1. Who We Are
This Privacy Policy applies to the global English website of TAJIMA ROOFING INC. (“TAJIMA”, “we”, “us”, or “our”), operated by:
Company Name
TAJIMA ROOFING INC.
Address
Tajima Building, 3-11-13 Iwamotocho, Chiyoda-ku, Tokyo, Japan 101-8575
Representative
President and CEO, Yukio Matsubara
This Privacy Policy describes how we collect, use, store, and protect personal data submitted through the contact form on our global website. It also describes the rights available to you under applicable data protection laws, including the EU General Data Protection Regulation (“GDPR”) and the UK GDPR.
2. What Personal Data We Collect
When you submit the contact form on our website, we collect the following information:
| Data Field |
Purpose |
Required |
| Full Name |
To identify who is contacting us |
Required |
| Company Name |
To understand the context of the inquiry |
Required |
| Country |
To route your inquiry to the appropriate contact |
Required |
| Email Address |
To respond to your inquiry |
Required |
| Phone Number |
For follow-up contact if necessary |
Optional |
| Message / Inquiry Content |
To understand and respond to your request |
Required |
We also collect standard technical data automatically when you visit our website, such as IP address, browser type, and pages visited, for the purpose of website security and analytics. This data is not linked to your personal identity.
3. Legal Basis for Processing (GDPR Article 6)
We process your personal data on the following legal bases under the GDPR:
| Legal Basis |
Applicable Situation |
| Article 6(1)(b) — Performance of a contract / pre-contractual steps |
When you submit a contact form requesting product information, samples, or business inquiries |
| Article 6(1)(f) — Legitimate interests |
For website analytics and security monitoring to maintain and improve our online services |
| Article 6(1)(a) — Consent |
For non-essential cookies, where your explicit consent is obtained via the cookie consent banner |
4. How We Use Your Personal Data
We use the personal data you provide exclusively for the following purposes:
- —Responding to your inquiry or request
- —Routing your inquiry to the appropriate regional contact or authorized distributor
- —Sending a confirmation email acknowledging receipt of your inquiry
- —Following up on your request if necessary
We do NOT use your personal data for:
- —Direct marketing or promotional emails without your explicit consent
- —Automated profiling or decision-making
- —Sale or transfer to unrelated third parties
- —Any purpose beyond responding to your specific inquiry
5. Data Storage and Retention
Storage Location
Your personal data is processed via Google Apps Script (a Google Cloud service) and delivered to our internal team via notification. Google LLC acts as a data processor under a Data Processing Agreement (DPA) that includes Standard Contractual Clauses (SCCs) as approved by the European Commission, ensuring GDPR-compliant handling of your data. For details on Google's data processing practices, please refer to Google's Privacy Policy and DPA at
https://policies.google.com
Retention Period
We retain your personal data only for as long as necessary to fulfill the purpose for which it was collected:
| Data Type |
Retention Period |
| Contact form submissions |
Up to 2 years from the date of submission, or until the inquiry is resolved |
| Website analytics data (anonymized) |
Up to 26 months (standard Google Analytics retention) |
| Cookie consent records |
Up to 12 months |
After the applicable retention period, your data will be securely deleted or anonymized.
6. Sharing of Personal Data
We do not sell your personal data. We may share your data only in the following limited circumstances:
| Recipient |
Purpose and Safeguards |
| Authorized regional distributors |
Where local follow-up is required and you have given consent in the contact form, your contact information may be shared with our authorized distributor in the recipient country shown in the form or otherwise separately confirmed with you. The applicable protection regime depends on that recipient country (for example, GDPR in the EU/EEA, UK GDPR, Switzerland’s nFADP, Japan’s APPI, or other local privacy laws), and distributors are bound by confidentiality obligations. |
| Google LLC (Google Apps Script / Workspace) |
Used for processing and routing contact form submissions. Google acts as a data processor under a Data Processing Agreement (DPA) compliant with GDPR Article 28. |
| Legal or regulatory authorities |
Only where required by applicable law or court order. |
Where personal data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) as approved by the European Commission, or reliance on an adequacy decision.
7. Cookies and Tracking Technologies
Our website uses cookies and similar technologies. We distinguish between:
| Cookie Type |
Consent Required |
Purpose |
| Essential / Strictly Necessary |
No |
Required for basic website functionality (e.g., cookie consent preference storage) |
| Analytics |
Yes |
Website traffic analysis to improve our services (e.g., Google Analytics) |
| Functional |
Yes |
Enhanced website features and personalization |
If you are accessing our website from the EU, EEA, UK, or Switzerland, a cookie consent banner will be displayed upon your first visit. You may accept all cookies, or choose essential cookies only. You can update your cookie preferences at any time by clearing your browser cookies and revisiting the site.
