Privacy Policy for EU Residents

1. Home
2. Privacy Policy for EU Residents

Privacy Policy for EU Residents

Definitions

In this Privacy Policy, the following terms shall have the meanings set forth below.

"Consent" means any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which the data subject signifies agreement to the processing of Personal Data through a statement or a clear affirmative action.

"Data Controller" means a natural person or organization that, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

"Data Processor" means a natural person or organization that processes Personal Data on behalf of the Data Controller.

"Personal Data" means any information relating to an identified or identifiable natural person, including a name, identification number, location data, or an online identifier. For information regarding Personal Data processed through the CareerCross Services, please refer to "What is Personal Data" below.

"Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data.

"Processing" means any operation or set of operations performed on Personal Data, including the collection, recording, organization, storage, alteration, retrieval, consultation, use, transmission, disclosure, restriction, erasure, or destruction of Personal Data.

"Profiling" means any form of automated processing of Personal Data to analyze, predict, or evaluate certain personal aspects relating to a natural person, including work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, movements, or other personal aspects.

What is Personal Data

Personal Data means any information relating to an identified or identifiable natural person (the "data subject").

An identifiable natural person is a person who can be identified, directly or indirectly, by reference to a name, telephone number, address, email address, identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Personal Data processed in connection with the job search website, job listing services, scout and application functions, recruitment services, messaging functions, recommendation functions, and other related services provided by CareerCross (collectively, the "Services") includes, for example, the following information:

• Name, address, telephone number, email address, and other contact information
• Account information, login information, and other information required to use the Services
• Résumé, curriculum vitae, educational background, employment history, qualifications, skills, language proficiency, desired job type, preferred work location, desired annual salary, and other information relating to job search and career change activities
• Work authorization, residence status, visa information, eligibility to work, and other information required to verify work authorization
• Application history, scout receipt history, scout response history, application status, hiring and employment status, and other information generated through the use of the Services
• Message content, attachments, dates and times of transmission and receipt, and other related information exchanged through the Services between users and recruiting companies
• Inquiry details, communication history with CareerCross, and support history
• IP address, Cookies, advertising identifiers, device information, browser information, browsing history, usage history, and other information automatically collected through the use of the Services

CareerCross does not actively collect sensitive Personal Data beyond the scope necessary for providing the Services. However, if a user voluntarily includes such information in a résumé, curriculum vitae, message, attachment, or other free-text field, CareerCross may collect, review, store, use, disclose, and otherwise process such information to the extent necessary for the purposes described in accordance with this Privacy Policy and as permitted under applicable law.

Legal Basis for the Processing of Personal Data under the GDPR

CareerCross Co., Ltd. ("CareerCross" or the "Company") determines, as the Data Controller, the purposes and means of processing the Personal Data of job seekers, registered users, representatives of recruiting companies, website visitors, and persons who contact us in connection with the Services.

CareerCross processes Personal Data only where one of the following legal bases applies.

1. Consent

CareerCross may process Personal Data based on the user's consent where the user has given such consent.

For example, CareerCross obtains the user's consent where CarceerCross determines that consent is required or considered appropriate for processing, such as the delivery of marketing communications, newsletters, advertising using Cookies and similar technologies, measurement of advertising effectiveness, or the viewing and recording of message content.

This processing is based on Article 6(1)(a) of the GDPR:

"the data subject has given consent to the processing of his or her personal data for one or more specific purposes."

Users may withdraw their consent at any time. However, the withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal. In addition, as a result of withdrawing consent, users may no longer be able to use all or part of the Services.
 

2. Legitimate Interests

CareerCross may process Personal Data as necessary to operate the Services safely and appropriately and to provide users with optimal and efficient services as the operator of a job search website, job listing services, recruitment services, and other Services.

Such processing includes, for example, recommending jobs, scout opportunities, and career-related information, improving matching accuracy, improving the Services, analyzing usage, preventing unauthorized use, responding to issues, confirming placement status, responding to inquiries, and processing necessary for the establishment, exercise, or defense of legal claims.

This processing is based on Article 6(1)(f) of the GDPR:

"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject."

Where CareerCross processes Personal Data based on legitimate interests, it processes such Personal Data only to the extent necessary so as not to unduly affect the rights and freedoms of users.
 

3. Contract

CareerCross processes Personal Data to the extent necessary for users to use the Services.

For example, CareerCross processes Personal Data for the performance of a contract or in order to take steps at the request of the user prior to entering into a contract where such processing is necessary for user registration, account management, job searches, job applications, scout functions, messaging functions, recruitment services, application management, recruitment process management, the provision of applicant or candidate information to recruiting companies or hiring companies, responding to inquiries, and other processing necessary for the provision of the Services.

