Scope of this Privacy Policy

This Application Privacy Policy for “ANOTHER EDEN” (this “Policy”) sets out how WFS, Inc. (the “Company”) handles personal data in connection with the application “ANOTHER EDEN” provided by the Company (the “Service”). For matters not provided for in this Policy, please also refer to the “Basic Policy on the Protection of Personal Information.”

Scope of Application and Order of Priority of this Policy

This Policy applies to all customers who use the Service. However, any restrictions or exceptions under applicable law prevail when applying each provision of the Common Provisions. In addition, customers who reside in certain countries or regions are subject to additional provisions accompanying this Policy (see “Supplemental Provisions for Specific Countries and Regions”). If there is any inconsistency or conflict between the Common Provisions of this Policy and such supplemental provisions, the supplemental provisions will prevail to the extent required by applicable law.

Common Provisions

Handling of Personal Data

(1) Personal Data Collected

(a) Collection Methods
The Company collects personal data by the following methods, depending on the nature of the Service and your use of it.

• Information collected directly from you: information that you enter or provide in connection with account registration, profile settings, linking with external services, data migration, inquiries, campaign applications and other use of the Service.
• Information automatically collected in connection with your use of the Service: user IDs, device information, IP addresses, play data, play logs, advertising identification and measurement information, purchase history and other information generated or collected in connection with your use of the Service.
• Information collected from external services or third parties: user IDs, identifiers and other member information on external services collected when linking with external services; payment-related information provided by payment service providers; and other information necessary to provide the Service.

(b) Categories of Personal Data Collected
The personal data collected by the Company may vary depending on the functions of the Service, your usage status and your settings, but may include the following information.

• User ID: an internal identifier issued by the Company to identify you individually.
• Region and language: country of residence or region of stay identified from registration information, IP address or other information, and the language settings of the device.
• External service linkage information: member information collected when linking with an external service (Google Account, Facebook), such as the user ID, identifiers on that service.
• Data migration information: migration ID, password and other information necessary for data migration, as set by you or issued by the Company.
• Payment information and purchase history: credit card information and other information concerning payment methods, purchase history of paid content and other information necessary for payment processing.
• Play data and play logs: information concerning the status and progress of the Service, status, possessed items, browsing history, operation history, event tracking data and other usage status of the Service.
• Inquiry information: other information necessary to respond to inquiries, provided at the time of inquiry.

(c) Personal Data Automatically Collected
In accordance with the requirements of local laws, the Company may automatically collect the following information in connection with your use of the Service for the provision of the Service, security, quality improvement, analysis of usage status, advertising effectiveness measurement and optimization of ad delivery.

• Device information: device identifiers (such as identifier for vendors and push tokens), device name, OS and browser session information.
• IP address: identifiers assigned when connecting to a network and information concerning the communication environment that is automatically transmitted during use.
• Play logs and event tracking data: browsing history, operation history, crash logs, event occurrence history and other information concerning your usage status of the Service.
• Advertising identification and measurement information: advertising identifiers, advertisement view and click history, and information concerning traffic sources.

(2) Purposes and Legal Bases for Processing Personal Data

The Company uses the personal data it collects for the following purposes. Where the Company is required to indicate a legal basis for processing under applicable law, the Company processes personal data on one of the legal bases for each processing purpose and category of personal data.

