Basic Policy

R YACHT CO., LTD. (the “Company,” “we,” “our”) is committed to ensuring that customers can use our services with confidence. As data controller, we handle the personal data of customers residing in the European Economic Area (EEA) and the United Kingdom appropriately and in accordance with the EU General Data Protection Regulation (GDPR).

Information We Collect

We collect information such as your name, address, contact details, and passport information — from you directly or from travel agencies and similar parties — to the extent necessary for cruise reservations, boarding procedures, communications with you, safety management, and payment processing.
Where necessary, we may also ask you to provide special categories of information, such as dietary restrictions or health conditions. Such information is strictly protected and processed only where required. If this information is not provided, we may be unable to provide all or part of our services.
In addition, CCTV footage may be recorded on board to ensure onboard safety and to prevent crime and accidents.

Purposes of Use of Personal Data

1. 1. To communicate with you and to conclude and perform contracts of carriage, and to provide services at sea and ashore
2. 2. To ensure the accuracy of information by verifying boarding records, including past service history (including inquiries to handling travel agencies)
3. 3. To plan, develop, and improve travel products and services (including market analysis)
4. 4. To conduct surveys and analyze their results
5. 5. To handle immigration inspections and dealings with government authorities at ports of call in Japan and abroad (including the submission of documents and electronic data required by laws, regulations, or security requirements)
6. 6. To ship and analyze products purchased in the onboard shop and online shop
7. 7. To process procedures relating to ship visits
8. 8. To make prompt contact and respond appropriately in emergencies (illness, disaster, accident, etc.)

Legal Basis

We process personal data on the basis of the performance of a contract, compliance with legal obligations, legitimate interests, or your consent, in accordance with the GDPR. Special categories of data are processed only with your explicit consent or where required by law.

Disclosure, Provision, and Entrustment of Personal Data

To provide our services, we may provide your data to contractors such as travel agencies, system providers, and payment processors. In such cases, we conclude appropriate agreements with these parties and supervise them to ensure that your data is managed securely.

International Data Transfers

Your personal data may be processed outside the EEA and the United Kingdom in connection with ship operations, port-of-call procedures, and similar purposes. We manage personal data primarily on servers located in Japan. Japan has been recognized under the GDPR as providing an adequate level of protection for personal data (adequacy decision), and your personal data remains appropriately protected in connection with such transfers.

Data Retention

Personal data is retained only for the period necessary to provide our cruise services and to fulfill related legal obligations, or for a reasonable period determined in accordance with applicable laws and industry practice. After this period, personal data is deleted or anonymized by secure means.

Your Rights

You have the right to access, rectify, and erase your personal data, to restrict its processing, to data portability, and to object to processing. Where processing is based on consent, you may withdraw that consent at any time. You also have the right to lodge a complaint with a data protection supervisory authority regarding our handling of your personal data.

Security

We implement technical and organizational security measures to prevent unauthorized access to, and the loss or leakage of, personal data. We also provide the necessary training to and supervise our employees and contractors to ensure proper handling.

Updates to This Notice

This notice may be revised in response to changes in law or in our services. Any revisions will be published promptly, with the date of the most recent revision clearly indicated.

We will continue to work to protect personal data so that our customers can use our services with confidence.