Hoshino Resorts, which are the corporations running facilities listed on the official websites of Hoshino Resorts (https://hoshinoresorts.com/en/), Hoshino Resorts Holdings Inc., its subsidiaries and affiliated companies, including corporations listed in this list, and other separate businesses, which operate under hotel management agreements (hereinafter collectively, “Hoshino Group”, “Company” or “we”.), acknowledging that it is an important social responsibility of the Company to protect and appropriately use information relating to individuals provided by our customers and business partners (hereinafter the “Customer(s)” or “you”) （such information, as set forth in Article 1 (Information We Collect), will be called the “Personal Information”), establishes and faithfully implements its Privacy Policy (hereinafter “this Policy”).

1. ）Personal Information provided by the Customers and Travel agents:

   Personal Information to be collected by the Company includes names, addresses, telephone numbers, e-mail addresses, birth dates, gender, nationality, passport, visa information, marketing preferences, other information that the Customers input on the entry form provided by the Company, or Company’s staff members input at the instruction of the Customers, information about the Customers’ previous transaction with us including our hotels where the Customers have stayed, dates of arrival and departure, goods and services purchased or utilized at our hotels, personal preferences information which the Company learns about during the Customer’s stay, information that the Customers provide the Company for using the Company’s service, information that the Customers provide travel agents (e.g., travel agents, group travel organizers, the Customer’s employer, credit card companies, and airline operators, involved in making the Customer’s travel arrangements, hereinafter collectively, the “travel agents”), upon reservations, information of credit card number or other payment methods and information that is indispensable for the provision of services or transactions.

2. ）Information collected by the Company from the Customers’ visit to the Company’s websites:

   The Company may collect information on the occasion of a visit to its websites including:
   Device information;
   Log information;
   Cookies and anonymous ID; and
   IP address and device identification information.

3. ）Sensitive Information

   To the extent any of the categories of information we collect are sensitive categories of information under applicable law, we process such information only for the limited purposes permitted by applicable law. We do not sell or use sensitive categories of information for purposes of targeted advertising or to make inferences.
   ※“targeted advertising” is the display of advertising that you are interested in on the Company’s websites, other websites, or web services.

The Company collects the Personal Information since the Personal Information is required for the Company’s legitimate interests (as detailed below), for the performance of legal obligations that the Company is subject to or for fulfilling contractual obligations to the travel agents.
The Company’s legitimate interests include:

1. ）To contact the Customers for the confirmation of a reservation or similar purposes;

2. ）To provide the Customers with a service, product or information;

3. ）To process payments;

4. ）To conduct marketing activities that fall under the following;

   (a)Distribution of targeted advertising through ad distributors such as Google and Yahoo. (*1, and *3)
   (b) Provision of advertising and information on products, services, campaigns, etc., through information letters, emails, etc, based on the analysis of attribute information and activity history acquired by the Company in order to understand the hobbies and tastes of the Customers (* 2)
   (c) Other matters which shall be treated pursuant to items (a) through (b).

   (* 1)The Company's websites uses cookies to make your experience more convenient. For more information about how the Company handles cookies, see in article 6 (Cookies and other similar related technologies).
   (* 2)The Company’s websites uses Google Analytics, a service provided by, Google-owned to track the Customers’ visits to the websites. When the Customers visit the websites, we collect, record, and analyze the history of the Customers’ visits to the Company’s websites based on cookies issued by the Company. The Company receives the results of the analysis from Google to track the Customers’ visits to the Company websites. The Customers can stop Google Analytics from collecting information about you by disabling it in your browser’s add-on settings. For more information about the Google Analytics, please visit the Google Analytics Terms of Service website, and for more information about Google’s privacy policy, please visit the Google’s Privacy Policy website. To disable Google Analytics, visit the Google Analytics opt-out add-on website.
   【Google Analytics Terms of Service】
   https://marketingplatform.google.com/about/analytics/terms/us/
   【Google’s Privacy Policy】
   https://policies.google.com/privacy?hl=en
   【Google Analytics opt-out add-on】
   https://tools.google.com/dlpage/gaoptout?hl=en
   (* 3) The Company’s websites may hash (“hash” means the process that generates a value from a string of text taking measures prescribed by laws and regulations and makes it impossible to restore the personal information.) the email address provided by the Customers and may send the hashed email address to Google. Please visit the Google's opt-out site below to disable advertising.
   【Google optout】
   https://support.google.com/My-Ad-Center-Help/answer/12155764?hl=en&visit_id=638471226864490912-662105129&rd=1&sjid=16503022507909407840-AP

5. ）To make an analysis for improvement of services or products;

6. ）To send a questionnaire for further improvement of the Company’s service;

7. ）To request compliance with the terms of use for services provided through the Company’s websites or mobile sites;

8. ）To protect services provided through the Company’s websites or mobile sites, or the Customers;

9. ）To verify the Customer’s identity if the Customers make requests regarding the Personal Information pursuant to this Policy;

10. ）To meet legal obligations the Company is required to subject, which includes Japanese law and laws of the area that the Company’s hotels are located;

11. ）To manage events of prize, drawings or other promotions;

12. ）To fulfill contractual obligations to the travel agents;

13. ）To engage in targeted advertising. We work with agencies, ad networks, technology providers, and other third parties to place advertising about our products and services on other websites and services. For example, we place advertising through Google that you may view on their platforms as well as on other websites and services. As part of this process, we incorporate tracking technologies into our own Service as well as into our advertising displayed on other websites and services. Some of these tracking technologies may track your activities over time and across non-affiliated services and obtain or infer information about you for purposes of targeted advertising.

14. ）For purposes separately notified or announced to the Customer; and

15. ）To administer record keeping.

The Company collects the Personal Information in the following methods:

1. ）Directly from the Customers: Regarding the information as described in Article 1 (Information We Collect) (1), the Company may collect the Personal Information when the Customers book a reservation, use the Company’s hotels, create an account, answer a questionnaire, apply for a prize or a prize draw, contact customer service, or apply for the Company’s service

2. ）From the Customers’ devices and the Company’s networks: Regarding the information as described in Article 1(Information We Collect) (2), the Company may collect the Personal Information automatically through cookies and related technologies from the Customers’ devices when the Customers view the Company’s websites or other websites and services.

3. ）From other businesses when they operate as our service providers: To offer more comfortable services, the Company may collect the Personal Information by using other company’s services. The Company may also receive the Personal Information from (i) the Customer’s travel agents, (ii) the Customer’s travel provider, such as an airline, or (iii) credit card companies used by the Customers, when such parties are operating as the Company’s service providers.

4. ）From social media: If the Customers voluntarily apply for or participate in activities or services which the Company host on a social media, the Company may receive contact and identification information, stay and purchase information, internet and network activity, and any other personal information contained in the Customer’s social media posts or profiles.

1. ）We implement and maintain reasonable administrative, physical, and technical security safeguards to help protect the Personal Information from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of the Personal Information.

2. ）The Company will manage the Personal Information appropriately in accordance with applicable laws.

1. ）The Company may disclose the Personal Information to service providers in order to improve the quality of the Company’s services, for the convenience of the Customers, and for other permitted business purposes. In this case, the Company will instruct and supervise the service provider to ensure appropriate management of the Personal Information. To the extent required by laws, the Company will contractually prohibit its service providers from processing the Personal Information they collect on the Company’s behalf for purposes other than performing services for the Company, although the Company may permit them to use non-personal information, including de-identified or anonymized information, for any purpose to the extent permitted by applicable laws.

2. ）Some of the third parties we work with to perform services act as our service providers in some contexts, but in other contexts independently control the purposes and means of processing your information. For example, we disclose the Personal Information to ad networks, technology providers, and other third parties that help us provide targeted advertising, but they may also use your information for their own purposes. For these third parties, including service providers and other relevant technology providers we work with to perform targeted advertising, we encourage you to familiarize yourself with and consult their policies and terms of use.

3. ） The Company will not disclose or provide the Personal Information to any third partis (which does not include Shared Users as described in Article 7 (Shared Use)) except for the following cases:

   ①If the Customer consents to the disclosure or provision;
   ②If the disclosure or provision is required under the laws and regulations;
   ③If the disclosure or provision is necessary to protect human life, body or property, and it is difficult to obtain the Customer’s consent;
   ④If the disclosure or provision is specifically necessary for the improvement of public health or the promotion of the sound development of children, and it is difficult to obtain the Customer’s consent;
   ⑤If the Company is required to cooperate with a national government organ, local government or person entrusted thereby in performing business prescribed in legislation, and obtaining the consent of the person may impede the performance of such business;
   ⑥If the Personal Information is disclosed or provided to an outside contractor to the extent necessary for providing services to the Customers; or
   ⑦If the Company transfers the Personal Information or the right of management of the Personal Information as a part of the transfer of assets in connection with a corporate reorganization such as a business transfer.

1. ）The Company uses cookies and related technologies on the Company’s websites to allow the Company to evaluate and improve the functionality of the websites. These cookies and related technologies also allow the Company, advertising networks, social media companies, and other providers, to place advertisements and customized content. With respect to use of cookies for advertising, the Customer can find different methods of managing the Customer’s cookies preferences by referring to user instructions of the Customer’s own internet browser including blocking certain cookies by adjusting the settings on the Customer’s Internet browser. A cookie preference set by the Customer is unique to the websites, devices, and browsers, and it will be deleted if the Customer clears the cache in the browser. If the Customers block cookies, the Customers will not be able to use a part of the features of the Company’s websites.

2. ）If the Customers visit the Company’s websites and make an airline reservation or rent a car, the Customers may be redirected to websites maintained by third parties. In this case, the Company’s responsibility is limited to its own websites except some particular websites. The Company will not be responsible for personal information collection practices or privacy policies of other websites maintained by third parties where the Customers submit its personal information directly. The Company recommends that the Customers review the privacy and security policies of such websites before access and provide any personal information.

The Company may share the Personal Information as follows:

1. ）Items of the Personal Information shared : the items in “Article 1 (Information We Collect).

2. ）Scope of users of sharing : Hoshino Group

3. ）Purposes of sharing: the purposes in “Article 2 (Purposes of Use of Personal Information).

4. ）Name of the corporation responsible for the management of shared use:
   Hoshino Resorts Inc.
   2148 Oaza-Nagakura, Karuizawa Town, Kitasaku-gun, Nagano 389-0111 Japan
   Representative Director　Takashi Sogawa

The Company will comply with laws, regulations and applicable guidelines on personal information aimed at protecting the Personal Information.

Because the Company is based in Japan, if the Customers access the Company’s websites from outside Japan, the Personal Information may be transferred to, stored, and processed in Japan and other countries where the Company’s servers are located and its central database is operated. The Company will endeavor to take reasonable steps to ensure that the Personal Information is protected, but the data protection and other laws of Japan and other countries might not be as comprehensive as those in the Customer’s country.

The Customers may always choose what the Personal Information the Customers wish to provide to the Company and receive (or deny) communications from the Company. However, if the Customers choose not to provide the Personal Information, some services of the Company may not be available. The Company may contact the Customers for introducing services and events which the Company thinks the Customers are interested in. The Customers may always choose not to receive any or all of these communications or wish to update the way the Company communicates the Customer by contacting the Company as described below in Article 14 (Contact Information). For California residents, to opt out of sales or shares (as those terms are defined by applicable law) or the processing of the Personal Information for targeted advertising purposes, as permitted under your jurisdiction, please refer to the jurisdiction-specific sections below.

The Company will retain the Personal Information for the period necessary to fulfill the purposes listed in this Policy according to the criteria as described below:

1. ）If the Company has an ongoing relationship with the Customers and provide the services to the Customers (for example, as long as the Customers have accounts with the Company or keep using the Company’s services);

2. ）If there is a legal obligation to which the Company is subject; or

3. ）If the Company determines that retention is advisable considering the Company’s legal position (such as, for statutes of limitations, litigation or regulatory investigations).

The Company does not sell products or provide services to children under the age of 18 and the Company does not knowingly collect the Personal Information (as that term is defined by the U.S. Children’s Privacy Protection Act, or “COPPA” in this Article.) from children under the age of 18. If you are a parent or guardian and believe we have collected the Personal Information from children under the age of 18, please contact us as described below in Article 14 (Contact Information). We will delete the Personal Information in accordance with COPPA.

The Company will respect the rights of the Customers, and if disclosure, correction, restriction, deletion of the Personal Information, the right to data portability or object to processing is exercised, the Company will verify the identity of the applicant and accommodate such request to the extent reasonable and necessary. If the Customers have agreed to provide the Personal Information to the Company, the Customers also have the right to withdraw its consent at any time by contacting us as described below in Article 14 (Contact Information).

