Legal
Privacy notice
This is a review draft, not final legal advice. It identifies the areas the approved six-locale privacy notice must cover.
Controller and contact
JUN Travel Co., Ltd. (JUNトラベル株式会社), 1F, 1-24-19 Junka, Fukui-shi, Fukui 910-0023, Japan, operates Japanツアー and is the controller. Privacy requests may be sent to support@japantsua.com or +81-776-25-6266 during published support hours.
Information we collect
We collect account identifiers and authentication status; name, email, mobile number and preferences; tour choices, traveler count, eligibility confirmation, pickup/drop-off requests and special requests; quotes, bookings, payment/refund status and support communications; policy-version and consent records; and security data such as IP address, device/browser details, timestamps and fraud signals. Card numbers and security codes are entered only on Stripe-hosted pages and are not received by Japanツアー.
Purposes and legal bases
We use information to create and secure accounts, answer enquiries, provide quotes, enter into and perform travel contracts, collect payment, communicate operational changes, prevent fraud, keep required records, process cancellations/refunds and legal claims, and improve reliability. Depending on the context, processing is necessary for a contract or pre-contract steps, compliance with law, legitimate interests in safe and reliable operation, protection of vital interests, or consent where required. Marketing and non-essential tracking require a separate choice.
Recipients and international transfers
Information is shared only as needed with guides, vehicle providers, venues and other tour suppliers; authentication, hosting, database, storage, payment, email, mapping and support providers; professional advisers; and authorities where legally required. Planned technology providers include Cloudflare, Supabase, Stripe and Google authentication. Processing may occur outside Japan and the EEA. Required processor agreements, transfer information and safeguards must be completed before launch.
Retention and security
Booking, payment and contract records are retained for applicable accounting, tax, travel-business, dispute and audit periods. Account and enquiry data is kept while active and then deleted or anonymized when no longer needed, subject to fraud prevention, legal holds and statutory duties. We use access controls, encryption in transit, logging, least privilege and supplier controls appropriate to the risk. The owner must approve the detailed retention schedule before launch.
Your rights and choices
Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or information about disclosures and international transfers. You may withdraw consent without affecting earlier lawful processing. EU/EEA users may complain to their local supervisory authority. We may verify identity before acting. Essential authentication and security storage is required to use the service; non-essential cookies will require a separate consent mechanism before introduction.
Sensitive information, minors and changes
Do not submit passport, health, dietary, accessibility or other sensitive details unless a field expressly requests them and explains why. The launch product is for travelers aged 13–69; a parent or lawful guardian must make a booking involving a minor where required. Material notice changes will be dated and communicated where law requires.