Chapter 1. Handling of Personal Information in ANA GranWhale

1. Handling of Personal Information

• ANA NEO, Inc. (“ANA NEO”) obtains and uses personal information when hosting the ANA GranWhale virtual platform service.
• Definitions of terms not expressly defined in this Policy shall be as in the Act on the Protection of Personal Information.
• When handling personal information, ANA NEO complies with the Act on the Protection of Personal Information, ordinances for enforcement of the said act, enforcement rules for the said act, and other applicable legislation and guidelines, and endeavors to provide a convenient, safe and secure service for users.
• In regard to matters not prescribed in this Policy, ANA NEO shall use the personal information of users within the scope necessary, in accordance with the ANA NEO Privacy Policy. In the event the content of this Policy differs from the ANA NEO Privacy Policy, this Policy shall be applied with priority.

2. Personal Information to be Obtained

• ANA NEO obtains the following information when the user uses the Service.
  • Information on the terminal on which the app is used (OS, type, browser, language setting on terminal being used, advertising identifiers, IP addresses, etc.)
  • History of usage of the Service (Premium V-TRIP and V-TRIP usage history, V mile acquisition and usage history, Sky Mall purchase service usage history, app functions that are used, dates and times of app usage, other logs and action history, etc.)
  • Inquiry history, information from surveys, information from contest entries
  • Information concerning cookies and similar technologies when the Service is used
• ANA NEO obtains the following information that is voluntarily entered in the Service by the user.
  • Email address
  • ANA Mileage Club member registration information (ANA Mileage Club member number, name, date of birth, gender, residential address, email address, existence or non-existence of ANA card, credit card type, credit card brand, number of miles, number of Sky Coins, premium member status, etc.)
  • Name
  • Date of birth
  • Gender
  • Residential address
  • Telephone number
  • Payment information, etc., including details on the payment method, such as credit card
  • Information voluntarily provided by the user in response to surveys conducted in the Service (for example, marital status, household composition, presence or absence of child(ren), age of child(ren), occupation, official position, address, type of residence, nearest railway station, means of commute, final academic history, annual income, household annual income, habits, and lifestyle and similar particulars)

3. Purpose of Use

The purposes of use of personal information by ANA NEO are set forth below.

• Smooth provision, operation, and maintenance of the Service
  • To confirm the identity of the user
  • To manage the marketing, exchange, award, and use of V miles
  • To manage the marketing and use of products and services
  • To perform such transactions, including those for the reservation, purchase, and shipping of products and services
  • To provide and communicate various types of information to users
  • To respond to inquiries from users
• Performance of various analyses; development and improvement of the Service, etc.
  • To examine and analyze Service usage history, in order to improve the Service and develop new services
  • To examine and analyze Service usage, in order to conduct marketing analyses and other analyses
  • To examine and analyze the usage history of the Service, in order to provide content that addresses the needs and interests of users
  • To analyze information, such as viewing history, purchase history, and Service usage history. After encryption of the results of various analyses to ensure that individuals cannot be identified, to use such information at ANA NEO, and provide it to third parties
  • To conduct other surveys and analyses
• Provision of information on services and products offered by ANA NEO, group companies of ANA HOLDINGS INC. (“ANA Group companies”), JP GAMES, Inc., partner companies, etc.
  • To provide users with relevant information in such forms as notices and advertising concerning services and products offered by ANA NEO, ANA group companies, JP GAMES, Inc., partner companies, etc. (including information on events and promotions).
  • To recommend to users’ services and products that are currently being considered by ANA NEO, ANA group companies, JP GAMES, Inc., partner companies, etc.
  • To deliver information, including notices and advertisements that address the needs and interests of the user.
• Promotion of appropriate use and security improvements
  • To issue communications as necessary, regarding such things as notices for Service maintenance and important updates
  • To identify users who violate this Policy or the Terms of Use of the Service, or who attempt to use the Service for illicit or unlawful objectives, and to stop such use
  • To permit individual users to view, change, and delete their registration information, and to monitor their usage status
• Other
  • Other purposes incidental to the purposes of use described above

4. Acquisition of personal-related information

ANA NEO may receive personal-related information about customers from ANA Group companies, JP GAMES, Inc., and other third parties.
(Example) Obtaining advertising identifiers from third parties or ANA Group companies, and JP GAMES, Inc. for advertising distribution
If we will link such personal-related information to customer personal information held by ANA NEO and use it as personal information, then we will obtain the consent of the customer in advance and handle the information appropriately in accordance with the purpose of use specified in "3. Purpose of Use" unless we have specified another purpose.

