Privacy Policy | Xgene Inc.

Xgene Inc. (the “Company”) recognizes the importance of the personal information it handles in its business, and handles personal information properly in compliance with the Act on the Protection of Personal Information (the “APPI”) and other related laws, regulations, and guidelines. This Privacy Policy (this “Policy”) sets out how personal information is handled across all of the Company’s businesses.

Article 1 (Scope and Service-Specific Policies)

This Policy applies to the personal information handled by the Company.
Where the Company establishes a separate privacy policy for a service it provides (including the ZARMS Privacy Policy; each a “Service-Specific Policy”), personal information in that service is handled in accordance with the Service-Specific Policy. If a Service-Specific Policy differs from this Policy, the Service-Specific Policy prevails for that service, and matters not covered by the Service-Specific Policy are governed by this Policy.

Article 2 (Definitions)

The terms “personal information,” “personal data,” “retained personal data,” “personally referable information,” and “special care-required personal information” in this Policy have the meanings given in the APPI.

Article 3 (Information We Collect and Purposes of Use)

The Company obtains the following information by fair means and uses it within the scope of the purposes below.

Inquiry and consultation information (name, organization, contact details, content of the inquiry, and other information received through the contact form on our website, email, telephone, etc.): responding to inquiries, handling requests, and keeping records of our responses
Business partner information (names, departments, titles, and contact details of business partners’ officers and employees, business card information, communications about negotiations and transactions, etc.): business negotiations, entering into and performing contracts, billing and payment, communication, and transaction management
Job applicant information (name, contact details, education and work history, application documents, interview records, etc.): recruitment screening, communication with applicants, and onboarding procedures. Information about applicants who are not hired is deleted within one year after the screening ends.
Information about visits to our websites (cookies and other identifiers, IP address, pages viewed, browser and device information, etc.): operating and improving our websites, analyzing usage, and ensuring security
AI chat information on our website (questions entered in the AI chat and the conversation, the AI’s answers, a per-conversation ID, the path of the page being viewed, the heading of the section shown on screen, and the IP address used for rate limiting): generating answers to questions, improving the website and understanding frequently asked questions, and preventing abuse (Article 7, Paragraph 3)
Information about users of our services: providing each service (details of the information collected and the purposes of use are set out in each Service-Specific Policy)
Purposes common to the above: fulfilling obligations under laws or contracts, handling disputes and inquiries, and informing you about the Company’s products, services, events, etc. (job applicant information is not used for such communications; marketing emails are sent only to people who have consented or as otherwise permitted by law, in accordance with the Act on Regulation of Transmission of Specified Electronic Mail, and you can unsubscribe at any time)

Except as required by law or otherwise permitted, the Company does not obtain special care-required personal information without your consent. If the Company changes a purpose of use, it does so only within the scope reasonably considered to be related to the original purpose, and publishes the changed purpose.

Article 4 (Security Control Measures)

To prevent leakage, loss, or damage of personal data and otherwise to manage personal data securely, the Company takes the following measures.

Basic policy and rules: We have established a basic policy and handling rules for personal data.
Organizational measures: We have appointed a person responsible for handling personal data and established a reporting and communication structure for incidents such as data leaks.
Human measures: We train our employees on handling personal data and set out confidentiality obligations in our work rules and other documents.
Physical measures: We take measures to prevent theft or loss of devices that handle personal data.
Technical measures: We have implemented access controls, encryption of communications, and mechanisms to prevent unauthorized external access and malicious software.
Understanding the external environment: Through the cloud services we use for our business (such as Google Workspace), the Company entrusts the handling of personal data to businesses located in the United States and Singapore, and takes security control measures with an understanding of the personal information protection systems of those countries. Foreign service providers used for each service are listed in the relevant Service-Specific Policy.

Article 5 (Entrustment of Handling)

The Company may entrust all or part of the handling of personal data to third parties to the extent necessary to achieve the purposes of use. In such cases, the Company selects service providers appropriately and supervises them as necessary and appropriate through contracts and other means. For service providers located outside Japan, in accordance with Article 28 of the APPI, the Company confirms that they have established a system to take measures consistent with the intent of the APPI, and takes the measures necessary to ensure that those measures continue to be implemented. Information about these measures is provided upon request through the contact point in Article 10.