• Performance of a Contract with You
  The Company uses user IDs, external service linkage information, device information, IP addresses, play data, data migration information, payment information, purchase history, inquiry information and other personal data necessary to provide the Service to the extent necessary to provide the Service based on the contract with you. This includes provision of basic functions, login authentication and identity verification, data migration, payment processing, responding to inquiries and other provision of the Service requested by you.
• Compliance with Legal Obligations
  The Company may use payment information, purchase history, user IDs, IP addresses, play logs, inquiry information and other personal data necessary to perform obligations under applicable laws and regulations or orders of public authorities, to the extent necessary to perform such obligations.
• Legitimate Commercial Interests
  The Company may use the personal data described in the section “Personal Data Collected” above for the following purposes where necessary for the legitimate interests pursued by the Company or a third party and where your fundamental rights and freedoms do not override those interests. Specifically, the Company may use the personal data described in the section “Personal Data Collected” above for the following purposes.
  • Smooth operation and maintenance: maintenance of the Service, server management, troubleshooting and other stable provision of the Service using user IDs, device information, IP addresses and play logs.
  • Bug fixes and quality control: operational improvements, bug fixes, investigation of causes of crashes and other quality improvements using user IDs, device information and play logs.
  • Investigation and prevention of unauthorized use and violations of terms: investigation, prevention and correction of unauthorized access, cheating, violations of terms and other misconduct using user IDs, attribute information, IP addresses, play logs.
  • Service improvement and development of new functions: analysis of usage status, statistical understanding, planning and development of new functions and service improvement using user IDs, device information, play logs and advertising identification and measurement information.
  • Measurement of effectiveness of campaigns and statistical analysis: measurement of effectiveness and statistical analysis of campaigns, advertisements and measures using user IDs, play logs and advertising identification and measurement information.
  • Operational notices: notices of changes to terms of use, maintenance information and other operationally necessary notices using user IDs, region and language, and device information.

  Where the Company processes personal data on the legal basis of legitimate interests, the Company will confirm the content of the relevant legitimate interests, the necessity of the processing and the balancing of those interests against your rights and interests before carrying out the processing. To the extent that the Company relies on its legitimate interests as the legal basis for processing your personal data, you have the right to object to such processing. Unless the Company can demonstrate (1) compelling legitimate grounds that override your interests, rights and freedoms, or (2) that it is necessary to process the data for the establishment, exercise or defense of legal claims, the Company must cease processing your personal data (see the section “Your Rights” below).

• Use of Personal Data Based on Your Consent
  Where consent is required under applicable law, the Company may use personal data based on your consent. This includes the following.
  • Provision of personalized information and optimization of advertising: ad delivery, advertising effectiveness measurement, linking of user IDs with advertising identifiers, and provision of information according to interests and preferences using user IDs, play logs and advertising identification and measurement information.
  • Processing for which consent is required under applicable law with respect to the use of advertising identifiers, information collection modules and other similar technologies.

  To the extent that the Company processes personal data on the legal basis of your consent, you may withdraw such consent at any time as provided in the section “Your Rights” below.

(3) Disclosure and Entrustment of Personal Data

The Company may disclose personal data to, or entrust the handling of personal data to, the following persons to the extent necessary for the provision and operation of the Service.

• Company group companies: for development, operation, maintenance, analysis, anti-fraud measures, business management and other intra-group operations of the Service.
• Contractors and service providers: for cloud services, customer support, payment processing, data analysis, advertising effectiveness measurement, push notifications, crash analysis, security, anti-fraud measures and other operations necessary to provide the Service.
• Payment service providers: for purchases of paid content, payment processing, prevention of unauthorized use, refunds and other payment-related operations.
• Advertising and marketing partners: for ad delivery, advertising effectiveness measurement, campaign effectiveness measurement and provision of personalized information.
• Third parties permitted by law: for responding to requests from courts, supervisory authorities, investigative authorities and other public authorities, complying with legal obligations, protecting rights and investigating unauthorized use.
• Business successors: in connection with mergers, company splits, business transfers and other business successions.
• Third parties based on your consent or request: where personal data is provided based on your consent or request.

The Company may use or disclose information that has been anonymized or statistically processed so that individuals cannot be identified, for service improvement, analysis, research, marketing and other purposes permitted by applicable law. Such information does not identify individuals. When using, disclosing or otherwise processing de-identified or anonymized information, the Company will maintain and use such information in a non-identifiable form and will not re-identify individuals except in accordance with applicable law.