5. Outsourcing

• When providing the Service to users, ANA NEO may outsource all or part of business operations relating to handling personal data in ANA NEO’s possession to other business operators (“Business Contractors”), and in conjunction with this, may provide personal data to Business Contractors within the scope required to achieve the purposes of use.
• In the case of the preceding Paragraph, ANA NEO, upon selecting appropriate Business Contractors, will enter into an agreement with the said Business Contractors for handling users’ personal data, and will appropriately manage and supervise the Business Contractors.

6. Joint Use

ANA NEO jointly uses users’ personal data as described below.

Extent of joint users	ANA group companies, and JP GAMES, Inc. (“Joint Use Companies”)
Purposes of use of using entities	To market products and services offered by ANA NEO, Joint Use Companies, and Marketers, Etc.; to provide travel services, such as tours and hotel services; advertising services; other products and services To send direct mail organized by ANA NEO or Joint Use Companies; to provide information on products and services; to conduct surveys, etc. To analyze marketing of ANA NEO and the Joint Use Companies; to conduct other forms of surveys and research; to develop new products and services After receipt of an inquiry, application for use, or other request from a user regarding products and services provided by ANA NEO and Joint Use Companies, to transmit and pass on such communications to the relevant companies For ANA NEO and Joint Use Companies to ensure appropriate and smooth transactions with users For ANA NEO and Joint Use Companies to ensure their operational management and internal management To promote other joint use within the scope of purposes of use set forth in Part 3 of this Chapter 1 (“Purpose of Use”).
Items of personal data subject to joint use	Items prescribed in Part 2 of this Chapter 1 (“Personal Information, etc., to be Obtained”)
Name, address and representative name of entity with responsibility for management of personal data	ANA NEO, Inc. (For address, name of representative and other company information, please refer to the link below) https://www.ana-neo.com/about/

7. Third Party Provision

• ANA NEO does not disclose or provide the personal data of users to a third party except for cases that fall under any of the following. In addition, discrete personal information that includes sensitive information of the user is not obtained except for cases that fall under any of the following, and shall not be disclosed or provided to a third party in any situation other than where prescribed by legislation, or when consented to by the user.
  • If the user has given their prior consent
  • If required by law or ordinance
  • If necessary for the protection of the life, person, or property of an individual, and it is impractical to obtain the consent of the user
  • If it is particularly necessary for the improvement of public health or to promote the sound development of children, and it is impractical to obtain the consent of the user
  • If it is necessary to cooperate with a national government agency, local government body, or entity contracted by either of these for the execution of an obligation prescribed in legislation, and if requesting the consent of the user could hinder the said execution
  • If the said third party is an academic research organization or the like, and if it is necessary for that third party to handle the said personal data for academic research purposes (including when part of the objective is for academic research, excluding where the rights and interests of the individual could be unduly infringed upon)
• For the cases set forth below, the recipient of the said personal data shall not be a third party, and the provision of the personal data shall not fall under the third-party provision prescribed in the preceding Paragraph.
  • If all or part of the handling of personal data is outsourced by ANA NEO to Business Contractors within the scope required for achieving the purposes of use, in accordance with Part 5 of this Chapter 1 (“Outsourcing”).
  • If the personal data is provided in conjunction with a merger or a business succession for some other reason
  • If the personal data is provided by ANA NEO to a Joint Use Company in accordance with Part 6 of this Chapter 1 (“Joint Use”)

8. Secure Management Measures

• Information which is obtained in the Service is managed on servers located in Japan that are managed by ANA NEO, partners or Business Contractors of ANA NEO (“Management Server”).
• ANA NEO ensures appropriate safeguards for personal information obtained from users, and endeavors to prevent leakage, loss, damage, and unauthorized access to user information. Please contact the Help Office mentioned in Part 12 of this Chapter 1 (“Contact Point for Inquiries”) for information on secure management measures taken by ANA NEO when managing personal information.

9. Handling of Personal Data Upon Withdrawal or Termination of Service Use

ANA NEO will continue to use information of users for whom the usage period of the Service has terminated (in addition to information stored on ANA NEO’s management server, this also includes information stored by Business Contractors), even after termination of the usage period of the said users. Such use will only be within the range of purposes of use as set forth in Part 3 of this Chapter 1, and only when such use is necessary. Efforts shall be made to delete user information without delay when use is no longer required relevant to the said purposes of use.

10. User Requests

The user, by requesting via the inquiry form on ANA NEO’s website may, with regard to their personal information, ask for notification of purpose of use, disclosures, corrections, etc., suspension of use etc., suspension of provision to third parties, and disclosure of third party provision records.

11. Liability

Except when there is willful or gross negligence on the part of ANA NEO, ANA NEO bears no responsibility for loss or damage incurred by the user with regard to handling of the user’s personal information.

12. Contact Point for Inquiries

Send opinions, questions, or other inquiries concerning the handling of personal information in the Service to the Help Office using the inquiry form on ANA NEO’s website.

13. Revisions of this Privacy Policy

In the event this Policy is changed, the Company shall post the revised Privacy Policy on its website.
In the event of a change arising to the purposes of use, usage method, and types of personal information of users prescribed in this Policy, Personal information is used only after consent is obtained from the owner user.

Chapter 2. Handling of personal information of EEA and UK residents in ANA GranWhale

This Chapter 2 provides additional information about the handling of personal information of customers and other individuals in the European Economic Area (“EEA”) and/or the United Kingdom (“UK”) in accordance with EU General Data Protection Regulation 2016/679 (“GDPR”) and the UK Data Protection Act 2018 (“DPA 2018”) and other national and international data protection and privacy laws (together, “Data Protection Laws”).
Please note that the UK’s laws are similar to those in the EEA, and customers from both jurisdictions have very similar rights. Accordingly, references to the GDPR in this Chapter should also be read as references to corresponding UK law.
A guardian’s consent or permission must be obtained in the event that a customer under the age of 16 uses ANA NEO’s service and consents to this Privacy Policy. The data subject’s consent to this Privacy Policy must be obtained in the event that a person such as family member applies for ANA NEO’s service on behalf of the data subject.
In the event that any provisions of this Chapter 2 contradict those of Chapter 1, the provisions of this Chapter 2 shall prevail.

1. The controller of personal information

The controller of your personal information is ANA NEO.
ANA NEO protects personal information which is collected and used by controllers (who make decisions about how and why your personal information is used) and processors (who act on the controller’s written instructions) on the basis of Data Protection Laws.

2. Personal Information to be Obtained

ANA NEO obtains personal information listed in Part 2 of this Chapter 1(“Personal Information to be Obtained”). Of the personal information stated in Part 2 of this Chapter 1, ANA NEO obtains ANA Mileage Club Membership Registration information from All Nippon Airways Co., Ltd.
When using services of ANA NEO, the user may be asked to provide ANA NEO certain data. If such data is not provided, it is possible such services cannot be provided to a user.

3. Our lawful basis for processing personal information

ANA NEO protects your personal information by ensuring that it can only be used to the extent necessary for specific purposes (as set out in Part 3 of Chapter 1 of this Privacy Policy) and by requiring that there is a lawful basis for each processing activity on the basis of Data Protection Laws. ANA NEO may process customer personal data on one or more of the following lawful bases:

• When your consent is obtained to the processing (Article 6(1)(a) GDPR)
  Consent will usually only be relied upon for promotional and marketing related processing, or in some cases, in relation to sensitive personal data.
• When processing is necessary in order to perform or take steps to enter into a contract (Article 6(1)(b) GDPR).
  This is typically why we process customer information which is essential to providing our services, including a customer’s identity, contact, payment and travel details, etc.
• ANA NEO needs to process the information to comply with a lawful obligation (Article 6(1)(c)). This includes the requirement to share personal information with customs and immigration authorities or law enforcement, as well ANA NEO’s legal duties towards its staff and customers.
• The information is required to protect your, or a third party’s, vital interests (Article 6(1)(d)), for example in the event of a medical emergency.
• It is in ANA NEO’s or a third party’s legitimate interests to process the personal data, and these interests are not overridden by your rights under Data Protection Laws (Article 6(1)(f) GDPR).
  This includes the use of personal information necessary to operate ANA NEO’s business and also to maintain, develop and improve its products and services and provide the best possible customer experience.

4. Request about processing of personal information

• Data Protection Laws provide you with the following legal rights:
  • Request for disclosure: You can request copies of your personal information and details of how we process it.
  • Request for correction or updating: Corrections or updates to personal information will be undertaken wherever possible after due review of the request.
  • Request for erasure: You may request that we delete all or part of the personal information we hold about you. We will consider your request and, where the information is no longer required or the law does not permit us to continue to retain it, we will delete it.
  • Transferring your personal information: You can request a copy of your personal information in a structured, common, machine-readable format. This only applies to personal information which we obtain from you and process on the basis of your consent or in order to perform a contract, and which is processed by automated means.
  • Objecting to processing: You can object to processing which is carried out on the basis of our or a third party’s legitimate interests or for the purpose of direct marketing. We will stop processing your information unless we have a strong reason to continue which overrides your objection. If your objection is to direct marketing, we will always stop.
  • Restricting how your personal information is processed. You can limit how we process your personal information in certain circumstances. Where this applies, any processing of your personal information (other than storing it) will only be lawful with your consent or where required for legal claims, protecting certain rights or important public interest reasons.
  • The right to withdraw consent. If we are relying on consent to process your personal information, you have the right to withdraw that consent at any time. Please note, the rights set out above are not absolute and do not apply in every situation. There are also legal exemptions which apply in some situations and mean a request may be refused. Of course, if a request is refused we will inform you of the reasons for this when we respond.
• Method for submitting request

  You can exercise your rights free of charge (except in the case of unreasonable, excessive or repeated requests in which case we may charge a fee or refuse the request). For inquiries concerning the handling of personal information, please use the inquiry form on ANA NEO’s website.

• Procedures for individual identification

  When a request is made, we will confirm the identity of the individual as described below.
  (For individuals)
  Upon receiving a request for the exercise of the Access Right or Deletion Right, ANA NEO will ask the user to submit information sufficient to confirm that such request was submitted by such customer himself/herself, such as his/her name and email address, and compare the submitted information with the information held by ANA NEO.
  (For representatives)
  In addition to the information required for the identification of individual in “(For individuals),” a power of attorney (legal representatives must provide a certifying document) needs to be submitted. In addition, ANA NEO may ask the user to directly contact ANA NEO to confirm that he/she has granted the representative authority to exercise the Access Right or Deletion Right.
  As a rule, ANA NEO will not treat customers who have submitted such requests in a discriminatory manner, such as changing their services. Even so, please note that deletion requests may prevent customers from receiving services which they have been provided with, or may impede the provision of services that are in accordance with their needs.

• Responding to a request

  We will respond without delay and usually within one month. We may, in some cases, ask for identification or (if you are making the request on behalf of a third party) proof of your authority to submit a request. If your request is particularly complex or you have made a number of requests, it may take longer to provide a detailed response. Please also bear in mind that there are exceptions to the rights above and some situations where they do not apply.
  If you are not satisfied with our response to a data protection request or if you think your personal information has been mishandled, then you have the right to complain to a supervisory authority. Please see Part 9 of this Chapter 2 (“Lodging a complaint with an authority”) for further details.

5. Data sharing which is necessary to provide products or services

ANA NEO’s products and services are provided with the assistance of other companies and organizations and often ANA NEO will need to share personal information with third parties in order to run its business. These third parties include:

• Other companies in the ANA Group
• JP GAMES, Inc.
• Organizations with which ANA NEO is legally required to share personal information
  including: government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.
• Service providers
  including: various service providers, providers with whom we have a marketing partnership, etc.
  Where ANA NEO instructs companies, contractors or service providers to process data on its behalf, then it will ensure that it does so pursuant to a contract which meets the requirements of applicable Data Protection Laws.

6. Marketing communications

ANA NEO sends out marketing communications from time to time to notify interested persons of news and provide details of products and services which may be of interest to them. ANA NEO will only do this if the recipient has consented to receive marketing or if they are an existing customer who purchased products or services from ANA NEO and were given the opportunity to opt-out from marketing at the time but chose not to do so.

7. Where your personal information is stored and transferred

ANA NEO is located in Japan and many of the service providers and other organizations with whom we share your personal information will be located in jurisdictions outside the EEA and UK. It should be noted that Japan has been recognized by the European Commission as providing adequate protection for personal information.
When transferring personal information to third parties ANA NEO will ensure that it complies with the requirements of Data Protection Laws, including the onward transfer requirements of the EU-Japan adequacy decision and related Japanese laws. However, you should be aware that recipients outside the EEA and UK may be subject to national laws which do not necessarily provide equivalent protection for your personal data. If you would like more information regarding where your personal information is stored and transferred please contact ANA NEO using the details set out in Part 12 of this Chapter 1 (“Contact Point for Inquiries”).

8. Retention of personal information

ANA NEO retains customers’ personal information until the purpose of use is achieved. Particularly, ANA NEO has set the retention period for personal information as follows. For most other personal information, the appropriate retention period will be determined based on the nature of the information and the purpose for having it by reference to legal and accounting requirements and our business needs.

• Personal information of the user of the Service
  From commencement of use of the Service until the withdrawal
• Personal information relating to purchased services
  The period required for the purpose of use consented to
• Other personal information
  Required period for the purpose which customers have consented

9. Lodging a complaint with an authority

Customers have the right to lodge a complaint on the processing of their personal information with the data protection authority having jurisdiction over their residence.

