GDPR Policy

1. When Does the GDPR Apply?

The GDPR does not automatically apply simply because a website is accessible in the European Union. Under Article 3, it may apply when an organization processes personal data in the context of an establishment in the EU, or when an organization outside the EU offers goods or services to individuals in the EU or monitors their behavior there, subject to the applicable legal conditions. 

2. Data Protection Principles

Where the GDPR applies, personal data must be processed in accordance with its applicable principles, including:

  • Lawfulness, fairness, and transparency: Process personal data on a valid legal basis and provide clear information.
  • Purpose limitation: Use personal data for specified and legitimate purposes.
  • Data minimisation: Collect only personal data that is necessary for the relevant purposes.
  • Accuracy: Take reasonable steps to keep personal data accurate and up to date where necessary.
  • Storage limitation: Retain personal data only as long as necessary, subject to applicable legal obligations.
  • Integrity and confidentiality: Apply appropriate protection against unauthorized access, loss, or damage.
  • Accountability: Where required, be able to demonstrate compliance with applicable GDPR obligations.

3. Individual Rights Under the GDPR

Where the GDPR applies, individuals may have the following rights, subject to the applicable conditions, limitations, and exceptions:

  • Access: Request access to their personal data and related processing information.
  • Rectification: Request correction of inaccurate or incomplete personal data.
  • Erasure: Request deletion of personal data where the GDPR provides this right.
  • Restriction: Request restriction of processing in certain circumstances.
  • Data portability: Receive certain personal data they have provided in a structured, commonly used, machine-readable format and, where legally applicable, request its transfer to another controller.
  • Object: Object to certain processing, including direct marketing, as provided by the GDPR.
  • Automated decision-making: Where Article 22 applies, benefit from the protections relating to certain decisions based solely on automated processing, including profiling, that have legal or similarly significant effects.
  • Withdraw consent: Withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.
  • Lodge a complaint: Submit a complaint to a competent data protection supervisory authority where the GDPR provides this right.

4. How to Exercise Your Rights

If you believe the GDPR applies to your situation and wish to exercise a relevant right, contact us using the details in the Contact Us section.

Please describe your request clearly. Where reasonably necessary and permitted by law, we may request additional information to verify your identity or clarify your request. We will seek to avoid collecting unnecessary sensitive information.

Where Article 12 of the GDPR applies, we generally must respond without undue delay and within one month of receiving a request. This period may be extended by up to two additional months where necessary due to the complexity or number of requests. If an extension is needed, we must notify you within the initial one-month period and explain the reasons. Any refusal, fee, or other limitation must comply with the applicable GDPR provisions. 

5. Data Controller and EU Representative

The website operates under the name Norafioradrel. The contact details currently provided are:

  • Email: info@norafioradrel.com
  • Address: Uchinouchi 1372, Wakayama, Wakayama Prefecture 641-0013, Japan

The website name and contact details do not necessarily establish the legal identity of the business operator. The controller's legal name and role should be confirmed against the actual business arrangements before publication.

Under Article 27, certain organizations established outside the EU may be required to appoint a representative in the EU when Article 3(2) applies, unless an applicable exception is met. Whether this requirement applies to Norafioradrel depends on its actual activities and the relevant legal conditions. 

6. Data Security and International Transfers

Where the GDPR applies, appropriate measures must be taken to protect personal data, and transfers of personal data outside the European Economic Area must comply with the applicable GDPR requirements.

Depending on the circumstances, an international transfer may require an applicable adequacy decision, appropriate safeguards, or another lawful basis under Chapter V of the GDPR. The relevant requirements depend on the destination, recipient, and actual transfer arrangements.

We do not claim that a particular transfer mechanism or security certification is in place unless it has been verified. Our actual data flows and safeguards should be assessed before this policy is published.

7. Updates to This Policy

We may update this GDPR Policy when our business activities or applicable legal requirements change. The revised version will be published on this page with an updated date.

8. Contact Us

For questions about this policy or requests concerning rights that may apply under the GDPR, contact us:

Address: Uchinouchi 1372, Wakayama, Wakayama Prefecture 641-0013, Japan
Phone: +81 73-427-1962
Email: info@norafioradrel.com
Customer Service Hours: Monday–Friday, 9:00 AM–6:00 PM (Central Time, CT)