LIVAPON Immerse Privacy Policy

Effective date: August 15, 2026

Operator (data controller): CHAIRMAN Co., Ltd., 5-1-1-1-803 Chiharadai-minami, Ichihara-shi, Chiba, Japan ("we", "us", "our")

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use LIVAPON Immerse (immerse.livapon.com) (the "Service"). We handle personal information in accordance with the Act on the Protection of Personal Information of Japan (APPI). If you live in the European Economic Area (EEA) or the United Kingdom, Section 12 gives you additional information and rights under the GDPR and UK GDPR.

1. Who We Are

The Service is operated by CHAIRMAN Co., Ltd., a company incorporated in Japan. We provide online courses and in-person cultural experiences in Japan. For anything related to this policy, you can contact us at the address in Section 14.

2. Information We Collect

We collect only the information we need to run the Service:

• Account information. Your name, email address, and phone number, received when you sign in with your Shopify account or place your first order. We do not operate a separate password system; login is handled through Shopify Customer Accounts.
• Shopify customer ID. An identifier that links your Service account to your Shopify account.
• Booking contact details. When you book an experience, we save a snapshot of the lead participant's name, email address, and phone number (phone is optional). If you leave these fields blank, we fill them from your account profile. This snapshot stays attached to the booking and does not change if you later update your profile.
• Cancellation reason. If you cancel a booking, you may optionally tell us why. We store what you write.
• Order information. Details of your orders received from Shopify, including order number, amount, currency, your email, and the order data Shopify sends us, which may include your name, billing or shipping address, and phone number.
• Operational and audit records. Logs of order and refund notifications we receive from Shopify, and audit logs of actions taken on your bookings and enrollments (for example, a cancellation or a manual correction by our staff).

What we do not collect:

• Payment card details. All payments are processed by Shopify Checkout. Your card number is never stored on, and never passes through, our systems.
• Advertising trackers or behavioral profiling. We do not use advertising trackers or build behavioral profiles of you. We do use Google Analytics to measure aggregate site usage — see Section 4.

3. How We Use Your Information

We use your information to:

• create and manage your account, enrollments, and bookings;
• contact you about your bookings, courses, cancellations, and refunds;
• share booking information (the lead participant's name and the number of participants in each category, such as adult or child) with the instructor or host of an experience you booked, so they can prepare for and run the session;
• process payments and refunds through Shopify;
• prevent fraud and unauthorized use of the Service; and
• comply with legal obligations, such as record-keeping requirements.

We do not use your information for marketing without asking you first, and we do not sell your personal information.

4. Cookies

We use the following cookies:

The livapon_session and livapon_oauth cookies are HTTP-only and strictly necessary for the Service to work — they are not accessible to scripts, and we do not use them for advertising or profiling. The _ga / _ga_* cookies are set by Google Analytics and are not strictly necessary; we currently set them on every visit without a separate cookie consent step. You can prevent Google Analytics from tracking your visit with the Google Analytics Opt-out Browser Add-on, or by using your browser's tracking-protection or ad-blocking features. We do not use advertising cookies or any other third-party tracking cookies. Google's own privacy policy governs the data it collects through Google Analytics.

5. Who We Share Your Information With

We share your information with the following service providers, only to the extent needed to run the Service:

• Shopify — handles your customer account, orders, payments, and refunds. When you book an experience, the booking contact details you enter are transmitted to Shopify as part of your order. Shopify's own privacy policy applies to the data it processes.
• Amazon Web Services (AWS) — hosts our application servers and database in the ca-central-1 region (Montreal, Canada).
• Vercel — hosts our website front end and keeps standard access logs.
• Google Analytics — measures aggregate site usage (pages visited, how often) using the cookies described in Section 4. We do not send it your name, email address, or any other information that directly identifies you.
• Experience instructors and hosts — receive the lead participant's name and the number of participants in each category (adult or child) for sessions you book, as described in Section 3.

YouTube. Course archive videos are hosted on YouTube as unlisted videos. When you click a video link on the Service, you leave our site and go to YouTube. We do not embed YouTube players on our pages. Your viewing on YouTube is governed by Google's privacy policy, not this one.

If our business is transferred — for example, through a merger or a sale of the business — your information may be transferred to the successor as part of that transaction. The successor will be bound by this policy, and we will notify you of the change as described in Section 11.

We do not share your personal information with anyone else, except where the law requires it (for example, a lawful request from a court or public authority).