Information Collection Modules, Advertising Identifiers and Personalization

The Company may use information collection modules, advertising identifiers and other similar technologies provided by third parties for the functions of the Service, analysis of usage status, defect analysis, optimization of ad delivery, advertising effectiveness measurement and other purposes described in “Purposes and Legal Bases for Processing Personal Data” above. By using the Service, information such as your device information and behavioral history is automatically provided to the providers through information modules. The providers use the personal data provided in accordance with their respective privacy policies.

You may be able to restrict the collection of certain personal data and ad delivery through opt-out pages prepared by the providers or through your device settings. However, individual means to stop information collection modules that are essential for the provision of the Service may not be provided. In such case, you can stop the collection of information by ceasing to use the Service, such as by uninstalling the application.

Handling of Personal Data Concerning Children

The Company does not knowingly collect personal data from persons under 16 years of age (or under the age for protection of children provided by the laws of their country of residence) without the consent of a person with parental authority or a legal representative (a “Guardian”).
If it is found that a customer under 16 years of age has provided personal data to the Company without the consent of a Guardian, the Company will promptly delete such information. If you believe that the Company may have collected information from a child under 16 years of age without the consent of a Guardian, please contact the contact point described in “Contact” below.

Cross-Border Transfers of Personal Data

For the provision, operation, maintenance and analysis of the Service, advertising effectiveness measurement, payment processing, anti-fraud measures, responding to inquiries and other purposes described in “Purposes and Legal Bases for Processing Personal Data” above, the Company may transfer your personal data to countries or regions other than your country or region of residence. Transfer destinations may include Japan, the United States and other countries where Company group companies, contractors, payment service providers, cloud service providers and analytics or advertising-related service providers are located. In making such transfers, the Company will take appropriate safeguards based on any of the following in accordance with the requirements of applicable laws and regulations.

• Use of adequacy decisions: where personal data is transferred to a country, such as Japan, that has been recognized by the European Commission or other authority as ensuring an adequate level of protection for personal data.
• Execution of standard contractual clauses: for transfers of personal data from the European Economic Area (the “EEA”) or the United Kingdom to countries that do not ensure an adequate level of data protection, the Company uses data transfer agreements based on the EU Standard Contractual Clauses adopted by the European Commission (the “Standard Contractual Clauses”) or data transfer clauses under other local laws.
• Your consent: where you have given individual consent to a transfer outside the country.
• Performance of a contract and legal obligations: where directly necessary to provide services under the contract with you or indispensable for complying with legal obligations.

Security Control Measures for Personal Data

The Company implements the following measures to prevent leakage, loss or damage of personal data and otherwise ensure security control.

• Organizational security control measures: formulation of basic policies and rules concerning the handling of personal data, appointment of managers, and establishment of reporting and communication systems, as well as regular audits of compliance with rules.
• Human security control measures: regular training for all employees, including dispatched workers, and obtainment of confidentiality pledges.
• Physical security control measures: restriction of access to offices through entry and exit controls, measures to prevent theft or loss of devices and media, and erasure of data in a manner that makes restoration impossible at the time of disposal.
• Technical security control measures: restriction of access authority, introduction of measures against unauthorized external access (firewalls and, where necessary, encryption during communication and storage, etc.), and regular evaluation of the effectiveness of such measures.
• Understanding of external environments: understanding of personal data protection systems outside Japan and implementation of appropriate security control measures based on such systems.

However, because no information system can guarantee complete security, the Company will endeavor to maintain and improve appropriate security control measures within a reasonable scope.

Your Rights

The Company respects your rights (the “Rights”) with respect to the handling of your personal data to the extent permitted under applicable laws and regulations.

(1) Details of Rights
Subject to restrictions and exceptions under applicable law, you may have the following rights with respect to your personal data collected by the Company.

