Privacy Policy

Established: April 17, 2025
Last revised: September 14, 2026

EVERYDAYGRC ("we," "us," or "our") handles personal information in accordance with Japan's Act on the Protection of Personal Information (個人情報の保護に関する法律, "APPI"), which is the law governing our processing. Where we process the personal data of individuals in the European Economic Area or the United Kingdom, we also apply the corresponding rights and safeguards described in Section 9.

Advising other organisations on privacy and information security is our work. We hold ourselves to the same standard we audit against.

1. Business Operator

• Trade name: EVERYDAYGRC
• Legal form: Sole proprietorship (個人事業主), established 2025
• Proprietor and person responsible for personal information: William Hollis (ホリス・ウィリアム)
• Location: Saitama Prefecture, Japan
• Registered address: Not published. Provided without delay on request to the contact address below, in accordance with Article 32 of the APPI.
• Contact: info@everydaygrc.com

2. Personal Information We Collect

2.1 Website visitors and enquiries

• Information you submit: name, email address, company name, company website, and the content of your message. Only the name and email address are required.
• Technical information: IP address, browser and device type, referring page, and request logs generated automatically by our hosting provider.

2.2 Clients and prospective clients

• Contact details and role information for individuals at client and prospective client organisations.
• Records necessary for contracting, invoicing, and tax and accounting obligations under Japanese law.

2.3 Personal data encountered during engagements

Audit, assessment, and advisory work may bring us into contact with personal data held by a client. That data is handled under Section 7, not under this section.

We do not seek or knowingly collect special care-required personal information (要配慮個人情報) through this website.

3. Purposes of Use

We use personal information only for the following purposes:

• To respond to enquiries and to provide, propose, and administer our services
• To prepare contracts, statements of work, invoices, and qualified invoices (適格請求書)
• To maintain the security, availability, and integrity of this website
• To comply with legal, tax, and accounting obligations
• To send service-related communications you have requested, where you have given consent

We do not use personal information for any purpose beyond those listed without first obtaining your consent. We do not sell personal information, and we do not use enquiry data for unsolicited marketing.

4. Security Control Measures

The following measures are in place to protect the personal information we handle (安全管理措置, APPI Article 23 and Article 32(1)):

• Organisational: A single named individual is accountable for all personal information handled by the business. Handling rules, an inventory of personal information held, and a defined incident response procedure are maintained and reviewed.
• Human: The proprietor is the only person with access to personal information. No employees, contractors, or subcontractors are engaged without a written confidentiality agreement and prior client consent where client data is involved.
• Physical: Personal information is held on encrypted devices kept in a secured working environment. Printed material is avoided; where unavoidable, it is stored securely and destroyed after use.
• Technical: Full-disk encryption, multi-factor authentication on all accounts used for business purposes, unique credentials managed in a password manager, least-privilege access, encrypted transport (TLS) for this website and all data in transit, and encrypted backups.
• External environment: Where personal information is stored by a provider outside Japan, we assess the data protection regime of that country before use. See Section 6.

Further detail on these measures is available on request.

5. Service Providers

We keep the number of parties handling your information as small as practicable. We currently use:

• Netlify, Inc. (United States): website hosting, form submission handling, and server logs.
• Our email provider: receipt and storage of correspondence sent to our contact address.

Providers are engaged under terms that require them to protect personal information, and we supervise them as required by Article 25 of the APPI. We do not provide personal information to any third party for that party's own purposes, and we do not sell or share personal information.

6. Cross-Border Transfer

The providers named in Section 5 are located in the United States, so personal information submitted through this site is stored and processed there.

The United States has not received an adequacy finding from Japan's Personal Information Protection Commission. We therefore rely on contractual arrangements with those providers requiring standards equivalent to those the APPI imposes on a business operator in Japan, and we review the continued adequacy of those arrangements.

Information about the personal data protection regime of the United States, and about the measures our providers take, is available on request.

7. Personal Data Handled on Behalf of Clients

When an engagement requires access to personal data held by a client, we act as a contractor (委託先) on the client's instructions, under a written agreement. In that role:

• We access only the data necessary for the agreed scope, and only for the duration of the engagement.
• We do not use client personal data for any other purpose, including our own.
• We do not engage a subcontractor (再委託) without the client's prior written consent.
• Data is returned or securely destroyed at the end of the engagement, and confirmation is provided on request.
• We notify the client without undue delay on becoming aware of any suspected incident affecting their data.
• Confidentiality obligations survive the end of the engagement.

Where a client's own policy or contract imposes stricter requirements, those apply.

8. Retention

• Enquiries that do not lead to an engagement: retained for up to 12 months, then deleted.
• Client records, contracts, and invoices: retained for the period required by Japanese tax and accounting law, currently seven years from the end of the relevant fiscal year.
• Server and request logs: retained for the period applied by our hosting provider.
• Client personal data accessed during an engagement: not retained after the engagement ends, except where the client instructs otherwise in writing.

9. Your Rights and How to Exercise Them

Under the APPI you may request disclosure (開示), correction (訂正), addition, deletion, cessation of use (利用停止), cessation of provision to third parties, or disclosure of records of third-party provision, in respect of retained personal data about you.

Procedure: Send your request to info@everydaygrc.com stating what you are requesting. We will ask for information sufficient to confirm your identity, or that of an authorised agent. We respond without delay, normally within 14 days, and we do not charge a fee. If we are unable to act on a request in whole or in part, we will tell you why.

If you are in the European Economic Area or the United Kingdom, you may additionally have the right to object to or restrict processing, to data portability, to withdraw consent at any time, and to lodge a complaint with your national supervisory authority.

10. Complaints

Complaints about our handling of personal information should be sent to info@everydaygrc.com and will be acknowledged within five business days.

If you are not satisfied with our response, you may contact Japan's Personal Information Protection Commission (個人情報保護委員会), which supervises compliance with the APPI. We do not currently belong to an accredited personal information protection organisation (認定個人情報保護団体).

11. Cookies and Analytics

This website does not use cookies for advertising, tracking, or analytics, and does not run third-party analytics or advertising scripts. Our hosting provider records standard server logs, as described in Section 2.1.

If this changes, we will update this policy before the change takes effect and provide an opt-in mechanism where one is required.

12. Changes to This Policy

We may revise this policy. The revision date at the top of this page reflects the most recent change. Material changes will be described here rather than made silently.

13. Contact

EVERYDAYGRC
William Hollis
Saitama Prefecture, Japan
info@everydaygrc.com