TON — Rules
Privacy Policy
Last updated: 2026-08-27
This Privacy Policy (the "Policy") sets out how BUPPHA Inc. (the "Company") handles personal information in connection with TON (the "Facility"), the accommodation facility it operates, and the services it provides (including the website, reservation systems and related social media; collectively, the "Services"). This page is an English-language reference; the Japanese version (プライバシーポリシー) prevails in case of any discrepancy.
Article 1 (Business Operator)
| Item | Details |
|---|---|
| Business name | BUPPHA Inc. (株式会社BUPPHA) |
| Representative | Naoki Yoshizawa, Representative Director |
| Address | Nishitomo Bldg. Room 205, 1099 Minamiagata-machi, Minami-Nagano, Nagano City, Nagano 380-0836, Japan |
| Contact | contact@ton-nagano.com |
| Personal information protection manager | Naoki Yoshizawa, Representative Director |
Article 2 (Definition of Personal Information)
In this Policy, "personal information" means personal information as defined in Article 2, paragraph 1 of Japan's Act on the Protection of Personal Information: information about a living individual that can identify a specific individual by name, date of birth or other description contained in the information (including information that can be readily collated with other information and thereby identify a specific individual), as well as information containing an individual identification code.
Article 3 (Personal Information We Collect)
The Company may collect the following personal information in connection with the Services:
- Information collected at booking and during a stay
- Names (of the representative and all accompanying guests)
- Address
- Telephone number
- Email address
- Gender and age group
- Nationality, passport number, port of entry and date of entry into Japan (for guests who are foreign nationals)
- Dates of stay, number of guests and purpose of use
- Payment-related information (card details such as the credit card number, expiry date and security code are handled by our payment service provider and are neither collected nor stored by the Company. What the Company retains is limited to the payment result, the card brand, the last four digits of the card number, and transaction identifiers issued by the payment service provider.)
- Emergency contact details
- Information collected through use of the Services
- Information provided in inquiries, feedback and surveys
- Website access logs, cookies, IP addresses, browser information and device information
- Social media account information (where social media integration features are used)
- Information collected at the Facility
- Security camera footage (limited to outdoor areas, the entrance and shared areas of the Facility; no cameras are installed in guest rooms, the sauna room, bathroom, toilets or any other space where privacy must be respected)
Article 4 (Purposes of Use)
The Company uses the personal information it collects for the following purposes:
- Receiving, confirming, changing and cancelling accommodation reservations, and related administration
- Providing accommodation and ancillary services
- Fulfilling obligations under the Ryokan Business Act, the Act on the Prevention of Infectious Diseases and Medical Care for Patients with Infectious Diseases and other applicable laws (preparation and retention of the guest register, etc.)
- Payment processing, billing and issuing receipts
- Responding to inquiries
- Providing information about the Company and the Facility (newsletters, campaign information, etc.)
- Conducting surveys, improving service quality and developing new services
- Responding to conduct that violates the Terms of Use, the Accommodation Terms and Conditions or other rules
- Crime prevention, safety management of the Facility and accident response
- Any other administration necessary for the smooth provision of the Services
Article 5 (Provision to Third Parties)
- The Company does not provide personal information to third parties without the individual's prior consent, except in the following cases:
- Where required by law
- Where necessary to protect a person's life, body or property and it is difficult to obtain the individual's consent
- Where particularly necessary to improve public health or promote the sound development of children and it is difficult to obtain the individual's consent
- Where cooperation is required for a national or local government agency, or a party entrusted by one, to carry out duties prescribed by law
- Notwithstanding the preceding paragraph, the Company may entrust the handling of personal information to contractors within the scope necessary to achieve the purposes of use. In such cases, the Company concludes the necessary agreements with the contractors and supervises them appropriately.
Article 6 (Entrustment)
The Company may entrust the following operations to external contractors within the scope necessary to achieve the purposes of use:
- Operation of reservation management systems (site controller, PMS, etc.)
- Payment processing
- Cleaning and facility management
- Email delivery and CRM operations
- Data analysis and website analytics
- Any other operations necessary for providing the Services
Article 7 (Joint Use)
The Company does not currently plan any joint use of personal information. Should joint use be undertaken, the Company will notify the individuals concerned in advance — or make readily accessible to them — the fact of joint use, the categories of personal information jointly used, the scope of joint users, the purposes of use and the name of the party responsible for management.
Article 8 (Provision to Third Parties Located Abroad)
Where a reservation is made through a booking site (Airbnb, Booking.com, etc.), personal information may be located abroad via the operator of that site. Please also review the privacy policy of the relevant site.
Article 9 (Security Management)
The Company takes the following measures to prevent leakage, loss or damage of personal information and otherwise manage it securely:
- Establishing internal rules for the protection of personal information
- Training employees who handle personal information
- Managing the areas where personal information is handled and preventing theft of devices and electronic media
- Access control, prevention of unauthorized access and anti-virus measures
- Appropriate selection and supervision of contractors entrusted with the handling of personal information
Article 10 (Requests for Disclosure, etc.)
- An individual may request that the Company notify the purposes of use of, disclose, correct, add to, delete, suspend the use of, erase or suspend the third-party provision of their retained personal data (collectively, "disclosure, etc.").
- Requests for disclosure, etc. should be made to the contact point set out in Article 14. The Company will respond within a reasonable period after verifying the identity of the requester by its prescribed method.
- A fee may be charged for requests for disclosure, etc. as provided by law.
Article 11 (Cookies)
- The Company's website may use cookies to improve convenience, analyze site usage and deliver advertising.
- You can refuse cookies through your browser settings; however, disabling cookies may make some features of the Services unavailable.
- The Company's website uses the following analytics tools:
- Google Analytics (Google LLC) — to understand how the site is used.
- Microsoft Clarity (Microsoft Corporation) — to record on-page interactions (where you click, how far you scroll, mouse movement) and aggregate them into heatmaps. Anything typed into input fields is automatically masked and is not recorded.
- These tools collect browsing activity via cookies and similar technologies. The Company does not send your name, address, contact details or any other directly identifying information to them. For how the collected information is handled, please refer to each provider's privacy policy.
Article 12 (Personal Information of Minors)
If you are a minor, please provide personal information through the Services only with the consent of a parent or guardian.
Article 13 (Retention Period)
- The Company retains personal information only for the period necessary to achieve the purposes of use.
- The guest register required under the Ryokan Business Act is retained for 3 years from the date of stay, as required by law.
- Other personal information is erased within a reasonable period after the purposes of use have been achieved or after the individual requests erasure.
Article 14 (Contact)
For inquiries about the handling of personal information, requests for disclosure, etc., or opinions and complaints, please contact:
| Item | Details |
|---|---|
| Business name | BUPPHA Inc. (株式会社BUPPHA) |
| Address | Nishitomo Bldg. Room 205, 1099 Minamiagata-machi, Minami-Nagano, Nagano City, Nagano 380-0836, Japan |
| contact@ton-nagano.com | |
| Reception hours | Inquiries are received by email at any time. There are no fixed business hours; we reply in the order received. |
Article 15 (Amendment of this Policy)
The Company may amend this Policy as necessary. The amended Policy takes effect when posted on the Company's website. Material changes will be notified separately by appropriate means.