• Right of access: you have the right to request access to your personal data held by the Company and information concerning the processing of your personal data.
• Right to rectification: if personal data held by the Company is inaccurate or incomplete, you may request that it be updated or corrected.
• Right to deletion: except where the Company is required by law to retain your personal data, where retention is necessary to exercise or defend claims, where there is a legitimate purpose, or in other exceptional cases, you may request the Company to delete your personal data. (This is subject to exceptions, such as where the Company retains user IDs, device information, play logs, payment information and purchase history in order to comply with applicable laws and regulations or respond to orders from governments, courts or other supervisory authorities.) You may also stop the collection and transmission of information at any time, for example by deleting (uninstalling) the application from the device on which you use the Service.
• Right to object: where the Company processes personal data based on legitimate interests, you have the right to object to the processing of your personal data by the Company on grounds relating to your particular situation, unless the Company can demonstrate compelling legitimate grounds for processing your personal data.
• Right to withdraw consent: where the Company processes personal data based on your consent, you have the right to withdraw consent at any time with effect for the future.
• Right to restrict processing: in certain circumstances, you have the right to restrict the processing of your personal data by the Company, such as where (i) the personal data concerning you held by the Company is inaccurate, (ii) the personal data has not been lawfully processed but you wish processing to be restricted instead of having the personal data deleted, or (iii) the Company no longer needs your personal data for the purposes for which it was collected, but you believe that the personal data is necessary for the establishment, exercise or defense of legal claims.
• Right to data portability: in certain circumstances, where the Company processes personal information based on your consent or for performance of a contract with you and the processing is carried out by automated means, you have the right to request that the personal information you provided to the Company be transferred to a third party.

(2) Scope of Application and Method of Exercise
The specific details, conditions for exercise and restrictions of the Rights are governed by the applicable laws and regulations of your place of residence. If you wish to exercise your Rights, please contact the contact point described in “Contact” below. The Company will respond in accordance with laws and regulations after verifying your identity.

Contact

For inquiries, consultations and complaints regarding the handling of personal data in the Service, please contact the Company’s Data Protection Manager below.

Management Policy

(1) Retention Period
The Company sets retention periods for your personal data (all data generated or obtained in connection with your use of the Service). Such information will be deleted when it is no longer necessary to achieve the purposes of processing described in “Handling of Personal Data” above. Specifically, inquiry information will be retained for 10 years from the inquiry for the management of customer complaint handling history and prevention of future disputes, while other personal data of customers will be retained for 5 years from termination of the Service. Information obtained based on your consent will be deleted when the consent is withdrawn. However, where necessary to comply with applicable laws and regulations or respond to orders from governments, courts or other supervisory authorities, the Company will retain such information for the relevant period after implementing security control measures.

(2) Method of Notice, Publication or Obtaining Consent
This Policy is posted and published within the Service, on the screen at the first launch and on the download page. The Company may amend this Policy, and when making material amendments, the Company will provide notice within the Service or on the official website. The amended Policy will apply from the time it is posted in each place where it is made available.

Supplemental Provisions for Specific Countries and Regions

If you reside in any of the following countries or regions, in addition to the Common Provisions, supplemental provisions specific to each region apply.
United States: Supplemental Provisions for United States Residents

Supplemental Provisions for United States Residents

This section applies to customers residing in the United States. This section supplements the provisions on the handling of personal information set out in this Policy. If there is any inconsistency or conflict between this section and other provisions of this Policy, this section will prevail to the extent required by applicable law.

(1) California Residents
The “California Privacy Notice” below applies to customers residing in California. The California Privacy Notice includes additional information under the California Consumer Privacy Act and related regulations concerning the categories of personal information the Company collects, uses, discloses, sells or shares about California residents, the sources of such personal information, purposes of use, retention periods, and the rights of California residents and how to exercise them.

(2) Residents of Other U.S. States
Customers residing in other U.S. states may have, in addition to the rights set out in “Your Rights” in the Common Provisions above, rights under applicable state laws, such as the right to opt out of the sale of personal data, processing for targeted advertising purposes or profiling that produces legal or similarly significant effects concerning you, and the right to appeal the Company’s response to a rights request, as well as other rights.
The availability, content, conditions for exercise and restrictions of these rights are governed by the applicable laws and regulations of your state of residence. If you wish to exercise your rights, please contact the contact point described in “Contact” above. The Company will respond after verifying your identity in accordance with applicable law.

