jpnthings

Legal

Privacy

Last updated: 29 July 2026

Protecting your personal data is a priority for us. We therefore only use your personal data within the scope of the applicable legal regulations, in particular the EU General Data Protection Regulation ("GDPR"). This privacy policy explains how jpnthings uses and processes your personal data when you use the services of jpnthings, in particular via the platform jpnthings.com, including its brand areas jpnthings, jpnthings Experiences, jpnthings Boosted and jpnthings Stays (hereinafter jointly the "jpnthings Platform"). It also informs you about your rights regarding your personal data and how you can contact us.

If you are a resident of the United States, please also consult the section "United States Residents' Rights" below.

This privacy policy has been drafted, and shall be construed, in English. Any translation is for reference only. In the event of any inconsistency between the English version and a translated version, the English version shall prevail, unless mandatory law requires otherwise.

I. Terms

The following terms are used in this privacy policy:

  • "Activity" refers to the tours, experiences, driving events, transfers, vehicle rentals and accommodations offered by Suppliers through the jpnthings Platform.
  • "Supplier" means the independent local provider in Japan of the Activities offered on the jpnthings Platform.
  • "GDPR" refers to the General Data Protection Regulation (EU) 2016/679.
  • "jpnthings Platform" refers to the booking platform accessible via jpnthings.com, including its localized language versions and brand areas.
  • "Personal Data" refers to any information relating to an identified or identifiable natural person.

II. Controller and Contact

The controller responsible for processing your Personal Data when you use or access the jpnthings Platform is:

Ilias Ammour Altes Gericht 22 35398 Giessen, Germany Email: hello@jpnthings.com

Please note that any data processing by Suppliers in connection with a booked Activity that goes beyond the booking data transmitted by us (e.g. data collected on site, rental documents, waivers) is outside our control and is subject to the Supplier's own privacy practices. In this respect, Suppliers act as separate, independent data controllers.

III. Data Processing Activities

1. Automated Data Collection

When you visit the jpnthings Platform, we automatically collect the following information, which is stored separately from any other data you may transmit to us:

  • URL of the accessed page and referrer URL
  • Date and time of access
  • Information about your device (e.g. operating system, browser type and version, language settings)
  • IP address

We collect this data to deliver the website and to ensure the proper operation and security of the jpnthings Platform and to prevent fraudulent activities, based on our legitimate interest (Art. 6 (1) (f) GDPR). Server logs are generally deleted after a maximum of 30 days, unless a security incident requires longer retention.

2. jpnthings Account

Registration is not required to use the jpnthings Platform; you may also book as a guest (see Section III.5). If you create a jpnthings Account, we process:

  • Name
  • Email address
  • Password (stored exclusively in hashed form)
  • Phone number (optional), preferred language, marketing preferences (opt-in)
  • Optional booking prefill details you choose to save for faster checkout (e.g. WhatsApp number, Instagram handle, address of your accommodation in Japan)

Registration, login and account management are handled by our own platform software on our own infrastructure; we do not use third-party login providers (such as Google, Facebook or Apple). We process this data to set up and manage your jpnthings Account as outlined in our General Terms and Conditions, on the basis of Art. 6 (1) (b) GDPR.

3. Activity Reviews

After a completed booking, you may review the booked Activity. Reviews are linked to the underlying booking (verification of authenticity), are moderated before publication, and are displayed with the display name you provide. Your review may be displayed in the context of the reviewed Activity on the jpnthings Platform and in our own promotional materials. We may use automated tooling (see Section III.11) to generate neutral summaries of published reviews. The processing is based on our legitimate interest in enhancing our offerings and assisting other customers in making informed decisions (Art. 6 (1) (f) GDPR) and, with regard to submitting the review as part of the booking relationship, on Art. 6 (1) (b) GDPR. You can request deletion of your published review at any time by contacting hello@jpnthings.com.

4. Customer Service

If you contact us (e.g. by email or via the contact form), we process the data provided in the request — such as your name, email address, booking number, the brand area contacted, and other information shared during the communication — to handle your enquiry (Art. 6 (1) (b) GDPR). Further storage of the communication is based on our legitimate interest in the proper documentation of our business operations and the safeguarding of our legal positions (Art. 6 (1) (f) GDPR) and, where applicable, on legal obligations (Art. 6 (1) (c) GDPR).

If you provide us with a messenger contact (e.g. a WhatsApp number) for booking-related communication, we may contact you via that messenger about your booking. WhatsApp is operated by Meta Platforms; the privacy policy of the respective messenger provider applies to the transmission via the messenger. The use of a messenger channel is optional; email is always available as a communication channel.

