GDPR Privacy Policy
The protection of your personal data is of great importance to Skyhop Bus Marketing Japan
Co.,Ltd,(“SMJ”) . This Privacy Policy therefore intends to inform you about how the SMJ
whose entities may act as data controllers or processors, collect and processes your personal
data that you submit or disclose to us, in the case where the General Data Protection
Regulation (“GDPR”) applies to such collection or processing.
The SMJ routinely collects, uses, stores and transfers a variety of data, including Personal
Data. The SMJ is committed to ensure the privacy of Personal Data throughout its global
business, and make sure its employees and business partners also take the necessary
measures to protect Personal Data.
This Privacy Policy sets out the basis on which any personal data we collect from you, or thatyou provide to us, will be processed by us. Our Privacy Policy applies to you in the casewhere the GDPR applies to such collection or processing and is available on our website andthrough other channels. In all your dealings with us you must ensure that others you may
represent are aware of the content of our Privacy Policy and consent to you on their behalf.
We encourage you to read this Privacy Policy carefully. If you do not wish your personal data
to be used by us as set out in this Privacy Policy, please do not provide us with your personal
data. Please note that in such a case, we may not be able to provide you with our services,and your customer experience may be impacted.
1. Your Personal Data•

This refers to a combination of personal data such as your name, address, telephone
number, email address, travel preference and special needs/disabilities/dietaryrequirements that you supply us or is supplied to us, including your social preference,
activities and any information about other persons you represent such as those on yourbooking. Your personal data is collected when you contact us, make a booking, use our
website(s)/apps, link to or from our website(s)/apps, connect with us via social media andany other engagement we or our business partner have with you.
2. Processing of Your Personal Data
Data processes•

We may collect and process your personal data for the purposes set out below and disclose
your personal data to the SMJ companies for business purposes and also to our service
providers who act as ‘controller’ or ‘processor’ on our behalf. These purposes include:
a.Fulfilling the contract with you and legal obligations (Articles 6(1)(b) and (c) of the GDPR:
In order for you to travel abroad, it may be mandatory as required by government
authorities at the point of departure and/or destination to disclose and process yourpersonal data for immigration, border control and/or any other purposes. Also we need toprovide airlines/accommodation providers with your name, passport number, contact
details, and other related information in accordance with their terms and conditions. If
you do not provide us with this personal data, we might not be able to offer our services
to you.
b.Fulfilling your and our legitimate interests (Article 6(1)(f) of the GDPR): Where it is in bothyour and our benefit that we further process your personal data as part of our businessadministration, maintaining service quality, customer care, business management, risk
assessment/management, security, and operation purposes.
c.Consent: For marketing purposes and other similar data processes that may require yourauthorization for their processing (Article 6(1)(a) of the GDPR). We will usually inform you
before collecting your data if we intend to use your data for such purposes or if we intend
to disclose your personal data to any third party for such purposes. You can exercise yourright to prevent such processing by checking certain boxes on the forms we used to collect
your data.
d.Explicit consent (Article 9(2)(a) of the GDPR): Information such as health or religion may
be considered ‘sensitive personal data’ under the GDPR. This personal data might include
information necessary to arrange bookings and travel plans, including your allergies,
disabilities, and other relevant health information. We collect it to provide you with ourservices, cater to your needs or act in your interest, and we are only prepared to accept
sensitive personal data on the condition that we have your positive consent.

•

We will process your data for as long as possible in order to fulfil our service to you andcomply with the applicable fiscal, tax, securities and commercial law regulations on retentionof business and financial documentation.
Children•Our products and services are intended for adult customers. However, we may knowingly
collect and process personal data on children under thirteen (13). On these occasions, we willtake account of this event when processing the personal data of children and implementing
the legal basis for such processing. For example, where the processing of personal data ofchildren is based on their consent such as the processing of his/her sensitive personal data,
we will seek the consent of parents, tutors, or other adults holding parental responsibility
over children, if required under the GDPR.