This processing is based on Article 6(1)(b) of the GDPR:

"processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract."

4. Legal Obligation

CareerCross may process Personal Data where necessary to comply with applicable laws and regulations.

Such processing includes the retention of records as required by law, responding to lawful requests from administrative authorities, supervisory authorities, courts, and other public authorities, and making reports, disclosures, or taking other actions required by law.

This processing is based on Article 6(1)(c) of the GDPR:

"processing is necessary for compliance with a legal obligation to which the controller is subject."

Recipients of Personal Data

CareerCross may disclose Personal Data, to the extent necessary, to the following recipients or categories of recipients:

Recruiting companies or hiring companies to which the user has applied
Recruiting companies or hiring companies to which the user has responded through the scout function
Recruiting companies or hiring companies where CareerCross provides recruitment services
Service providers engaged for system operation, hosting, cloud services, email delivery, analytics, advertising delivery, customer support, security, legal and accounting services, and other services necessary for business operations
Administrative authorities, supervisory authorities, courts, law enforcement authorities, and other public authorities
Lawyers, certified public accountants, tax accountants, auditors, information security professionals, and other professionals subject to confidentiality obligations
Other third parties where the user has given consent

Where CareerCross engages service providers to process Personal Data on its behalf, CareerCross requires such service providers to implement appropriate contractual, technical, and organizational, and security measures that CareerCross reasonably considers appropriate in accordance with applicable laws and regulations.

Viewing and Retention of Message Content

CareerCross may view, record, and retain the content of messages exchanged through the Services between users and recruiting companies, the dates and times such messages are sent and received, the sender and recipient, and other related information, to the extent necessary for the proper operation of the Services, the prevention of employment-related disputes, the confirmation of placement status, the prevention of unauthorized use, responding to inquiries, operational support, improving matching accuracy, and otherwise providing and improving the Services.

CareerCross may obtain the user's explicit consent for the above viewing, recording, and retention at the time of user registration, upon the first use of the Services, when the relevant function is used, or at such other time as CareerCross considers appropriate.

If a user does not provide such consent, CareerCross may suspend, restrict, limit, or refuse access tothe provision of all or part of the application, scout, messaging, and other related functions.

International Data Transfers

CareerCross is located in Japan. Personal Data collected in connection with the Services may be stored or processed in Japan.

The European Commission has adopted an adequacy decision for Japan pursuant to Article 45 of the GDPR. Accordingly, transfers of Personal Data from the EU/EEA to Japan may be made on the basis of that adequacy decision.

Where CareerCross transfers Personal Data to service providers, recruiting companies, hiring companies, or other third parties located outside Japan or in countries that are not subject to an adequacy decision, CareerCross implements appropriate safeguards and transfer mechanisms as it determines are necessary or appropriate in accordance with applicable data protection laws, including Standard Contractual Clauses, adequacy decisions, Binding Corporate Rules, the explicit consent of the data subject, or other lawful transfer mechanisms.

Retention of Personal Data

CareerCross retains Personal Data for as long as CareerCross determines is reasonably necessary to achieve the purposes for which it was collected, the period necessary to provide the Services, the period during which the relationship with the user continues, and the period necessary to comply with legal obligations, conduct audits, respond to disputes, or establish, exercise, or defend legal claims.

The specific retention period is determined taking into account the type of Personal Data, the purpose for which it was collected, the relationship with the user, legal or business requirements, the possibility of disputes, and the need for security measures.

Where a user deletes the user's account, withdraws from the Services, or requests deletion of Personal Data, CareerCross will delete or anonymize the relevant Personal Data within a reasonable period, except where a longer retention period is required by law or is necessary for legitimate business purposes.

Data Subject Rights under the GDPR

Under the GDPR, data subjects are granted the following important rights.

1. Right of Access and Right to Data Portability

Users may confirm whether CareerCross processes their Personal Data and, where such processing takes place, request access to that Personal Data and related information.

Users also have the right to receive their Personal Data in a structured, commonly used, and machine-readable format.

Where the processing of Personal Data is based on consent or a contract and is carried out by automated means, users may, where technically feasible, request that CareerCross transmit such Personal Data directly to another Data Controller.

2. Right to Rectification

Users may request the correction or completion of inaccurate or incomplete Personal Data.

Where CareerCross has disclosed a user's Personal Data to a third party, CareerCross will notify that third party of the request for correction to the extent required by applicable law. However, CareerCross does not guarantee that such third party will comply with the request.