5. Booking Activities

When you book an Activity on the jpnthings Platform — with a jpnthings Account or as a guest — we collect the data required to process the booking and to organize and carry out the Activity. This typically includes: name, email address, phone number, number of participants, booked Activity, date and time slot, selected add-ons, special requests, acceptance of booking notices (with timestamp), and booking and payment status. Depending on the specific Activity, further information may be required (e.g. confirmation of driving license and International Driving Permit for self-drive Activities, ages of participants).

We use this data to provide our services, specifically to conclude and manage your booking as commercial agent of the Supplier, based on Art. 6 (1) (b) GDPR.

Transfer to the Supplier: To the extent necessary for the performance of the Activity, we transfer booking data (e.g. name, group size, date, time slot, add-ons, special requests, contact details) to the Supplier responsible for the Activity in Japan. The Supplier processes this data as an independent data controller. Japan is subject to an adequacy decision of the European Commission (Art. 45 GDPR); the transfer is additionally necessary for the performance of the contract (Art. 6 (1) (b), Art. 49 (1) (b) GDPR).

Guest bookings: If you book without an account, a technical session identifier is used so that you can view, manage and cancel your booking via a secure booking link. You can later link guest bookings to a jpnthings Account using the email address used for the booking.

Booking communications: To keep you updated, we send booking confirmations, payment confirmations, reminders and updates (e.g. in case of time or meeting point changes) to the email address provided and, where provided and appropriate, via phone/messenger. This processing is necessary to provide our services (Art. 6 (1) (b) GDPR).

6. Payments (Stripe)

We offer various payment modes for booked Activities (e.g. full online payment, deposit with balance on arrival or online, pre-authorisation with later capture, payment on arrival, request-to-book). Depending on the chosen mode, we process your Personal Data to facilitate the transaction as described below. This processing is necessary to fulfil contractual obligations (Art. 6 (1) (b) GDPR).

Online payments are processed by Stripe (for customers in the EEA typically Stripe Payments Europe, Ltd., Ireland; Stripe, Inc., USA). Payment is carried out on Stripe's hosted checkout pages; your payment instrument data (e.g. card number) is transmitted directly to Stripe and is never stored on our servers. We only receive confirmation of whether the payment was successful, along with limited payment references (e.g. payment status, amounts, currency, card brand and last four digits).

Where the payment mode provides for storing a payment method for later charges (e.g. remaining balance after the Activity, or a card on file for no-show protection), such storage takes place only after your express confirmation during checkout (Art. 6 (1) (a) and (b) GDPR). Pre-authorisations are only captured in accordance with the booked payment mode.

Stripe may process certain data as an independent controller for fraud prevention and regulatory purposes. More information: https://stripe.com/privacy.

7. Fraud Prevention

To safeguard our services and protect ourselves, the Suppliers and our customers from fraud, payment transactions are analysed by Stripe's fraud prevention systems (e.g. Stripe Radar). These tools analyse transaction data and usage patterns to detect potential fraud and security threats. We process this data based on our legitimate interest in preventing fraud and ensuring the safety of the jpnthings Platform (Art. 6 (1) (f) GDPR). See also Section VI (Automated Decision-Making).

8. Newsletter

If you subscribe to our newsletter, we process your email address, preferred language, the brand area of the subscription, and the source of the subscription for the purpose of sending the newsletter, based on your consent (Art. 6 (1) (a) GDPR). We may store the date and time of your subscription to document your consent (Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR).

You can withdraw your consent and unsubscribe at any time via the unsubscribe link in each newsletter or by emailing hello@jpnthings.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Newsletters are dispatched via our email provider Resend (see Section III.10).

9. Hosting and Technical Service Providers

  • Hosting (Vercel): The jpnthings Platform is hosted by Vercel Inc., USA. When you interact with the jpnthings Platform, technical data (including your IP address) is processed on Vercel's servers to deliver the website and ensure its security and stability (Art. 6 (1) (f) GDPR). Media files (e.g. Activity images) are stored and delivered via Vercel Blob storage.
  • Database (Neon): Our application database is operated with Neon Inc. (serverless PostgreSQL). It stores the account, booking, content and communication data described in this policy. Access is restricted and encrypted in transit (Art. 6 (1) (b) and (f) GDPR).
  • Rate limiting (Upstash): Where enabled, we use Upstash, Inc. (Redis) to protect our interfaces against abuse. For this purpose, short-lived technical request data (e.g. IP-based counters) is processed (Art. 6 (1) (f) GDPR).
  • Error diagnostics (Sentry): Where enabled, error and crash reports (stack traces, browser/OS metadata, truncated IP address) are processed via Functional Software, Inc. (Sentry), USA, to diagnose and fix technical faults (Art. 6 (1) (f) GDPR).

