GDPR Privacy Policy

A. Who is responsible for the data processing and who can you contact?

Responsible as controller for the processing of your personal data is:

Japan Pulp & Paper Company Limited
Address: Forefront Tower, 3-12-1 Kachidoki, Chuo-Ku, Tokyo 104-8656, Japan.
Email: (Please replace "★" with "@" when sending an email.)

B. How do we process personal data?

We process various personal data you provide to us when using our website for several purposes.
In principle, the following can be considered as the purposes of the processing: the processing for the initiation of contractual relationships and the performance of contracts (Art. 6 (1) lit. b GDPR), the processing for the protection of legitimate interests (Art. 6 (1) lit. f GDPR), the processing based on your consent (Art. 6 (1) lit. a GDPR) and/ or the processing subject to statutory provisions (Art. 6 (1) lit. c GDPR).
You can find in the following further information on the specific personal data and the purposes we process such personal data for as well as the legal basis for such processing.

C. Are you obliged to provide personal data?

There is no legal or contractual obligation to provide us with your personal data when using our website. We only ask you to provide us with the data necessary for providing our services. Without these personal data, we are not able to offer you the full functionalities of the website and our services may be limited.

D. With whom do we share personal data?

We use external service providers to process personal data when providing the website and its functionalities and services to you. Processing of personal data by such service provider is carried out on our behalf and in accordance with our instructions (so-called “Processors”, see Art. 4 No. 8 GDPR).
We engage the following service providers or categories of services providers:

• IT Service Providers (including hosting, administration and security reviews).

We may also share personal data with recipients, which process personal data under their own responsibility for own purposes (see Art. 4 No. 7 GDPR). This includes transfer to the following recipients or categories of recipients:

• Google LLC (see our Cookie Policy for further information).

Furthermore, we may share personal data with our group companies in Japan and overseas if it is necessary for the purposes mentioned in this Privacy Policy.

E. Do we transfer personal data to third countries?

We may transfer personal data to service providers and recipients located in countries outside of the European Economic Area (EEA), if such transfer is necessary for the purposes mentioned in this Privacy Policy.
Any transfer to a third country shall take place only in compliance with the applicable data protection regulations, in particular the assurance of an adequate level of data protection (see Art. 45 GDPR).
We transfer your personal data in the following cases:

• Processing of personal data by services providers located in Japan acting on our behalf, including hosting and administration of our website (see Section D). According to the EU Japan adequacy decision by the EU Commission Japan provides an adequate level of protection pursuant to Art. 45 GDPR.

• Sharing of personal data with Google located in the USA for tracking and web analytics purposes. Google has subjected itself to the EU-US Privacy Shield Agreement, https://www.privacyshield.gov/EU-US-Framework. According to the EU-US privacy shield decision by the EU Commission data transfers to companies located in the USA and certified under the EU-US Privacy Shield Agreement are subject to an adequate level of protection.

F. How long do we store personal data?

We process your personal data as long as they are necessary for the specific processing purposes.
In general, we store your personal data for the time required for carrying out the processing for the purposes above, unless storage beyond this period is necessary to fulfil the respective processing purposes.

G. How do we secure personal data?

We maintain up-to-date technical measures to safeguard data security, in particular to protect your personal information from threats when transferring data and from third parties gaining unlawful knowledge. These measures are constantly adapted to the latest state of the art.
In order to prevent unauthorized access by third parties to your personal data, the connection is encrypted using SSL technology.

H. Which rights do you have?

You have the right of access (Art. 15 GDPR), the right to rectification (Art. 16 GDPR), the right to erasure (Art. 17 GDPR), the right to restriction of processing (Art. 18 GDPR) and the right to data portability (Art. 20 GDPR).
When personal data is processed based on your consent, you have the right to withdraw your consent according to Art. 7 (3) GDPR. Please keep in mind that your withdrawal only affects future processing based on your consent.
As far as the personal data is processed for the purpose of our legitimate interest according to Art. 6 (1) lit. f GDPR, you have the right to object according to Art. 21 GDPR. You can find further information regarding your right to object at the end of this Privacy Policy.
To exercise the aforementioned rights, you can contact us, in particular via email under . (Please replace "★" with "@" when sending an email.) Please note that we may require you to present proof of identity to verify the eligibility of your rights execution.
If you are of the opinion that the processing of your personal data is unlawful, you have the right to lodge a complaint with the competent supervisory authority (Art. 77 GDPR). This right to complain is without any prejudice to any other administrative or judicial remedy.