NKB INC.
Personal Information Protection Manager: MOTOMIYA Yasuhiro
NKB INC. (the “Company”) establishes the following provisions (the “Provisions”) regarding the handling of personal information of users of the website “creare-art.com” operated by the Company (the “Site”) (the “Users”), which is obtained in connection with the Site and the services provided or introduced through the Site.
1. Personal Information We Collect
In connection with the operation of the Site and the acceptance of various applications and requests through the Site, including inquiries, production requests, studio visits, and Program applications, the Company may collect the following information.
- Information Provided by Users
• Name, company or organization name, department, job title, and other related information
• Address, telephone number, email address, and other contact information
• Details of inquiries, requests, applications, communication history, and other related information
• Information necessary for the operation of studio visits, Programs, and other activities, including emergency contact information, date of birth, information necessary for age verification, and information necessary for participant management - Information Collected by the Company When Users Access or Use the Site
• Access logs, IP addresses, browser information, device information, Cookies, and other online identifiers
When a User makes a payment by credit card, the payment is processed by a payment service provider. Therefore, except for information regarding whether the payment was successfully completed, the Company does not obtain credit card numbers or other credit card payment information.
2. Purposes of Use of Personal Information
The Company shall use personal information obtained in connection with the operation of the Site and the services provided or introduced through the Site for the following purposes:
- To respond to inquiries concerning the Site, verify the identity of Users, and communicate with Users, including sending responses
- To communicate and hold discussions regarding requests for art production, quotations, media coverage, and other requests; to send materials; to prepare and send quotations, proposals, and other documents; and to maintain and manage related records
- To accept applications for visits to CREARE Atami–Yugawara Studio, coordinate schedules, provide guidance on the day of the visit, make contact in emergencies, and manage the operation of studio visits
- To accept applications for courses, training programs, workshops, and other Programs; manage participants; coordinate schedules; process payments, confirm receipt of payments, and issue refunds; manage Program operations; and make contact in emergencies
- To communicate regarding Content on the Site, including introductions to artworks and activities; confirm permission for publication; and respond to applications to use images and other materials
- To maintain records of studio visits, courses, training programs, workshops, and other activities. When photographs or videos in which Users appear are taken and published on the Site, social media, brochures, or other media, the Company shall take appropriate measures as necessary, such as applying blurring
- To publicize and provide information about the Company’s activities through the Site, email, social media, and other media, and to send or distribute various notices and information
- To provide information to job applicants applying through the Site, verify their identities, and communicate with them, including sending responses
- To improve the convenience and functionality of the Site, analyze usage, prevent unauthorized use, and ensure security
- To perform activities incidental to the purposes of use listed above
Except where permitted by applicable laws and regulations, the Company shall not use personal information beyond the scope of the purposes of use stated above.
3. Use of Cookies and Similar Technologies
The Company may use Cookies and similar technologies to improve the convenience and functionality of the Site, analyze usage, and ensure security in accordance with the “Cookie & External Transmission Policy” separately published on the Site.
4. Provision of Personal Information to Third Parties
The Company shall not provide personal information to any third party without the prior consent of the User, except in the following circumstances:
- When required by laws or regulations
- When necessary to protect a person’s life, physical safety, or property and it is difficult to obtain the consent of the individual concerned
- When particularly necessary to improve public health or promote the sound development of children and it is difficult to obtain the consent of the individual concerned
- When it is necessary to cooperate with a national government agency, local government, or another entity in performing duties prescribed by laws or regulations, and obtaining the consent of the individual concerned may impede the performance of those duties
5. Outsourcing the Handling of Personal Information
The Company may outsource all or part of the handling of personal information to the extent necessary to achieve the purposes of use.
In such cases, the Company shall exercise necessary and appropriate supervision over the service provider.
6. Security Control Measures
The Company shall implement necessary and appropriate measures to prevent the leakage, loss, or damage of personal information and otherwise ensure the secure management of personal information.
7. Disclosure and Related Requests Concerning Personal Information
When an individual requests notification of the purpose of use; disclosure; correction, addition, or deletion; suspension of use; disclosure of records concerning provision to third parties; erasure; or suspension of provision to third parties, the Company shall respond appropriately.
An administrative fee of JPY 500 shall be charged for requests for notification of the purpose of use, disclosure, or other related procedures.
To submit a request for disclosure or a related procedure, please contact the Complaints and Consultation Desk specified below.
8. Voluntary Provision of Information
The provision of personal information by Users is voluntary. However, if a User does not provide the necessary information, the User may be unable to receive services provided or introduced through the Site.
9. Additional Provisions for Residents of the EEA and the United Kingdom
This Article applies to Users located in the European Economic Area (EEA) or the United Kingdom (the “European Users”) in accordance with the General Data Protection Regulation (GDPR) and applicable United Kingdom data protection laws.
