Privacy Policy

• Personal information handling business operator: SOLA INTERNATIONAL K.K.
• Address: 7-14-9 Minami-Aoyama, Minato-ku, Tokyo, Japan
• Contact desk: Tokyo Limousine Service Privacy Desk
• Inquiries and requests concerning personal information: Contact Form

This Policy applies to the following services:

• Our website and landing pages
• Our booking platform, including booking.tokyolimoservice.com
• Inquiry forms
• WhatsApp and online chat provided by us
• Member accounts
• Quotations, bookings, payments, dispatch, operation management, and related customer support

Where an external business operator handles personal information for its own purposes and under its own responsibility, that operator’s privacy policy also applies.

We collect the following information to the extent necessary to provide the Services.

3.1 Information About Bookers and Passengers

• Names of bookers and passengers
• Email address of the booker
• Telephone numbers of bookers and passengers
• Company name
• Billing address and information required to issue receipts
• Name of the representative passenger when only minors will travel
• Whether a child seat is required

3.2 Booking, Operation, and Transaction Information

• Pickup locations, drop-off locations, and stopovers
• Service date, pickup time, and other operation dates and times
• Flight information, including airline, flight number, and arrival or departure time
• Number of passengers, number and size of luggage items, and preferred vehicle type
• Special accommodations or requests
• Quotation details, booking history, service history, cancellation history, and booking change history
• Amounts billed, payment method, and the status of receipts, payments, and refunds

3.3 Member Authentication Information

A member’s email address is used as the login ID. When password login is used, we store only a bcrypt-hashed value of the password and do not store the password in plaintext or in a recoverable form.

When Google or LINE login is used, we collect the identifiers, authentication information, and information provided by the relevant service that are necessary for authentication. Login using a one-time link sent by email is also available. We do not store the member’s password for these login methods.

Members may optionally enable two-factor authentication using an authenticator app.

3.4 Inquiry and Communications Information

We collect the content of communications, attachments, and response history exchanged through inquiry forms, email, SMS, WhatsApp, and our online chat. We do not record telephone calls.

Messages in our online chat are stored in the booking system database. Administrators may export chat content as a PDF before deletion when necessary.

3.5 Payment Information

Payment instrument information, including credit card details, is entered directly on Stripe’s payment screen. We do not collect or store card numbers, expiration dates, or security codes.

Depending on the payment method selected and our settings, Stripe may collect or process the following information:

• Card number, expiration date, security code, and other payment instrument information
• Name, email address, and billing address
• Transaction information, including the merchant, purchase amount, payment date and time, order number, and details of the goods or services
• Fraud-prevention and authentication information, including IP address, approximate location inferred from the IP address, device and browser information, device identifiers, cookies, and usage data
• Telephone number, shipping address, tax information, or custom fields, depending on our settings or the selected payment method

We may receive from Stripe the payment result, amount paid, booking number, and other information necessary to administer payments.

For bank transfers, we confirm the remitter name shown on the transfer statement, but we do not seek to collect the customer’s bank account number or other account information.

3.6 Website and System Usage Information

• IP address
• Browser, operating system, device, and other technical information
• Date and time of access, pages viewed, and referring URL
• Cookies, similar identifiers, and cookie preference information
• Logs relating to login, operations, changes, errors, and security
• Website usage information collected through Google Analytics 4
• Search performance information provided through Google Search Console

We do not collect or store GPS location information during a ride.

Please see our separate Cookie Policy for details about cookies and external transmissions.

3.7 Drive Recorders

Vehicles operated by hire car or bus companies to which we outsource transportation may be equipped with drive recorders for safe operation, accident prevention, and responding to accidents, complaints, and disputes. The recording range, whether audio is recorded, and the method of management vary by vehicle or operator.

