JaCER Engagement and Remedy Platform
GDPR Privacy Policy

Japan Center for Engagement and Remedy on Business and Human Rights (JaCER) has
formulated this privacy policy in order to comply with EU and UK’s General Data ProtectionRegulation (hereinafter “GDPR”) and other equivalent privacy laws and regulations in theoperation of our grievance mechanism platform “Engagement & Remedy Platform”. This
privacy policy will explain how JaCER uses the personal data which JaCER collects from you
when you submit grievance through JaCER and you use JaCER’s website.
Scope of application
This privacy policy applies to JaCER’s processing of any personal data of any data subjects
whose personal data is located in the European Economic Area, Switzerland, and United
Kingdom (hereinafter “GDPR data subjects”).
What data does JaCER collect?
Through the operation of Engagement and Remedy Platform, JaCER collects any personal
data in grievance reports and any other communications including but not limited to:names,addresses(asnecessary),

telephonenumbers,nationalities,occupations,companies/organizations of affiliation, e-mail addresses, content of the grievance, andcircumstances and history pertaining to processing of the grievance, etc.
How does JaCER collect your data?
You directly provide JaCER with most of the data which JaCER collects. JaCER collects andprocesses your data when you submit a grievance report to JaCER.
JaCER may also receive your data indirectly from the following source:⚫

JaCER’s member companies when you submit a grievance report to them⚫

Any third parties who submit a grievance report involving you to JaCER

Please note that the provision of your personal data is neither a statutory or contractual
requirement, nor a requirement necessary to enter into a contract and that you are not obliged
to provide personal data. Nonetheless, if you do not provide your data, there is a risk that we
may not be able to appropriately investigate and address the contents of your grievance.
How will JaCER use your data?
The legal bases on which JaCER relies for processing your data are:

1) JaCER and the company concerned have legitimate interests of appropriately
investigating and addressing the contents of grievance for respecting the UN Guiding
Principles on Business and Human Rights and for complying with applicable laws andregulations; and2) Where appropriate, your consent freely given by accepting this privacy policy.
JaCER will process your data contained in your grievance report only for the purpose of
implementing appropriate measures depending on the results of the investigation and not for
any other purpose.
However, in order to appropriately process your grievance, personal data contained in yourgrievance report may be provided to the parties concerned.

Parties Concerned Use of Personal Data

Company Concerned JaCER provides all of the data in regard to your grievance to thedepartment in charge of processing grievances in the company
concerned. The company concerned processes the grievancereceived from you.

Suppliers and other JaCER provides all of the data in regard to your grievance to thebusiness partners of department in charge of processing grievances in the company
the company

concerned. The company concerned processes the grievanceconcerned

received from you.

Advisory andAn advisory and mediation panel and investigation panel may be

Mediation Panel and set up in the company concerned to appropriately investigate andInvestigation Panel process your grievance. The advisory and mediation panel and theinvestigation panel have duties to maintain secrecy with respect tothe company concerned. The personal data contained in yourgrievance may be provided to the advisory and mediation panel
and investigation panel.

How do we store your data?
JaCER securely stores your data at the cloud server in Japan where security measures are taken.
JaCER keep your data as long as for necessary to achieve the above purposes.
What are your data protection rights?
JaCER would like to make sure you are fully aware of all of your data protection rights. You,
as GDPR data subject, is entitled to the following:⚫

The right to access – You have the right to request JaCER for copies of your personal data.
We may charge you a small fee for this service.

⚫

The right to rectification – You have the right to request that JaCER correct any data you
believe is inaccurate. You also have the right to request JaCER to complete the data you
believe is incomplete.

⚫

The right to erasure – You have the right to request that JaCER erase your personal data,
under certain conditions.

⚫

The right to restrict processing – You have the right to request that JaCER restrict theprocessing of your personal data, under certain conditions.

⚫

The right to object to processing – You have the right to object to JaCER’s processing ofyour personal data, under certain conditions.

⚫

The right to data portability – You have the right to request that JaCER transfer the datathat we have collected to another organization, or directly to you, under certain
conditions.

If you make a request, JaCER has one month to respond to you. If you would like to exerciseany of these rights, please contact us at our email: info@jacer-bhr.org
In addition, you also have a right to lodge a complaint with a supervisory authority.
Data Transfer to Third Countries
JaCER and the company concerned may provide your data in your grievance report to theparties concerned who reside in countries other than Japan in order to appropriately process
your grievance. Although we request the parties concerned to protect your data carefully,
please note that the third countries may not have an equivalent level of data protection as
Japan, EU, and UK.
Cookies and Web Beacons

JaCER's website may use cookies and Web beacons for enhanced provision of services topersons accessing JaCER’s website. Cookies enable provision of data that is more personally
relevant to persons who have accessed JaCER’s website and are revisiting the site.
Cookies are small packets of data sent to the user's browser so that the Web server can identify
the user's computer but cannot identify specific individuals unless you input personal data.
Some browsers allow the user to disable cookies by changing the browser's settings. However,as a result, you may not be able to use part or all of the services offered by JaCER’s website.
Web beacons are used to count the number of times JaCER’s website page is visited for
preparation of statistical data. Web beacons do not have a function that enables identificationof specific individuals.
Access Log
Data on persons who access JaCER’s website is recorded in the access log.
Access logs are records of user data that include IP addresses, types of browsers, and accessdates and times. This data is utilized for website maintenance and management, statisticalanalysis of how users interact with JaCER’s website, and site enhancement. JaCER uses thedata obtained from access logs only within the scope of established purposes for use of
personal data.
JaCER also uses Google's Google Analytics to collect, record, and analyze browsing history on
our website. Google Analytics uses cookies to collect data that does not include data that canidentify a specific individual. The disable setting for Google Analytics can be downloaded
from Google's Opt-out Browser Add-on download page. Download and install "GoogleAnalytics Opt-out Browser Add-on." You can disable Google Analytics by changing thebrowser's Add-on setting. Data collected by Google is managed in conformance with Google's
Privacy Policy as follows.
Google Analytics Terms of Service
Google Privacy Policy
Google Analytics Opt-out Browser Add-on
Automated decision-making
JaCER does not carry out any automated decision-making, including profiling, based on thedata which you provide.
Privacy policies of other websites
JaCER’s website contains links to other websites. JaCER’s privacy policy applies only toJaCER’s website, so if you click on a link to another website, you should read their privacy
policy.
Changes to JaCER’s Privacy Policy
JaCER keeps its privacy policy under regular review and places any updates on this web page.
This privacy policy was last updated on March 2023.
How to contact us (Contact Point)
If you have any questions about JaCER’s privacy policy, the data that JaCER hold on you, or
you would like to exercise one of your data protection rights, please do not hesitate to contactus.
Japan Center for Engagement and Remedy on Business and Human Rights（JaCER）
Address Otemachi Center Bldg., 1-1-3, Otemachi, Chiyoda Ward, Tokyo 100-0004
Representative Sakon Kuramoto,Daisuke Takahashi,Hidemi Tomita
Contact Point

info@jacer-bhr.org