JALPAK Basic Policy on Information Security and Personal Information Protection

n light of the importance of information security and personal information protection in an advanced information and communications society, JALPAK will endeavor to properly manage and protect the information held by our company in accordance with the JAL Group policy and the JQA (Japan Quality Assurance Organization) JIS Q 15001 Standard.

1. Compliance with laws and regulations

JALPAK will comply with laws and regulations, as well as policies and guidelines set by government agencies.

2. Prohibition of use for other purposes

With respect to dealing with the personal information, we will acquire and use such personal information as appropriate within the scope of purpose specified in advance, and will not handle personal information in such a way that exceeds the scope necessary to fulfill said purpose (use for other purposes).

3. Establishing a management system

We will establish an internal management system for the clear allocation of responsibilities.

4. Compliance with internal policies, regulations, guidelines, etc.

We will comply with the JAL Group policy, internal policies, internal regulations, guidelines, etc., as well as the JQA (Japan Quality Assurance Organization) JIS Q 15001 Standard.

5. Implementing safety measures

We will implement safety measures, and take other precautionary measures against unauthorized access to information, as well as the loss, destruction, falsification, and leakage of information.

6. Conducting educational and awareness activities

We will promote educational and awareness activities for our employees in efforts to improve understanding and raise awareness related to information management, so that information is properly managed.

7. Collaboration with outsourcing partners and suppliers

When outsourcing information management tasks to other companies, we will select personnel with sufficient experience and ability, and stipulate matters relating to our obligation of confidentiality in the work contract, to ensure that information is properly managed.

8. Efforts to improve operations

We regularly check that information is being properly managed and continuously conduct business improvement initiatives.

9. Threat monitoring and response to incidents

In the unlikely event of an incident, we will promptly disclose all necessary information while keeping any harm caused to a minimum, and take appropriate measures, including measures to prevent the incident from recurring.

10. Clarification of consultation services

We have established a consultation desk to address customer inquiries, complaints, and requests, and we will respond promptly and sincerely.

11. Disclosure of policies

This policy and other policies relating to information security and personal information protection will be made public on our website, etc.

End

Handling of Personal Information

JALPAK Basic Policy on Information Security and Personal Information Protection

1. Purpose of use of personal information and its provision to third parties

• (1) Personal information contained in applications submitted by customers when applying for travel shall be used by JALPAK and its contracted travel agents or their representatives (hereinafter "Distributors") to communicate with customers. Additionally, such information shall also be used by Distributors to the extent necessary within the scope of arranging travel services provided by transportation and accommodation organizations, etc. (major ones are listed for each plan, etc.), and to process the receipt of such services; fulfilling their contractual obligations to JALPAK and ensuring that the costs of accidents are covered by insurance; and ensuring customers' convenience when shopping at duty-free or souvenir stores at the travel destination.
  *JALPAK and its Distributors may also use customers' personal information to:
  a. introduce customers to products, services, and promotions from JALPAK, its Distributors, and their partner companies;
  b. ask customers for opinions and feedback about their trip;
  c. send surveys;
  d. offer benefits and services;
  e. create statistical materials (for sales analyses and other investigations and research, development and provision of new services and products);
  f. handle tasks, inquiries, etc., related to items a. to e. above.
• (2) The personal information to be obtained by JALPAK shall include your name, date of birth, age, gender, address, telephone number, fax number, e-mail address, passport number, and any other personal information to the minimum extent required for your travel plan in order for JALPAK to conduct the trip. In addition, in cases where special arrangements are required, such as accompaniment by a carer or provision of a wheelchair, JALPAK may obtain additional personal information other than the above for the purpose of making such arrangements (or informing that such arrangements cannot be made); this is considered to be within the scope necessary for JALPAK to make arrangements.
• (3) If you do not consent to JALPAK acquiring your personal information where necessary, JALPAK reserves the right to abstain from concluding a contract. Furthermore, not consenting may mean that JALPAK is unable to make your desired arrangements.
• (4) JALPAK and its agents (including overseas subsidiaries of JALPAK) shall provide customer information to transport and accommodation organizations in advance, including name, age, gender, telephone number, and other information, by electronic means, etc., to the extent necessary in order to make arrangements, as set forth in paragraph (1) of this section. In addition, only in the unlikely event of an accident will information be provided to insurance companies in written form to the extent necessary for insurance procedures.
• (5) We may provide customers' personal data to duty-free stores, souvenir stores, baggage carriers, etc., for the convenience of our customers at their destination. In such cases, personal data including customer names, passport numbers, and flight numbers will be provided in advance by electronic means, etc.