California Privacy Notice

This California Privacy Notice (this “Notice”) applies to customers residing in California and provides additional information under the California Consumer Privacy Act and related regulations (collectively, the “CCPA”) concerning the Company’s handling of personal information and the rights of California residents.

This Notice supplements this Policy. If there is any inconsistency or conflict between this Notice and any other provision of this Policy or any other notice, this Notice will prevail with respect to personal information of California residents subject to the CCPA to the extent required by applicable law.

In this Notice, the terms “personal information,” “sensitive personal information,” “sale,” “sharing,” “business purpose,” “service provider” and other terms defined in the CCPA have the meanings defined in the CCPA unless otherwise stated.

Scope of this Notice

This Notice applies to personal information that the Company collects from or about California residents in connection with the Service, responding to inquiries, advertising and marketing activities and other interactions with customers.
This Notice does not apply to information exempt from the CCPA, anonymized information, de-identified information, aggregate information or other information that does not constitute personal information under applicable law.

Personal Information Collected, Used, Disclosed, Sold or Shared by the Company

The categories of personal information that the Company collects or has collected in the past 12 months, the sources of information, purposes of collection and use, and whether the information is disclosed for a business purpose, sold or shared are as follows. The personal information actually collected varies depending on the content and functions of the Service you use, usage status, settings and whether consent has been given. Such information does not identify individuals. When using, disclosing or otherwise processing de-identified or anonymized information, the Company will maintain and use such information in a non-identifiable form and will not re-identify individuals except in accordance with applicable law.

The Company may use or disclose information that has been anonymized or statistically processed so that individuals cannot be identified, for service improvement, analysis, research, marketing and other purposes permitted by applicable law. Such information does not identify individuals. When using, disclosing or otherwise processing de-identified or anonymized information, the Company will maintain and use such information in a non-identifiable form and will not re-identify individuals except in accordance with applicable law.

Use and Disclosure of Sensitive Personal Information

The Company uses or discloses sensitive personal information within the scope of purposes permitted by the CCPA. This includes use or disclosure necessary to provide the Service, login authentication and identity verification, data migration, ensuring security, investigation and prevention of unauthorized use and violations of terms, providing functions requested by you, compliance with legal obligations, maintaining the quality and safety of services, and enabling service providers to provide services on behalf of the Company.
The Company does not use or disclose sensitive personal information for the purpose of inferring characteristics about you. If the Company uses or discloses sensitive personal information in a manner subject to the right to limit under the CCPA, the Company will provide necessary notices and choices in accordance with applicable law.

Sale and Sharing of Personal Information

The Company does not sell your personal information to third parties for monetary consideration.
However, when the Company uses information collection modules, Cookies, advertising identifiers or other similar technologies of advertising and marketing partners, advertising networks, analytics providers or other third parties, the provision or use of advertising identifiers, IP addresses, device information, play logs, advertisement view and click history, inference information and other advertising-related information may constitute “sharing” or “sale” under the CCPA. You have the right to opt out of the sale or sharing of personal information in accordance with “How to Exercise Rights” below.
The Company does not knowingly sell or share the personal information of customers under 16 years of age. If the Company sells or shares the personal information of customers under 16 years of age,

Retention Period for Personal Information

The Company deletes your personal information when it is no longer necessary to achieve the purposes of processing described in “Handling of Personal Data” in the Common Provisions above, in accordance with the retention periods set out in “Management Policy” in the Common Provisions above.
Specifically, inquiry information will be retained for 10 years from the inquiry for the management of customer complaint handling history and prevention of future disputes. Other personal information of customers will be retained for 5 years from termination of the Service. Information obtained based on your consent will be deleted when the consent is withdrawn. However, where necessary to comply with applicable laws and regulations, respond to orders from governments, courts or other supervisory authorities, handle disputes, protect rights, or investigate or prevent unauthorized use, the Company may retain such information for the necessary period after implementing security control measures.