10. Transactional Email (Resend)

System emails (e.g. email verification, password reset, booking confirmations, payment confirmations, cancellation confirmations, contact form notifications) and newsletters are sent via Resend, Inc., USA. Resend processes the recipient address and message metadata on our behalf as a processor (Art. 28 GDPR). Legal basis: Art. 6 (1) (b) GDPR (system emails) and Art. 6 (1) (a) GDPR (newsletter).

11. AI-Assisted Features (OpenAI)

Where enabled, we use services of OpenAI, L.L.C., USA, to (a) generate neutral summaries of published customer reviews and (b) assist with translating our own editorial content. We do not transmit account, payment or full booking records to OpenAI for these purposes. Legal basis: Art. 6 (1) (f) GDPR (efficient, multilingual presentation of our content).

12. Maps (OpenStreetMap)

For displaying meeting points and locations, we embed map tiles from OpenStreetMap (OpenStreetMap Foundation, United Kingdom). When a map is loaded, your IP address and technical request data are transmitted to the OpenStreetMap Foundation's tile servers (Art. 6 (1) (f) GDPR — user-friendly presentation of locations). More information: https://osmfoundation.org/wiki/Privacy_Policy. The United Kingdom is subject to an adequacy decision of the European Commission.

Web fonts used on the jpnthings Platform are self-hosted; no connection to Google servers is established when fonts are loaded.

IV. Cookies and Tracking Technologies

We use cookies and similar storage technologies only to a minimal extent:

Strictly necessary technologies (no consent required; legal basis: § 25 (2) TDDDG and Art. 6 (1) (b)/(f) GDPR):

  • Authentication cookies — to maintain your login session.
  • Locale/language preference — to store your selected language (EN/DE/JP).
  • Guest booking session identifier — so that guests can view, manage and cancel their booking without an account.
  • Consent cookie (jpn_analytics_consent) — stores your decision on optional analytics (retention: 12 months).

Optional analytics/statistics are disabled by default ("consent default: denied") and are only activated if you explicitly consent via the consent banner (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw your consent at any time with effect for the future via the cookie settings on the jpnthings Platform.

We do not use marketing, advertising or remarketing cookies, tracking pixels of social networks, or cross-context behavioural advertising.

V. Further Sharing of Data

Beyond the cases described in this policy, your Personal Data will only be disclosed without your express prior consent in the following cases:

  • Law enforcement and legal claims: If necessary to investigate unlawful use of our services or for legal prosecution, Personal Data may be disclosed to law enforcement authorities and, where applicable, to injured third parties. This only happens if there are specific indications of unlawful or abusive conduct. Disclosure may also take place to enforce our Terms and Conditions or other agreements, or where we are legally obliged to provide information to authorities (Art. 6 (1) (f) and (c) GDPR).
  • Professional advisers: We disclose Personal Data to auditors, accounting service providers, lawyers, banks, tax consultants and similar bodies insofar as this is necessary for the provision of our services (Art. 6 (1) (b) GDPR), the proper operation of our business (Art. 6 (1) (f) GDPR), or to fulfil legal obligations (Art. 6 (1) (c) GDPR).
  • Processors: We rely on contractually bound service providers ("processors") to provide our services (see Section III). Processors are carefully selected, may only use data for the purposes specified by us, and are contractually obliged to process your data exclusively in accordance with this privacy policy and applicable data protection law (Art. 28 GDPR).
  • Business restructuring: If the structure of our business changes (e.g. change of legal form, sale of the business or parts thereof), customer information may be transferred together with the part of the business concerned, in accordance with this privacy policy and applicable data protection law (Art. 6 (1) (f) GDPR).

VI. Automated Individual Decision-Making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR), with the following exception: to secure the payment process, transactions assessed as high-risk by our payment provider's fraud prevention systems (see Section III.7) may be automatically declined. If your transaction is declined, you have the right to request human intervention, express your point of view and contest the decision by contacting hello@jpnthings.com.

VII. Data Transfers to Third Countries

Some of our service providers (in particular Vercel, Stripe, Resend, Upstash, Sentry, OpenAI) are based in the USA or may process data in the USA. Transfers are based on the adequacy decision of the European Commission for the EU-US Data Privacy Framework for certified companies and/or on the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR), supplemented by additional safeguards where required.

Since the Activities booked via the jpnthings Platform are performed in Japan, the data required for performance is shared with the responsible Supplier in Japan (see Section III.5). Japan is subject to an adequacy decision of the European Commission (Art. 45 GDPR).

