1. Introduction

M9 STUDIO INC. ("we," "us," or "our") is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or engage with our services.

We comply with the EU General Data Protection Regulation (GDPR), Japan's Act on the Protection of Personal Information (APPI), and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

We may collect the following categories of personal data:

• Contact Information: Name, email address, company name, and phone number when you submit inquiries through our contact form.
• Technical Data: IP address, browser type, operating system, and access times collected automatically when you visit our website.
• Communication Data: Records of correspondence when you contact us.
• Business Data: Information provided in the context of business relationships, including contract details and project specifications.

4. Legal Basis for Processing (GDPR)

Under GDPR, we process your personal data based on the following legal grounds:

• Consent: When you have given clear consent for us to process your personal data for a specific purpose.
• Contract: When processing is necessary for the performance of a contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: When processing is necessary for our legitimate interests, such as improving our services, provided these interests do not override your rights.
• Legal Obligation: When processing is necessary to comply with a legal obligation.

5. How We Use Your Information

We use your personal data for the following purposes:

• Responding to inquiries and providing customer support
• Processing and fulfilling service requests
• Sending relevant business communications (with your consent)
• Improving our website and services
• Complying with legal obligations
• Protecting our rights and preventing fraud

6. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or reporting requirements. The retention period depends on the nature of the data and the purpose of processing:

• Contact form inquiries: 3 years from last contact
• Business contract data: Duration of contract plus 7 years
• Technical logs: 12 months

7. Data Sharing and Transfers

We do not sell your personal data. We may share your information with:

• Service Providers: Third-party vendors who assist in operating our website and services, bound by contractual obligations to protect your data.
• Legal Requirements: When required by law, regulation, or legal process.
• Business Transfers: In connection with any merger, acquisition, or sale of assets.

For international data transfers outside the EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

8. Your Rights

Under GDPR and applicable laws, you have the following rights:

• Right of Access: Request a copy of your personal data we hold.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure: Request deletion of your personal data under certain circumstances.
• Right to Restrict Processing: Request limitation of processing in certain situations.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us using the details provided below.

9. Cookies and Tracking

Our website uses minimal cookies necessary for basic functionality. We do not use third-party tracking cookies or advertising cookies. For analytics purposes, we may collect anonymized, aggregated data that cannot identify individual users.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for data in transit
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

11. Children's Privacy

Our services are not directed to individuals under 16 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy periodically. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy regularly.

13. Contact Us