Links to other sites•

We may propose hypertext links from our websites to third-party websites or Internet
sources. We do not control and cannot be held liable for third parties’ privacy practices andcontent. Please read carefully their privacy policies to find out how they collect and process
your personal data.
Data transfers•

When we process your personal data, we will store it on our systems located within theEuropean Economic Area (EEA), which comprises the Member States of the EU, Norway,
Iceland and Lichtenstein, as well as outside the EEA. In the event of a merger,
reorganization, acquisition, joint venture, assignment, spin-off, transfer, or sale or dispositionof all or any portion of our business, including in connection with any bankruptcy or similar
proceedings, we may transfer any and all personal data to the relevant third party.

•Your data may also be processed by staff operating outside the EEA who work for us or for
one of our suppliers (e.g., travel guides, transportation services). Such staff may be engaged
in, among other things, the provision of support services.
Service providers•

For the purpose of providing you with our services, including your booking of flight, hotel,
security, incident/accident management etc., we may disclose and process your personal
data outside of the EEA countries. In order for you to travel abroad, it may be mandatory as
required by government authorities at the point of departure and/or destination to discloseand process your data for immigration, border control and/or any other purposes. Also weneed to provide airlines/accommodation providers with your name, passport number, contact
detail, etc. in accordance with their terms and conditions.
Legal compliance and security•

It may be necessary for us － by law, legal process, litigation, and/or requests from publicand governmental authorities within or outside your country of residence － to disclose yourpersonal data. We may also disclose your personal data if we determine that, due topurposes of national security, law enforcement, or other issues of public importance, thedisclosure is necessary or appropriate.
We may also disclose your personal data if we determine in good faith that disclosure isreasonably necessary to protect our rights and pursue available remedies, enforce our terms
and conditions, investigate fraud, or protect our operations or users.
Safeguards to protect your personal data•

Where we share your data with a data processor, we will put the appropriate legal
framework in place in order to cover such transfer and processing (Articles 26, 28 and 29).
Furthermore, where we transfer your data from EEA to any entity outside the EEA, we will
put appropriate legal frameworks in place, notably Binding Corporate Rules (Article 47

GDPR), controller-to-controller (2004/915/EC) and controller-to-processor (2010/87/EU)
Standard Contract Clauses approved by the European Commission, in order to cover suchtransfers (Articles 44 ff. GDPR), or we will share your data based on rules of the GDPR.
•

By submitting your personal data, you agree to this transfer, storing or processing. We willtake all steps reasonably necessary to ensure that your data is treated securely and inaccordance with this Privacy Policy, in particular, by adopting Binding Corporate Rules (fortransfers among certain the SMJ) and Standard Contract Clauses (for transfers with thirdparties) where possible.
3. Our Records of Data Processes•

We handle records of all processing of personal data in accordance with the obligations
established by the GDPR (Article 30), both where we might act as a controller or as aprocessor. In these records, we reflect all the information necessary in order to comply with
the GDPR and cooperate with the supervisory authorities as required (Article 31).
4. Security Measures•

We process your personal data in a manner that ensures their appropriate security, including
protection against unauthorised or unlawful processing, accidental loss, destruction ordamage. We use appropriate technical or organisational measures to achieve this level ofprotection (Article 25(1) and 32 GDPR).
We will retain your personal information for as long as it is necessary to fulfill the purposes
outlined in this Privacy Policy, unless a longer retention period is required or permitted bylaw.
5. Notification of Data Breaches to the Competent Supervisory Authorities•

In case of breach of security leading to the accidental or unlawful destruction, loss,
alteration, unauthorised disclosure of, or access to, personal data transmitted, stored orotherwise processed, we have the mechanisms and policies in place in order to identify it andassess it promptly. Depending on the outcome of our assessment, we will make the requisite
notifications to the supervisory authorities and communications to the affected data subjects,
which might include you (Articles 33 and 34 GDPR).

6. Processing Likely to Result in High Risk to your Rights and Freedoms•

We have mechanisms and policies in place in order to identify data processing activities that
may result in high risk to your rights and freedoms (Article 35 of the GDPR). If any such dataprocessing activity is identified, we will assess it internally and either stop it or ensure thatthe processing is compliant with the GDPR or that appropriate technical and organisationalsafeguards are in place in order to proceed with it.
•

In case of doubt, we will contact the competent Data Protection Supervisory Authority inorder to obtain their advice and recommendations (Article 36 GDPR).

