Purpose and scope
This policy explains how mtc collects, uses, shares and protects personal information, and how you can make requests about it. It covers our website, our clients, suppliers and subcontractors, and anyone else who contacts us, and is based on the Act on the Protection of Personal Information (個人情報の保護に関する法律).
Effective 1 October 2026. Last reviewed 19 September 2026. Policy owner: Leon Appleby, Representative Director, mtc K.K. (株式会社エム・ティー・シー).
1. About this policy
株式会社エム・ティー・シー (mtc K.K., “mtc”, “we”, “us”) respects the privacy of the people we work with. This policy sets out how we handle personal information in line with the Act on the Protection of Personal Information (個人情報の保護に関する法律, “APPI”) and the guidelines issued by the Personal Information Protection Commission (個人情報保護委員会, “PPC”).
It applies to personal information about website visitors, clients, prospective clients, suppliers, subcontractors, partners and anyone else who contacts us.
2. Business operator
The business handling personal information (個人情報取扱事業者) under this policy is:
- Name: 株式会社エム・ティー・シー (mtc K.K.)
- Address: 2F Tosei Building, 18-10 Nihonbashi Hakozakicho, Chuo-ku, Tokyo 103-0015, Japan
- Representative: Leon Appleby, Representative Director
3. Information we collect
We may collect the following types of personal information:
- Identity and business details: name, company name and job title.
- Contact details: email address, phone number and postal address.
- Business information: details of enquiries, project requirements, quotations, contracts and service requests.
- Supplier and subcontractor information: details of people who work on mtc projects, including information needed to confirm they may lawfully do that work.
- Technical information: IP address, browser and device type, pages viewed and similar usage data collected through cookies and similar technologies when you visit our website.
- Other information you choose to give us.
4. How we collect information
We collect personal information directly from you, for example through the contact form on our website, by email, by phone, in meetings, from business cards and through contracts. We also collect technical information automatically through cookies and similar technologies on our website, as described below.
When you give us personal information in writing, including through our website form, the purposes set out in this policy apply.
5. Purposes of use
We use personal information only for the following purposes, and will not use it beyond them without your consent unless the law permits:
- To respond to enquiries and communicate with clients, prospective clients and partners.
- To prepare, issue and carry out estimates, proposals and contracts.
- To design, install, deliver, maintain and support our IT, AV and physical security services.
- To manage relationships with suppliers and subcontractors, including confirming that people working on mtc projects may lawfully do that work.
- To send information about our services, events and updates, where you have agreed to receive it.
- To analyse how our website is used and improve our website and services.
- To measure the effectiveness of our online advertising and show our advertising to people who may be interested in it.
- To display maps and process enquiries submitted through our website form.
- To manage invoicing, payments and accounting.
- To comply with legal and regulatory obligations and respond to lawful requests from public authorities.
6. Cookies and similar technologies
Our website uses cookies and similar technologies, including tools provided by third parties. When you visit our website, some information about your browser and device may be sent to these providers. The table below lists the tools we use, what they do and how you can control them.
When you first visit our website, a cookie banner lets you accept or reject non-essential cookies. You can change your choice at any time through the cookie settings link on our website. You can also block or delete cookies through your browser settings, although some parts of the website may then not work properly.
Information collected through cookies is generally personally referable information (個人関連情報) rather than personal data. We do not provide personally referable information to a third party where we expect that third party to obtain it as personal data, unless we have confirmed that the required consent has been obtained, as set out in Article 31 of the APPI.
| Tool | Provider | Purpose | How to opt out |
|---|---|---|---|
| Google Analytics | Measures how visitors use our website (pages viewed, time on site, device and approximate location) so we can improve it. | Reject analytics cookies in our cookie banner, or install the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout). | |
| Google Tag Manager | Manages and loads the other Google tags on our website. | Controlled through the cookie banner and your browser settings. | |
| Google Ads | Measures the results of our advertising, such as whether an advert led to an enquiry (conversion measurement). We do not use Google Ads remarketing to show advertising to people who have visited our website. | Reject advertising cookies in our cookie banner, or manage ad personalisation in Google My Ad Center (https://myadcenter.google.com). | |
| Google Maps | Displays an embedded map showing our office location. Google may receive your IP address and set cookies when the map loads. | Controlled through your browser settings. See Google’s Privacy Policy (https://policies.google.com/privacy). | |
| CookieYes | CookieYes | Shows the cookie banner and remembers your cookie choices. | This cookie is needed to record your choice. You can delete it through your browser settings. |
| FluentForm | Contact form on our Japan-hosted website | Collects and stores the enquiries you submit through our contact form. | Only used when you choose to submit the form. |
7. More about Google tools
Google Analytics, Google Tag Manager, Google Ads and Google Maps are provided by Google. Information collected by these tools is handled by Google under its own privacy policy. You can read how Google uses information from sites that use its services at https://policies.google.com/technologies/partner-sites.
8. Outsourcing
We may entrust the handling of personal information to service providers, such as IT, hosting and professional service providers, to the extent needed to achieve the purposes of use. This is outsourcing (委託) under the APPI and is not provision to a third party.
Our main business systems are Microsoft 365 and Microsoft Dynamics 365, provided by Microsoft. Personal data in these services is stored in Microsoft data centres located in Japan.
When we outsource, we choose providers that handle personal information appropriately and supervise them as required by the APPI.
9. Provision to third parties
We do not sell or rent personal information. We do not provide personal data to third parties without your prior consent, except where the APPI permits, including:
- where the provision is required by law;
- where it is necessary to protect a person’s life, body or property and it is difficult to obtain your consent;
- where it is especially necessary to improve public health or promote the healthy development of children and it is difficult to obtain your consent;
- where it is necessary to cooperate with a national or local government body, or a person entrusted by one, in carrying out duties set by law, and asking for your consent would be likely to interfere with those duties.
