Global Privacy Policy

Last Updated: January, 2026

Enactic Inc. (the "Company", "Enactic", "we", "us", or "our") values your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information in connection with our website and our services (collectively, the "Services").

If you reside in Japan, the Japan Privacy Policy shall apply instead of this Privacy Policy. This Policy also includes disclosures for individuals located in the European Economic Area ("EEA"), the United Kingdom ("UK"), and California, as required under the EU General Data Protection Regulation ("GDPR"), the UK GDPR, and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").

1. Who We Are

For personal information described in this Policy, Enactic is the data controller (under GDPR/UK GDPR) and the business (under CCPA/CPRA), except where we process personal information solely on behalf of a business customer as a service provider/processor under a contract (see Section 2.3).

Contact (Data Protection Office):
Enactic Inc. Data Protection Office
1-22-5 Yotsuya, Shinjuku-ku, Tokyo, Japan
Email: info@enactic.ai / dpo@reazon.jp

2. Personal Information We Collect

2.1 Information You Provide to Us

When you contact us via the Website or otherwise communicate with us about the Services (e.g., requests for materials, inquiries, consultations), we may collect:

Name
Email address
Inquiry content / message (the information you choose to provide)

We ask that you do not include sensitive personal information (e.g., health data) in free-text inquiry fields unless it is necessary for your request.

2.2 Information Collected Automatically (Cookies and Similar Technologies)

When you access the Website (and where applicable, certain online portions of the Services), we may collect information automatically through cookies and similar technologies, such as:

Internet or other electronic network activity information, such as pages viewed and interactions with the Website
Online identifiers (e.g., cookie identifiers), where applicable

Google Analytics is activated only after your consent via our consent management tool (see Section 7).

2.3 Service Data Processed for Business Customers (If Applicable)

Some Services may be provided to business customers (e.g., enterprises or facilities). In those contexts, personal information may be collected and processed under the customer's direction. In such cases, the customer may be the controller/business, and Enactic may act as a processor/service provider under contract. Individuals should refer to the customer's notice for those services and contact the customer to exercise rights relating to that customer-controlled processing.

3. Sources of Personal Information

We collect personal information from:

You (when you submit inquiries or communicate with us)
Your device/browser (automatically via cookies and similar technologies)
Service providers that help us operate the Services (e.g., hosting, email delivery, CRM, analytics providers)

4. Purposes of Use

We use personal information for the following purposes:

To respond to requests for materials, inquiries, and consultations, and to verify your identity where reasonably necessary
To conclude and perform contracts related to our business operations
To provide information necessary to administer our relationship with you, such as responding to follow-up questions related to your inquiry, and providing service-related or administrative communications (including notifications about events or seminars you have requested or registered for, where applicable)
To improve service quality and conduct research and development for new services, including demonstration experiments, surveys/questionnaires, and analysis
To analyze Website usage, perform maintenance and security management, and improve convenience (analytics cookies only after consent)
To notify you of changes to our terms, policies, or other rules related to our services
Other purposes incidental to the above (limited to what is reasonably necessary to achieve the purposes described above)

5. Legal Bases (EEA/UK – GDPR/UK GDPR)

If you are located in the EEA or UK, we process personal data for the purposes above based on the following legal bases:

Legitimate interests (e.g., responding to inquiries, operating and securing the Services, improving usability and performance, internal administration, and preventing misuse)
Performance of a contract and/or steps prior to entering into a contract (e.g., where communications relate to contracting)
Consent (for analytics cookies and similar technologies where required)
Legal obligation (e.g., compliance with applicable laws and lawful requests)

Where we rely on consent, you may withdraw your consent at any time (see Section 11). Withdrawal does not affect the lawfulness of processing before withdrawal.