Drive recorder recordings are generally managed by the relevant operator and are normally deleted within one month after completion of the service. However, where necessary in connection with an accident, complaint, dispute, insurance matter, or other response, they are retained only for as long as necessary for that response. If we receive a recording, we likewise use it only to the extent necessary for the relevant purpose and delete it when retention is no longer necessary. Please contact our Privacy Desk for details concerning the vehicle used for your service.

3.8 Information Not Collected During Ordinary Bookings

For ordinary bookings, we do not collect dates of birth, ages, driver’s license numbers, passport numbers, residence card numbers, or other official identification numbers. However, when we receive a request concerning personal information from an individual or a representative, we may ask for the minimum identification documentation necessary to verify the individual’s identity or the representative’s authority.

In addition to obtaining information from customers themselves, we may obtain information from bookers, travel agencies, hotels, concierge companies, event companies, corporate general affairs or secretarial personnel, family members, acquaintances, or others whom the customer has asked to arrange a booking.

When a person other than the passenger makes a booking, the booker must inform the passenger of this Policy, obtain any necessary authority or consent, and provide accurate information.

We use the information we collect for the following purposes:

• To provide the Services, including quotations, booking acceptance, identity verification, dispatch, transportation, and boarding and alighting assistance
• To communicate regarding booking details, vehicle arrangements, operational changes, meeting arrangements, lost property, and similar matters
• To create and administer member accounts and display registration information and service history
• To bill fees, process payments and refunds, issue receipts, and conduct accounting and tax processing
• To respond to inquiries, requests, complaints, and requests concerning personal information
• To prevent and investigate fraudulent bookings, fraudulent payments, violations of terms, unauthorized access, and similar conduct, and to ensure the security of the Services
• To analyze booking and usage trends and website usage, and to improve the Services, plan new services, and manage quality
• To create, use, or publish statistical information that does not identify individuals
• To send advertisements and information about campaigns, discounts, new services, and similar matters where the customer has voluntarily consented
• To comply with legal obligations and respond to lawful inquiries from public authorities
• To respond to accidents, complaints, and disputes, and to exercise or defend our rights or those of third parties
• To protect the life, physical safety, or property of a person in an emergency such as sudden illness, an accident, or a disaster
• To consider or implement a merger, company split, business transfer, or other business succession

If we change a purpose of use, we will do so only to the extent reasonably related to the original purpose and will provide notice or make a public announcement in accordance with applicable law.

We send marketing emails about campaigns, discounts, new services, and similar matters only to members who have separately given voluntary prior consent apart from member registration. Consent to marketing emails is not a condition of registration or booking. You may unsubscribe or withdraw consent at any time using the method stated in the email or through the Contact Form.

Booking confirmations, operational changes, payment and security notices, material changes to the Terms of Use or this Policy, service suspensions, and other communications important to a contract or the Services will be sent to the relevant persons regardless of whether they have consented to marketing emails.

To the extent necessary to achieve the purposes of use, we may outsource the handling of personal information to, or use services provided by, the following parties:

• Domestic hire car and bus companies
• Stripe, a payment service provider
• IONOS Inc., which provides the infrastructure for our booking system and email
• Squarespace, which provides our website
• Google, which provides Google Forms, Google Sheets, Google Drive, Google Analytics 4, Google Search Console, Google Maps, Google Places, and Google login
• Meta, which provides WhatsApp; LY Corporation, which provides LINE login; and other communications and authentication service providers
• Tax accountants, accounting firms, and other professionals
• Providers of servers, backups, communications, and other IT infrastructure

We operate our internally developed booking system on a virtual private server located in the United States and provided by IONOS Inc., and store booking data in the United States. We also use IONOS’s hosted email service located in the United States for our main mailbox.

Information entered into Google Forms is stored in or forwarded to Google Sheets, the notification email destination, and our booking system.

We may outsource operations to domestic transportation operators in order to provide hire car, bus, and other transportation services. In such cases, we provide only the information necessary for the operation from among the passenger’s name, telephone number, pickup and drop-off locations, date and time of use, flight number, number of passengers, luggage, and special requests.

