1.Who is responsible for your data
Okawari Travels, Tokyo, Japan ([registered address], business registration no. [business registration no.]) is responsible for your personal data. We are a “personal information handling business operator” under Japan’s Act on the Protection of Personal Information (APPI) and the “controller” under the EU and UK General Data Protection Regulation (GDPR). This policy covers okawaritravels.com, our bookings, our tours and your messages to us.
2.Data you give us
- Contact details: name, email address, phone or WhatsApp number, Instagram handle.
- Booking details: tour, date, number of guests, preferred language, booking reference, amount paid and any notes or requests.
- Dietary needs and allergies, and any health information you choose to share so we can keep you safe.
- Payment: handled entirely by Stripe. We only receive the payment status and limited details such as card brand, last four digits and country. We never see or store your full card number or security code.
- Newsletter and bar map: if you request our newsletter or free bar map, your email address, language and sign-up time.
- Messages: what you write to us through Instagram or our contact form.
3.Data collected automatically
When you visit our website, our hosting provider automatically records technical data such as your IP address, browser type, device, pages visited and the date and time, for security and troubleshooting. Our site also stores a few items in your browser (see section 9). We do not use advertising cookies or cross-site tracking. Fonts are loaded from Google Fonts, which receives your IP address when the page loads.
4.Why we use your data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Process your booking, run the tour, send confirmations and contact you on the day | Performance of a contract |
| Take payment and prevent fraud | Contract; legitimate interest |
| Handle allergies, dietary needs and health information | Your explicit consent |
| Keep accounting and tax records | Legal obligation |
| Answer your questions | Steps before a contract; legitimate interest |
| Send the newsletter and bar map | Consent (withdraw any time) |
| Keep the website secure and working | Legitimate interest |
| Promotional photos (you can opt out at the start of the tour) | Legitimate interest |
Under the APPI we use personal information only within the scope of these purposes, and we ask for your consent before using it for any other purpose, except where the law allows otherwise.
6.International transfers
Our booking data is stored in Japan. Some of our providers, such as Stripe, Meta and our email provider, may process data in the United States, the European Union or other countries. Japan is recognised by the European Commission and the UK as providing an adequate level of protection. When data leaves Japan, we take the measures required by the APPI, and for EU/UK data we rely on adequacy decisions or standard contractual clauses. You can ask us for information about the data protection system of the countries concerned.
7.How long we keep it
- Booking and payment records: 7 years, to meet accounting and tax obligations.
- Allergy and health notes: only as long as needed for your tour, then deleted.
- Newsletter and bar map emails: until you unsubscribe.
- Messages and server logs: only as long as needed to answer you or keep the site secure.
8.Your rights
Under Japan’s APPI, you can ask us to disclose the personal data we hold about you (including records of transfers to third parties), to correct, add to or delete it, and to stop using it or sharing it with third parties, as provided by law.
If you are in the EU or the UK, the GDPR also gives you the right to access, rectify and erase your data, to restrict or object to its processing (including objecting to direct marketing at any time), to data portability, and to withdraw consent at any time. You can complain to the data protection authority in your country (in the UK, the ICO). In Japan, you can contact the Personal Information Protection Commission.
To exercise your rights, message us. We may need to verify your identity, and we will reply without undue delay and within one month.
10.Children
Our tours are for adults aged 20 and over. We do not accept bookings for anyone under 20 and do not knowingly collect their data. If you believe a minor has given us personal data, contact us and we will delete it.
11.Security
Our website uses HTTPS encryption, access to booking data is restricted to the people who need it, and card payments are handled by Stripe, which is certified to PCI DSS Level 1. No system is completely secure, but if a data breach affecting your rights occurs, we will notify you and the relevant authorities as required by law.
12.Contact
For any privacy question or request, contact us via Instagram DM (@okawaritours) or the contact form on our website.
13.Changes to this policy
We may update this policy. The date at the top shows the latest version, and we will tell you by email about important changes if we have your address. If the language versions differ, the English version prevails unless the law requires otherwise.