EU Data Privacy Notice

2. Recipients

In order to achieve our purposes set out in the table above, we may share your European Personal Data with the following categories of recipients:

(1)   franchised issuers;

(2)   third party issuers;

(3)   affinity partners;

(4)   merchants;

(5)   acquirers;

(6)   service providers;

(7)   risk based authentication solution providers; and

(8)   public bodies.

We require all third parties who process European Personal Data on our behalf to respect the security of your European Personal Data and to treat it in accordance with their contractual or legal obligations.

We may need to share your European Personal Data with more recipients than the ones listed above. Should this be the case, we will inform you of the change in accordance with applicable laws and regulations.

3. Automated decision making

Automated decision making takes place when our electronic systems process European Personal Data to make a decision about you or your business without human intervention. We are allowed to use automated decision making in the following circumstances:

(1)   authorizing transactions; *4;

(2)   authenticating transactions; *4;

(3)   detecting suspicious transactions *5; and

(4)   preventing and monitoring fraudulent transactions. *5.

*4 For the JCB proprietary cards and franchised issuer cards only.

*5 For the JCB proprietary cards, franchised issuer cards and third party issuer cards.

You will not be subject to decisions that will have a legal or significant impact on you based solely on automated processing, unless we have a lawful basis for doing so and we have notified you. For more information on your rights in connection with automated decision making, please see Section 6(8) (Right not to be subject to decisions based solely on automated processing below).

4. If you fail to provide European Personal Data

Where we need to collect European Personal Data by law, or under the terms of a contract we have with you, and you fail to provide the data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with card services). If that is the case, we may have to cancel a product or service you have with us.

5. International Transfer of European Personal Data

JCB USA is a USA company, and in order to provide you with our services we will process data in the USA and Japan. Transferring European Personal Data to the USA and Japan is necessary for the purposes of use set out in Sections 1 and 2 above. You should be aware that data protection law in the USA or Japan may differ from the data protection law applicable to you in the EEA or UK. However, we have adequate safeguards in place based on valid legal grounds, such as standard data protection provisions approved by the European Commission and the European Commission adequacy decision adopted between the EEA and Japan on 23 January 2019, for transferring European Personal Data to Japan.

If your JCB Card has been issued by a third party issuer, and you use your JCB card at merchants in the EEA or UK, it is necessary for JCB USA to transfer your European Personal Data to the relevant third party issuer in order to authenticate, authorize or settle your card transaction. Such third party issuer may be located in a country with different data protection standards. Please note that you can object to this transfer, at any time, by contacting us at the contact details set out at Section 11(Contact Us) below but this will limit your further use of the JCB Card in certain circumstances but not affect your obligations to us and the third party issuer.

6. Your rights in relation to European Personal Data

You have the following rights regarding your European Personal Data that we hold:

(1)   Right of access

You can request details of your European Personal Data that we hold. We will confirm whether we are processing your European Personal Data and we will disclose supplementary information including the categories of data, the sources from which it originated, the purpose and legal basis for the processing, the expected retention period, and the safeguards regarding data transfers to non-EEA countries, subject to the limitations set out in applicable laws and regulations. We will provide you free of charge with a copy of your European Personal Data, but we may charge you a fee to cover our administrative costs if you request further copies of the same information.

(2)   Right of correction

We will comply with your request to correct incomplete or inaccurate parts of your European Personal Data, although we may need to verify the accuracy of the new information you provide us.

(3)   Right to be forgotten

At your request, we will delete your European Personal Data promptly if:

・  it is no longer necessary to retain your European Personal Data;

・  you withdraw the consent which formed the basis of your European Personal Data processing;

・  you object to the processing of your European Personal Data and there are no overriding legitimate grounds for such processing;

・  the European Personal Data was processed illegally; or

・  the European Personal Data must be deleted for us to comply with our legal obligations.

We will decline your request for deletion if processing of your European Personal Data is necessary:

・  to comply with our legal obligations;

・  in pursuit of a legal action;

・  to detect, predict and monitor fraud; or

・  for the performance of a task in the public interest

(4) Right to stop your European Personal Data being used for direct marketing purposes.

At your request, we will stop using your European Personal Data for the purpose of direct marketing. If you want to stop us from calling, emailing you in connection with marketing communications, please email us at the email address listed in Section 11 (Contact Us) of this European Privacy Notice.

Please note that even if we stop all marketing communications, you may still receive administrative communications from us.

(5)   Right to restrict processing of your European Personal Data

At your request, we will limit the processing of your European Personal Data if:

・  you dispute the accuracy of your European Personal Data;

・  your European Personal Data was processed unlawfully and you request a limitation on processing, rather than the deletion of your European Personal Data;

・  we no longer need to process your European Personal Data, but you require your European Personal Data in connection with a legal claim; or

・  you object to the processing pending verification as to whether an overriding legitimate ground for such processing exists.

We may continue to store your European Personal Data to the extent required to ensure that your request to limit the processing is respected in the future.

(6)   Right to data portability

At your request, we will provide you free of charge with your European Personal Data in a structured, commonly used and machine readable format, if:

・  you provided us with European Personal Data;

・  the processing of your European Personal Data is based on your consent or required for the performance of a contract; or

・  the processing is carried out by automated means.