In accordance with applicable law, we appropriately select service providers, limit the information entrusted and the purposes of use to what is necessary, and exercise other necessary and appropriate supervision, including ascertaining the security measures and handling practices of service providers.

In addition, we use service providers for operating the booking system, such as email delivery, push notifications, error monitoring, flight information lookup, machine translation of messages, and bot protection. Some of these providers process data in the United States or the European Union. We select providers that are contractually bound to protect personal information to a standard equivalent to the APPI and, where the GDPR applies, to standard contractual clauses or other appropriate safeguards. Information on the individual providers, the countries concerned and the measures taken is available on request through the Contact Form.

We do not provide personal data to third parties without the prior consent of the individual, except in the following cases:

• Where required or permitted by law
• Where necessary to protect a person’s life, physical safety, or property and it is difficult to obtain the individual’s consent
• Where particularly necessary to improve public health or promote the sound development of children and it is difficult to obtain the individual’s consent
• Where cooperation is necessary for a national or local government body, or a person entrusted by such a body, to perform duties prescribed by law, and obtaining the individual’s consent may impede performance of those duties
• Where provided in connection with a merger, company split, business transfer, or other business succession
• Where all or part of the handling of personal information is outsourced to the extent necessary to achieve the purposes of use
• In other cases permitted by law

We do not sell personal information or provide it to third parties in exchange for money or other consideration. We do not currently jointly use personal information with group companies or other parties.

Because we use IONOS, Google, Stripe, Squarespace, WhatsApp/Meta, and other external services, customers’ personal information may be stored or processed outside Japan. In particular, booking data and main email data are stored using IONOS services located in the United States. Other services may process information in countries where the relevant service provider or its subprocessor is located.

When we provide personal data to a business operator in a foreign country or outsource its handling to such an operator, we comply with Japan’s Act on the Protection of Personal Information and other applicable laws by providing required information and obtaining required consent, or by confirming that the recipient has established a system necessary to continuously implement measures equivalent to those required under Japanese law.

When personal data subject to the EU General Data Protection Regulation or the UK GDPR is transferred outside the EEA or the United Kingdom, we use an adequacy decision, standard contractual clauses, or another transfer mechanism permitted by applicable law.

To the extent permitted by law, customers may request information from our Privacy Desk regarding personal information protection measures in the destination country.

We retain personal information only for as long as necessary to achieve the purposes of use, and securely delete or anonymize information when it is no longer necessary to retain it. The principal retention periods or criteria used to determine them are as follows:

If an administrator exports our chat content as a PDF, that PDF is retained for the applicable period stated above as an inquiry record or service record, depending on its content.

Where an accident, dispute, unpaid amount, fraudulent use, legal claim, or legal retention obligation exists, we may extend retention of necessary information until the matter is resolved or the retention obligation ends. Data in backups is deleted in accordance with our prescribed rotation and secure-deletion procedures.

We use cookies and similar technologies to provide the Services, ensure security, save settings, and analyze usage. We use Google Analytics 4 and Google Search Console for analytics.

The cookie consent banner on the booking website was developed by us and supports Google Consent Mode v2. Non-essential analytics, advertising, or functionality cookies are not activated until the customer permits them. Customers may allow or reject cookies by category and may change their selection later. We do not use advertising pixels, and our social media features consist only of links.

Please see the separate Cookie Policy for details of cookie names, providers, purposes, categories, retention periods, destination countries, and methods of refusal.