2. Personal Information Management and Protection

Based on our "JALPAK Basic Policy on Information Security and Personal Information Protection," we properly manage and protect our customers' personal information.

*Regarding Security Measures

(1) Organizational Security Measures

We have established a "Risk Management Committee" to determine policies and measures regarding information security and personal information protection within our company. We have also implemented a system to strictly separate and manage customer personal information from other information to reduce risks, and we have a system in place to respond quickly in the event of an accident.

(2) Human Security Measures

We conduct regular information security training for all employees and have obtained confirmation documents regarding the handling of personal data.

(3) Physical Security Measures

We manage employee access to areas handling important customer information to prevent unauthorized viewing of personal data. Furthermore, for systems handling customer personal data, we have implemented measures such as restricting internet access on accessible terminals.

(4) Technical Security Measures

We implement measures to protect systems handling personal data from unauthorized external access and malicious software, including measures to prevent information leaks and viruses. We also monitor for threats such as unauthorized access and virus infections 24 hours a day, 365 days a year.

(5) Understanding the External Environment

When providing personal data to foreign countries, we take necessary security measures after understanding the personal information protection systems of those countries.

3. Provision of personal information to outsourced service providers and its management

We may entrust the handling of personal information to a third party other than ourselves to the extent necessary to achieve the purpose of use. In such cases, we will appropriately manage and supervise the third party in accordance with Section 7 of the "JALPAK Basic Policy on Information Security and Personal Information Protection."

4. Regarding the joint use of personal data

We will share the personal data of our customers that we hold, including JMB customer number, name, date of birth, gender, address, telephone number or email address, travel details, and seminar details, with our group companies. Our group companies may use this information to provide information on their respective sales activities and events, to ship purchased products, and as reference for product development.

5. Disclosure, correction, deletion, or suspension of the provision of personal data held by JALPAK

If you wish to disclose personal data, correct, add or delete certain details, or if you would like us to stop using, erase, or cease providing personal data to third parties, etc., we will inform you of the necessary procedures. See 6. below for how to get in touch. Once you have contacted us, we will confirm your identity and take the necessary action without delay in accordance with laws and regulations. If we are unable to meet all or part of your request, we will inform you of the reason.

6. Entrusted work

If JALPAK is entrusted with a portion of another company's work, we will handle personal information to the extent necessary in order to perform the work as instructed by the contractor.

7. Credit card information

JALPAK shall collect and use credit card information to process payments for customers who wish to pay for our services by credit card, and to respond to inquiries regarding such transactions.

8. Point of contact for inquiries and complaints about personal information

If you have any inquiries or complaints regarding the handling of personal information, please contact:

JALPAK Co., Ltd.
Personal Information Customer Consultation,
2-4-11, Higashi-Shinagawa, Shinagawa-ku, Tokyo, Japan 140-8658
E-mail address: security.jpk@jal.com

GDPR Privacy Policy

This Privacy Policy sets out how JALPAK Co., Ltd. (trading as Experiences Japan Airlines) processes personal data of its customers in connection with its website at https://uk.jalvacations.jal.co.jp/ (link below) (“Site”), including the products and services that are offered through the Site
This Privacy Policy should be read in conjunction with the JALPAK Cookie Policy (link below) and Booking Conditions.

1. JAL Group Airlines

JALPAK is a part of the JAL Group Airlines which processes personal data pursuant to the JAL Group's Basic Policies for Information Security and Personal Data Protection.

