This Privacy Policy explains how Deebo Inc. ("Deebo", "we", "us") collects, uses, and safeguards personal data when you visit deebo.co.jp, contact us through our forms, or engage us under a services agreement. We operate from Tokyo, Japan and London, United Kingdom, and serve clients globally. This policy is drafted in accordance with Japan's Act on the Protection of Personal Information (APPI), the UK General Data Protection Regulation (UK GDPR), and the EU General Data Protection Regulation (EU GDPR).
1. Data controller
Deebo Inc. is the data controller responsible for your personal data. For privacy-related enquiries, contact us at info@deebo.co.jp.
2. Information we collect
We collect information you submit directly — such as your name, work email, company, and the message you send through our contact form — as well as standard server logs (IP address, browser type, pages viewed, referrer URL, date and time of access) and cookie data described in our Cookie Policy.
3. Legal basis for processing
We process personal data on the following lawful bases under UK and EU GDPR: • Consent — where you have given clear consent for us to process your data for a specific purpose, for example by submitting a contact form or accepting optional cookies. • Contractual necessity — where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract. • Legitimate interests — where processing is necessary for our legitimate business interests (such as improving our website and responding to enquiries), provided those interests are not overridden by your rights. • Legal obligation — where processing is necessary to comply with a legal requirement. Under Japan's APPI, we process personal information within the scope of a specified purpose of use and in accordance with the requirements of the Act.
4. How we use information
We use information to respond to your inquiries, deliver services we have agreed to provide, operate and improve the website, communicate about engagements, send relevant updates about our services (where you have consented or we have a legitimate interest to do so), and meet legal, tax, and accounting obligations.
5. Sharing and processors
We share information only with vetted service providers (data processors) who help us run our business — for example, hosting, email delivery, and analytics providers. Each processor is bound by a data processing agreement that requires them to process data only on our instructions and to maintain appropriate security measures. We do not sell personal data and we do not share it for cross-context behavioural advertising.
6. International transfers
As a Tokyo- and London-based agency, your information may be transferred to and stored in Japan, the United Kingdom, or the European Economic Area. Where we transfer personal data outside of the UK or EEA, we rely on appropriate safeguards such as the European Commission's adequacy decisions, Standard Contractual Clauses (SCCs), or the UK International Data Transfer Agreement, as applicable. Transfers from Japan are conducted in compliance with APPI requirements for the cross-border provision of personal data.
7. Your rights
Subject to applicable law, you have the following rights regarding your personal data: • Access — request a copy of the personal data we hold about you. • Rectification — request correction of inaccurate or incomplete data. • Erasure — request deletion of your data where there is no compelling reason for continued processing. • Restriction — request that we restrict processing in certain circumstances. • Data portability — receive your data in a structured, commonly used, machine-readable format (UK/EU GDPR). • Objection — object to processing based on legitimate interests or direct marketing. • Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Under Japan's APPI, you may request disclosure, correction, suspension of use, or deletion of your retained personal data as provided by the Act. To exercise any of these rights, contact us at info@deebo.co.jp. We will respond within one month (UK/EU GDPR) or without delay (APPI), as required by applicable law.
8. Complaints
If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. In the EU, you may contact your local data protection authority. In Japan, you may contact the Personal Information Protection Commission (PPC).
9. Automated decision-making
We do not use automated decision-making, including profiling, that produces legal effects or similarly significantly affects you.
10. Children's data
Our website and services are directed at businesses and professionals. We do not knowingly collect personal data from anyone under the age of 16. If you believe we have inadvertently collected such data, please contact us immediately so we can delete it.
11. Retention and security
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal obligations. Contact form submissions are typically retained for up to 24 months after the last interaction unless a longer period is required for an ongoing engagement or legal obligation. Server logs are retained for up to 12 months. We use appropriate technical and organisational measures — including encryption in transit, access controls, and regular security reviews — to protect personal data against loss, misuse, and unauthorised access.
12. Updates to this policy
We may update this Privacy Policy from time to time. Where changes are material, we will take reasonable steps to notify you. The "last updated" date at the top of this page reflects the most recent revision.
For any questions about this document, contact us at info@deebo.co.jp.