(7) Right to object

Where we process your European Personal Data based upon our legitimate interest (or that of a third party), you have the right to object to this processing on grounds relating to your particular situation if you feel it impacts on your fundamental rights and freedoms. We will comply with your request unless we have compelling legitimate grounds for the processing which override your rights and freedoms, or where the processing is in connection with the establishment, exercise or defense of legal claims.

(8) Right not to be subject to decisions based solely on automated processing

You will not be subject to decisions with a legal or similarly significant effect (including profiling) that are based solely on the automated processing of your European Personal Data, unless you have given us your explicit consent or where they are necessary for a contract with us.

(9) Right to withdraw consent

You have the right to withdraw any consent you may have previously given us at any time.

(10) Right to complain to a supervisory authority

If you are not satisfied with our response, you have the right to complain to or seek advice from a supervisory authority and/or bring a claim against us in any court of competent jurisdiction.

If you wish to contact us in connection with the exercise of your rights listed above, please email us at the email address listed in Section 11 (Contact Us) of this European Privacy Notice. We will respond to your written request as soon as possible from receiving it.

Unless stated otherwise, we will not charge you any fee in connection with the exercise of your rights. In so far as it is practicable, we will notify the recipients of your European Personal Data of any correction, deletion, and/or limitation on processing of your European Personal Data.

Please note that if you decide to exercise your rights under Section 6 (Your rights in relation to European Personal Data), sub-sections (3), (4), (5), (7), (8) and (9) above, depending on our response, you may not be able to take full advantage of all of our benefits and services from that point on.

7. Retention Period

We will keep your European Personal Data on file for as long as is necessary to achieve our purposes listed in the table in Section 1 (Collection, Use and Legal Basis of European Personal Data) above.

We only keep European Personal Data as permitted by law applicable to us, which is typically for a period of 7 years but may be up to 10 years.

Please note, JCB is subject to a number of applicable laws and regulations globally which may require European Personal Data to be kept for longer periods such as in relation to tax filings, government investigations, the investigation of fraud and transaction monitoring and litigation and dispute resolution in accordance with our data retention policy. Your data will be kept securely. If you have any queries about how and for how long your European Personal Data is kept, you may contact us at the email address listed in Section 11 (Contact Us) of this European Privacy Notice.

8. Security

We have a management system to correct and prevent unauthorized access, loss, destruction, falsification, and leakage of European Personal Data, as well as the appropriate technical and organizational measures to address such risks, as further detailed below. The goal of these measures is to maintain our data protection standards and to ensure we have the necessary safeguards for the processing of European Personal Data.

(1)   We limit access to European Personal Data to authorized executives and employees only.

(2)   We limit our collection and use of European Personal Data to the extent necessary for providing our services and managing operations.

(3)   If we outsource the processing of European Personal Data to third parties, we base our selection on said third parties having adequate safeguards in place that meet our European Personal Data protection standards, and we regularly audit their compliance with applicable data protection policies, laws and regulations.

(4)   We strive to manage European Personal Data accurately and efficiently.

(5)   We pseudonymize and encrypt European Personal Data where necessary.

(6)   We strive to ensure our system and service’s confidentiality, integrity, availability, and recoverability.

(7)   We have systems in place to ensure we can restore the availability and access to European Personal Data in a timely manner in the event of a physical or technical incident.

(8)   We periodically inspect, assess, and evaluate the effectiveness of our technical and organizational measures to ensure the security of our processing.

9. Updates

This European Privacy Notice was published on the date “Last Updated” above. This European Privacy Notice may be updated to reflect changes to our European Personal Data processing policy. In the event there is material change to this European Privacy Notice we will inform you by updating this page. Please visit this European Privacy Notice regularly to read the current version.

10. Glossary

Some of the words in this European Privacy Notice have the meanings set out below:

•  acquirers: these are financial institutions or other parties that contract with merchants for JCB card transactions;
• affinity partners: third parties that are authorized to offer co-branded JCB Cards;
• consent: when you have explicitly given us your consent for processing of your European Personal Data;
• contract: to allow us to perform our contract with you;
• franchised issuers: these are companies who can issue JCB branded cards jointly with us in Japan;
• J/Secure authentication service: JCB’s authentication program to verify the authenticity of a cardholder that enables the secure processing of payment card transactions in the remote environment;
• legitimate interest: where it is necessary for our legitimate interests or those of a third party, and your interests and fundamental rights do not outweigh those interests;
• legal obligation: where we need to comply with a legal obligation (for example compliance with anti-money laundering and fraud laws or compliance with a court order);
• merchants: these are merchants where JCB cards are transacted.
• public bodies: they refer to supervisory authorities, government agencies and public entities that deal with European Personal Data. We may provide your European Personal Data to public bodies to comply with our legal and regulatory duties;
• service providers: we may engage service providers including financial institutions that issue cards, financial institutions that acquire merchants and process card transactions, subcontractors for card transactions and provision of services and service providers that facilitate card transactions and monitor unauthorized card access. These third parties may come to access or otherwise process your personal data in the course of providing these services and may not process your European Personal Data unless there are adequate legal reasons for them to do so. All third party service providers and subcontractors are required by contract to comply with all relevant data protection laws and security requirements in relation to your European Personal Data;
• risk based authentication solution provider: we may engage specialist service providers that assist us in authenticating cardholders and transactions by analyzing transaction data and related information from a wide range of sources; and
• third party issuers: these are companies who can independently issue by license JCB branded cards.