National University Corporation, University of Yamanashi Privacy Policy
Based on the EU General Data Protection Regulation (GDPR)
23, January, 2024
Determination of the President
1. Purpose
This Privacy Policy has been established by the National University Corporation, University ofYamanashi (hereinafter “the University”) in response to the GDPR to set forth policies related
to the processing of personal data of data subjects located in countries subject to the GDPR
(regardless of nationality or residency) and the transfer thereof to areas not subject to theGDPR (hereinafter “extraterritorial transfer”).
2. Definitions
The definitions of terms in this Privacy Policy are as follows.
TermDefinition

GDPR

EU General Data Protection Regulation 2016/679

Countries subject

Countries that make up the European Economic Area (the memberto the GDPR

countries of the EU, the Republic of Iceland, the Principality of
Liechtenstein, and the Kingdom of Norway) and the United Kingdom ofGreat Britain and Northern Ireland* The Information Commissioner’s Office (ICO), which serves as thesupervisory authority on personal-data protection in the United
Kingdom, has stated that its corresponding policies conform to theGDPR.

Data subject

An identified or identifiable natural person; an “identifiable naturalperson” is a person who can be identified directly or indirectly via areference to an identifier, especially a name, an identification number,
location data, or an online identifier (IP address, cookie, MAC address,etc.), or via a reference to one or more factors specific to the physical,physiological, genetic, mental, economic, cultural, or social identity ofsaid natural person.

Personal data

Any information relating to a data subject

Processing

Any operation or set of operations performed on personal data or setsof personal data, either by automated or non-automated means, suchas collecting, recording, organizing, structuring, storing, revising oraltering, searching, referencing, using, disclosing via transmission,
distributing or otherwise making available, aligning or combining,restricting, erasing, or destroying said personal data
Restriction of

The marking of stored personal data with the aim of limiting its

processing

processing in the future

Profiling

Any form of automated processing of personal data consisting of theuse of personal data to evaluate certain personal aspects relating to anatural person (especially to analyze or predict aspects concerning thatnatural person’s performance at work, economic situation, health,personal preferences, interests, reliability, behavior, location, ormovements)

Controller

A natural or legal person, public authority, agency, or other body that,alone or jointly with others, determines the purposes and means of theprocessing of personal data

Processor

A natural or legal person, public authority, agency, or other body thatprocesses personal data on behalf of the controller

Third party

A natural or legal person, public authority, agency, or body other thanthe data subject, controller, processor, and persons who, under the
direct authority of the controller or processor, are authorized to process
personal data

Consent of the

Any freely given, specific, informed, and unambiguous indication of thedata subject

data subject’s wishes by which he or she, by a statement or by a clear
affirmative action, signifies agreement to the processing of personal
data relating to him or herSCC

Standard Contractual Clauses* An agreement regarding extraterritorial transfer, concluded between
enterprises within the EU and enterprises outside the EU, that wasestablished by the Commission Implementing Decision (EU)2021/915 and Commission Implementing Decision (EU) 2021/914,
which were established to ensure conformance to the requirementsof the GDPR
* In this Privacy Policy, “SCC” shall include old SCC that were valid
until December 27, 2022 (prescribed in the Data Protection
Directive [95/45/EC] applicable to EU member countries) only until
said date.

SDPC

Standard Data Protection Clauses

* A replacement for SCC, as established by the GDPR
Adequacy

A decision by the European Commission finding that a country or region

decisionensures an adequate level of data protection* An adequacy decision enables the extraterritorial transfer of
personal data without the need for any special procedures.
* Japan received an adequacy decision in January 2019, butgovernmental institutions, incorporated administrative agencies,etc. are not part of the framework of the adequacy decision.

3. Name and address of the controller
Name: National University Corporation, University of Yamanashi
Address: 4-4-37 Takeda, Kofu, Yamanashi, Japan
4. Tasks involved in the processing of personal data
The University shall process personal data only for the purposes of performing the tasks
set forth for the corresponding personal data.
i.

The personal data of an individual intending to participate in a study-abroad
program or other international academic exchange program carried out inaccordance with an agreement concluded between the University (includingorganizations established by the University of Yamanashi) and a university or
research institution in a country subject to the GDPR for the purpose ofeducation- and research-related exchange (hereinafter an “agreement onexchange”)
a. Procedures relating to the study-abroad program or other international
academic exchange programb. Procedures associated with the study-abroad program or otherinternational academic exchange program (scholarships, etc.)
c. Contact during emergencies, etc.
d. Procedures, contact, etc. necessary for other tasksii.

The personal data of an individual who does not fall under the preceding Itema. Applications and procedures, etc. for various projects
b. Payment of rewards, travel expenses, etc. and collection of feesc. Procedures relating to taxes, etc.
d. Surveys/questionnaires
e. Procedures, contact, etc. necessary for other tasks

5. Sources of personal data
The University shall obtain personal data from the following sources to perform the tasksprescribed in the preceding Article.
i.