2. Data Controller, Data Protection Officer and Representatives

Full details, including contact details, of JALPAK and its Data Protection Officer and UK Representative are set out here:

1. Personal Data Controller
   JALPAK Co., Ltd.
   Address: 2-4-11 Higashishinagawa, Shinagawa-ku, Tokyo, 140-8658
   E-mail: security.jpk@jal.com
2. Data Protection Officer
   Japan Airlines Group Data Protection Officer
   Address: 2-4-11 Higashishinagawa, Shinagawa-ku, Tokyo, 140-8637
   E-mail: dpo@jal.com

3. Purpose and Legal Basis for Processing Personal Data

JALPAK will process customers' personal data for the following purposes:

4. Personal Data Categories

JALPAK process customers' personal data necessary for the above purposes, including:

• Basic Data
  Name, address, contact details (TEL/FAX numbers, e-mail address), gender, date of birth, country/region of residence, passport number, credit card number, information on employment (company name, department, job title, address, TEL/FAX numbers), etc.
• Data for Making Reservations and Itineraries
  Reservation/boarding information (flight name, etc.), itinerary information, copy of e-ticket, EMD, (online) check-in, accompanying passengers, incidental services (upgrades, additional baggage, etc.), mailing address of items sent to customers, e.g. ticket, itinerary, etc.
• JMB Membership Data
  Membership number, member's service qualifications, membership region, accumulated mileage, data-related mileage awards, etc.
• Communications Data
  Records of communications with JALPAK (recordings of phone calls to the call center, records of responses to questions submitted via e-mail or web inquiry forms, etc. Where necessary, records of questions or complaints, etc. received at airport counters or when boarding may be kept)
• Data Collected from Websites and Apps, etc.
  Website access logs (IP address, Cookies, etc.) and data collected by apps, etc. Please see our Cookie Policy (link below) for further information.

Where a customer reserves the JALPAK' air transportation services via a third party such as travel agents or other airline companies, some of the above-stated personal data may be collected from such third party. This policy also applies to personal data collected in such ways.

■Collection and Use of Sensitive Personal Data

JALPAK may sometimes collect and use 'special category' or 'sensitive' personal data (such as data relating to health) in order to provide air transportation services. The collection and use of such personal data is limited to cases in which customers request special assistance when using air transportation services, and such data is not used for any other purpose. We process such personal data to ensure that we provide our services in accordance with our health and safety obligations and to establish, exercise or defend any legal claim that may arise in relation to accidents or incidents. We may from time to time share this information with our insurance providers.

■Examples of Processing Sensitive Personal Data

• Where requesting escort from check-in counter to departure gates for passengers that use a wheelchair or are visually impaired
• Where requesting rental medical oxygen bottles or permission to carry on a medical oxygen bottle
• When requesting permission to carry on syringes or other medical equipment for a chronic disease
• When a pregnant passenger requests to board a flight within 28 days of expected delivery date
• Where a customer requests a special inflight meal, etc., data may be processed that is not sensitive personal data but may indicate a customer's religious beliefs or state of health.

5. Refusal to Provide Personal Data

The provision of personal data on customers may in some cases be necessary for customers to be provided with services by JALPAK (air transportation services, JAL Mileage Bank services, etc.). JALPAK may not be able to provide a service in whole or in part if personal data is not provided.

6. Disclosure and Provision of Personal Data to other Companies

1. JALPAK disclose and provide customers' personal data to JAL Group companies to achieve the purposes stated in this privacy policy.
   Please refer to the following website for details on group companies.
2. Customers' data may be disclosed or provided to partner airlines or companies entrusted with ground handling and check-in operations to provide air transportation services such as when using code share flights or connecting flights, and to achieve purposes such as mileage accumulation.
3. Where customers have made reservations via a travel agent, customer data is disclosed and provided to such travel agent in relation to the reservation.
4. JALPAK share personal data with suppliers that assist it in processing payments and refunds.
5. Customers' data is transmitted to third party suppliers who provide IT systems and services, including data hosting services.
6. JALPAK may conduct surveys relating to their services, etc. using an external web service. When a customer answers a survey, some personal data on customers is disclosed or provided to the operator that provides the web service. When requesting a response to a survey JALPAK indicate the name of the operator and matters concerning the processing of personal data by the operator.
7. JALPAK may share customer personal data with specialist suppliers who assist it in managing its marketing database and sending out marketing communications and account-related communications.
8. JALPAK uses Google Analytics, a web analytics service provided by Google, Inc. (hereinafter referred to as "Google") to analyse use of its Site. JALPAK also uses third party advertising, marketing and data management service providers for persononalised advertising purposes. Cookies, web beacons, and other similar technology may be used to provide these services. The personal information that is colliected by these technologies may, as part of JMB and other services, be associated with information collected by services that identifies customers so as to develop a profile of customers and to provide more customized advertising. JALPAK use user attribute and interest category reporting functions that respond to Google's advertising functions. Customers can opt-out of these (suspend functions) at their discretion. Visit the following sites for an explanation of how to opt-out:
9. Where JMB member customers request exchange of awards, etc., customer data necessary to provide awards (address, etc.) is disclosed and provided to related corporations (award providers, delivery companies, etc.).
10. Where required by law, customer data relating to reservations and itineraries (including passport, visa, and API data) may be submitted to the customs authorities or immigration bureaus in the customers' countries to be flown from, into or over, or in countries of transit and transfer.
11. Personal data is shared with professional services firms who advise and assist in relation to the lawful and effective management of JALPAK and in relation to any disputes that may arise.
12. Customers' personal data may be disclosed or provided to law enforcement authorities, regulatory agencies or other third parties where necessary to comply with applicable laws and regulations and/or court order.