• EEA residents: Please contact your national supervisory authority, details of which can be found on the European Data Protection Board’s website ( https://edpb.europa.eu/about-edpb/board/members_en).
• UK residents: Please contact the Information Commissioner’s Office (ico.org.uk).

10. The contact information of the controller and ANA NEO’s Data Protection Officer

ANA NEO, Inc.
4F Incubation Office CROSS CORP Urbannet Uchisaiwaicho Building, 1-1-13, Shinbashi, Minato-ku, Tokyo 105-0004, Japan
Data Protection Officer email: info@ana-neo.com

Chapter 3. Handling of personal information of California residents in ANA GranWhale

Last updated on October 16, 2024
Besides Chapter 1, Chapter 3 also shall be applied to the handling of personal information of persons residing in California, United States of America based on the California Consumer Privacy Act of 2018 (hereinafter “CCPA”). In the event that any provisions of this chapter contradict those of chapter 1, the provisions of this chapter shall prevail.
The terms used in this chapter are based on the definitions provided in CCPA. For example, the term “sale”, among others, means ANA NEO’s selling, lending, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to another business or a third party for monetary or other valuable consideration. Furthermore, “sharing” means that ANA NEO shares, lends, publishes, discloses, distributes, makes available, transfers, or communicates orally, in writing, electronically, or otherwise, the personal information of users to third parties for the purpose of cross-contextual behavioral targeted advertising, regardless of whether in exchange for money or other valuable consideration. Under the CCPA, if ANA NEO has an appropriate agreement with the entity or third party concerned for the handling of personal information, such acts do not constitute “selling” or “sharing”.

1. Acquisition and use of personal information

Personal information collected by ANA NEO in the preceding 12 months is classified as defined in the following table. ANA NEO uses such information for the purposes set forth in Part 3 of this Chapter 1 (“Purpose of Use”). It will acquire such personal information directly from customers.

Type of personal information collected	Example of personal information
Identifiers (name or symbol, etc. used to uniquely identify a particular subject)	The user’s name, address, telephone number, email address, ANA Mileage Club membership number, Information on the terminal on which the app is used (OS, type, browser, etc., advertising identifiers, IP addresses, Information concerning cookies and similar technologies when the Service is used, etc.
Additional data subject to the California Customer Records statute (personal information categories in Cal. Civ. Code Sec. 1798.80(e))	Credit card number, and payment information including details of credit card and other payment methods, etc.
Characteristics of protected classifications under California or federal law	Age, Nationality, Household composition, etc.
Commercial information	The type of customer’s ANA Mileage Club membership card, membership status, membership area, mileage status, credit card expiration date, usage history of credit card and related information, flight reservation and cancellation information, usage history of flights and other services, 2 History of usage of the Service (V-TRIP usage history, V mile acquisition and usage history, Sky Mall purchase service usage history, etc.) , Requests and complaints contained in correspondence with customers, etc.
Internet or other electronic network activity information	Information such as that on how customers use the ANA NEO website and mobile application, including details on cookies, etc.

2. Disclosure of personal information

• Sale of personal information
  ANA NEO will not sell customers' personal information (including personal information concerning minors) to any third parties, and has not sold the same in the past 12 months.
• Sharing of personal information
  The types of users’ personal information that ANA NEO has shared with third parties in the past 12 months and the types of third parties with whom such information has been shared are as shown below. ANA NEO will share such personal information for the purpose of conducting marketing activities (including personalized advertising), such as various events and campaign announcements. When ANA NEO knows that a certain piece of personal information is from a minor, ANA NEO will not share that personal information with third parties.

Types of personal information shared	Examples of personal information	Types of third parties with whom personal information has been shared in the past 12 months
Internet or other electronic network activity information	Information about how customers use the ANA NEO website and mobile app, including: cookies, advertising identifiers (IDFA/GAID), location information, information such as device-specific IDs, OS and browser type, and logs of activities on the website	Ad network

Disclosure of personal information for business purposes
The types of customers’ personal information that ANA NEO has disclosed in the past 12 months for business purposes and the types of third parties to which such personal information has been disclosed are shown below.