The data subject (only in cases where it can be proved that the data subject[or, if the data subject is under the age of 16 or under the age set forth bydomestic law in a country subject to the GDPR, if such legal provisions exist, aperson with parental authority over the data subject] has provided theirconsent to the processing of personal data)ii.

An institution, etc. with which the University has an agreement on exchange

6. Storage period for personal data
Personal data shall be stored for a period prescribed in the laws and regulations of Japanor the regulations, etc. of the University.
7. Processing of personal data
The University shall process personal data in the following cases.
i.

The data subject has given consent to the processing of their personal data forone or more specific purposesii.

Processing is necessary for the performance of an agreement to which thedata subject is party or necessary for the performance of procedures at therequest of the data subject prior to the conclusion of an agreementiii.

Processing is necessary for compliance with a legal obligation to which thecontroller is subject

iv.

Processing is necessary for the protection of important interests of the data
subject or another natural personv.

Processing is necessary in the execution of tasks carried out in the public
interest or in the exercise of public authority vested in the controller

vi.

Processing is necessary for the purposes of legitimate interests pursued by thecontroller or a third party, except where said interests are overridden by thebasic rights or freedoms of the data subject requesting protection of personaldata

8. Rights of the data subject
The data subject has the following rights. However, in the event of a request for disclosure
as prescribed in Japan’s Act on the Protection of Personal Information (Act No. 57 of 2003),
expenses shall be requested of the data subject.

i.

Right of access
The data subject may request that the controller provide the data subject’s
own personal data or other information prescribed in the GDPR.

ii.

Right to rectification
The data subject may request that the controller promptly rectify inaccuracies
in the data subject’s own personal data.

iii.

Right to erasure (right to be forgotten)
The data subject may request that the controller promptly erase the data
subject’s own personal data if said data is deemed to fall under any of thefollowing Items.
a. the personal data is no longer necessary in relation to the purposes forwhich it was collected or otherwise processed;b. the data subject withdraws consent to processing and there is no otherlegal ground for the processing;c. the data subject objects to the processing pursuant to Article 21,
Paragraph 1 of the GDPR and there are no overriding legitimate grounds
for the processing, or the data subject objects to the processing pursuant
to Article 21, Paragraph 2 of the GDPR;
d. the personal data has been unlawfully processed;e. the personal data must be erased for compliance with a legal obligation in
an EU law or a law in a member state to which the controller is subject;f.

the personal data has been collected in relation to the offer of informationsociety services referred to in Article 8, Paragraph 1 of the GDPR.

iv.

Right to restriction of processing
The data subject may request that the controller restrict processing of the data
subject’s personal data in cases that fall under Article 18, Paragraph 1 of theGDPR.

v.

Right to data portability
The data subject may obtain the personal data they have provided in astructured, general-use, machine-readable format from the controller in casesthat fall under Article 20, Paragraph 1 of the GDPR. In addition, the data
subject may transfer their personal data to another controller without
hindrance from the controller to which the data subject was originallyprovided.

vi.

Right to object
The data subject shall have the right to object, on grounds relating to theirspecific situation, at any time to the processing of personal data relating to thedata subject performed according to the provisions of Item v or vi in thepreceding Article, including cases involving profiling based on said specificsituation.
vii.

Right not to be subject to decision-making based on automated processing,including profiling
The data subject shall have the right not to be subject to decision-making
based solely on profiling or other automated processing that has a legal effector a similar significant impact on them.

9. Provision of personal data
In order to perform the tasks prescribed in Article 5, the University may provide personal
data to a third party in cases where the consent of the data subject has been obtained for said
provision or where the provisions of the Items in Article 27, Paragraph 1 of the Act on theProtection of Personal Information apply. However, in cases involving special types of data
prescribed in Article 9, Paragraph 1 of the GDPR, these provisions shall, as a general rule, apply
only in cases where the consent of the data subject has been obtained for the provision
thereof.
10. Transfer of data
Personal data may be transferred to a third country other than those subject to the GDPR
only in cases where the country or region of the recipient of the data transfer has received anadequacy decision, cases where said data transfer has been provided for by the SCC or SDPC,
cases that fall under the reasons prescribed in Article 49, Paragraph 1 of the GDPR, or othercases where the legality of said data transfer is guaranteed.
11. Security measures
The University has established security measures, confirming to the standards prescribed inthe Act on the Protection of Personal Information and other relevant laws and regulations, inregard to the protection of personal data.
12. General provisions
The University may revise this Privacy Policy based on laws and regulations or its policies as acorporation. However, the University shall not use personal data for any post-revision purpose
without obtaining the consent of the data subject.