In the event of any inconsistency between this Article and any other provision of these Provisions, this Article shall prevail.
- Legal Bases for Processing
The Company processes the personal data of European Users on one or more of the following legal bases:
• The European User has consented to the processing of their personal data. Consent may be withdrawn at any time.
• Processing is necessary for the performance of a contract with the European User or in order to take steps at the European User’s request before entering into a contract.
• Processing is necessary for compliance with a legal obligation to which the Company is subject.
• Processing is necessary for the legitimate interests pursued by the Company or a third party, except where the European User’s privacy rights and interests take precedence over those interests. - Rights of Data Subjects
European Users have the following rights regarding their personal data:
• Right of Access
The right to request access to the personal data concerning the European User held by the Company and to receive a copy of that data
• Right to Rectification
The right to request the correction of inaccurate or incomplete personal data
• Right to Erasure (Right to Be Forgotten)
The right, under certain conditions, to request the deletion of the European User’s personal data
• Right to Restriction of Processing
The right, under certain conditions, to request that the Company restrict the processing of personal data
• Right to Data Portability
The right to receive personal data provided by the European User in a structured, commonly used, and machine-readable format and to transmit that data to another controller
• Right to Object
The right to object to the processing of personal data based on the legitimate interests of the Company - Fees for Exercising Data Subject Rights
As a general rule, no fee shall be charged for exercising the rights specified in the preceding paragraph. Notwithstanding any other provision of these Provisions, the Company shall respond to such requests free of charge.
However, if a request from a European User is manifestly unfounded or excessive, particularly where requests are repetitive, the Company may charge a reasonable fee based on the administrative and management costs of responding to the request or may refuse to act on the request. - Transfers of Personal Data Outside the EEA and the United Kingdom
The Company is located in Japan, and the personal data of European Users will therefore be transferred to Japan, which is outside the EEA and the United Kingdom.
Japan has received adequacy decisions concerning the protection of personal data from the European Commission and the United Kingdom government. Based on these adequacy decisions, the Company shall appropriately protect and handle Users’ personal data. - Retention Period
⑤-1. General Principle
As a general rule, the Company shall not retain the personal data of European Users for longer than is necessary to achieve the applicable purposes of use.
⑤-2. Shortening of the Retention Period
When a European User or another person exercises the European User’s privacy rights, the relevant personal data may no longer be retained.
In such cases, the period during which the Company processes the personal data may be shorter than the period specified under “General Principle.”
⑤-3. Extension of the Retention Period
In exceptional circumstances, the Company may process the personal data of European Users for a longer period.
In such cases, the period during which the Company processes the personal data may be longer than the period specified under “General Principle.”
This may apply when the Company needs to process the personal data of European Users for a longer period after considering any of the following:
• A statutory minimum retention period applicable to the Company that requires longer retention, or another specific legal obligation
• Practical or operational requirements
• Legal proceedings
• The right to freedom of expression and information
• Tasks carried out in the public interest or in the exercise of official authority vested in the controller
• Public health - Right to Lodge a Complaint with a Supervisory Authority
European Users have the right to lodge a complaint regarding the Company’s handling of personal data with a data protection supervisory authority in the EU Member State of their habitual residence, place of work, or the place in which the alleged infringement of the GDPR occurred. - Inquiries and Exercise of Rights under EEA and United Kingdom Data Protection Laws
To exercise rights under EEA or United Kingdom data protection laws or to submit an inquiry concerning this Article, please contact the Complaints and Consultation Desk specified below.
10. Complaints and Consultation Desk Concerning the Handling of Personal Information
NKB INC.
Tokyo Takarazuka Building
1-1-3 Yurakucho, Chiyoda-ku, Tokyo 100-0006, Japan
Tel: 03-3504-2100
Fax: 03-3504-2101
11. Amendments
The Company shall review the content of these Provisions as appropriate and endeavor to improve them.
Except where otherwise provided by laws, regulations, or these Provisions, the Company may amend these Provisions.
The amended Provisions shall take effect when the Company notifies Users by a method designated by the Company or publishes them on the Site.
12. Accredited Personal Information Protection Organization
The Company is a covered business operator of the Japan Institute for Promotion of Digital Economy and Community (JIPDEC), an accredited personal information protection organization.
JIPDEC accepts complaints and consultations concerning the handling of personal information by its covered business operators.
[Contact]
Office of the Accredited Personal Information Protection Organization
Japan Institute for Promotion of Digital Economy and Community (JIPDEC)
Roppongi First Building, 12F
1-9-9 Roppongi, Minato-ku, Tokyo 106-0032, Japan
Tel: 03-5860-7565 / 0120-700-779
Established on June 30, 2026