Please click “Contact Us” or contact us by any of the following means if you have any opinions, questions, inquiries, complaints about this Policy and handling of the Personal Information or if you would like to submit a request under the applicable law to exercise your rights in relation to the Personal Information that we maintain about you.

・by mail
Personal Information Management Officer, Hoshino Resorts Inc.
Mailing address: 1-2-3 Ginza, Chuo-ku, Tokyo 104-0061 Japan

・by telephone
Please call the phone number listed on the contact page of each facility’s websites of the Company.

The Company may review and, if necessary, modify this Policy from time to time. If the Company modifies this Policy, the Company shall take appropriate measures, such as posting the modified policy on the Company’s websites (https://hoshinoresorts.com/en/). If the revisions are material, the Company may provide you additional notice to your email.

This Policy shall also apply to the users of the reservation system for Tour products “Hoshino Resorts HotelPay”, which Time Design Co., Ltd. Manages and the Personal Information collected through “Hoshino Resorts HotelPay”.

The Company may entrust the handling of the payment information that the Company receives from the Customers who book Hoshinoya Guguan to GMO Payment Gateway Inc.

These additional rights and disclosures apply only to California residents. Terms have the meaning ascribed to them in the California Consumer Protection Act as amended by the California Privacy Rights Act (CPRA), unless otherwise stated.

1. ）Notice of Collection.

   For the categories of the Personal Information we have collected in the past 12 month, see in Article 1 (Information We Collect) above, which we have further set out below using California-specific terms:

   •　Contact Identifiers, including your name, email address, postal address, and phone number.
   •　Characteristics or demographics, including your age, gender, and country.
   •　Commercial or transactions information, including records of products or services you purchased, obtained, or considered.
   •　Device identifiers, including your device’s IP address and Ad Id. •　Device information, including your device’s operating software and browser (e.g., type, version, and configuration), internet service provider, and regional and language settings.
   •　Internet activity, including information about your browsing history and interactions, such as the features you use, pages you visit, content you view, purchases you make or consider, time of day you browse, and referring and exiting pages.
   •　Non-precise location data, such as location derived from an IP address or data that indicates a city or postal code level.
   •　Inferences, drawn from any of the above information identified in this section.

   •　Account credentials, including your username, password, password hints, and other information for authentication or account access.
   •　Payment information, including your payment instrument number (such as a credit or debit card number), expiration date, and security code as necessary to process your payments.

   For the categories of sources from which the Personal Information is collected, see in Article 3 (How We Collect the Personal Information) above. For the specific business and commercial purposes for collecting and using the Personal Information, see in Article 2 (Purposes of Use of Personal Information) above. For the categories of third parties to whom the Personal Information is disclosed, see in Article 5 (Disclosure of Personal Information) above.

   We do not sell the Personal Information as that term is traditionally understood. However, some of our disclosures of the Personal Information may be considered a “sale” or “share” as those terms are defined under the CPRA. A “sale” is broadly defined under the CPRA to include a disclosure for something of value, and a “share” is broadly defined under the CPRA to include a disclosure for cross-context behavioral advertising. We collect, sell, or share the following categories of the Personal Information for commercial purposes: contact identifiers, characteristics or demographics, commercial or transactions information, user-generated content, device identifiers, device information, internet activity, non-precise geolocation data, and inferences drawn from any of the above. The categories of third parties to whom we sell or share the Personal Information include, where applicable, vendors and other parties involved in cross-context behavioral advertising. For details on your rights regarding sales and shares, see the Right to Opt-Out of Sales and Sharing section below. We do not knowingly sell or share the Personal Information of minors under 16 years old who are California residents.

   Some of the Personal Information we collect may be considered sensitive personal information under CPRA. For example, precise location data or account credentials. We collect, use, and disclose such sensitive personal information only for the permissible business purposes for sensitive personal information under the CPRA or without the purpose of inferring characteristics about consumers. We do not sell or share sensitive personal information.

2. ）Right to Know, Correct, and Delete

   You have the following rights under the CPRA:

   
   

   •　The right to know what personal information we have collected about you, including the categories of the Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purposes for collecting, selling, or sharing the Personal Information, the categories of third parties to whom we disclose the Personal Information, and the specific pieces of the Personal Information we have collected about you.
   •　The right to correct inaccurate personal information that we maintain about you.
   •　The right to delete the Personal Information we have collected from you.
   
