Privacy Policy (Draft v1.0)

Important: Draft for review by Japanese legal counsel. Intended to align with Japan's Act on the Protection of Personal Information (APPI) and accommodate international guests.

1. Purpose

GS Astuto (“we”, “our”, “us”) respects your privacy and handles personal information responsibly. This Privacy Policy explains how we collect, use, store and disclose your information when you use our Ride, Stay and Explore services.

2. Information We Collect

We may collect: name, postal address, email, telephone, nationality, emergency contact, date of birth, passport/ID where required by law, booking history, bicycle sizing information, medical/dietary information voluntarily provided, payment information processed through Stripe, website analytics, device/browser information, and IP address.

We do not store full payment card numbers.

3. How We Use Your Information

  • manage bookings;
  • provide accommodation, rentals and tours;
  • communicate before and during travel;
  • process payments and refunds;
  • comply with Japanese legal obligations;
  • improve customer service;
  • maintain safety records;
  • respond to emergencies;
  • prevent fraud.

4. Legal Basis

  • performance of a contract;
  • legal obligations;
  • legitimate business interests;
  • customer consent.

5. Payment Processing

Payments are processed by Stripe or other approved providers. Sensitive payment information is handled by the payment processor in accordance with its own security standards.

6. Cookies and Analytics

Our website may use session cookies, security cookies, Google Analytics or equivalent, and performance monitoring tools. Users may disable cookies, although some features may not function correctly.

7. Sharing Information

We may share information only where reasonably necessary with accommodation providers, transportation operators, guides, insurers, emergency responders, payment processors, and government authorities where legally required. We do not sell personal information.

8. International Transfers

As we serve international customers, information may be transferred across national borders where necessary to deliver services. Reasonable safeguards will be used.

9. Data Retention

Information is retained only as long as reasonably necessary for legal compliance, taxation, accounting, insurance, dispute resolution, and operational records. Information no longer required will be securely deleted or anonymised.

10. Security

We implement reasonable administrative, technical and organisational safeguards including encrypted payment processing, access controls, secure backups, and limited staff access. No electronic system can guarantee absolute security.

11. Marketing

Marketing emails are sent only where permitted by law or with consent. Customers may unsubscribe at any time. Operational booking communications cannot always be opted out of while an active booking exists.

12. Your Rights

  • access to your information;
  • correction of inaccurate information;
  • deletion where appropriate;
  • withdrawal of consent where processing relies upon consent.

Identity verification may be required.

13. Children's Privacy

Bookings involving minors require consent from a parent or legal guardian.

14. Third-Party Websites

Links to external websites are provided for convenience. GS Astuto is not responsible for third-party privacy practices.

15. Changes

This Privacy Policy may be updated periodically. Material changes will be published on our website.

16. Contact

GS Astuto
Matsuida, Annaka City, Gunma, Japan
Email: [Insert Email]
Website: https://www.gsastuto.com

Version: Draft 1.0 | Status: Pending legal review.