About GDPR initiatives in our services
GDPR * 1 is a regulation concerning the processing and transfer of personal data acquired
within the EEA * 2 region. EU (European Union)
Although it is a regulation of the EEA, it is also applied to Japanese companies in order toprotect personal data about individuals in the EEA area * 3.
* 1 GDPR: General Data Protection Regulation* 2 EEA: European Economic Area (European Economic Area). 27 countries in EU, Norway,
Liechtenstein and Iceland.
* 3 Individuals in the EEA area: Individuals who are currently located in EEA are eligible
regardless of nationality or residence. In addition, it is determined by GDPR
The "personal data" defined in GDPR is a broader concept than personal information definedin Japan. For details, please see the website of Personal Information Protection Commission

Cases where the GDPR applies
The following Companies may be subject to the GDPR.
When processing personal data acquired within the EEA region
When transferring personal data to Japan
start date: May 25, 2018

About GDPR initiatives in our services
Customers who process personal data using our cloud service * are "controller".
In providing our cloud services, we are mainly "processors".
PositionController

ExaminationA

corporate

customer

Main role
who,Controller

have

directalone or jointly, determines theresponsibility to the data subject

purposeand the EU Data Protection

and

means

of

processing personal data.

Authority

intheoverall

processing of personal data.
Processors

Processor will process personal

Processor will process personal

data on behalf of the corporate

data on behalf of the corporate

customer who is Controller.

customer who is Controller.

Compliance with GDPR
Customers needs the following clauses and contract for compliance with GDPR.

SCC (Standard Contractual Clauses)
A contract that must be concluded when transferring personal data located in the EEA tooutside the EEA (including Japan). If you need SCC, please prepare it yourself.
* According to the GDPR, only the English version is valid.

Processing contract
contract that stipulates the processing of personal data in the EEA area handled by us.
We will present it in the "クラウドサービスに関する契約約款".
* If we are not service provider, Customer will be the "processor", so both of the above
contracts are required. If the contracts are needs, you will have to conclude the contracts withthe service provider.
Our service applied GDPR⚫

IDCF Cloud⚫

Infinite LB

⚫

RDB⚫

Cloud Storage

⚫

CDN⚫

DNS⚫

GSLB⚫

Private Cloud⚫

Bare-metal server⚫

Measures against DdoS⚫

Intrusion Detection and Prevention⚫

Container⚫

Monitoring⚫

Zenlogic hosting⚫

Zenlogic hosting on IDCF Cloud

We have revised "クラウドサービスに関する契約約款" to add the provisions about processor
contract.
https://www.idcf.jp/jp/stipulation.html

Application start date: May 25, 2018
Sub-processor
We admit the following companies to take a charge with regard to our service.
⚫

Fastly, Inc.

⚫

Google LLC⚫

SoftBank Corp.

⚫

Doctor Web Pacific, Inc⚫

IBM Japan, Ltd.

⚫

HP Japan Inc.

⚫

Hatena Co., Ltd.

⚫

Lenovo Enterprise Solutions. LLC⚫

Dell Technologies Japan Inc.

⚫

NetApp G.K.

⚫

Pure Storage Japan K.K⚫

Fujitsu Ltd.