Introduction
Create. (operated by Zorba Jobs Wong; hereinafter "we" or "us") recognizes the importance of personal information and handles all personal data in accordance with Japan's Act on the Protection of Personal Information (APPI) and the EU General Data Protection Regulation (GDPR). This Privacy Policy explains how we collect, use, manage, and protect your personal information when you use our website and services.
Definition of Personal Information
In this policy, "personal information" refers to information about a living individual that can identify the individual by name, date of birth, address, telephone number, email address, or other description contained in such information, as defined under the APPI.
Purpose of Use
We collect and use personal information for the following purposes:
- To respond to inquiries and consultation requests
- To provide, maintain, and improve our services
- To send project-related communications and updates
- To process billing and payments
- To verify user identity (e.g. CAPTCHA verification)
- To comply with applicable laws and regulations
Legal Basis for Processing
Under the GDPR, we process your personal data based on the following legal grounds:
- Consent — when you submit a booking form or accept analytics cookies, you provide explicit consent for us to process your data for the stated purpose
- Legitimate interest — to respond to your inquiries, prevent fraud and abuse (e.g. CAPTCHA verification), and improve our services
- Legal obligation — to comply with applicable laws such as tax and accounting requirements
Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes described in this policy:
- Booking and consultation data — retained for the duration of our business relationship, plus 3 years thereafter for potential legal claims
- Cookie consent records — retained for as long as the consent remains valid
Methods of Collection
We collect personal information through the following methods:
- Directly from you, via our contact form or booking form on this website
- Automatically, through cookies and web analytics tools (see "Cookies and Analytics" below)
Management and Security
We implement the following organizational and technical security measures to prevent unauthorized access, loss, destruction, alteration, or leakage of personal information:
- SSL/TLS encryption for all data transmitted through our website
- Access-controlled cloud services with multi-factor authentication
- Regular review and improvement of security practices
Disclosure to Third Parties
We will not disclose or provide your personal information to third parties without your prior consent, except in the following cases:
- When required by law or regulation
- When necessary to protect the life, body, or property of an individual
- When outsourcing operations within the scope of the stated purpose of use (e.g. payment processing, hosting)
If you wish to opt out of any third-party data sharing, please contact us at the email address listed below.
Cross-Border Data Transfer
Your personal data may be processed using services hosted outside of Japan, including Cloudflare (hosting and security) and Resend (email delivery). These providers are based in the United States and utilize Standard Contractual Clauses (SCCs) approved by the European Commission as a safeguard for international data transfers. We ensure that appropriate safeguards are in place in accordance with both APPI and GDPR requirements.
Cookies and Analytics
This website uses the following cookies and similar technologies:
- Essential cookies — Cloudflare Turnstile sets cookies required for CAPTCHA verification and bot protection. These are strictly necessary for the site to function and do not require consent.
- Analytics cookies (optional) — We use Google Analytics and Cloudflare Web Analytics to understand how visitors use our site and to improve our services. These analytics cookies are only set if you give consent via the cookie banner. For more information, see the Google Privacy Policy and Cloudflare Privacy Policy .
You can manage your cookie preferences at any time by clicking the "Cookie Settings" link in the footer of this website. You may also disable cookies through your browser settings.
Your Rights
Under APPI and GDPR, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure — request deletion of your personal data ("right to be forgotten")
- Right to restrict processing — request that we limit how we use your data
- Right to data portability — request your data in a structured, machine-readable format
- Right to object — object to the processing of your data based on legitimate interest
- Right to withdraw consent — withdraw your consent at any time (e.g. via cookie settings or by contacting us)
To exercise any of these rights, please contact us at the email address below. We will respond within 30 days after verifying your identity. You also have the right to lodge a complaint with the relevant supervisory authority:
- Japan: Personal Information Protection Commission (個人情報保護委員会)
- EU: Your national data protection supervisory authority
Disclosure Request Procedure
To request disclosure, correction, deletion, or suspension of use of your personal data held by us, please follow this procedure:
- Send your request to create@zorbawong.com with the subject line "Personal Data Request"
- We will verify your identity by confirming information you previously provided to us (e.g. name and email address used in your booking)
- We will respond to your request within 2 weeks of identity verification, in accordance with APPI requirements
Complaints
If you have any complaints regarding our handling of personal information, please contact us at create@zorbawong.com. We will investigate and respond to your complaint promptly.
Data Breach Response
In the event of a data breach or suspected breach involving personal information, we will promptly investigate the matter, notify affected individuals without undue delay, and report to the relevant supervisory authority within 72 hours as required under the GDPR. We will also report to the Personal Information Protection Commission as required under APPI.
Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised "Last updated" date. We encourage you to review this page periodically.
Data Controller & Contact
The data controller responsible for your personal information is:
- Business name: Create.
- Operator: Zorba Jobs Wong
- Email: create@zorbawong.com
- Address: 26-9 Chitose-Shinmachi, Takatsu-ku, Kawasaki, Kanagawa, Japan