Types of personal information to be disclosed	Examples of personal information	Types of third parties to whom personal information has been disclosed in the past 12 months	Business purpose of disclosure
Identifiers (name or symbol, etc. used to uniquely identify a particular subject)	The user’s name, address, telephone number, email address, ANA Mileage Club membership number, Information on the terminal on which the app is used (OS, type, browser, etc., advertising identifiers, IP addresses, Information concerning cookies and similar technologies when the Service is used, etc.	ANA Group companies, ANA GranWhale partner companies, marketing partner companies, development partner companies, etc.	-
Additional data subject to the California Customer Records statute (personal information categories in Cal. Civ. Code Sec. 1798.80(e))	Credit card number, and payment information including details of credit card and other payment methods, etc.	N/A	-
Characteristics of protected classifications under California or federal law	Age, Nationality, Household composition, etc.	N/A	-
Commercial information	The type of customer’s ANA Mileage Club membership card, membership status, membership area, mileage status, credit card expiration date, usage history of credit card and related information, History of usage of the Service (V-TRIP usage history, V mile acquisition and usage history, Sky Mall purchase service usage history, etc.), Requests and complaints contained in correspondence with customers, etc.	ANA Group companies, ANA GranWhale partner companies, development partner companies, etc.	-
Internet or other electronic network activity information.	Information such as that on how customers use the ANA NEO website and mobile application, including details on cookies, etc.	ANA Group companies, development partner companies, etc.	-

3. Handling of sensitive personal information

ANA NEO will not use or disclose customers’ sensitive personal information for any purpose other than the certain purposes permitted by the CCPA.
ANA NEO will not obtain or process customers’ sensitive personal information for the purpose of inferring their characteristics.

4. Retention of personal information

ANA NEO will retain customers’ personal information until the purpose of use is achieved; in particular, ANA NEO has established the following retention periods for personal information.
For other personal information, ANA NEO determines retention periods based on the nature of the information and the purpose of retention, taking factors into consideration such as legal and accounting requirements and ANA NEO’s business needs.

• Personal information of ANA Mileage Club members
• Until withdrawal from ANA Mileage Club
• Other personal information
• For the period necessary for the purpose of the agreed upon us

5. Request about handling of Personal Information

Customers living in California have the following rights concerning their personal information:

Overview of rights held by users

Access right

Users have the right to request that ANA NEO disclose the following information (hereinafter referred to as “Access Right”) regarding their personal information that ANA NEO has obtained, used, or disclosed after December 1, 2022.

• Type of the user’s personal information collected by ANA NEO
• Source of the collection of such personal information
• Business or commercial purposes for the collection of such personal information
• Types of third parties to whom the personal information concerned is disclosed
• The user’s specific personal information collected by ANA NEO
• Types of personal information ANA NEO has sold or shared
• Types of parties to or with whom the personal information concerned has been sold or shared for each type of information
• Type of the user’s personal information disclosed by ANA NEO for a business purpose
• Type of third parties to which each type of such personal information has been disclosed

Deletion right

• Customers have the right to make a request to ANA NEO for the deletion of their certain personal information collected by ANA NEO (hereinafter “Deletion Right”).
• Correction request right
• Users have the right to request that ANA NEO correct inaccurate personal information that ANA NEO retains (hereinafter referred to as “Correction Request Right”).
• Opt-out rights for sale or sharing

Users have the right to request that ANA NEO stop selling or sharing their personal information to or with third parties (hereinafter referred to as “Sale or Sharing Opt-out Right”).

Among the above rights, to exercise the Access Request Right, Deletion Request Right, or Correction Request Right, please contact the following:

Where to submit requests: Please contact us via the Contact Form on ANA NEO’s website.

ANA NEO will respond to requests from users within a timeframe and scope that adheres to the relevant laws and regulations. Please note that we will perform the following individual identification process in advance when you make a request.

Procedures for individual identification
(For individuals) Upon receiving a request from a user to exercise the Access Right, Deletion Right, or Correction Right, ANA NEO will ask the user to submit information sufficient to confirm that such request was submitted by such customer himself/herself, such as his/her name and email address, and compare the submitted information with the information held by ANA NEO to confirm the user’s identity.

(For representatives)
In addition to the information required for the identification of individual in “(For individuals),” a power of attorney (legal representatives must provide a certifying document) needs to be submitted. In addition, ANA NEO may ask the user to directly contact ANA NEO to confirm that he/she has granted the representative authority to exercise the Access Right or Deletion Right.

If you wish to exercise the Sale or Sharing Opt-out Right, please contact us at the link below. Once ANA NEO receives a request, it will be handled in accordance with the related laws and regulations within a reasonable timeframe and manner.

