Japan Electronics Show Association (JESA, “we”, “us” or “our”) deeply recognises that personal data constitutes important information relating to the privacy of individuals. We are committed to complying with all applicable data protection legislation, including the UK General Data Protection Regulation (“UK GDPR”), the EU General Data Protection Regulation (“EU GDPR”), the Data Protection Act 2018, Japan’s Act on the Protection of Personal Information (“APPI”), and associated guidance, and to establishing appropriate safeguards for the secure management of personal data.

■ Scope of This Policy (Organiser / Operator Relationship)

JESA operates, or operates under contract, a number of trade exhibitions and events (including CEATEC and Inter BEE). For each such event, JESA is responsible for operating the visitor registration system and managing personal data on behalf of the relevant organiser. JESA acts as the Data Controller for personal data collected through those systems, in accordance with this Policy. Where an event-specific Privacy Notice has been published for a particular exhibition or event, that notice shall take precedence over this Policy in relation to that event.

1. Personal Data We Collect

JESA is principally composed of manufacturers and distributors of electronic equipment and components. In the conduct of our core activities—namely the organisation of trade exhibitions (including online exhibitions) and seminars (including online lectures and seminars)—JESA recognises that the proper handling of personal data is a fundamental obligation.

In the course of our business activities, JESA collects information that can identify a specific individual (“personal data”). This includes data collected through written forms, electronic media and websites in connection with venue-based or online exhibitions, lectures, seminars and other events, such as:

• Full name
• Age bracket
• Address
• Telephone number
• E-mail address
• Employer / organisation name
• Department
• Job title
• Badge scan date and time
• Other information voluntarily submitted during registration

Data that cannot identify an individual on its own but can do so when combined with other information is also treated as personal data for the purposes of this Policy.

■ JESA Accounts

Registration for exhibitions and events operated or operated under contract by JESA may require a JESA Account (an account for the JESA Registration Site). A JESA Account may be used across multiple events operated by JESA, including CEATEC and Inter BEE.

Core account information (name, e-mail address, employer, etc.) is retained and may be used for re-registration at future events. Event-specific information collected at registration (e.g. survey responses) is used solely in connection with the event for which it was collected.

To request deletion of a JESA Account, please use the JESA Account Withdrawal Request Form. Deletion of a JESA Account does not automatically result in the deletion of personal data already disclosed to exhibitors, speakers, affiliated organisations or seminar organisers.

2. Purposes of Processing

Personal data collected by JESA is processed for the following purposes, within the scope of JESA's objects as set out in its articles of association:

• Sending reports, communications and other information relating to JESA’s activities
• Organising and administering exhibitions, seminars, lectures and other events operated by or on behalf of JESA (see Note 1 below)
• Operating and maintaining JESA’s websites
• Distributing JESA’s publications (newsletters, reports, proposals, etc.)
• Responding to enquiries and notifications received in connection with JESA’s activities or contracted activities
• Sending notices, surveys and other communications relating to JESA’s activities or contracted activities
• Other communications and administrative matters relating to the operation of JESA

Note 1: JESA may collect personal data for the purposes of improving services, event admission, conference session booking, safe access to online exhibitor pages, and the administration of surveys and document requests. JESA may also collect personal data to provide visitors with promotional information relevant to the event and to facilitate the distribution of product and service information by exhibiting companies. Personal data is used solely within the scope of these purposes.

3. Legal Basis for Processing

Where the UK GDPR or EU GDPR applies, JESA relies on the following legal bases:

Contractual Necessity (Article 6(1)(b))

Processing necessary to register visitors and issue badges for attendance at events.

Legitimate Interests (Article 6(1)(f))

Processing for statistical analysis, event improvement, and the administration of JESA’s operations, where such interests are not overridden by the rights of data subjects.

Consent (Article 6(1)(a))

Processing for badge scanning by exhibitors, speakers and seminar organisers; optional marketing communications; and non-essential cookies. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.

Legal Obligation (Article 6(1)(c))

Processing required to comply with applicable law.

4. Disclosure of Personal Data to Exhibitors and Others

JESA issues admission badges containing a QR code or barcode to visitors at its exhibitions and events. Where a visitor voluntarily presents their badge for scanning at a conference venue entrance, exhibition hall entrance, or at an exhibitor’s stand, the personal data registered in advance will be disclosed to the relevant exhibitor, speaker, seminar organiser or affiliated organisation as visitor information for that event.

Data disclosed may include name, employer, department, job title and e-mail address. By voluntarily presenting a badge for scanning, the visitor consents to such disclosure. Visitors should be aware that they may subsequently receive communications by e-mail or post from exhibitors to whom their data has been disclosed.

In relation to online exhibitions and online lectures or seminars, personal data of online visitors registered to view content on the platform will be disclosed to the relevant online exhibitor, speaker or seminar organiser upon the visitor’s consent being obtained at the point of entry to each exhibitor page or session.

