Privacy Policy

Effective from October 31, 2026

This English version is provided for reference only. The Spanish version is the official version.

1. Controller

This policy applies to personal data we handle through our website, booking site, email, WhatsApp, Instagram, contact forms, payment page and communications before and after the tour.

Name, email address and WhatsApp number.
Travel dates, city, number of participants, guide language, preferred route and special requests.
If you tell us: details of companions, accommodation, meeting point, country or region of residence, phone number, and information needed for safety or care, such as age range, walking limitations, wheelchair use, food allergies or dietary restrictions.
Service purchased, amount, currency, payment date and time, payment and refund status, billing information and payment IDs. Stripe processes the full card number and security code; we do not store them in our systems.
Content of communications by email, WhatsApp, social media, etc., booking changes, complaints and support history.
Technical data such as IP address, browser, device, access date and time, security logs and cookies.
If you sign in with Google, the name and email address that Google sends us.

We may obtain data from you, the group representative, companions or travel agency, the payment processor, the social media and messaging services you use to contact us, and the assigned guide, transport companies or facilities.
If a representative provides data about companions, the representative is responsible for informing them and confirms that they have the necessary authority to do so.

Answering enquiries, preparing quotes and receiving bookings: pre-contractual steps.
Confirming bookings, assigning guides and running tours: performance of the contract.
Payments, refunds, billing, accounting and tax: performance of the contract and legal obligations.
Sharing the meeting point, itinerary and special requests: performance of the contract.
Preventing fraud, abuse and cyberattacks: our legitimate interests and those of users.
Handling complaints, accidents and disputes: performance of the contract, legitimate interests and legal claims.
Marketing communications: your consent where required.
Data requiring special care, such as health or allergies: as a rule, your explicit consent.

We share with the assigned guide only what is needed for the tour, such as your name, WhatsApp number, dates, number of participants, language, meeting point, preferred route and any care needed for safety.
When we book transport, experiences, facilities, restaurants or private vehicles, we may share the data needed for the booking with each provider.
We use Stripe for payments, Resend for sending emails, Vercel and Render for the website, server and database, Cloudflare Turnstile for bot protection, Google for Google sign-in and for checking guide availability (no customer data), and web push notifications to alert our team and guides.
We may use WhatsApp, Instagram and other services to communicate with you, and Google Workspace or similar tools for internal management.
We may share data with accountants, lawyers, tax advisers, insurers or public authorities as required by law or for our business.
We do not sell personal data to third parties.

We are an Estonian company and tours take place in Japan. Depending on the service provider, data may be processed in the European Economic Area, Japan, the United States or other countries.
When data is transferred outside the European Economic Area, we use, where applicable, adequacy decisions, standard contractual clauses or other safeguards recognised by law.

We keep personal data only as long as needed for its purposes, for handling contracts and complaints, and for accounting and tax obligations.
Enquiries that did not lead to a booking: 2 years from the last contact.
Booking, tour and customer support records: 3 years from the end of the tour.
Contracts, billing, payments, refunds and accounting and tax records: as a rule, 7 years from the end of the relevant financial year.
Health, allergy, mobility and similar information: deleted or anonymised within 30 days after the tour, unless needed for a dispute or similar reason.
Security and access logs: up to 12 months.
We check that these periods are followed, including in backups and external services.

We may use cookies and similar technologies that are necessary for bookings, payments, security, fraud prevention and basic site operation.
If we introduce optional analytics, advertising or tracking cookies in the future, we will ask for your consent where required and update this policy and the cookie notice.
If you restrict cookies in your browser, bookings and payments may not work correctly.

We may use automated tools to organise enquiries, send standard information or draft replies.
As a rule, we do not make decisions with significant effects on you by automated processing alone. Decisions on bookings, refunds, complaints and exceptions are reviewed by a person.
If we send personal data to a new AI service, we will check what is sent, retention settings, the purpose and the provider, and update this policy if necessary.

To prevent unauthorised access, loss, leaks, alteration or misuse, we take reasonable measures such as limiting access rights, managing secrets separately, encrypting communications, account authentication, backups, logging and sharing only what is necessary.
We manage access keys and passwords securely and do not include them in shared documents.
No internet communication or electronic storage can be guaranteed to be completely secure.

Under applicable law, you may have the right to access, rectification, erasure, restriction of processing, data portability, objection, withdrawal of consent, and human review of automated decisions.
To exercise your rights, contact info@shusensei.com. We may ask for information to verify your identity.
As a rule, we respond to valid requests without undue delay and within one month at the latest. Some data may not be deleted because of legal retention obligations or legal claims.

If we send promotional emails, we will ask for your prior consent where required. You can unsubscribe at any time.
Even after you unsubscribe from marketing, we may still send booking confirmations, date changes, safety notices and other messages needed for the contract.

We handle data about minors only when provided by a parent or an authorised representative, and only as needed to provide the service.
Before providing data about companions, the person making the booking must inform them about this policy and obtain their consent where required.

If you move from this site to third-party sites or services, their handling of your data is governed by their own privacy policies.

We may update this policy in response to changes in the law, our services, our systems or the external providers we use. We will announce important changes on this site or by other appropriate means.

For questions, requests to exercise your rights or complaints about personal data, contact Japon Go OÜ / Shuhei Ogawa: info@shusensei.com / +81 90 6702 5121.
If we do not resolve your issue, you may lodge a complaint with the Estonian supervisory authority (Andmekaitse Inspektsioon) or the data protection authority where you live.