Data Processing Agreement (DPA)

1. Definitions and Purpose

This Data Processing Agreement (DPA) is established in accordance with the Act on the Protection of Personal Information (APPI) of Japan. It defines the terms under which Kilobyteivore合同会社 (the "Processor") processes personal data entrusted by a corporate or sole proprietorship client (the "Controller"). This agreement supplements the Terms of Service.

2. Scope and Nature of Processing

The Processor shall handle personal data contained within physical media (video tapes, audio tapes, films, etc.) provided by the Controller solely for the purpose of digitization and restoration. Categories of processed data include visual appearances and voices captured in recordings, as well as contact information required for shipping and communication.

3. Processor Obligations and Security

The Processor undertakes the following obligations:

• To process data only according to the Controller's written instructions and for the specified purpose.
• To comply with the APPI and all relevant Japanese legislation to maintain strict confidentiality.
• To implement technical and organizational security measures to prevent unauthorized access, leakage, or loss of data.

For more detailed information on our data handling, please refer to our Privacy Policy.

4. Sub-processors

The Processor engages the following third parties to provide essential infrastructure, managed in accordance with Article 27-12 of the Telecommunications Business Act (External Transmission Regulations):

• エックスサーバー株式会社 (Hosting Provider: 〒530-0011 大阪府大阪市北区大深町4-20)
• FormSubmit (Inquiry form processing: based in the USA)

Any transfer of data to third parties located outside of Japan is conducted based on the Controller's consent and under appropriate safety management measures.

5. Incident Response

In the event of a leak, loss, or damage of personal data, or if such an event is suspected, the Processor will promptly notify the Controller. The Processor will follow the Controller's instructions regarding reporting to the Personal Information Protection Commission and notifying the affected data subjects.

6. Return and Erasure of Data

Upon completion of the entrusted services or termination of this agreement, the Processor shall return or delete the data as instructed by the Controller. Unless otherwise specified, the Processor will permanently erase all digital copies stored on its servers within 30 days after the completion of work. Physical original media will be returned according to the methods specified in the Terms of Service.

7. Audit and Jurisdiction

The Controller has the right to audit the Processor's data handling practices upon providing reasonable notice. Any disputes arising from this agreement shall be subject to the exclusive jurisdiction of the court in Osaka-shi Kita-ku as the court of first instance.

For inquiries regarding this agreement, please contact:

Kilobyteivore合同会社 (Director: 森 大輔 / Capital: 500万円)
Address: 〒530-0003 大阪市北区Kita-ku大阪府大阪市北区堂島2-14-8
Phone: 06-4804-0117 / E-mail: [email protected]

Supervisory Authority: Personal Information Protection Commission (〒105-0001 東京都港区虎ノ門二丁目2-3 虎ノ門アルセアタワー12階 / https://www.ppc.go.jp)