   To exercise any of these rights, please contact us as set out in Article 14 (Contact Information) above and specify which right you are seeking to exercise along with your region. Please note these rights are subject to exceptions. If you have an account with us, we may require you to use the account to submit the request. We will confirm receipt of your request within 10 business days and respond to your request within 45 days. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your request.

3. ）Right to Opt-Out of Sales and Sharing

   To the extent we “sell” or “share” your personal information as those terms are defined under the CPRA, you have the right to opt-out of sales or sharing of your personal information. To opt-out, please contact us as set out in Article 14 (Contact Information) above and specify which right you are seeking to exercise along with your region.
   
   Please note that when you submit an opt-out, we do not know who you are within our systems, and your opt-out will only apply to personal information collected from tracking technologies on the specific browser from which you opt-out. If you delete or reset your cookies, or use a different browser or device, you will need to reconfigure your settings.

4. ）Authorized Agent

   You can designate an authorized agent to submit requests on your behalf. Requests must be submitted through the designated methods listed above. Except for opt-out requests, we will require written proof of the agent’s permission to do so and may verify your identity directly.

5. ）Right to Non-Discrimination

   You have the right not to receive discriminatory treatment by us for the exercise of any your rights.

This Article 19 is only relevant if the European Data Protection Regulation (GDPR) applies. The provisions set out here shall prevail over any conflicting provision in this Policy.

1. ）The processing of the Personal Information is based on the following legal grounds:
   

   •　Processing according to Articles 2 ①, ② ③, ⑦, ⑨ and ⑫ of this Privacy Policy are based on Article 6 (1) (b) of the GDPR.

   •　Processing according to Articles 2 ④ (b) (c), (*2), ⑤, ⑥, ⑧, ⑪ and ⑭ of this Privacy Policy are based on Article 6 (1) (f) GDPR.

   •　Processing according to Articles 2 ④ (a), (c), (*1) (*3) ⑬ of this Privacy Policy are based on Article 6 (1) (a) GDPR.

   •　Processing according to Articles 2 ⑩, ⑮ of this Privacy Policy are based on Article 6 (1) (c) GDPR.

2. ）You have the following rights in relation to the Personal Information:

   (a)Right of Access.
   You have the right to access the Personal Information that we hold about you, i.e. the right to require free of charge (i) information whether your Personal Information is retained, (ii) access to and/or (iii) duplicates of your Personal Information retained. You can use the right to access to your Personal Information by contacting us under the address as described in Article 14 (Contact Information). If the request affects the rights and freedoms of others or is manifestly unfounded or excessive, we reserve the right to charge a reasonable fee (taking into account the administrative costs of providing the information or communication or taking the action requested) or refuse to act on the request.
   
   (b)Right to Rectification.
   If we process the Personal Information, we shall endeavor to ensure by implementing suitable measures that the Personal Information is accurate and up-to-date for the purposes for which it was collected. If your Personal Information is inaccurate or incomplete, you can change the information you provided by contacting us as described in Article 14 (Contact Information).
   

   
   (c)Right to Erasure.
   You have the right to obtain deletion of the Personal Information concerning you. We will delete all your Personal Information, except for the data which are required for our compliance with the requirements of applicable laws (e.g. tax and accounting requirements) or to resolve disputes and enforce our agreements. We will also retain anonymous or de-identified information after your Personal Information has been deleted.
   
   (d)Right to Object.
   When our processing of your Personal Information is based on legitimate interests according to Article 6(1)(f) of the GDPR, you have the right to object to this processing. If you object, we will no longer process your Personal Information unless there are compelling and prevailing legitimate grounds for the processing as described in Article 21 of the GDPR; in particular if the data is necessary for the establishment, exercise or defense of legal claims. You also have the right to lodge a complaint at a supervisory authority.
   
   (e)Right to Restriction of processing of your Personal Information
   You have the right to obtain restriction of processing of your Personal Information under the conditions set out in Article 18 of the GDPR.
   
   (f)Right to Personal Information portability
   You have the right to receive your Personal Information in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller under the conditions set out in Article 20 of the GDPR.
   
   (g)Complaint with data protection regulator
   You also have the right to lodge a complaint with the data protection regulator in your jurisdiction.

3. ）In the event of any inconsistency between the Japanese language version of this Policy and the English version, the Japanese language version shall prevail.

Last Updated: July 5, 2024