay of the decision not to disclose.

1. When disclosure may damage the life, body, property, or other rights and interests of the person or a third party
2. When disclosure may significantly impede the proper execution of our school's business
3. When disclosure violates other laws

Article 10 (Correction and Deletion of Personal Data)

1. Customers may request our school to correct, add, or delete (hereinafter "correction, etc.") their personal data if the information is incorrect, in accordance with our established procedures.
2. If our school receives a request from the preceding paragraph and determines that it is necessary to respond to such request, we will promptly make the correction, etc. of the personal data.
3. Our school will notify the customer without delay when we have made a correction, etc. in accordance with the preceding paragraph, or when we have decided not to make the correction, etc.

Article 11 (Suspension of Use of Personal Data)

When a person requests suspension of use or deletion (hereinafter "suspension of use, etc.") of their personal data because the data has been handled beyond the scope of the purpose of use or was obtained by fraudulent means, our school will conduct the necessary investigation without delay and, based on the results, suspend the use of the personal data and notify the person. However, when suspension of use, etc. of the personal data requires significant costs or other circumstances make suspension of use, etc. difficult, and alternative measures can be taken to protect the person's rights and interests, we will take such alternative measures.

Article 12 (Personal Data of Minors)

1. For a learner under 18, we verify the parent or legal guardian and obtain the consents required for the contract and data handling.
2. We may share with that guardian contract and billing information, whether meetings occurred, learning themes, submission status, progress, goals, and continuity warnings.
3. Without separate consent or a legal basis, we will not routinely share chat transcripts, full source code, credentials, private family, school, or friendship discussions, sensitive career details, or third-party information.
4. For a learner aged 18 or older, we will not share information with a parent or other person without the learner's specific consent or another lawful basis.
5. Requests for disclosure, correction, suspension of use, or deletion will be handled after confirming the requester's identity, authority, and the rights available under applicable law.
6. Slack is available only to learners aged 16 or older. We verify date of birth or age before invitation. A learner under 16 will not be invited to Slack and will receive email or another individually specified alternative.

Article 13 (Changes to Privacy Policy)

1. When changing this Policy, our school will identify the changed content, affected scope, and effective date and provide notice by email, website notice, or another appropriate method before the change takes effect.
2. A material adverse change requiring consent under applicable law will not apply until the customer expressly consents. Continued use will not substitute for consent where the law requires consent.
3. Prior policy versions and records of required notices and consents will be preserved for the applicable retention period. A new version will not retroactively alter data handling that is governed by a prior consent or contract unless legally permitted.

Article 14 (Contact Information)

For inquiries about this Policy, please contact us through the following channel.