10. Joint use
mtc does not currently use personal data jointly with any other company (共同利用). If this changes, we will publish the required details in advance, including the data concerned, who will use it, the purpose and the party responsible.
11. Overseas transfers and where your data is held
Personal data held by mtc is stored in Japan: in Microsoft 365 and Microsoft Dynamics 365, using Microsoft data centres located in Japan, and on our Japan-hosted website, which stores the enquiries you submit through our contact form.
The Google tools on our website (Google Analytics, Google Tag Manager, Google Ads and Google Maps) may process information outside Japan, including in the United States. The United States does not have a single comprehensive federal privacy law. Privacy is protected through a mix of sector-specific federal laws and state laws, such as those in California. The PPC publishes information on the privacy regimes of foreign countries.
If we ever provide personal data to a third party in a foreign country, we will do so in line with Article 28 of the APPI, either with your consent after giving you the information the law requires, or where the recipient has put in place measures equivalent to those required by the APPI. In the latter case, we will provide information about those measures on request.
12. Security control measures
We take the following measures to prevent the leakage, loss or damage of personal data and to manage it securely. We describe them in general terms, because more detail could weaken our security. You can ask us for more information using the contact details below.
- Organisational measures: our Representative Director is responsible for the handling of personal data. We set rules on how personal data is acquired, used, stored, provided and deleted and on how we respond to incidents, and we carry out monthly reviews and regular audits of access rights and security settings.
- Human measures: staff are bound by confidentiality obligations and receive regular training on information security and the handling of personal data.
- Physical measures: we control access to our office and take steps to prevent the theft or loss of devices and documents that contain personal data.
- Technical measures: sign-in to our business systems requires multi-factor authentication, company laptops are encrypted with BitLocker, access to personal data is limited to people who need it for their work, and we use measures to protect our systems from unauthorised access and malicious software.
- Understanding the external environment: personal data held by mtc is stored in Japan, in Microsoft data centres located in Japan and on our Japan-hosted website. Where information is processed by the Google tools on our website, it may be processed outside Japan, including in the United States, as described above.
13. Retention
We keep enquiry and customer personal information for three years from our last contact with you or the end of our business relationship, unless a longer period is required by law, for example for tax and accounting records. When it is no longer needed, we delete or dispose of it securely.
14. Your requests
Under the APPI, you may ask us to:
- notify you of the purposes of use of your retained personal data;
- disclose your retained personal data, including in electronic form;
- disclose records of any provision of your personal data to third parties;
- correct, add to or delete your retained personal data if it is inaccurate;
- suspend the use of, or erase, your retained personal data where it is used beyond the purposes of use, was obtained improperly, or where the APPI otherwise allows;
- suspend the provision of your retained personal data to third parties where the APPI allows.
15. How to make a request
Please send your request by email to compliance@milestonetc.asia or by post to the address above, stating what you are requesting and the personal data concerned.
We will ask you to confirm your identity before we act on your request. A legal representative or a person authorised by you may make a request on your behalf, with documents showing their authority.
We will reply without undue delay, by the method you ask for where possible, including electronically. If we cannot meet your request in full, we will tell you why.
Requests are free of charge.
16. Enquiries and complaints
Please direct any questions or complaints about our handling of personal information to:
mtc K.K., 2F Tosei Building, 18-10 Nihonbashi Hakozakicho, Chuo-ku, Tokyo 103-0015, Japan. Email: compliance@milestonetc.asia. Phone: 03-6773-5523 (9:30 to 18:30, weekdays excluding public holidays).
mtc is not currently a member of a certified personal information protection organisation (認定個人情報保護団体).
17. Data breaches
If a leak, loss or damage of personal data occurs, we will act promptly to contain it and prevent it happening again. Where the APPI requires, we will report the incident to the PPC and notify the people affected.
18. Links to other websites
Our website may link to other websites. This policy does not apply to those websites, and we recommend that you read their privacy policies.
19. Changes to this policy
We may update this policy to reflect changes in the law or in how we handle personal information. We will post the updated policy on this page with its effective date.
The APPI was amended in 2026, with most changes taking effect in stages by 2028 once the detailed rules are published. We will review this policy as those changes take effect, and at least once a year.
20. Governing law
This policy is governed by the laws of Japan.
21. Effective date
Effective and last updated: 1 October 2026.
Policy owner: Representative Director, mtc K.K.
Legal references
- Act on the Protection of Personal Information (個人情報の保護に関する法律)
- Cabinet Order to Enforce the Act on the Protection of Personal Information (個人情報の保護に関する法律施行令)
- PPC Guidelines on the Act on the Protection of Personal Information: General Rules (個人情報の保護に関する法律についてのガイドライン（通則編）)
- PPC Guidelines on the Act on the Protection of Personal Information: Provision to Third Parties in Foreign Countries (個人情報の保護に関する法律についてのガイドライン（外国にある第三者への提供編）)
Contact and reporting concerns
Questions about this policy, requests and reports of concerns can be made to Leon Appleby, Representative Director, directly or by email to compliance@milestonetc.asia (please write “Confidential” in the subject for reports). You can also call 03-6773-5523, 9:30 to 18:30 on weekdays excluding public holidays. mtc will not tolerate retaliation against anyone who raises a concern in good faith.
mtc K.K. (株式会社エム・ティー・シー), 2F Tosei Building, 18-10 Nihonbashi Hakozakicho, Chuo-ku, Tokyo 103-0015, Japan. This policy is governed by the laws of Japan.
Related policies