Following disclosure, each recipient becomes independently responsible for the personal data received and must comply with all applicable data protection legislation. Visitors are encouraged to review the privacy policies of the relevant exhibitors and third parties.

Aggregated, anonymised statistical data derived from website usage and event attendance may be shared with related organisations; this does not constitute disclosure of personal data.

JESA requires all organisers, exhibitors, speakers and seminar organisers (including those operating online) to manage personal data to an equivalent standard as JESA itself.

5. International Data Transfers

Personal data may be transferred to and processed in Japan. The European Commission has adopted an adequacy decision in respect of Japan pursuant to Article 45 EU GDPR (the EU–Japan Adequacy Decision), recognising that Japan provides an adequate level of protection for personal data.

Where personal data is disclosed to exhibitors, speakers, affiliated organisations or seminar organisers located outside Japan or the UK/EEA, such recipients become independently responsible for ensuring compliance with applicable data protection laws in their jurisdiction.

6. Website Operations, Cookies and Access Logs

Cookies

The websites operated by JESA or operated under contract by JESA in connection with each exhibition use cookies to provide customised services and to compile access statistics. JESA may collect visitors’ IP addresses for statistical analysis and to monitor website usage; IP addresses are not linked to other data that would identify an individual, except where necessary to protect JESA’s legitimate legal rights.

The following categories of cookies may be used:

• Strictly Necessary Cookies – required for the website to function; these do not require consent
• Analytics Cookies – used to understand how visitors interact with the website (consent required)
• Marketing Cookies – used to deliver relevant promotional content (consent required)

Non-essential cookies are activated only where consent has been obtained in accordance with applicable law. Visitors may disable cookies through their browser settings, although doing so may limit the functionality of certain services.

Note: A cookie is a string of alphanumeric characters sent from a web server to a visitor’s browser. It acts as an identifier, enabling the website to recognise the visitor on a return visit and to restore their preferences. Cookies do not contain information that directly identifies an individual.

Access Logs

Information relating to access to JESA’s websites is recorded in access logs. These records are used principally for statistical analysis, assessment of website usage, and promotional purposes.

7. Security and Data Retention

Security

JESA implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, damage, alteration or disclosure. Where JESA engages external processors to handle personal data, it enters into confidentiality agreements and maintains oversight of those processors’ activities. JESA follows the personal data protection policies of each event organiser, as applicable, in addition to this Policy.

Retention

Personal data will generally be retained for up to three (3) years following the relevant event unless:

• a longer retention period is required by law;
• retention is necessary for the establishment, exercise or defence of legal claims; or
• the data subject has consented to a longer retention period.

Recipients such as exhibitors and speakers may retain personal data under their own retention policies, for which they are independently responsible.

8. Data Subject Rights

Where the UK GDPR or EU GDPR applies, data subjects have the following rights in respect of personal data held by JESA:

• Right of access – to obtain a copy of personal data held
• Right to rectification – to have inaccurate personal data corrected
• Right to erasure (“right to be forgotten”)
• Right to restriction of processing
• Right to object to processing
• Right to data portability
• Right to withdraw consent (where processing is based on consent)
• Right to lodge a complaint with a supervisory authority

To exercise any of the above rights in relation to personal data held by JESA, please contact us using the details in Section 10 below. We will respond within the timescales required by applicable law following verification of your identity. Please note that where personal data is held in encrypted form, a fee for decryption may apply; this will be explained to you prior to any such work being carried out.

For personal data that has been disclosed to exhibitors, speakers, affiliated companies, affiliated organisations or seminar organisers, requests should be directed to the relevant recipient. In relation to online events, visitors may exercise the right to stop disclosure to a specific exhibitor during the event period (including any archive period) by activating the “Opt-Out” button displayed on the relevant exhibitor page.

Data subjects located in the EEA or UK may lodge a complaint with their local supervisory authority if they consider that their personal data has been processed in breach of applicable data protection law.

9. External Links

JESA’s websites and event websites may contain links to websites operated by exhibitors, speakers, seminar organisers or other third parties. JESA is not responsible for the privacy practices of such websites. Visitors are encouraged to review the privacy policies of any linked websites before submitting personal data to them.

10. Data Protection Management

JESA maintains a personal data protection management structure under the overall supervision of the Secretary-General, who acts as the Data Protection Lead. This structure is designed to ensure consistent and rigorous compliance with applicable data protection legislation across all of JESA’s activities.

11. Changes to This Policy

JESA may amend this Policy from time to time to reflect changes in law, regulation or operational practice. The latest version will always be published on JESA’s website.

12. Contact Details

For enquiries regarding the handling or disclosure of personal data held by JESA, or to exercise your data subject rights, please contact us at:

Japan Electronics Show Association (JESA)
4th Floor, Ote Center Building
1-1-3 Otemachi, Chiyoda-ku
Tokyo 100-0004, Japan
E-mail: privacy@jesa.or.jp
JESA Account Withdrawal: https://reg.jesa.or.jp/withdrawal/