Do Not Sell or Share My Personal Information

ANA NEO will respond to opt-out requests submitted through Global Privacy Controls and treat them as valid requests based on the right to opt-out of sharing. As a rule, ANA NEO will not treat customers who have submitted such requests in a discriminatory manner, such as changing their services. Even so, please note that deletion requests may prevent customers from receiving services which they have been provided with, or may impede the provision of services that are in accordance with their needs.

Chapter 4. Handling of personal information of Thailand residents in ANA GranWhale

This Chapter 4 provides additional information about the collection, use, or disclosure (“processing”) of personal information of customers and other individuals in the Kingdom of Thailand (“Thailand”) in accordance with the Personal Data Protection Act of Thailand B.E. 2562 (A.D. 2019) (“PDPA”).
In the event that any provisions of this Chapter 4 contradict those of Chapter 1, the provisions of this Chapter 4 shall prevail.

1. Handling of personal information of minors

If consent is required for processing of personal information relevant to the use of ANA NEO’s services of data subjects who are minors, quasi-incompetents or incompetents under the law of Thailand and cannot lawfully give consent by themselves, consent or permission of the persons exercising parental power, their curators or custodians (as the case may be) must also be obtained. If data subjects are under the age of 10, only consent or permission of the persons exercising parental power must be obtained.
If ANA NEO is not aware that the data subjects are minors, quasi-incompetent persons or incompetent persons prior to the collection of their personal information, upon learning that we have collected personal information of minors without the consent of persons exercising parental power (when it is required and the minors cannot lawfully give consent by themselves), or from quasi-incompetent persons and incompetent persons without the consent of their legal curator and custodian, we will delete the personal information at the earliest convenience unless we can rely on other legal grounds apart from consent for such processing.
The data subject’s consent to this Privacy Policy must be obtained in the event that a person such as family member or an agent authorized to act on its behalf applies for ANA NEO’s service on behalf of the data subject.

2. The controller of personal information

The controller of your personal information is ANA NEO.
ANA NEO protects personal information which is collected and used by controllers (who make decisions about how and why your personal information is used) and processors (who act on the controller’s written instructions) on the basis of the PDPA.

3. Our lawful basis for processing personal information

ANA NEO protects your personal information by ensuring that it can only be used to the extent necessary for specific purposes (as set out in Part 3 of Chapter 1 of this Privacy Policy) and by requiring that there is a lawful basis for each processing activity on the basis of the PDPA.
ANA NEO may process customer personal information on one or more of the following lawful bases:

• When your consent is obtained to the processing (Article 19 PDPA).

  Consent will usually only be relied upon for promotional and marketing related processing, or in some cases, in relation to sensitive personal information.

• When processing is necessary in order to perform or take steps to enter into a contract (Article 24(3) PDPA).

  This is typically why we process customer information which is essential to providing our services, including a customer’s identity, contact, payment and travel details, etc.

• ANA NEO needs to process the information to comply with a lawful obligation (Article 24(6) PDPA).
  This includes the requirement to share personal information with customs and immigration authorities or law enforcement, as well ANA NEO’s legal duties towards its staff and customers.
• The information is required to protect your, or a third party’s, vital interests (Article 24(2) PDPA), for example in the event of a medical emergency.
• It is in ANA NEO’s or a third party’s legitimate interests to process the personal information, and these interests are not overridden by your fundamental rights regarding your personal information under the law (Article 24(5) PDPA).

This includes the use of personal information necessary to operate ANA NEO’s business and also to maintain, develop and improve its products and services and provide the best possible customer experience to the extent permissible under the PDPA.

4. Request about processing of personal information

• The PDPA provides you with the following legal rights:
  • Request for disclosure: You can request copies of your personal information and details of how we process it.
  • Request for correction or updating: Corrections or updates to personal information will be undertaken wherever possible after due review of the request.
  • Request for erasure: You may request that we erase, destroy or anonymize all or part of the personal information we hold about you. We will consider your request and, where the information is no longer required or the law does not permit us to continue to retain it, we will delete it.
  • Transferring your personal information: You can request a copy of your personal information in a structured, common, machine-readable format. This only applies to personal information which we obtain from you and process on the basis of your consent or in order to perform a contract, and which is processed by automated means.
  • Objecting to processing: You can object to processing which is carried out on the basis of our or a third party’s legitimate interests or for the purpose of direct marketing. We will stop processing your information unless we have a legitimate reason to continue which overrides your objection. If your objection is to direct marketing, we will always stop.
  • Restricting how your personal information is processed. You can limit how we process your personal information in certain circumstances. Where this applies, any processing of your personal information (other than storing it) will only be lawful with your consent or where required for legal claims, protecting certain rights or important public interest reasons.
  • The right to withdraw consent.
    If we are relying on consent to process your personal information, you have the right to withdraw that consent at any time.
    However, the withdrawal of consent shall not affect the processing of your personal information that you have already given consent legally before it is withdrawn.
    Please note, the rights set out above are not absolute and do not apply in every situation. There are also legal exemptions which apply in some situations and mean a request may be refused.
    Of course, if a request is refused we will inform you of the reasons for this when we respond.
    Records of requests made to us will be retained so that we can ensure we have complied with our legal obligations.
• Method for submitting request