3. Right to Erasure (Right to be Forgotten)

Users may request the erasure of their Personal Data in certain circumstances.

However, where CareerCross is required to retain such Personal Data in order to comply with legal obligations, perform a contract, respond to disputes, establish, exercise, or defend legal claims, or for any other reason permitted under applicable law, CareerCross may not be able to comply with the request for erasure.

Where CareerCross has disclosed a user's Personal Data to a third party, CareerCross will notify that third party of the request for erasure to the extent required by applicable law. However, CareerCross does not guarantee that such third party will comply with the request.

4. Right to Restriction of Processing

Users may request the restriction of the processing of Personal Data in the following circumstances:

where they contest the accuracy of the Personal Data;
where the processing is unlawful, but the user opposes the erasure of the Personal Data and requests restriction of its processing instead;
where CareerCross no longer needs the Personal Data, but the user requires it for the establishment, exercise, or defense of legal claims; or
where the user has objected to processing based on legitimate interests and verification is pending as to whether CareerCross's legitimate grounds override those of the user.

5. Right to Object

Where CareerCross processes Personal Data based on legitimate interests, users may object to such processing on grounds relating to their particular situation.

Where such an objection is made, CareerCross will cease the processing unless there are compelling legitimate grounds for continuing the processing or the processing is necessary for the establishment, exercise, or defense of legal claims.

Users may also object at any time to the processing of Personal Data for direct marketing purposes. In such case, CareerCross will cease processing for that purpose.

6. Right to Object to Automated Decision-Making

CareerCross does not make decisions based solely on automated processing that produce legal effects concerning users or similarly significantly affect them, except in the following circumstances:

where necessary for entering into, or the performance of, a contract;
where authorized by law; or
where the user has given explicit consent.

CareerCross may provide job information, scout opportunities, recommendations, and other information displayed through the Services as reference information for users. However, CareerCross does not guarantee job applications, selection results, hiring decisions, employment conditions, employability, or suitability for any particular job opportunity.

7. Right to Compensation

Where a violation of the GDPR has occurred, such violation is attributable to the Data Controller or Data Processor, and the user has suffered damage, the user may have the right to receive compensation under the GDPR.

8. Right to Withdraw Consent

Where CareerCross processes Personal Data based on the user's consent, the user may withdraw such consent at any time.

The withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

9. Right to Lodge a Complaint with a Supervisory Authority

Users may contact CareerCross if they have concerns regarding the processing of their Personal Data.

Users also have the right to lodge a complaint with the data protection supervisory authority of the EU/EEA Member State of their habitual residence, place of work, or the place where they believe an infringement of the GDPR has occurred.

How to Exercise Your Rights

If users wish to exercise any of their rights under this Privacy Policy, please contact CareerCross using the contact details below.

CareerCross Co., Ltd.

Contact for Personal Data Inquiries:
[CareerCross Customer Center]

E-mail:
[info@careercross.com]

Contact Form:
[https://www.careercross.com/en/suggestion]

Postal Address:
Jinbocho Mitsui Bldg. 15F
1-105 Kanda Jinbocho
Chiyoda-ku, Tokyo 101-0051
Japan

CareerCross may request the provision of information necessary to verify the identity of the user. CareerCross will respond to requests within a reasonable period in accordance with applicable law.

Where a request is manifestly unfounded, excessive, or otherwise permitted under applicable law, CareerCross reserves the right to  refuse, limit, defer or charge a reasonable fee in connection with any request to the extent permitted under applicable law.

Security of Personal Data

CareerCross implements appropriate technical and organizational measures to prevent the leakage, loss, destruction, unauthorized access, unauthorized use, unauthorized disclosure, and other risks relating to Personal Data.

CareerCross restricts access to Personal Data to employees, officers, service providers, and other relevant persons to the extent necessary, imposes confidentiality obligations on such persons, and provides appropriate training and supervision.

Personal Data of Minors

Where a minor uses the Services, the minor must obtain the prior consent of his or her legal representative or guardian before using the Services.

CareerCross processes the Personal Data of minors only to the extent necessary and appropriate in accordance with applicable law.

Changes to this Privacy Policy

CareerCross may amend this Privacy Policy as necessary due to changes in applicable laws, changes to the Services, changes to the processing of Personal Data, or for other reasons.

Where this Privacy Policy is amended, CareerCross will publish the revised Privacy Policy through the Services or by other appropriate means. Where material changes are made, CareerCross may provide additional notice to users or obtain their consent in accordance with applicable law. 

Effective Date: July 17, 2026