7. Transfer of Personal Data to Third Countries

JALPAK may transfer customers' personal data from within the United Kingdom and/or the EU/EEA to non-UK/EU/EEA countries and regions where there are establishments of JAL Group Airlines and/or its third party suppliers in order to achieve the purposes stated in this privacy policy.
In such case, except where the country or region is considered to have laws that adequately protect personal data, JALPAK uses standard data protection clauses to ensure that personal data is subject to appropriate protection.

8. Retention of Personal Data

JALPAK retain customers' personal data for the period necessary to achieve the purposes stated in this privacy policy. Records concerning boarding by customers, such as reservations records and ticket information, are normally retained after boarding for a maximum of three years.
For a JMB member, data is retained as membership data for a maximum 10 years after withdrawing membership, in addition to the period as a member. Furthermore, records concerning contracts and invoices are retained for the period necessary to meet legal obligations. If it is necessary for the establishment, exercise or defense of legal claims, we may keep personal data for a longer period.

9. Your rights and how to make enquiries

You may make the following requests concerning personal data retained by JALPAK:

• Right of access
  If you ask us, we will confirm whether we are processing your personal data and, if so, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may charge a reasonable fee for producing those additional copies.
• Right to rectification
  If the personal data we hold about you is inaccurate or incomplete, you are entitled to have it rectified. If we have shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you who we’ve shared your personal data with so that you can contact them.
• Right to erasure
  You can ask us to delete or remove your personal data in some circumstances, such as where we no longer need it or where you withdraw your consent (where applicable). If we have shared your personal data with others, we will let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we will also tell you who we have shared your personal data with so that you can contact them directly.
• Right to restrict processing
  You can ask us to “block” or suppress the processing of your personal data in certain circumstances such as where you contest the accuracy of that personal data or you object to us processing it for a particular purpose. This may not mean that we will stop storing your personal data but, where we do keep it, we will tell you if we remove any restriction that we have placed on your personal data to stop us processing it further. If we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly.
• Right to data portability
  You have the right, in certain circumstances, to obtain personal data you have provided to us (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer it to your chosen third party.
• Right to object
  You can ask us to stop processing your personal data, and we will do so, if we are: (i) relying on our own or someone else’s legitimate interest to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or (ii) processing your personal data for direct marketing purposes.
• Rights in relation to automated decision-making and profiling
  You have the right not to be subject to a decision when it is based on automatic processing, including profiling, if it produces a legal effect or similarly significantly affects you, unless such profiling is necessary for the entering into, or the performance of, a contract between you and us.
• Right to withdraw consent
  If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time. You can exercise your right of withdrawal by contacting us as set out below (procedure for making requests) or by using any other opt-out mechanism we may provide, such as an unsubscribe link in an email.
• Right to lodge a complaint with the supervisory authority
  If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, please contact us using the contact details provided in Section 10 below. You can also report any issues or concerns to a national supervisory authority in the Member State of your residence or the place of the alleged infringement. You can find a list of contact details for all EU supervisory authorities at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm (link below) . If you are in the United Kingdom, you can report any issues to the Information Commissioner’s Office (“ICO”). Contact details for the ICO can be found on its website at https://ico.org.uk (link below) .

■Procedure for Making Requests

Please send your request, including any applicable request form set out below, to JALPAK (or to its Data Protection Officer or its UK representative) using the contact details set out in Section 2 (Data Controller, Data Protection Officer and Representatives) above.

Download an application form from one of the following links: