KK NISEKO ALPINE DEVELOPMENTS (“we,” “us,” or the “Company”) operates and/or markets accommodation facilities and related business activities, in the course of which we receive and hold the personal information of guests, property owners, business partners, and job applicants.
We comply with the Act on the Protection of Personal Information (the “APPI”) and other relevant laws, regulations, and guidelines, and handle personal information appropriately. This Policy sets out how we handle personal information.
Article 1 (Business Operator Information)
| Item | Details |
|---|---|
| Name | KK NISEKO ALPINE DEVELOPMENTS |
| Address | 10-2 Minami 1-jo Nishi 2-chome, Kutchan-cho, Abuta-gun, Hokkaido 044-0031, Japan |
| Representative | Representative Director, Patrick Shunji Otani |
Article 2 (Definitions)
Terms used in this Policy have the meanings given to them under the APPI. This applies equally to the terms “personal information,” “personal data,” “retained personal data,” “special care-required personal information,” and “personal-related information.”
Article 3 (Categories of Personal Information Collected and Methods of Collection)
We collect the following personal information by appropriate means in the following contexts.
- Accommodation Reservations and Use: Name, name in kana or Roman characters, date of birth, gender, nationality, address, telephone number, email address, passport number and copy of passport (for foreign guests without a residential address in Japan; collected pursuant to Article 6 of the Hotel Business Act and Article 4-2 of its Enforcement Regulations), information on accompanying persons, arrival and departure date/time, means of transportation used, stay history, payment information, requests and inquiries, and emergency contact information. Method of collection: our website reservation form, telephone, email, accommodation booking sites and other booking intermediaries, travel agencies, and the guest register completed at check-in.
- Applications for Guest Services (Activities, Transfers, Rentals, Restaurant Reservations, etc.): Name, contact details, number of participants, date/time of participation, height, weight, shoe size, etc. (to the extent necessary to arrange rental equipment), and health condition, injuries, allergies, etc. (to the extent necessary to ensure safety).
- Property Owners and Management Association Matters: Name or company name, address, telephone number, email address, registration information, bank account information, tax-related information, and information relating to sectional ownership.
- Newsletter and Campaign Registration: Email address, name, country of residence, and areas of interest.
- Inquiries, Opinions, and Requests: Name, contact details, and content of the inquiry.
- Job Applications: Name, date of birth, address, contact details, educational and employment history, qualifications, residence status information, information stated in resumes/CVs, and information obtained during the selection process.
- Use of Our Website: Cookies, IP address, device information, browser type, browsing history, search conditions, and referrer URL. Further details are set out in Article 7.
- Use of Facilities: Security camera footage. We install security cameras in common areas of the facilities we manage for the purposes of ensuring facility safety and crime prevention.
- Reviews and Feedback: Name, and the content of reviews or feedback you submit, whether directly through our website or via third-party review platforms.
Article 4 (Purposes of Use)
We use collected personal information for the following purposes.
- Purposes Relating to the Provision of Accommodation and Other Services:
- Accepting, confirming, changing, and cancelling accommodation reservations
- Providing accommodation facilities and associated services
- Preparing and retaining the guest register as required under the Hotel Business Act and other applicable laws
- Arranging and providing guest services (activities, transfers, rentals, restaurant reservations, etc.)
- Billing, collecting, and settling accommodation and other charges
- Responding to guest inquiries, requests, and complaints
- Contact and response in the event of an accident, theft, disaster, or other emergency
- Purposes Relating to Property Management:
- Performing property management operations, and reporting and settling accounts with owners
- Use to the extent necessary to perform the administrative affairs of the management association under the Act on Building Unit Ownership, etc.
- Purposes Relating to Public Relations and Marketing:
- Sending information regarding new properties, campaigns, events, and other services (by email, post, SMS, telephone, or other means)
- Conducting surveys and analysing the results
- Improving services and developing new services based on analysis of usage patterns
- Analysing use of our website and optimising advertisement delivery
- Purposes Relating to Recruitment:
- Use to the extent necessary for recruitment selection, communicating selection results, and post-hire personnel and labour management
- Purposes Relating to Administration and Legal Compliance:
- Performance of contracts with business partners, communication, and transaction management
- Ensuring facility safety and crime prevention
- Responding as required by law, exercising our rights or performing our obligations, and responding to disputes
Article 5 (Collection of Special Care-Required Personal Information)
We may collect information regarding food allergies, medical history, physical condition, need for assistance, and other health-related information to the extent necessary for the safe and appropriate provision of accommodation or guest services. As such information may constitute special care-required personal information, we collect it based on your own disclosure, with your consent, and use it only within the scope of that purpose.
Article 6 (Change of Purpose of Use)
Where we change the purpose of use, we will do so only to the extent reasonably considered relevant to the purpose prior to the change, and will notify the changed purpose by posting it in this Policy or by other means.
Article 7 (Handling of Cookies, etc.)
- Our website uses cookies and similar technologies (tags, pixels, SDKs, etc.) for the purposes of improving guest convenience, analysing usage, and optimising advertisement delivery.
- The main tools and providers we use are as follows.
| Category | Tool / Provider |
|---|---|
| Tag management | Google Tag Manager |
| Access analytics | Google Analytics 4 |
| Advertising / measurement | Google Ads; Meta Pixel |
| CRM tracking / web push / personalisation | Netcore Cloud (Netcore Smartech) |
| Product analytics | Mixpanel |
| Session recording / heatmaps | Hotjar |
| Affiliate / partner tracking | Impact.com |
| Price comparison widget | 123compareme |
- Information collected via cookies, etc. cannot by itself identify a specific individual, but may become personal information when cross-referenced with other information we hold. In such cases, we treat that information as personal information.
- You may refuse to accept cookies through your browser settings; however, in such cases, some functions of our website may not be available. You may also use the opt-out mechanisms provided by each tool provider.
- Where we expect to receive personal-related information from a third party and acquire it as personal data, we will confirm in advance that your consent has been obtained, pursuant to Article 31 of the APPI.
Article 8 (Security Control Measures)
- We implement the following measures to prevent the leakage, loss, or damage of personal data and otherwise ensure the security of personal data:
- Formulation of basic policy: We have formulated and published this Policy.
- Establishment of rules for handling personal data: We have established internal rules setting out handling methods, responsible persons, staff in charge, and their duties, covering each stage of acquisition, use, storage, provision, and deletion/disposal.
- Organisational security control measures: We have appointed a person responsible for the handling of personal data, established a system to confirm the status of handling, and established a reporting and communication structure for cases of non-compliance with laws or internal rules.
- Personnel security control measures: We take appropriate steps to ensure that employees handling personal data understand and observe their confidentiality obligations.
- Physical security control measures: We take reasonable measures to control physical access to areas and devices where personal data is handled, with a view to preventing unauthorised access, loss, or theft.
- Technical security control measures: We have implemented access controls, user identification and authentication, and mechanisms to prevent unauthorised external access to information systems handling personal data.
- Understanding of the external environment: Where personal data is handled in a foreign country, we ascertain that country’s personal information protection regime and implement measures necessary and appropriate for security control. The foreign countries in which we handle personal data are as set out in Article 11, paragraph 2.
Article 9 (Outsourcing of Personal Data Handling)
- We may outsource all or part of the handling of personal data to external parties to the extent necessary to achieve our purposes of use.
- The categories of outsourcing parties are as follows.
- Providers of property management systems (PMS) and channel managers
- Online travel agencies (OTAs) and other booking intermediaries
- Payment processing providers and credit card companies
- Cloud service and server providers
- Providers of customer relationship management (CRM) systems and email delivery services
- Call centre and customer support service providers
- Providers of cleaning, linen, facility maintenance, transfer, and other operational services
- Providers of activities and other guest services
- Providers of printing, shipping, advertising, and marketing services
- Providers of accounting, tax, legal, and other professional services
- Providers of information systems development and maintenance
- We select outsourcing parties based on appropriate selection criteria, set out matters relating to the security control of personal data in outsourcing contracts, and exercise necessary and appropriate supervision over outsourcing parties.
- Where necessary to fulfil a booking, we may share a guest’s name, contact details, and stay information with the relevant property owner or their representative, for purposes such as check-in coordination and on-site guest services.
Article 10 (Provision to Third Parties)
- Except in the following cases, we will not provide personal data to a third party without obtaining your prior consent:
- Where required by law (including responding to requests to inspect the guest register under the Hotel Business Act)
- Where necessary for the protection of a person’s life, body, or property, and it is difficult to obtain your consent
- Where particularly necessary for public health or the sound development of children, and it is difficult to obtain your consent
- Where necessary to cooperate with a national or local government body, or a party entrusted by it, in carrying out affairs prescribed by law, and obtaining your consent would impede the performance of those affairs
- Where personal data is provided in connection with outsourcing as set out in the preceding Article
- Where the data falls under joint use as set out in the following Article
- Where personal data is provided in connection with a business succession due to a merger or other reason
- Where we provide personal data to a third party with your consent, we will create and retain a record pursuant to Article 29 of the APPI.
Article 11 (Provision to Third Parties Located in Foreign Countries)
- We may provide personal data to third parties located in foreign countries in the following cases. In such cases, we will either obtain your prior consent, or, where the relevant third party has established a system that conforms to standards under the APPI, take measures necessary to ensure that the third party continuously implements equivalent measures:
- Where joint use as set out in Article 12 is conducted with our parent company or other group companies
- Where we outsource the handling of personal data to a cloud service provider, reservation management system provider, or other outsourcing party located in a foreign country
- Where information necessary to fulfil a reservation is exchanged with an accommodation booking site or travel agency located in a foreign country
- The foreign countries to which personal data is provided are as follows.
