Privacy Policy

1. Who we are

The data controller for this website is Ishibashi, a legal practice based in Chiyoda-ku, Tokyo, Japan. References to "we", "us" or "our" in this policy refer to Ishibashi.

2. What personal data we collect

We may collect the following categories of personal data:

• Contact data: name and email address submitted via the contact form
• Message content: the content of enquiries submitted through the contact form
• Technical data: IP address, browser type, device type, pages visited and timestamps — collected automatically when you visit the site
• Cookie data: preferences and identifiers stored locally via cookies, where consent is given (see our Cookie Policy)

3. How we collect data

• Contact form submissions: when you fill in and submit the contact form on this site
• Cookies and analytics: automatically, when you browse the site (subject to your consent preferences)
• Direct correspondence: if you contact us by other means, such as email

4. Why we use your data

We process personal data for the following purposes:

• Responding to enquiries: to read and reply to messages submitted via the contact form (legal basis: legitimate interest / pre-contractual steps)
• Improving the website: to understand how the site is used and where it can be improved, using anonymised analytics data (legal basis: consent)
• Legal obligations: where we are required to retain or disclose data under applicable Japanese law

We do not use your personal data for marketing purposes without explicit consent, and we do not sell data to third parties.

5. Data sharing

We share personal data only in the following limited circumstances:

• Analytics providers: anonymised usage data may be shared with analytics tools where you have consented to analytics cookies
• Legal requirements: we may disclose data if required by law, court order or regulatory authority
• Professional advisers: in exceptional circumstances, we may consult with technical or legal advisers who are bound by confidentiality obligations

No personal data is sold, rented or traded.

6. Data retention

• Contact form data is retained for as long as necessary to respond to the enquiry and for a reasonable period thereafter (generally up to two years), unless we are required to retain it longer under applicable law
• Analytics data is retained in anonymised or aggregated form for up to 26 months
• Cookie consent records are retained for 12 months from the date of consent

7. Data security

• This website is served over HTTPS, encrypting data in transit
• Access to personal data is restricted to those who need it to carry out their responsibilities
• In the event of a data breach affecting personal data, we will take appropriate steps to contain the breach and notify affected individuals where required by law

8. Your rights

Under the Act on the Protection of Personal Information (APPI, Japan) and, where applicable, the GDPR, you have the following rights:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate data
• Right to erasure: to request deletion of your personal data, subject to legal retention obligations
• Right to data portability: to receive your data in a commonly used, machine-readable format
• Right to withdraw consent: where processing is based on consent, to withdraw that consent at any time
• Right to object: to object to processing based on legitimate interests

To exercise any of these rights, please contact us via the contact page. We will respond within 30 days.

9. Cookies

This site uses cookies. For full details of the cookies used, their purposes, and how to manage your preferences, please see our Cookie Policy.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page indicates when it was last revised. Significant changes will be noted prominently. Continued use of the site after any update constitutes acceptance of the revised policy.