Takumo K.K. (株式会社タクモ) 

Privacy Policy

Applies to Takumo Pro and Takumo Lite 

Version 1.0  ·  Effective Date: March 2026 
Level 12, YANMAR TOKYO, 2-1-1 Yaesu, Chuo-ku, Tokyo 104-0028, Japan · info@takumo.jp  · takumo.jp

---

IMPORTANT NOTICE: These terms constitute a legally binding agreement. Please read carefully before using the Takumo platform. If you do not agree with these terms, you must not use or access the platform. 

1. Introduction 

Takumo K.K. (“Takumo”, “we”, “us”, “our”) is committed to protecting the personal information of all individuals whose data we process. This Privacy Policy describes how we collect, use, store, share, and protect personal information in connection with the Takumo Pro platform and the Takumo Lite guest application. 
We comply with Japan’s Act on the Protection of Personal Information (個人情報の保護に関する法律, “APPI”) and, where applicable, other international privacy standards. We are registered with the Personal Information Protection Commission (PPC) of Japan. 
If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@takumo.jp. 

2. Who We Are

3. Personal Information We Collect 

3.1 Information about hotel guests (processed through Takumo Pro and displayed in Takumo Lite) 

 
3.2 Information about hotel staff and account users (Takumo Pro) 
 

Account credentials 
Username, email address, and encrypted password. 
Authentication logs 
Login time, IP address, and device identifier for security purposes. 
Usage activity 
Actions taken within the Platform for audit, support, and security purposes. 
Billing information 
Invoicing contact details. Payment card data is processed by Stripe and is not stored by Takumo. 
3.3 Technical information (both platforms) 
 

IP address 
Collected automatically when you access the Platform or Takumo Lite. 
Device information 
Browser type, operating system, and device model. 
Usage logs 
Pages visited, features used, errors encountered, and session duration. 
Cookies 
Session cookies for authentication. Takumo does not use advertising or tracking cookies. 
4. How We Use Personal Information 
We use personal information only for the following purposes: 
 

Shipment booking generation 
Processing luggage forwarding bookings on behalf of hotels and transmitting data to the selected carrier. 
Shipment tracking 
Retrieving and displaying tracking updates from carriers for display to hotel staff and guests. 
Guest notifications 
Sending email and SMS status notifications to guests regarding their shipment. 
Platform security 
Authenticating users, preventing unauthorised access, and detecting fraud or abuse. 
Customer support 
Diagnosing and resolving technical issues, responding to queries. 
Legal compliance 
Archiving digital waybills for the minimum 7-year retention period required under Japanese law. 
Service improvement 
Analysing aggregated, anonymised usage data to improve Platform performance. This data does not identify individuals. 
Billing 
Processing subscription payments and platform processing fees. 
We do not use personal information for profiling, automated decision-making, or targeted advertising. 
5. Legal Basis for Processing 
Under APPI and applicable data protection law, our lawful basis for processing personal information is: 
Performance of a contract: processing guest shipment data is necessary to provide the logistics facilitation service for which the hotel has contracted with Takumo. 
Legitimate interests: processing staff account data is necessary for secure platform operation and support. 
Legal obligation: archiving waybill records for 7 years to comply with Japanese commercial and tax record-keeping requirements. 
Consent: where we send optional marketing communications to hotel contacts, we rely on consent which may be withdrawn at any time. 
6. Data Storage and Infrastructure 
6.1 All personal data processed by Takumo is stored in Japan. Our primary hosting infrastructure is operated by Amazon Web Services (AWS) in the Tokyo region (ap-northeast-1), with disaster recovery in the Osaka region (ap-northeast-3). 
6.2 We do not transfer personal data outside Japan except where: (a) required to do so by Japanese law; (b) the data subject has provided explicit consent; or (c) the transfer is necessary to complete a cross-border shipment at the guest’s request. 
6.3 AWS operates data centers in Japan to international security standards including ISO 27001 and SOC 2. Our contractual arrangements with AWS include data processing terms consistent with APPI requirements. 
7. Data Retention 
 

