Skip to main content

Alto K.K. Data Protection Policy

Company: Alto K.K.

Address: #818 Ebisu Green Glass Building, 3-1-1 Ebisuminami, Shibuya-ku, Tokyo, 150-0022

Recruiting License Number: 13-ユ-309227

Alto K.K. (“the Company”) recognizes its duty to protect personal information under Japan’s Act on the Protection of Personal Information (APPI) and related regulations. This policy outlines our practices for collecting, using, and safeguarding your data.

1. Collection of Personal Information

Alto K.K. (“the Company”) collects:

  • Name, date of birth, address, contact details, visa status, work history, and resume data.
  • Professional certifications, video interview recordings (with consent), and publicly available professional social media data (e.g., LinkedIn).
  • Sensitive Data (e.g., race, religion, medical history) only with explicit consent or where legally mandated under APPI Article 17.

1.1 – Definitions

  • Data Subject: The individual to whom the personal information relates.
  • Pseudonymized Data: Personal information that cannot identify an individual without additional information (APPI Article 2.6).
  • Legitimate Interest: Processing necessary for recruitment services, balanced against data subject rights.

2. Management of Personal Information

The Company implements:

  • Role-based access controls and encryption for stored/transmitted data.
  • Regular staff training on APPI compliance.
  • Secure traceability systems for data access logs.

3. Purposes of Use of Personal Information

The Company uses personal information for the following purposes:

  • Recruitment services (contractual necessity).
  • AI-driven candidate matching (human oversight available; opt-out upon request).
  • Legal compliance (e.g., visa verification).

Exceptions to Consent (APPI Article 23). Data may be disclosed without consent for:

  • Life/body/property protection.
  • Public health or child welfare.
  • Legal cooperation with authorities.

4. Sharing of Personal Information

The Company may share and jointly utilize the collected personal information with other company entities but at present this is not applicable.  The Company has no other entities at present.

  • For purposes of shared use: Appropriate recruitment and dispatched labour services for job seekers, recruitment and employment management operations for the employees of the Company, and other related services;
  • Items of personal information subject to shared use: Name, address, telephone number, email address, work history and other information provided in your resume;
  • Person responsible for the management of personal information: Alto K.K.;
  • Method of collecting information: As outlined in Section 1 “Collection of Personal Information”

5. Cross-border Transfer of Personal Information to Group Entities

The Company may transfer the collected personal information to group entities in the course of providing Our Services. For the guarantee of sufficient standards in protection of personal information maintained among the group entities, the Company has established the corporate data protection rule that is applicable to the Company itself and the group entities.

5.1 – Safeguards for Transfers

Where Personal Information is transferred outside Japan (e.g., to group entities or cloud providers), Alto K.K. ensures compliance with APPI, Japanese law and GDPR requirements through:

  • Standard Contractual Clauses (SCCs).
  • Adequacy decisions for recipient countries.
  • Binding Corporate Rules (BCRs) for intra-group transfers.

6. Data Subject Rights

Under APPI, you may request:

  • Access (free within 30 days).
  • Correction or deletion of inaccurate data.
  • Suspension of unlawful processing.
  • Data portability (where feasible).

Submit requests to privacy@alto-consulting.co.jp; response time: 14 business days.

7. Changes in the Privacy Policy

The Company reserves the right to change this Privacy Policy without obtaining prior consent from you when any amendment, change, addition or clarification is deemed necessary.  In such event, you will be notified by the Company of the changes through postings on its website and/or through other appropriate means.

By using Our Services after such changes have been notified by such means, you are deemed to have agreed to the changes in the Privacy Policy.

8. Cookies

  • Essential cookies: No consent required.
  • Analytics/marketing cookies: Require prior opt-in consent.
  • Google Analytics: IP anonymization enabled.

9. Security & Compliance

9.1 – Technical Measures

End-to-end encryption, annual penetration testing.

9.2 – Organizational Measures

Data Protection Impact Assessments (DPIAs) for high-risk processing.

9.3 – Breach Notification

Report to Personal Information Protection Commission (PPC) within 72 hours if risk exists.

10. Disclaimer

Our website may provide links to other websites which are not operated by the Company for general information purposes. The Company will not be liable for any loss or damage whatsoever arising out of your use of any linked website.

Contact: privacy@alto-consulting.co.jp | +81 80 3429-6252