Article 6 (Provision to Third Parties)

The Company does not provide personal data to third parties without your consent, except in the following cases:
1. When required by law
2. When necessary to protect a person’s life, body, or property and it is difficult to obtain your consent
3. When especially necessary to improve public health or promote the sound growth of children and it is difficult to obtain your consent
4. When necessary to cooperate with a national agency, a local government, or a party entrusted by either of them in carrying out duties prescribed by law, and obtaining your consent is likely to impede those duties
5. In other cases permitted under the APPI
The following do not constitute provision to third parties under the preceding paragraph:
1. When the Company entrusts the handling of personal data as described in Article 5
2. When personal data is provided in connection with the succession of a business due to a merger, company split, business transfer, or other reason

Article 7 (Cookies and External Transmission)

Our websites may use cookies and similar technologies for display and functionality. You can disable cookies in your browser settings, but some features may become unavailable.
Our website (https://www.xgene.co.jp) uses Google Analytics, provided by Google LLC (United States), to analyze access and improve the website. Through Google Analytics, information such as the URL of the page viewed, the referrer, the date and time of the visit, browser and device information, identifiers based on cookies and similar technologies, and IP address is sent from your browser to Google LLC. For how Google handles this information, see Google’s policy. You can stop transmission to Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
When a question is entered in the AI chat on our website (“Ask AI” on each page), the Company sends the question, the conversation, and the text of the page being viewed to Workers AI (Google’s open model Gemma) of Cloudflare, Inc. (United States) to generate an answer. Cloudflare states that it does not retain the content after generating the answer and does not use it to train AI models. To improve the website and understand frequently asked questions, the Company sends the question and the AI’s answer, the path of the page being viewed and the section heading, and a per-conversation ID to PostHog, an analytics tool of PostHog, Inc. (United States), where they are stored in the US. Before sending, strings that appear to be email addresses or phone numbers, and long numbers, in the question and answer are masked (masking may not catch everything, so please do not enter personal information in the AI chat). The visitor’s IP address and identifiers such as cookies are not sent to PostHog. Nothing is sent to PostHog from a browser with Global Privacy Control enabled. In the browser, conversations are kept only in the visitor’s tab and are deleted when the tab is closed. To prevent abuse, the number of questions is limited per IP address (the IP address is used only to apply the limit and is not stored).
External transmission in the Company’s services is described in each Service-Specific Policy.

Article 8 (Requests for Disclosure, etc.)

You may request, with respect to retained personal data held by the Company, notification of the purposes of use, disclosure (including disclosure of records of provision to third parties), correction, addition, or deletion, suspension of use or erasure, and suspension of provision to third parties (collectively, “Disclosure, etc.”).
Requests for Disclosure, etc. are accepted at the contact point in Article 10. The format of the documents to be submitted, the documents required to verify that you are the person concerned or their agent, and other procedures will be explained when we receive your request. After verifying that the request comes from you or your agent, the Company will respond without delay in accordance with the law.
Disclosure will be made by the method you specify, either by providing an electronic record (such as by email) or by delivering a written document. If disclosure by the specified method is difficult, it will be made by delivering a written document.
A fee of JPY 1,100 per request (including consumption tax at 10%) is charged for requests for notification of the purposes of use and for disclosure (including disclosure of records of provision to third parties). Please pay the fee by the method designated by the Company. No fee is charged for requests for correction, addition, or deletion, suspension of use or erasure, or suspension of provision to third parties.
For personal information that the Company handles on behalf of a service customer under an entrustment (for example, ZARMS team data), please first make your request to that customer. If a request is made to the Company, we will respond in cooperation with the customer.

Article 9 (Changes to This Policy)

The Company may change this Policy as necessary due to amendments to laws, changes in its business, or other reasons.
When making a change, the Company will publish the changed content and its effective date on its website by the effective date. For changes that legally require your consent, the Company will obtain consent by the method it prescribes.

Article 10 (Company Information and Contact)

Company: Xgene Inc.
Representative: Teppei Kawabe, Representative Director
Address: N&E BLD. 6F, 1-12-4 Ginza, Chuo-ku, Tokyo 104-0061, Japan (we do not accept visitors at this address)
Inquiries and complaints about the handling of personal information, and requests for Disclosure, etc.: our contact form or email (contact@xgene.co.jp)
Contact points for ZARMS are described in Article 14 of the ZARMS Privacy Policy and on the Help contact page (https://help.zarms.cloud/en/contact) (users who can sign in should use the contact point in the service; those who cannot sign in should email support@zarms.cloud; those considering adoption should email contact@zarms.cloud).