Privacy Policy for GDPR and CCPA

Last Updated:Aug 26th,2021

In accordance with this Privacy Policy, CREEK & RIVER Co., Ltd. (hereinafter referred to as “C&R”), will process Personal Information (in this Privacy Policy, it means “Personal Data” defined in General Data Protection Regulations (hereinafter referred to as “GDPR”) and “Personal Information” defined in California Consumer Privacy Act (hereinafter referred to as “CCPA”) of residents in the European Economic Area (hereinafter referred to as “EEA”) or California (hereinafter referred to as “Users”) who use C&R’s products or services (hereinafter referred to as “Services”)) under GDPR and CCPA in addition to the “Personal Information Protection Policy” and “Handling of Personal Information” of C&R (Please confirm here. URL:, hereinafter collectively referred to as “Personal Information Protection Policy etc. “). This Privacy Policy is made for reference purpose of Japanese version of this Privacy Policy. In the event of any difference from the Japanese version of this Privacy Policy, the Japanese version shall prevail to the extent applicable.

1.Applicable relationship

Terms not defined in this Privacy Policy is subject to the Terms of Use, guidelines, and Personal Information Protection Policy etc. by C&R according to Services used by User. Provided, however, that in the event of any conflict between the documents and this Privacy Policy, this Privacy Policy shall prevail.

2.Personal Information to be obtained

(1)C&R may obtain the following Personal Information from Users of Services.

  1. Name and address
  2. E-mail address
  3. User ID and password
  4. IP address, browser and operating system information, Cookie information, and access history of website
  5. Telephone number and fax number
  6. Company name, university name, department name, and title where Users affiliated
  7. The address of the company or university where Users affiliated
  8. Contents of inquiries to C&R
  9. Membership registration information, information on employment, resumes,employment history, Users’ previous works (hereinafter referred to as “Work”), account information entered by the Users when using sharing service of Work, etc.

(2)C&R may acquire Personal Information in the event of any of the following actions by Users.

  1. In the event of registration in the Services
  2. When applying for employment through Service
  3. Other use of the Services
  4. When receiving information from an affiliate on transactions between Users and C&R or an affiliate of C&R

3.Purpose and Basis of Processing Personal Information

C&R will obtain and process Personal Information only for the purposes set forth below.
(1)Fulfillment of contracts or response to requests from Users prior to conclusion of contracts
If Users order for Service, C&R may process the User’s Personal Information to fulfill the contract. C&R will not process Personal Information beyond the limits necessary to fulfill the contract.
(2)Contact etc.
C&R may use Users’ Personal Information of to (i) contact Users regarding Services, (ii) inform Users of their accounts or information important regarding use of Service, and (iii) respond to complaints. If Users create an account for Service, C&R will save Personal Information so that Users do not need to enter Personal Information each time. Such processing of Personal Information is necessary for the fulfillment of contracts or for C&R ‘s general business.
C&R will not sent marketing emails without prior consent from Users, except for contact which is about services similar to orders Users have made in the past. Users have the right to unsubscribe the mail from C&R at any time. Such processing of Personal Information is necessary for C&R to contact Users and provide similar products and Services or is based on the prior consent from the Users.
(4)Customer service
If Users use Customer services, C&R may use Users’ Personal Information to provide Customer services. Such processing of Personal Information is necessary for the fulfillment of contracts or for C&R’s general business.
(5)Application for employment
If Users apply for employment through Services, C&R may use Users’ Personal Information to respond to such application. Such processing of Personal Information is necessary for C&R to recruit employees who work at C&R.
(6)Legal requirements
In addition to the above, C&R may process Personal Information to comply with laws and regulations.

4.Rights of residents in the EEA

Users who are residents in the EEA have the following rights under GDPR with respect to their Personal Information if they meet GDPR requirements.
(1)Right to withdraw consent to the acquisition of Personal Information
Even if C&R has obtained Personal Information with the consent of Users, the Users may withdraw such consent at any time. If Users withdraw their consents, Users may not be able to use all or part of the Services.
(2)Right to access information relating to the handling of Personal Information
Users may request explanations of Personal Information held by C&R, the purpose of use of the information, and instructions on how to use the information through procedures designated by C&R. Users may also receive a copy of their Personal Information.
(3)Right to delete personal information
Users may request the deletion of Personal Information handled by C&R. Provided, however, this shall not apply to the following cases:

  1. Cases necessary to comply with legal obligations
  2. Cases where there are justifiable business purposes
  3. Cases required for proof, exercise or defense concerning legal claims

(4)Right to rectify or amend Personal Information
If Personal Information acquired by C&R is inaccurate, Users may request that C&R change, add, or modify the Personal Information in accordance with procedures separately specified by C&R.
(5)Right to object to or restrict use of Personal Information
Users may require C&R to suspend use of all or part of Users’ Personal Information or to restrict its use thereof. In addition, Users may file an objection to the supervisory authority in EEA or C&R regarding the handling of Personal Information by C&R.
(6)Right to data portability
Users may receive Personal Information provided from Users to C&R in structured, commonly used, mechanically readable form and may transfer the Personal Information to other administrators without disturbing by C&R. Provided, however, that such right shall be limited to those provided pursuant to the consent or contract of Users and the handling of Personal Information shall be performed by an automated means.

5.Rights of residents in California

Users who are residents in California have the following rights under CCPA with respect to their personal data if they meet CCPA requirements: In this case, C&R will comply with Users’ requirement for rights below within 45 days in accordance with regulations of CCPA.

(1)Right to access information relating to the handling of Personal Information
Users may request to disclose the following Personal Information of Users collected by C&R during the past 12 months up to twice in a 12-month period.

  1. Categories of personal information collected by C&R regarding Users
  2. Categories of information sources pertaining to the Personal Information
  3. The purpose the collection of the Personal Information
  4. Category of the third party who shared the Personal Information
  5. Categories pertaining to Personal Information of Users disclosed by C&R for business purposes and categories related to third parties to whom C&R disclosed for business purposes

(2)Right to delete Personal Information
Users may request the deletion of personal data collected by C&R from Users, under CCPA.
(3)Right to opt out the sale of Personal Information
Users may request that C&R cease to sell their Personal Information, or may request that C&R not sell Personal Information in the future. However, C&R does not sell Personal Information for residents in California.
(4)Refusal of discriminatory treatment
C&R does not treat Users improperly in exercising or exercising the above rights or discriminate against other Users.

6.Providing and sharing Personal Information

C&R may have to share Personal Information with the following third parties for the purpose of processing Personal Information described in this Privacy Policy.

  1. C&R Group companies
  2. Professional experts, such as lawyers, certified public tax accountants, and imperial accountants
  3. Financial institutions
  4. Current, past and future employees
  5. Service providers and suppliers
  6. Courts, investigative organizations and other public authorities

7.Retention and storage of information

C&R shall store information of Users for the term necessary for the fulfillment of the purpose of use or for the period specified by applicable laws and regulations etc. with regard to information of the users. Personal information will be promptly deleted after the purpose is fulfilled or after the period specified by applicable laws and regulations etc. However, in order to comply with its legal obligations and to protect its rights and interests, C&R may store or use information of the Users.

8.Transfer of Personal Information to a third country

C&R may transfer Personal Information acquired within the EEA to Japan or other EEA or non-EEA countries if necessary. In addition to countries recognized by adequate decision under GDPR such as Japan, transfer destinations may include countries without adequate decision. However, when transferring Personal Information of Users to countries without adequate decision, C&R will transfer only to countries that have obtained appropriate explicit consent from Users or concluded contracts that include Binding Corporate Rules under GDPR or Standard Contract Clause that are legitimate under GDPR, except in cases where the transfer is permitted outside the region based on GDPR.

9.For children under the age of 16

C&R will not intentionally obtain or process Personal Information of children under the age of 16 without parental permission and consent. C&R will take steps to delete the information as soon as possible if it discovers that it has collected and processed personal information of children under the age of 16 or under the age of a minimum of the same effect of GDPR, depending on the legislation of the European Union.

10.Cookies etc.

C&R uses Cookies to ensure that Service functions properly. Please refer to the following for details.

11.Change in this Privacy Policy

C&R may amend this Privacy Policy on a regular basis. Please confirm the applicable provisions periodically at Users’ responsibility. If any provision of this Privacy Policy conflicts with any law or regulation, such provision shall be replaced by a similar provision reflecting such intention to the extent permitted by law or regulation. In such event, the other provisions shall remain in full force and effect without modification.

12.Contact information

For questions, complaints, and the exercise of the rights set forth in this Privacy Policy, please find the following contact information:
For details of the procedure for exercising the rights, please refer to the following.

Personal Information Consultation Center of Creek & River Co., Ltd.