6. How We Disclose Personal Information

We may disclose personal information to:

Service providers / contractors that process data on our behalf under contractual restrictions (e.g., website hosting, cloud infrastructure, email delivery, CRM, analytics providers)
Our corporate group where necessary for internal administration and business operations (limited to what is necessary and subject to appropriate safeguards)
Professional advisors (e.g., legal, audit) as needed
Authorities and others when required by law or to protect rights, safety, and security
Business transferees in connection with corporate transactions (e.g., merger, acquisition), subject to applicable legal requirements

7. Cookies and Analytics

We use cookies and similar technologies to operate the Website and, with your consent, to understand how the Website is used.

7.1 Cookie Categories

Strictly Necessary Cookies: Required for basic Website operation and security.
Analytics Cookies (Google Analytics): Used to measure usage and improve performance. These cookies are set only after you provide consent via our consent management tool.

7.2 Your Choices

You can change or withdraw your cookie consent at any time via our cookie settings (consent management tool). You can also control cookies through your browser settings; however, disabling cookies may affect functionality.

8. International Data Transfers

Enactic is located in Japan, and personal information may be processed in Japan and other countries where our service providers operate.

EEA: Japan is recognized by the European Commission as providing an adequate level of protection for personal data.
UK: We apply appropriate safeguards for transfers under UK GDPR requirements.

Where transfers require additional safeguards (e.g., where a service provider processes data in a country not recognized as adequate), we use appropriate transfer mechanisms such as contractual safeguards.

9. Data Retention

We retain personal information only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Typical retention criteria include:

Inquiry records (name, email, inquiry content): retained for a reasonable period to respond, manage follow-up, and maintain business records
Security-related logs/cookie data: retained for a limited period appropriate for security monitoring and incident response
Analytics data (if you consent): retained based on analytics configuration and for as long as needed to evaluate Website performance, subject to your cookie choices

10. Disclosures for California Residents (CCPA/CPRA Notice)

This section applies to California residents.

10.1 Categories Collected and Purposes

In the preceding 12 months, we may have collected:

Identifiers (e.g., name, email address) — via inquiries
Internet or other electronic network activity information / online identifiers — via cookies and similar technologies (analytics only after consent)

We collect and use this information for the purposes described in Section 4.

10.2 Categories of Recipients / Disclosures

We may disclose the categories above to the recipients described in Section 6, including service providers/contractors, professional advisors, and authorities where required.

10.3 No "Sale" or "Sharing"

We do not sell personal information for money or other valuable consideration, and we do not share personal information for cross-context behavioral advertising (as those terms are defined under CCPA/CPRA).

10.4 Retention (California)

We retain personal information as described in Section 9.

11. Your Rights and How to Exercise Them

11.1 EEA/UK Rights (GDPR/UK GDPR)

Depending on your circumstances, you may have the right to:

Access, rectify, erase, or restrict processing of your personal data
Object to processing (including processing based on legitimate interests and direct marketing)
Data portability (where applicable)
Withdraw consent at any time where processing is based on consent
Lodge a complaint with your local data protection supervisory authority (EEA/UK)

11.2 California Rights (CCPA/CPRA)

California residents may have the right to:

Know the categories and specific pieces of personal information we collected, used, and disclosed
Delete personal information (subject to exceptions)
Correct inaccurate personal information
Opt out of sale or sharing (we do not sell or share as defined; you may also control cookies as described above)
Non-discrimination for exercising CCPA/CPRA rights

You may use an authorized agent to submit requests, where permitted by law.

11.3 How to Submit Requests

To exercise your rights, contact us at: info@enactic.ai or dpo@reazon.jp.
We may need to verify your identity before fulfilling certain requests. If you use an authorized agent (California), we may require proof of authorization and verification of your identity.

11.4 Cookie Choices

You can change or withdraw cookie consent at any time via our cookie settings (consent management tool), and you may also control cookies via your browser settings.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy and update the "Last Updated" date.

13. Contact Us

Enactic Inc. Data Protection Office
1-22-5 Yotsuya, Shinjuku-ku, Tokyo, Japan
Email: info@enactic.ai / dpo@reazon.jp