  You can exercise your rights free of charge (except in the case where expenses may be chargeable under the PDPA). The method for submitting a request and contact information are as follows. For inquiries concerning the handling of personal information, please use the inquiry form on ANA NEO’s website.

• Procedures for individual identification

  When a request is made, we will confirm the identity of the individual as described below.
  (For individuals)
  Upon receiving a request for the exercise of the Access Right or Deletion Right, ANA NEO will ask the user to submit information sufficient to confirm that such request was submitted by such customer himself/herself, such as his/her name and email address, and compare the submitted information with the information held by ANA NEO.
  (For representatives)
  In addition to the information required for the identification of individual in “(For individuals),” a power of attorney (legal representatives must provide a certifying document) needs to be submitted. In addition, ANA NEO may ask the user to directly contact ANA NEO to confirm that he/she has granted the representative authority to exercise the Access Right or Deletion Right.
  As a rule, ANA NEO will not treat customers who have submitted such requests in a discriminatory manner, such as changing their services. Even so, please note that deletion requests may prevent customers from receiving services which they have been provided with, or may impede the provision of services that are in accordance with their needs.

• Responding to a request

  We will respond without delay and usually within thirty (30) days. We may, in some cases, ask for identification or (if you are making the request on behalf of a third party) proof of your authority to submit a request. If your request is particularly complex or you have made a number of requests, it may take longer to provide a detailed response. Please also bear in mind that there are exceptions to the rights above and some situations where they do not apply.
  If you are not satisfied with our response to a data protection request or if you think your personal information has not been processed appropriately, then you have the right to file a complaint with the Personal Data Protection Committee of Thailand. Please see Part 9 of this Chapter 4 (“Lodging a complaint with an authority”) for further details.

5. Data sharing which is necessary to provide products or services

ANA NEO’s products and services are provided with the assistance of other companies and organizations and often ANA NEO will need to share personal information with third parties in order to run its business. These third parties include:

• Other companies in the ANA Group
• JP GAMES, Inc.
• Organizations with which ANA NEO is legally required to share personal information
  including: government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.
• Service providers

  including: various service providers, providers with whom we have a marketing partnership, etc.
  Where ANA NEO instructs companies, contractors or service providers to process data on its behalf, then it will ensure that it does so pursuant to a contract which meets the requirements of PDPA.

6. Marketing communications

ANA NEO sends out marketing communications from time to time to notify interested persons of news and provide details of products and services which may be of interest to them. ANA NEO will only do this if the recipient has consented to receive marketing communications.

7. Where your personal information is stored and transferred

ANA NEO is located in Japan and many of the service providers and other organizations with whom we share your personal information will be located in jurisdictions outside Thailand.
When transferring personal information to third parties, ANA NEO will ensure that it complies with the requirements of the PDPA and related Japanese laws.
However, you should be aware that recipients outside Thailand may be subject to national laws which do not necessarily provide equivalent protection for your personal information. If you would like more information regarding where your personal information is stored and transferred please contact ANA NEO using the details set out in Part 12 of this Chapter 1 (“Contact Point for Inquiries”).

8. Retention of personal information

ANA NEO retains customers’ personal information until the purpose of use is achieved. Particularly, ANA NEO has set the retention period for personal information as follows. For most other personal information, the appropriate retention period will be determined based on the nature of the information and the purpose for having it by reference to legal and accounting requirements and our business needs.

• Personal information of the user of the Service

  From commencement of use of the Service until the withdrawal

• Personal information relating to purchased services

  The period required for the purpose of use consented to

• Other personal information

  Required period for the purpose which customers have consented.

9. Lodging a complaint with an authority

Customers have the right to lodge a complaint on the processing of their personal information with the Personal Data Protection Committee of Thailand.

10. The contact information of the controller and ANA NEO’s Data Protection Officer

ANA NEO, Inc.
4F Incubation Office CROSS CORP Urbannet Uchisaiwaicho Building, 1-1-13, Shinbashi, Minato-ku, Tokyo 105-0004, Japan
Data Protection Officer email: info@ana-neo.com