Privacy Policy

1. Information We Collect

We collect information necessary to provide our services and ensure a safe festival experience. The types of data we collect include:

• Personal Information: Full name, email address, phone number, date of birth (for age verification), billing address, and nationality.
• Payment Information: Payment card details and billing information. Please note that payment transactions are processed securely by our payment providers (Stripe and PayPal). We do not store full card numbers or CVV codes on our servers.
• Technical Information: IP address, browser type and version, operating system, device identifiers, cookies and similar tracking technologies, referring URLs, and time zone settings.
• Usage Data: Pages visited on our website, links clicked, ticket selection history, session duration, and interaction with our emails and marketing materials.
• Event-Related Data: Ticket purchase history, QR codes, wristband assignments, and on-site check-in records.
• Communications Data: Records of your correspondence with us via email, live chat, or phone, including support requests and feedback.

2. How We Use Your Information

We use your personal information only for legitimate purposes related to operating the Joyful Craft Space event and providing you with our services:

• Ticket Processing: To complete your purchase, issue e-tickets, manage your booking, and facilitate on-site entry.
• Email Confirmations: To send booking confirmations, e-ticket delivery, receipts, and important festival updates.
• Festival Updates: With your consent, to send newsletters, artist announcements, schedule updates, and promotional offers.
• Customer Support: To respond to your enquiries, resolve disputes, and provide assistance before, during, and after the event.
• Security and Fraud Prevention: To verify identities, prevent fraudulent ticket purchases, and maintain the safety of our systems and attendees.
• Legal Compliance: To comply with applicable laws, respond to legal requests, and enforce our Terms & Conditions.
• Analytics & Improvement: To analyse website performance, understand user behaviour, and improve our services.

3. Legal Basis for Processing

Under GDPR and Japanese APPI, we must have a lawful basis for processing your personal data. We rely on the following legal bases:

• Contractual Necessity: Processing is necessary to fulfil our contract with you — for example, to issue your tickets and provide festival access.
• Legitimate Interests: We process certain data for our legitimate business interests, such as fraud prevention, improving our website, and ensuring event safety, where these interests are not overridden by your rights.
• Consent: Where we rely on consent — such as sending marketing emails or placing non-essential cookies — we will ask for your explicit agreement, and you may withdraw consent at any time.
• Legal Obligation: We may process your data to comply with a legal obligation, such as tax record-keeping requirements under Japanese law.

4. Data Sharing

We do not sell, rent, or trade your personal data to third parties for marketing purposes. We may share your information only in the following limited circumstances:

• Payment Processors: Stripe and PayPal receive the billing information necessary to process your payment. These providers maintain their own privacy policies and security certifications (PCI DSS compliant).
• Email Service Providers: We use trusted third-party email platforms to deliver transactional and marketing communications on our behalf.
• Event Operations Partners: Venue operators and accredited security personnel may access ticket validation data for on-site operations only.
• Analytics Providers: Aggregated and anonymised usage data may be shared with analytics platforms to improve our services.
• Legal Authorities: We will disclose your data to law enforcement or regulatory bodies when required by applicable law, court order, or to protect the safety of our attendees.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the relevant successor entity, subject to the same privacy protections.

5. Data Retention

We retain your personal data only for as long as is necessary for the purposes it was collected and to comply with our legal obligations:

• Ticket & Order Data: Retained for 7 years from the date of purchase to comply with Japanese corporate and tax law requirements.
• Marketing & Communications Data: Retained until you withdraw your consent or unsubscribe from our mailing list, after which it is deleted within 30 days.
• Customer Support Records: Retained for 3 years after your last interaction with our support team.
• Technical & Analytics Data: Typically retained in anonymised form for up to 26 months for analytical purposes.
• Security Incident Logs: Retained for up to 2 years from the date of the incident.

Once the retention period expires, your data is securely deleted or permanently anonymised.

6. Your Rights (GDPR & Japanese APPI)

Depending on your location, you have a number of rights in relation to your personal data. We are committed to honouring these rights promptly:

To exercise any of these rights, please email us at info@joyfulcraftspace.com with the subject line "Data Subject Request" or use our postal address. We will respond within 30 days. We may need to verify your identity before processing your request.

If you are unsatisfied with our response, you have the right to lodge a complaint with the Personal Information Protection Commission (PPC) in Japan, or with your local data protection authority if you are an EU resident.

7. Cookies Policy

We use cookies and similar tracking technologies to provide, improve, and personalise our website. When you first visit our site, you will be presented with a cookie consent banner. You can manage your cookie preferences at any time.

You can withdraw or modify your cookie consent at any time by clicking the "Cookie Settings" link in our footer. Withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal.

8. International Data Transfers

Joyful Craft Space is based in 東大阪市, Japan. Some of our service providers — including payment processors and email platforms — may process your data in countries outside Japan. Where we transfer data internationally, we ensure appropriate safeguards are in place:

• We only transfer data to countries that have been recognised as providing an adequate level of data protection under Japanese APPI and/or EU GDPR (e.g., EU/EEA member states and countries with adequacy decisions).
• Where adequacy decisions do not apply, we use Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent measures.
• All third-party processors are bound by data processing agreements that require them to protect your data in accordance with applicable law.

9. Children's Privacy

Our website and services are not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected data from a child under 13, please contact us immediately at info@joyfulcraftspace.com and we will promptly delete such information.

Attendees aged 13–15 must be accompanied by a parent or guardian who must hold a linked adult ticket. Festival ticket purchase requires the purchaser to be at least 16 years of age.

10. Contact Our Privacy Team

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: info@joyfulcraftspace.com
• Postal Address: Joyful Craft Space — Privacy Team, 〒578-0905 大阪府東大阪市川田4-3-1
• Response Time: We aim to respond to all privacy enquiries within 5 business days and will fulfil data subject requests within 30 days.

Update History

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The table below shows the history of material updates:

Version	Date	Summary of Changes
v1.0	January 2025	Initial privacy policy published for Joyful Craft Space 2025. Covers APPI compliance and basic GDPR provisions.
v1.1	June 2025	Updated cookies section to include Google Analytics 4. Added data portability provisions. Expanded third-party processor list.
v2.0	January 2026	Major revision for 2026 event. Updated retention periods, added international transfer safeguards, expanded Your Rights section, aligned with revised APPI amendments effective April 2025.