Legal
Privacy Policy
1. INTRODUCTION AND SCOPE
1.1 Who We Are. This Privacy Policy is issued by Ziddny World, a company incorporated in Japan, with its registered office at 10648-16-302 Misono'u, Saijo-cho, Higashihiroshima City, Hiroshima Prefecture, 739-0024, Japan ("we", "us", "our"). We provide a generative AI avatar platform and related services (the "Services"). Our designated contact for data protection matters can be reached at info@mechapal.com.
1.2 Our Dual Role: Controller vs. Processor. Our role under data protection law depends on the context:
Customer Data: This is data that our enterprise clients ("Customers") and their users submit to the Services for processing, including text, voice recordings, and any derived Biometric Data or video Outputs. For Customer Data, our Customer is the Data Controller, and we act as a Data Processor on their behalf. Part II of this policy applies to Customer Data.
Other Information: This is data we collect for our own purposes, such as from website visitors, Customer account administrators, and individual users of our public-facing services. For Other Information, we are the Data Controller. Part I of this policy applies to Other Information.
PART I: ZIDDNY AS A DATA CONTROLLER
This Part applies to Other Information, for which we are the Data Controller.
2. INFORMATION WE COLLECT AND HOW WE USE IT
2.1 Categories of Data Subjects. We collect and process personal data relating to the following categories of data subjects:
- Website visitors
- Customer account administrators
- Individual users of our public-facing services
2.2 Categories of Personal Data. The categories of personal data we collect may include:
- Contact Information (e.g. name, email address)
- Account Information (e.g. login credentials, account preferences)
- Billing Information (e.g. payment details, billing address)
- Usage Information (e.g. interaction logs, feature usage)
- Technical Information (e.g. IP address, browser type, device identifiers)
- Cookie Information (e.g. preferences, session IDs, tracking cookies)
- Marketing Information (e.g. communication preferences, engagement data)
- Individual User Content, including Biometric Data (e.g. voice recordings) submitted by users of our public services
2.3 Purposes and Legal Bases for Processing. We process Other Information based on the following legal grounds under the GDPR:
3. HOW WE SHARE OTHER INFORMATION
We may share Other Information with the following categories of recipients:
- Cloud Service Providers: We use third-party cloud service providers to host our platform and process data. A current list of these providers is available in our Legal Hub.
- Payment Processors: To securely handle billing and payment information.
- Analytics and Performance Tools: To help us understand usage patterns and improve our services.
- Customer Relationship Management (CRM) & Marketing Platforms: To manage our communications with you.
- Professional Advisors: Such as lawyers, accountants, and auditors, as necessary in the course of the professional services they provide to us.
- In Connection with a Business Transfer: If we are involved in a merger, acquisition, or sale of assets.
- For Legal Compliance: With law enforcement or public authorities as required by applicable law.
A list of our key sub-processors is available in our Legal Hub.
4. DATA RETENTION
We retain Other Information only for as long as necessary to fulfil the purposes for which it was collected or required under applicable law.
Our retention periods are determined based on the following criteria:
- The duration of your active account or our business relationship with you.
- The need to comply with our legal and regulatory obligations (e.g. tax and accounting records).
- The need to resolve disputes or enforce our agreements.
After the applicable retention period, personal data is securely deleted or anonymized.
5. INTERNATIONAL TRANSFERS
We are based in Japan. Our primary data processing facilities are in the United States. The European Commission has issued an adequacy decision for Japan, recognizing its data protection laws as providing a level of protection essentially equivalent to that of the EU. For transfers of Other Information from the EEA or UK to other countries not covered by an adequacy decision (e.g. to a sub-processor in the USA), we rely on legally-approved transfer mechanisms, such as the Standard Contractual Clauses (SCCs) and the UK's International Data Transfer Addendum.
A list of our key sub-processors and the applicable transfer mechanisms is available in our Legal Hub.
6. OTHER INFORMATION
6.1 Is Providing Your Data a Requirement? In most cases, providing your Personal Data is a contractual requirement. For example, we need your account and billing information to provide you with a paid subscription. Failure to provide this data will mean we are unable to provide you with the Services. We will inform you at the point of collection whether the provision of data is mandatory.
6.2 Automated Decision-Making. We do not use Other Information for the purposes of automated decision-making or profiling which produces legal effects concerning you or similarly significantly affects you.
7. YOUR DATA PROTECTION RIGHTS
Under the GDPR, you have the following rights regarding the Other Information we control:
- Right to Access: To request a copy of your Personal Data.
- Right to Rectification: To request correction of inaccurate data.
- Right to Erasure ("Right to be Forgotten"): To request deletion of your data where it is no longer necessary for the purposes for which it was collected.
- Right to Restrict Processing: To request that we suspend processing in certain circumstances.
- Right to Data Portability: To receive your data in a machine-readable format and have it transferred to another controller.
- Right to Object: To object to our processing of your data based on our legitimate interests.
- Right to Withdraw Consent: Where we process your data based on your consent, you may withdraw it at any time. This will not affect the lawfulness of processing before your consent was withdrawn.
To exercise these rights, please contact us at info@mechapal.com. We will respond to your request in accordance with applicable data protection laws.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement.
PART II: ZIDDNY AS A DATA PROCESSOR
This Part applies to Customer Data.
8. PROCESSING OF CUSTOMER DATA
8.1 Customer as Data Controller. For all Customer Data, our Customer is the Data Controller. They are responsible for the lawfulness of processing and for ensuring they have a valid legal basis (e.g. consent, legitimate interest) for collecting and processing the Personal Data of their end-users within our Services.
8.2 Our Role as Data Processor. We process Customer Data strictly on the documented instructions of our Customer, as governed by the Data Processing Addendum (DPA) in our agreement with them.
8.3 Data Requests. If you are using Ziddny World because your employer, school, or another organization (our "Customer") gave you access, that organization is in charge of your data.
We are their service provider, and our contract requires us to only follow their instructions. We don't decide what happens to your data, they do.
Because of this, for any requests about your personal data, such as to view, correct, or delete it, you need to contact the IT or privacy administrator at that organization.
If you send a request directly to us, our agreement with the data controller requires us to forward it to the organization you are part of so they can respond.
PART III: GENERAL INFORMATION
9. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make material changes, we will provide you with at least thirty (30) days' notice by emailing the primary account holder or by posting a prominent notice on our website.
10. CONTACT US
If you have any questions or concerns about this Privacy Policy or our data protection practices, please contact our data protection team at:
MechaPal株式会社, DBA as Ziddny World
10648-16-302 Misonou, Saijo-cho, Higashihiroshima City,
Hiroshima Prefecture, 739-0024 Japan
Email: info@mechapal.com