LEGAL
Privacy Policy
Effective date: 1 June 2025
Compliant with: EU General Data Protection Regulation (GDPR) · Japan Act on the Protection of Personal Information (APPI, 個人情報保護法)
1. Data Controller
Ataraxia Partners ("KEISHŌ", "we", "us") is the data controller for personal information collected through the KEISHŌ platform (keisho.ai). Contact: admin@keisho.ai
2. Personal Information We Collect
We collect the following categories of personal information: • Identity data: full name (including furigana), date of birth, nationality, age bracket • Contact data: email address, telephone number, postal address • Business data: business name, corporate registration number, financial information, business description • Financial data: budget range, payment information (processed by Stripe — we do not store card numbers) • Verification data: government-issued identity documents, LinkedIn profile URL • Usage data: pages visited, features used, match analyses generated, listings saved • Communication data: messages sent through the platform, notes to sellers • Technical data: IP address, browser type, device identifiers, cookies
3. Purposes and Legal Basis for Processing
We process your personal information for the following purposes: • Account registration and verification — Legal basis (GDPR Art. 6(1)(b)): performance of a contract; (APPI): necessary for providing services • Matching buyers with suitable business listings — Legal basis: legitimate interests (Art. 6(1)(f)); APPI: necessary for services • Facilitating introductions between buyers and sellers — Legal basis: performance of a contract (Art. 6(1)(b)) • Processing payments — Legal basis: performance of a contract (Art. 6(1)(b)) • Compliance with anti-money laundering, sanctions, and anti-organised-crime obligations — Legal basis: legal obligation (Art. 6(1)(c)); APPI: required by law • Sending service-related communications — Legal basis: legitimate interests (Art. 6(1)(f)) • Improving the Service through analytics — Legal basis: legitimate interests (Art. 6(1)(f)) • Marketing (where you have opted in) — Legal basis: consent (Art. 6(1)(a)); APPI: with consent
4. Disclosure to Third Parties (APPI Art. 27)
We do not sell your personal information. We share personal information only in the following circumstances: • With the counterparty in a transaction, solely upon payment of the platform fee and with your consent • With Stripe Inc. for payment processing • With Supabase Inc. for secure database hosting • With Resend Inc. for transactional email delivery • With Sentry for error monitoring (anonymised where possible) • With professional advisers (lawyers, accountants) under confidentiality obligations • Where required by Japanese law, court order, or regulatory authority Where we share data with overseas third parties, we ensure adequate safeguards are in place as described in Section 7.
5. Retention Periods
We retain personal information for as long as necessary to provide the Service and comply with legal obligations: • Active account data: for the duration of your account • Transaction records (including platform fees): 7 years (Japanese commercial law requirement) • KYC/identity verification documents: 5 years after the relationship ends • Compliance declarations: 5 years • Usage and analytics data: 2 years • Deleted account data: purged within 90 days, except where retention is required by law
6. Your Rights Under GDPR (EEA/UK Users)
If you are located in the European Economic Area or United Kingdom, you have the following rights: • Right of access (Art. 15): to receive a copy of your personal data • Right to rectification (Art. 16): to correct inaccurate data • Right to erasure (Art. 17): to request deletion ("right to be forgotten") • Right to restriction of processing (Art. 18) • Right to data portability (Art. 20): to receive your data in a structured, machine-readable format • Right to object (Art. 21): to object to processing based on legitimate interests • Right to withdraw consent: where processing is based on consent, you may withdraw at any time • Right to lodge a complaint with your national supervisory authority To exercise any of these rights, contact admin@keisho.ai. We will respond within 30 days.
7. Your Rights Under APPI (Japan Users)
Under Japan's Act on the Protection of Personal Information (APPI), you have the right to: • Request disclosure of your retained personal information (Art. 33) • Request correction of inaccurate personal information (Art. 34) • Request cessation of use or deletion of personal information (Art. 35) • Request cessation of third-party provision (Art. 37) • File a complaint with the Personal Information Protection Commission (個人情報保護委員会) Requests should be submitted to admin@keisho.ai with sufficient information to verify your identity.
8. International Data Transfers
KEISHŌ uses cloud infrastructure and service providers whose servers may be located outside Japan and the EEA, including the United States. When we transfer personal data internationally, we ensure appropriate safeguards are in place: • For transfers from the EEA/UK: Standard Contractual Clauses (SCCs) approved by the European Commission • For transfers from Japan: compliance with APPI cross-border transfer rules (Art. 24), including confirming adequate protection standards You may request information about the specific safeguards in place by contacting admin@keisho.ai.
9. Cookies and Tracking
We use strictly necessary cookies to maintain your session and authenticate your account. We do not use third-party advertising or tracking cookies. Analytics are conducted using anonymised, aggregated data. You can control cookies through your browser settings; disabling essential cookies may affect your ability to use certain features of the Service.
10. Security
We implement industry-standard technical and organisational security measures, including encrypted data transmission (TLS), database access controls, and regular security reviews. Identity documents are stored in encrypted, access-controlled storage. However, no system is completely secure, and we cannot guarantee absolute security.
11. Children
The Service is not directed at individuals under 18 years of age. We do not knowingly collect personal information from anyone under 18. If we become aware that we have done so, we will delete that information promptly.
12. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated by email or a prominent notice on the platform at least 14 days before taking effect. Continued use of the Service after changes take effect constitutes acceptance of the revised Policy.
13. Contact and Complaints
For any privacy-related queries, requests, or complaints: ATARAXIA PARTNERS Email: admin@keisho.ai Website: keisho.ai If you are not satisfied with our response, you have the right to lodge a complaint with: • In Japan: 個人情報保護委員会 (Personal Information Protection Commission) — ppc.go.jp • In the EU/EEA: your national data protection authority • In the UK: Information Commissioner's Office (ICO) — ico.org.uk