To prevent leakage, loss, damage, unauthorized access, and similar incidents involving personal data, we implement the following security measures according to the nature and risks of the information handled:

• Establishing responsibility for handling personal information, reporting structures, and procedures for responding to leaks and similar incidents
• Restricting personnel and privileges with access to personal information to the minimum necessary
• Imposing confidentiality obligations and providing employees with education on personal information protection and security
• Providing individual accounts for each authorized person, using strong passwords, and applying multi-factor authentication
• Applying non-reversible bcrypt hashing to member passwords
• Offering optional two-factor authentication for members using an authenticator app
• Using HTTPS communications for the website, booking website, inquiry forms, chat, and transitions to Stripe for payment
• Using device screen locks, software updates, and measures against malware and unauthorized access
• Recording system access and change histories and reviewing suspicious access
• Creating regular backups, ensuring restorability, and restricting access
• Securely deleting data, accounts, and media that are no longer required
• Selecting service providers and reviewing their handling practices

You may request details of our security measures from our Privacy Desk, except for matters whose disclosure could interfere with security management.

If leakage, loss, damage, or unauthorized access involving personal data occurs or is suspected, we investigate the facts, prevent expansion of harm, determine the cause, and take measures to prevent recurrence. Where required by law, we report to the Personal Information Protection Commission or another supervisory authority and notify affected individuals.

In accordance with applicable law, individuals may make the following requests regarding their personal data held by us:

• Notification of the purposes of use
• Disclosure of personal data and records of provision to third parties
• Correction, addition, or deletion of content
• Suspension of use or erasure
• Suspension of provision to third parties

Please submit requests through the Contact Form. We verify identity by confirming the request through the registered email address, matching the booking number or telephone number, or using another method, and request presentation of identification documents only where necessary.

If identification documentation is required, we provide instructions on masking information that is unnecessary for verification. Identification documentation is deleted within 30 days after completion of the request.

For a request made by a representative, we require a power of attorney or other documentation confirming the representative’s authority, as well as identification documentation for both the individual and the representative.

As a rule, we respond within 30 days after identity verification is completed. If the investigation is complex, we notify the individual of the reason for the extension and the expected response date. The individual may choose disclosure by electronic data or postal delivery of paper documents. If the specified method would require substantial expense, is technically difficult, cannot be provided securely, or otherwise makes disclosure difficult, we explain the reason and disclose by an alternative method.

Requests are generally free of charge. If special postage, copying costs, or similar expenses arise, we may charge reasonable actual costs after giving prior notice.

We may be unable to grant all or part of a request where a legal retention obligation applies, where granting it may harm the rights or interests of the individual or a third party, where it would materially interfere with the proper conduct of our business, or in another case permitted by law. In that event, we provide the reason to the extent permitted by law.

Where EU, EEA, or UK data protection law applies, we process personal data on the following legal bases:

Subject to applicable law, affected individuals may request access to, correction or erasure of, or restriction of processing of their personal data; data portability; objection to processing based on legitimate interests; and withdrawal of consent. They may also lodge a complaint with the supervisory authority having jurisdiction over their place of residence, place of work, or the place of the alleged infringement.

We do not make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals. Even if an automated quotation or similar tool is used, a staff member confirms the final booking and arrangement.

We accept member registrations and bookings only from a parent, guardian, or adult. When only minors will travel, we collect the representative passenger’s name, whether a child seat is required, and other minimum information necessary for the operation. The booker must inform the minors and their parents or guardians of this Policy and obtain any necessary consent.

The Services may contain links to external sites or services not operated by us. Please review the relevant operator’s privacy policy regarding the handling of personal information at the linked destination.

We may revise this Policy in response to changes in applicable law or in our handling of personal information. For material changes, we provide notice before they take effect through a prominent notice on the website, a notice sent to the registered email address, or another appropriate method. Minor changes are announced by posting them on this page and changing the last-updated date.

The Japanese version of this Policy is the governing version. If there is any discrepancy between a translated version and the Japanese version, the Japanese version prevails to the extent permitted by law. This does not limit any individual rights under applicable mandatory law.

For inquiries regarding the handling of personal information, this Policy, cookies, security measures, international transfers, or individual rights, please contact:

SOLA INTERNATIONAL K.K.
Tokyo Limousine Service Privacy Desk
7-14-9 Minami-Aoyama, Minato-ku, Tokyo, Japan
Contact Form