Shipment data and digital waybills 
Retained for a minimum of 7 years from the date of the relevant transaction, in accordance with Japanese commercial and tax law. 
Guest tracking data (Takumo Lite) 
Retained for a minimum of 7 years from the transaction date as part of the linked waybill record. 
Hotel staff account data 
Retained for the duration of the hotel’s subscription plus 12 months, after which inactive accounts are deleted. 
Authentication and access logs 
Retained for 12 months for security purposes. 
Billing records 
Retained for 7 years in accordance with Japanese tax record-keeping requirements. 
Support correspondence 
Retained for 3 years after the relevant matter is resolved. 
8. Third-Party Processors 
We share personal data with the following categories of third-party processors where necessary to provide the Platform services: 
 

Amazon Web Services (AWS) 
Cloud infrastructure and data storage. Data processed in Japan only. 
Ship&Co 
Shipping aggregator for carrier API access. Data transmitted as required to place bookings with selected carriers. 
Yamato Transport (ヤマト運輸) 
Carrier. Shipment data transmitted to process forwarding bookings. 
Sagawa Express (佐川急便) 
Carrier. Shipment data transmitted to process forwarding bookings. 
Japan Post (日本郵便) 
Carrier. Shipment data transmitted to process forwarding bookings. 
Stripe 
Payment processing for subscription billing. Stripe does not receive guest shipment data. 
SATO Holdings K.K. 
Hardware maintenance and support. Limited access to hotel installation data for servicing purposes only. 
We require all processors to maintain appropriate security measures, process data only on our instructions, and comply with applicable data protection laws. We do not sell personal data to any third party. 
9. Data Subject Rights 
Under APPI, individuals whose personal data we hold have the following rights: 
 

Right of disclosure 
You may request information about the personal data we hold about you and how it is used. 
Right of correction 
You may request correction of inaccurate personal data. 
Right of suspension 
You may request that we suspend processing of your personal data in certain circumstances. 
Right of deletion 
You may request deletion of your personal data, subject to our legal retention obligations. Shipment records retained for legal compliance cannot be deleted during the retention period. 
Right to withdraw consent 
Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal. 
To exercise any of these rights, please contact us at privacy@takumo.jp. We will respond within a reasonable period and in any event within 30 days. 
10. Security 
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration. These measures include: 
Encryption in transit using TLS/HTTPS for all data communications. 
Encryption at rest for all data stored on AWS infrastructure. 
Role-based access controls limiting data access to authorised personnel. 
Multi-factor authentication for administrative and privileged access. 
Audit logging of all data access and modification events. 
Regular security assessments and penetration testing. 
Vanta-powered compliance management for ISO 27001 and SOC 2 readiness. 
In the event of a personal data breach that is likely to result in risk to the rights of data subjects, we will notify the Personal Information Protection Commission (PPC) and affected individuals in accordance with our APPI obligations. 
11. Cookies 
Takumo Pro and Takumo Lite use session cookies solely for the purpose of authenticating logged-in users. We do not use advertising cookies, tracking cookies, or third-party analytics cookies. No cookie consent banner is required for session-only cookies under applicable Japanese law. 
12. Changes to This Policy 
We may update this Privacy Policy from time to time to reflect changes in our data practices or applicable laws. We will notify hotel customers of material changes via the Platform or by email with at least 30 days’ notice. Guests will be notified via a prominent notice in Takumo Lite. The effective date of the current version is shown at the top of this document. 
13. Contact 
For all privacy-related queries, requests, or complaints, please contact: 
 
Privacy Officer, Takumo K.K. 
Level 12, YANMAR TOKYO, 2-1-1 Yaesu, Chuo-ku, Tokyo 104-0028, Japan 
Email: privacy@takumo.jp 
Website: takumo.jp/privacy 
 
If you are not satisfied with our response, you have the right to lodge a complaint with the Personal Information Protection Commission (個人情報保護委員会) of Japan at https://www.ppc.go.jp. 
 
 
Takumo K.K.  ·  Level 12, YANMAR TOKYO, 2-1-1 Yaesu, Chuo-ku, Tokyo 104-0028  ·  privacy@takumo.jp  ·  takumo.jp 
Version 1.0 — March 2026. Draft for review. Takumo recommends review by a qualified legal professional and registration with the Personal Information Protection Commission prior to publication.