6. Where Your Information Is Stored

Your personal information is stored on servers located in Canada (AWS, ca-central-1 region). Our other providers process data in the countries where they operate — Shopify processes data primarily in Canada and the United States, and Vercel processes data primarily in the United States (with static content temporarily cached at edge locations worldwide). Canada's personal-information protection framework and each provider's safeguards apply to data stored there. Under the APPI, we provide this information so that you understand the data-protection environment of the countries where your data is held. If you would like more detail about these countries' data protection systems, contact us using the details in Section 14.

7. How Long We Keep Your Information

We keep your personal information for as long as necessary to:

• provide the Service to you;
• keep transaction records, handle refunds and disputes, and prevent fraud; and
• meet our legal obligations, such as bookkeeping and tax record retention under Japanese law.

We do not currently operate automatic deletion on a fixed schedule, so we do not promise specific retention periods in this policy. You can ask us to delete your data as described in Section 8.

8. Your Rights and How to Exercise Them

You can ask us to:

• tell you what personal information we hold about you (disclosure);
• correct information that is inaccurate;
• delete your information; or
• stop using your information for a particular purpose.

To make a request, email us at info@chairman.jp. We handle these requests manually and will respond without undue delay — and, if you are in the EEA or the UK, within one month of receiving your request. If a request is complex, we may need more time, and we will tell you if so. We may ask you to verify your identity before we act on a request. Where the law requires us to keep certain records (for example, transaction records), we may retain those even after a deletion request, and we will tell you if that is the case.

Some of your data — in particular your Shopify customer account and order history — is held by Shopify as an independent service. For that data, you can also contact Shopify directly or manage it through your Shopify account settings, and we can help you find the right channel.

9. Security

We limit access to personal information to those who need it to operate the Service, protect data in transit with encryption (HTTPS), and keep audit logs of administrative actions. Payment card data never touches our systems.

10. Children

The Service is not directed at children under 16, and we do not knowingly collect personal information directly from them. Where a child (for example, a 6–12-year-old participant in an experience) takes part, their information is provided to us by their parent or guardian as part of the booking.

11. Changes to This Policy

If we change this policy, we will post the updated version on the Service with a new effective date. For significant changes — for example, changes to the types of information we collect, the purposes we use it for, or the parties we share it with — we will notify you in advance by email or by a prominent notice on the Service before the change takes effect.

12. Additional Information for EEA and UK Residents (GDPR / UK GDPR)

This section applies only if you live in the EEA or the United Kingdom. It supplements, and does not replace, the rest of this policy.

Controller. The controller of your personal data is the operator identified at the top of this policy. We have not appointed an EU representative under Article 27 GDPR; we will consider doing so if sales to the EU become regular.

Legal bases. We process your personal data on the following bases:

• Performance of a contract — creating your account, managing enrollments and bookings, sharing participant details with instructors, and processing payments and refunds.
• Legitimate interests — preventing fraud, keeping audit and security logs, and defending legal claims. We balance these interests against your rights.
• Legal obligation — retaining transaction records where Japanese law requires it.

Do you have to provide your data? Providing your name and email address (and, for bookings, lead participant contact details) is necessary to enter into and perform your contract with us. If you do not provide them, we cannot process your order or booking. Providing a cancellation reason and a phone number is optional.

Your rights. You have the right to access your personal data; to have it corrected or erased; to restrict or object to processing; to receive the data you provided in a portable format; and, where processing is based on consent, to withdraw consent at any time without affecting past processing. We do not currently process your data on the basis of consent; this right will apply only if we introduce consent-based processing in the future (for example, marketing emails, which we will only send if you agree first as described in Section 3). To exercise any of these rights, use the contact in Section 14.

Complaints. You have the right to lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office).

International transfers. Your data is stored in Canada (our servers), accessed from Japan (where we operate), and processed by the providers in Section 5 in the countries listed in Section 6. Canada is covered by adequacy decisions of the European Commission (for commercial organizations) and, for UK readers, by corresponding UK adequacy regulations; Japan is covered in the same way. Where a transfer is not covered by an adequacy decision or regulation, we rely on appropriate safeguards such as standard contractual clauses implemented by our providers.

Automated decision-making. We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.

13. Language

This policy is written in English, and the English version is the authoritative text.

14. Contact

For questions about this policy or your personal information:

• Email: info@chairman.jp
• Operator: CHAIRMAN Co., Ltd., 5-1-1-1-803 Chiharadai-minami, Ichihara-shi, Chiba, Japan