Privacy Policy

Effective: June 12, 2026  /  Last revised: August 21, 2026

Revision of August 21, 2026: we have set out in more detail the country in which the external service used to operate our contact form is located, and the security measures we take (Sections 5, 6 and 8).

Ato Inc. ("we") handles personal information obtained through inquiries appropriately, in compliance with Japan's Act on the Protection of Personal Information and other applicable laws.

1. Operator

• Company: Ato Inc.
• Representative: Hiroto Akatsuka, CEO
• Address: 85-2 Koinari-cho, Shimogyo-ku, Kyoto 600-8208, Japan

2. Information we collect

Through our contact form, we collect the information you provide, such as your company name, name, email address, and the content of your inquiry.

3. Purpose of use

• To respond to your inquiries and to contact you for that purpose.
• To provide and inform you about our services.

We use personal information only within the scope of the purposes above, and do not use it for other purposes without your consent.

4. Disclosure to third parties

We do not provide personal data to third parties without your consent, except as required by law.

Where personal data is provided in connection with the outsourcing described in Section 5, the outsourcing service provider is not a "third party" under Article 27, Paragraph 5, Item 1 of Japan's Act on the Protection of Personal Information. However, for a service provider located in a foreign country, we obtain your consent as described in Section 6, in accordance with Article 28 of the Act.

5. Outsourcing and the location of our service provider

We use Google Workspace (Google Forms, Gmail, Sheets, and related services) to operate our contact form, to communicate with you, and to retain records. The entity with which we contract for Google Workspace is as follows.

• Entity: Google Asia Pacific Pte. Ltd.
• Country: Republic of Singapore

We exercise the necessary and appropriate supervision over this service provider as required by Article 25 of the Act. The service provider handles personal data only within the scope of the work we have outsourced to it.

6. Provision to a third party located in a foreign country

As stated in Section 5, our service provider is located in a foreign country (the Republic of Singapore). Accordingly, when you provide personal information through our contact form, we obtain your consent to the provision of personal data to a third party located in a foreign country. As a prerequisite to that consent, and in accordance with Article 28, Paragraph 2 of the Act and Article 17, Paragraph 2 of the Enforcement Rules, we provide the following information.

• (1) Name of the foreign country: the Republic of Singapore
• (2) Information on the personal information protection regime of that country: Singapore has the Personal Data Protection Act 2012, and the Personal Data Protection Commission acts as the supervisory authority. For details, please refer to the survey published by Japan's Personal Information Protection Commission: "Survey on the personal information protection regime of the Republic of Singapore" (PDF, in Japanese).
• (3) Information on the measures the third party takes to protect personal information: Under the Cloud Data Processing Addendum entered into with us, the service provider undertakes to process personal data only on our instructions, to impose confidentiality obligations on its personnel, to implement technical and organisational security measures, to publish its subprocessors and notify us in advance of changes, and to maintain third-party information security certifications (such as ISO/IEC 27001 and SOC 2 / SOC 3). The names and locations of subprocessors are published by the service provider as the Google Workspace subprocessor list.

If you do not consent, we are unable to accept your inquiry through the form. If you prefer not to use the form, please contact us by post as described in Section 10.

7. Cookies (advertising measurement)

To measure the effectiveness of our online advertising, some pages of our website use Google Ads tags provided by Google LLC and set cookies. The data collected consists of statistical information about ad impressions, clicks, and contact form submissions, and does not include information that directly identifies you, such as your name or email address.

You can refuse cookies through your browser settings. You can also turn off Google's use of cookies for advertising at Google Ad Settings. For how Google handles data, see Google's policies.

8. Security measures taken for retained personal data

The security measures we take are as follows.

• Basic policy: we have established this policy and published it on our website.
• Organisational measures: the personnel who handle personal data are limited to the Representative Director.
• Personnel measures: points to note in handling personal data are communicated to those engaged in our operations.
• Technical measures: access to the information systems that handle personal data requires account authentication and multi-factor authentication.
• Understanding the external environment: as set out below.

[Understanding the external environment] As stated in Section 5, we outsource the handling of personal data to a service provider located in the Republic of Singapore, and therefore handle personal data in a foreign country. We have ascertained that country's personal information protection regime through the survey published by Japan's Personal Information Protection Commission, have confirmed that the measures described in Section 6(3) are implemented by the service provider, and supervise the service provider accordingly.

[Country in which the servers storing personal data are located] We are unable to identify the country in which the servers storing our personal data are located. This is because the Cloud Data Processing Addendum with our service provider provides that data may be processed in any country in which the service provider or its subprocessors maintain facilities, and the storage location of individual data is not disclosed to us. As information that may be of reference to you, the service provider publishes the names and locations of its subprocessors as the Google Workspace subprocessor list.

9. Procedures for requests for disclosure, correction, or suspension of use

We respond, in accordance with applicable law, to requests from individuals or their agents for notification of the purpose of use, disclosure, correction, addition, deletion, suspension of use, erasure, or suspension of provision to third parties of retained personal data.

• How to submit a request: please write to the contact point in Section 10, stating the content of your request, your name, and your contact details, by post or through our contact form.
• Verification: we verify that the request comes from the individual (or a duly authorised agent), for example by contacting the details we hold. If we cannot verify this, we may be unable to respond.
• Fees: no fee is charged for requests for notification of the purpose of use or for disclosure.
• How we respond: in principle, we respond to the contact details you specify in your request, by electronic record or in writing.

10. Contact

For questions about this policy or our handling of personal information, and for the requests described above, please contact us by either of the following.

• Contact form
• Post: Ato Inc., Personal Information Contact Point, Grand-K Kyoto Ekimae Building 201, 85-2 Koinari-cho, Shimogyo-ku, Kyoto 600-8208, Japan

11. Changes

We may revise this policy as needed. Any revision takes effect when posted on this page.