| Foreign Country | Recipient | That Country’s Personal Information Protection Regime |
|---|---|---|
| Republic of Singapore | Our parent company, Luxe Nomad Pte. Ltd. (group management, marketing, systems operation) | The Personal Data Protection Act 2012 has been enacted, and the Personal Data Protection Commission (PDPC) has been established as the supervisory authority. |
| Republic of the Philippines | Group staff (Manila team) with routine operational access via Freshdesk, Netcore, and marketing systems | The Data Privacy Act of 2012 has been enacted, and the National Privacy Commission (NPC) has been established as the supervisory authority. |
| United States of America | Freshdesk (support ticketing); HubSpot (CRM); Google (GA4, GTM, Ads); Craft CMS (website CMS); Mixpanel (analytics); Flywire (payments); Cloudflare (CDN/security) | Governed in the United States of America by sector-specific federal and state laws (including the California Consumer Privacy Act). |
| Republic of India | Netcore Cloud (Netcore Smartech) (CRM, marketing automation, web push) | The Digital Personal Data Protection Act 2023 has been enacted. |
| Ireland | Meta Platforms (advertising and retargeting) | The General Data Protection Regulation (EU) applies. |
| United Kingdom | Trustpilot (guest review platform) | The UK General Data Protection Regulation (UK GDPR), together with the Data Protection Act 2018, applies; the Information Commissioner’s Office (ICO) is the supervisory authority. |
| Hong Kong | The Luxe Nomad Limited (group management, marketing, systems operation) | The Personal Data (Privacy) Ordinance has been enacted, and the Office of the Privacy Commissioner for Personal Data (PCPD) has been established as the supervisory authority. |
| Malta | Hotjar (session recording and heatmaps) | The General Data Protection Regulation (EU) applies. |
| United States of America | Impact.com (affiliate and partner tracking) | Governed in the United States of America by sector-specific federal and state laws (including the California Consumer Privacy Act). |
| Spain | 123compareme (price comparison widget) | The General Data Protection Regulation (EU) applies. |
Article 12 (Joint Use)
We jointly use personal data as follows.
| Item | Details |
|---|---|
| Categories of personal data jointly used | Name, name in kana or Roman characters, nationality, address, telephone number, email address, stay history, details of reservations and use, requests, and payment information |
| Scope of parties jointly using the data | Our parent company, Luxe Nomad Pte. Ltd. (Republic of Singapore), and The Luxe Nomad Limited (Hong Kong) |
| Purposes of use by the joint users | The purposes set out in Article 4(1), (3), and (5) (provision of accommodation services, reservation management, guest relations, sending of information, and analysis and improvement of usage across the group) |
| Party responsible for management of the personal data | We, as set out in Article 1 (address and representative’s name as stated in that Article) |
Article 13 (Retention Period for Retained Personal Data)
Retained personal data is kept for the period necessary to achieve the purpose of use and for any period prescribed by law, after which we will delete or dispose of it without delay. The principal retention periods are as follows.
| Type | Retention Period |
|---|---|
| Guest register | 3 years from the date of entry (Article 6, paragraph 1 of the Hotel Business Act) |
| Accommodation reservation and use records containing payment or financial information | 10 years from the date of use |
| Accommodation reservation and use records with no attached financial information | 3 years from the date of use |
| Transaction ledgers and documents | 10 years |
| Information relating to newsletter distribution | Until you request to unsubscribe |
| Information relating to recruitment selection | 1 year after the selection process ends (except where the applicant is hired) |
| Security camera footage | 90 days from the date of recording |
| Website analytics data | 14 months at user level |
Article 14 (Requests for Disclosure, etc. of Retained Personal Data)
- You or your agent may request us to notify the purpose of use of, disclose (including disclosure of records of third-party provision), correct, add to, or delete, and to suspend the use or provision to third parties of, your retained personal data.
- Requests should be made to the contact point set out below. You must complete our prescribed form and submit it together with documents verifying your identity (such as a copy of a driving licence or passport). Where the request is made by an agent, documents evidencing the agent’s authority and verifying the agent’s own identity must also be submitted.
- No fee will be charged for requests to notify the purpose of use or for disclosure.
- We will confirm the content of the request and respond without delay. However, where we are not obligated to disclose under the APPI or other applicable law, we will notify you of that fact and the reasons.
Article 15 (Contact Point for Complaints and Inquiries)
Inquiries regarding this Policy, complaints regarding the handling of personal information, and requests under the preceding Article should be directed to the contact point below.
KK NISEKO ALPINE DEVELOPMENTS — Personal Information Contact Point
Address: 10-2 Minami 1-jo Nishi 2-chome, Kutchan-cho, Abuta-gun, Hokkaido 044-0031, Japan
Telephone: +81 136-23-1724
Email address: [email protected]
Hours: 9:00 a.m. to 5:00 p.m. on weekdays (excluding weekends, public holidays, and the year-end/New Year period)
Article 16 (Personal Information Protection Manager)
We appoint a Personal Information Protection Manager to ensure the appropriate handling of personal information.
Personal Information Protection Manager: Satoshi Nagai
Article 17 (Amendment of this Policy)
We may amend this Policy in response to changes in law or in our business. Any amended Policy takes effect from the time it is posted on our website. Where a material change is made, we will announce this on our website for a reasonable period.
Article 18 (Governing Law)
This Policy is governed by, and shall be interpreted in accordance with, the laws of Japan.
Effective date: 8th September 2026
Last updated: 8th September 2026
KK NISEKO ALPINE DEVELOPMENTS