Rights of California Residents

Customers residing in California have the following rights under the CCPA, subject to certain restrictions and exceptions.

• (1) Right to Know and Right of Access
  You have the right to request disclosure of the following matters concerning your personal information collected, used, disclosed, sold or shared by the Company.
  • Categories of personal information collected by the Company
  • Categories of sources of such personal information
  • Business or commercial purposes for collecting, using, selling or sharing such personal information
  • Categories of recipients, purchasers or third parties with whom such personal information is shared
  • Specific pieces of personal information collected by the Company
• (2) Right to Deletion
  You have the right to request deletion of your personal information collected or held by the Company. However, the Company may refuse a deletion request where permitted by the CCPA, such as for compliance with laws and regulations, ensuring security, preventing unauthorized use, completing transactions, providing services requested by you, protecting rights or other purposes.
• (3) Right to Correction
  You have the right to request correction of inaccurate personal information concerning you that is held by the Company.
• (4) Right to Opt Out of Sale or Sharing
  You have the right to opt out at any time of the sale or sharing of personal information by the Company.
• (5) Right to Limit the Use and Disclosure of Sensitive Personal Information
  If the Company uses or discloses sensitive personal information in a manner subject to the right to limit under the CCPA, you have the right to request that such use and disclosure be limited.
• (6) Right Not to Be Discriminated Against or Retaliated Against
  You have the right not to be subject to discriminatory or retaliatory treatment prohibited by the CCPA, such as refusal to provide goods or services, application of different prices or rates, or provision of a different quality of service, on the grounds that you exercised rights under the CCPA.

How to Exercise Rights

If California residents wish to exercise the right to know (right of access), right to deletion or right to correction, they may submit a request through the contact point described in “Contact” in the Common Provisions above provided by the Company.

The Company verifies identity for requests concerning the right to know (right of access), right to correction or right to deletion under the CCPA. In verifying identity, the Company may compare information provided by you with information contained in the Company’s records. You may be asked to cooperate with procedures that the Company reasonably considers necessary, such as entering required items on the Company’s web form, providing necessary information to the contact point above, or confirming your email address.

The Company may request additional information where necessary to confirm or process a request. If the Company cannot sufficiently verify a request, the Company will notify the requester accordingly and respond in accordance with applicable law. The Company may refuse to respond to a request unless you or your authorized agent provides sufficient information to reasonably verify that the request concerns your personal information.

Depending on the content of the request, the Company may ask you to provide your user ID, email address, account information, device information and other information necessary for identity verification in order to respond to the request. The Company uses information obtained for identity verification only for identity verification and responding to the request.

You may exercise the rights set out in this Notice through an authorized agent permitted under the CCPA. In such case, the Company may request proof that the agent is a business registered to conduct business in California, written authorization or a valid power of attorney showing that the agent has authority to make the request on your behalf, and information necessary to verify your identity or the agent’s authority.

If you wish to opt out of sale or sharing, you may make a request through the contact point described in “Contact” in the Common Provisions above provided by the Company.

If you access the Company’s website or service from an Android mobile device, you may be able to change certain privacy settings and advertising settings through the device settings menu.
Android: You may be able to manage device permissions, privacy settings and advertising settings.
For details concerning advertising identifiers, information collection modules and other similar technologies and choices relating to them, please refer to “Information Collection Modules, Advertising Identifiers and Personalization” in the Common Provisions above.

Changes to this Notice

The Company may amend this Notice from time to time in response to changes in the Company’s handling of personal information, applicable laws and regulations or the content of the Service. If the Company makes material changes, it will notify you within the Service, on the Company’s website or by other appropriate means.

Contact

For inquiries regarding this Notice, the Company’s handling of personal information or the exercise of rights under the CCPA, please contact the contact point described in “Contact” in the Common Provisions above.