8. Your Rights Under the GDPR
If you are located in the European Union, European Economic Area, or the United Kingdom, you have the following rights regarding your personal data:
| Right |
Description |
| Right of Access (Art. 15) |
You may request a copy of the personal data we hold about you. |
| Right to Rectification (Art. 16) |
You may request correction of inaccurate or incomplete personal data. |
| Right to Erasure (Art. 17) |
You may request deletion of your personal data, subject to our legal obligations. |
| Right to Restriction (Art. 18) |
You may request that we restrict the processing of your data in certain circumstances. |
| Right to Data Portability (Art. 20) |
You may request your data in a structured, machine-readable format. |
| Right to Object (Art. 21) |
You may object to processing based on legitimate interests. |
| Right to Withdraw Consent (Art. 7) |
Where processing is based on consent, you may withdraw it at any time without affecting prior processing. |
To exercise any of these rights, please contact us at:
intl@tajima.co.jp
We will respond to your request within 30 days. In complex cases, this period may be extended by a further two months, and we will notify you accordingly.
You also have the right to lodge a complaint with your local data protection supervisory authority. For EU residents, a list of supervisory authorities is available at:
https://edpb.europa.eu
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, or alteration. These measures include:
- —Access controls limiting data access to authorized personnel only
- —Encrypted transmission of data via HTTPS
- —Regular security assessments of our systems
- —Incident response procedures in the event of a data breach
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and, where required, notify affected individuals without undue delay.
10. Children’s Privacy
Our website and services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately at
intl@tajima.co.jp
and we will delete such data promptly.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last updated” date at the top of this page. We encourage you to review this Privacy Policy periodically. Continued use of our website after any changes constitutes acceptance of the updated policy.
12. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or the handling of your personal data, please contact:
Department
International Business Division （海外事業室）
Postal Address
TAJIMA ROOFING INC., Tajima Building, 3-11-13 Iwamotocho, Chiyoda-ku, Tokyo, Japan 101-8575
Response Time
Within 30 days of receipt
This Privacy Policy is governed by the laws of Japan. For EU/EEA residents, the GDPR applies in addition to Japanese law where applicable.
13. EU Representative (GDPR Article 27)
As TAJIMA ROOFING INC. is established in Japan and does not maintain a physical presence in the EU/EEA, we are in the process of appointing an EU-based representative in accordance with Article 27 of the GDPR.
Until a formal appointment is made, all data protection inquiries from EU/EEA residents should be directed to:
Contact
International Business Division（海外事業室）
This section will be updated once the EU Representative has been formally designated.
14. Japanese Domestic Website
Our Japanese domestic website (flooring.tajima.jp) is operated separately and is intended exclusively for users located within Japan.
- —The domestic site is governed by Japanese law (Act on the Protection of Personal Information / APPI) and does not apply GDPR standards.
- —Form registrations, sample requests, catalog orders, and other interactive services on the domestic site are not available to users outside Japan.
- —Consent mechanisms and terms of use on the domestic site are configured for Japan-based users only.
If you are located outside Japan, please use this global website for all inquiries and requests.
Internal Review Note — Remove before publishing
The following items require confirmation before this policy is finalized:
Confirm whether Google Apps Script data is stored solely in Japan or may transit through overseas Google servers. If overseas, SCCs with Google must be explicitly referenced. → Resolved. Policy text updated to reference Google DPA + SCCs.- Confirm the authorized distributor list and whether any distributors are located in the EU/EEA. If so, confirm DPA or SCC arrangements are in place.
Confirm the final URL of this page for insertion into the website HTML placeholder. → Resolved. Privacy Policy is now linked from the contact form, footer, and cookie banner.- Confirm whether a dedicated EU Representative is required under GDPR Article 27. → In progress. Placeholder added in Section 13; update with formal representative details once appointed.
- Replace Google Analytics Measurement ID placeholder (
G-XXXXXXXXXX) with actual GA4 ID in the cookie consent script.
- Integrate a certified CMP tool (e.g., OneTrust, Cookiebot, CookieYes) to replace the built-in cookie banner for full IAB TCF 2.0 compliance.