VIII. Storage Periods and Erasure

We delete or anonymise your Personal Data as soon as it is no longer necessary for the purposes for which it was collected, unless statutory retention obligations require longer storage:

  • Account data: until you delete your account.
  • Newsletter data: until you unsubscribe.
  • Booking, payment and invoice data: up to 10 years (statutory commercial and tax retention periods in Germany, §§ 147 AO, 257 HGB).
  • Contact enquiries: until the matter is conclusively resolved, thereafter up to 3 years (limitation periods).
  • Reviews: until deletion is requested or the account/booking context is removed.
  • Server logs: generally a maximum of 30 days.

If you delete your jpnthings Account, your profile is deleted. We retain backup copies and individual data records only to the extent and for as long as this is required for legal reasons or to secure, assert or enforce legal claims (Art. 6 (1) (f) GDPR). Where data must be retained for legal reasons, its processing is restricted (Art. 18 GDPR) and the data is no longer available for other use.

IX. Security

All data transmission on the jpnthings Platform is encrypted using SSL/TLS (recognizable by "https://" and the lock symbol in your browser). Passwords are stored exclusively in hashed form. Access to production data is restricted.

X. Your Rights as a Data Subject

You have the following rights with regard to the processing of your Personal Data. To exercise them, contact us at hello@jpnthings.com or by post at the address above.

  • Right of access (Art. 15 GDPR): to receive information about the Personal Data we process about you.
  • Right to rectification (Art. 16 GDPR): to have inaccurate Personal Data corrected without delay.
  • Right to erasure (Art. 17 GDPR): to have Personal Data deleted under the conditions of Art. 17 GDPR, in particular where the data is no longer necessary, processing was unlawful, or you have validly objected.
  • Right to restriction of processing (Art. 18 GDPR).
  • Right to data portability (Art. 20 GDPR): to receive the data you provided in a structured, commonly used, machine-readable format.
  • Right to object (Art. 21 GDPR): where processing is based on Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation; we will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims. In the case of direct marketing, you may object at any time without giving reasons.
  • Right to withdraw consent (Art. 7 (3) GDPR): at any time with effect for the future.
  • Right to lodge a complaint (Art. 77 GDPR): with a supervisory authority of your choice. The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (The Hessian Commissioner for Data Protection and Freedom of Information), Wiesbaden, Germany.

Data processing when exercising your rights: We process the Personal Data you provide when exercising your rights under Art. 15–22 GDPR for the purpose of implementing these rights and to be able to provide evidence thereof (Art. 6 (1) (c) GDPR in conjunction with Art. 15–22 GDPR).

We are not legally required to appoint a data protection officer; all enquiries are handled directly by the controller named above.

XI. Information for Users Outside the EU/EEA

  • United Kingdom & Switzerland: Users in the UK and Switzerland have comparable rights under the UK GDPR and the Swiss FADP. The contact point for all requests is hello@jpnthings.com.
  • Japan: We handle personal information of users in Japan in accordance with the principles of the Act on the Protection of Personal Information (APPI). The purposes of use are those stated in this policy; requests for disclosure, correction or cessation of use can be sent to hello@jpnthings.com.

XII. United States Residents' Rights

If you are a resident of a U.S. state with a comprehensive privacy law (e.g. California, Colorado, Connecticut, Virginia), the following applies:

  • No sale or sharing: We do not "sell" personal information and do not "share" personal information for cross-context behavioural advertising within the meaning of the CCPA/CPRA or comparable state laws. We do not use targeted advertising. We do not knowingly collect or share personal information of minors under 16 years of age.
  • Categories collected: The categories of personal information we collect, the sources, the purposes and the categories of recipients are described in Sections III–V of this policy (identifiers such as name and email address; commercial information such as bookings and payments status; internet activity such as server logs; and, for self-drive Activities, confirmation of driving credentials).
  • Your rights: Subject to applicable law, you have the right to (i) know/access the personal information we have collected about you, including the categories of sources, purposes and recipients, (ii) request deletion, (iii) request correction of inaccurate personal information, and (iv) not be discriminated against for exercising your rights.
  • Exercising rights: Submit requests to hello@jpnthings.com. Please provide sufficient detail so we can verify your identity and respond appropriately. Where permitted by your state's law, you may use an authorized agent or submit a request on behalf of your minor child; we may take reasonable steps to verify the agent's authority and your identity.

XIII. Changes to this Privacy Policy

We may amend this privacy policy to reflect changed legal, technical or business circumstances. The current version is always available on the jpnthings Platform. For material changes affecting registered users, we will inform you in an appropriate manner.