7. Your Rights
You have the following rights:•－Access to personal data: You have the right to be provided full information about yourpersonal data that we hold.

•－Data correction: You have the right to require that we correct any incorrect information wehold about you.

•

－Data deletion: You may also have the right to ask that we delete your personal data.
Please note that certain conditions may apply to the exercise of this right.

•－Restriction on processing of personal data: You may have the right to ask that we restrict
the use of your personal data. Please note that certain may conditions apply to the exerciseof this right.

•－Object to processing of personal data: You may have the right to object to the use of yourpersonal data by us. Please note that certain conditions may apply to the exercise of thisright.

•

Portability of personal data: You may have the right to receive your personal data in a
structured and commonly used format. Please note that certain conditions may apply to theexercise of this right.

•－You also have the right to obtain from us a copy of the Binding Corporate Rules or of any
Standard Contract Clauses that we use if we transfer your personal data outside the EEA andtake such arrangement.

•

To exercise your rights, or if you require further information about how your personal data isused by us, you can contact the staff member in charge of your travel or write to us at:
info2@skyhopbus.com.

•

Following is the procedure when you want to execute these rights;
1)Upon receiving your request, we will contact you to confirm the request is being handled,
and we will indicate the reasonable timeframe for us to respond.
2)Our special team will make an initial assessment of the request to decide whether it is avalid request and whether confirmation of identity is required.
3)If no further action from you is required, we will proceed with the processing of yourrequest.
4)At the end of our assessment and internal procedure, we will provide a confirmation as toour compliance or processing of your request.

5)For any unfounded or excessive (e.g., further repeated) requests, we may charge areasonable fee based on administrative costs.

8. When you want to complain about your personal data•

We have appointed appropriate staff with management support to oversee and ensurecompliance with the GDPR.
You can bring complaints in writing by contacting the SMJ Data Protection Team at
info2@skyhopbus.com.

•

You can also contact the SMJ Data Protection Team members or other employees tocomplain about the way we handle your personal data. The employees to have been
confronted with the complaint will inform you about the contract details to file a complaint inaccordance with the present procedure or pass the complaint to the SMJ Data Protection
Team whichever appropriate.

•

After receiving the complaint the Data Protection Team will send an acknowledgement ofreceipt within one week to you. The confirmation may include further questions necessary forthe clarification of the issues. The Data Protection Team or local Human Resources
Department will provide an answer to you as soon as reasonably practicable, but no later
than one month upon receiving the complaint. If, due to complexity of the complaint, asubstantive response within one month cannot be provided, you will be notified with areasonable estimate of the timeframe, but not exceeding two months from the notice.

•

You may also raise the complaint to the relevant Data Protection Authority or lodge a claim
with a court of competent jurisdiction.
9. Changes to our Privacy Policy•

We may revise or update this Privacy Policy from time to time. Any changes we may make to
our Privacy Policy in the future will be posted on this webpage. If we make changes which we
believe are significant, we will inform you through the website to the extent possible andseek your consent where applicable.
10. Contact
Questions, comments and requests regarding this Privacy Policy are welcomed and should be
addressed to
Skyhop Bus Marketing Japan Co., Ltd.(‘SMJ’) Data Protection Team
7F 3-9-3 Kanda-Misaki-cho Chiyoda-ku, Tokyo JAPAN
Email: info2@skyhopbus.com

11. About Cookie•

The SMJ uses cookie information to provide better services, secure security, analyze anddistribute appropriate advertisements to customers. Third-party companies may distributeadvertisements or obtain behavioral information for the purpose of advertising theircompany. Third-party companies use cookies only for advertisement distribution purposes
and acquire information. If you wish to invalidate this function, please disable (opt out) fromthe site of the corresponding company below.
※ If you change browser, delete cookie, etc., you need to set opt-out and opt-in again.
Google LLC

http://www.google.co.jp/policies/technologies/ads/

Google Analytic Opt-out

https://tools.google.com/dlpage/gaoptout?hl=ja

The SMJ and its affiliates as below.
Hinomaru Jidousya Kougyo Co. Ltd,

http://www.hinomaru-bus.co.jp/

Myojo Kanko Co. Ltd,

http://www.myojo-mc.co.jp/