ZipUpp / Partner Program
LEGAL DOCUMENT

Partner Program Privacy Policy

Created: September 13, 2026 | Effective: September 13, 2026

1. Scope and responsible entity

Nagasaki Private Tours Co.,Ltd. (the “Company”) processes personal information for ZipUpp Partner Program applications, referral tracking, qualification review, commission payments, and inquiries. This Policy explains processing that relates to partners, applicants, and people who use referral links. The ZipUpp service privacy policy also applies to recruitment and career-service data processed within ZipUpp itself.

2. Information we collect

Application and account information: name, business name, contact information, country of residence, registration details, authentication status, and account ID. Agreement and referral information: consent timestamps and terms versions, referral IDs, referrer and referred-user relationships, click and registration timestamps, and attribution records. Qualification and accounting information: qualification status, event IDs, country and currency, commission amounts, approval, cancellation and payment status, and application, review and adjustment history. Payment information: payment destination, recipient name, identity-verification results, and legally required tax information. Additional fields depend on the payment method and will be explained when collected. Technical and support information: cookies and similar identifiers, access and security records, inquiries, and response history. Pseudonymized network or similar signals may be used to prevent fraud. Not every field is collected in every case; collection depends on the feature and the need.

3. Purposes of use

We use information to: (1) review applications, manage accounts, and communicate with participants; (2) identify referrers, record referral relationships, and prevent duplicate attribution; (3) verify qualifying activity, calculate and review commissions, make payments, and reconcile refunds and cancellations; (4) prevent and investigate fraud, impersonation, and misuse; (5) respond to inquiries, disputes, and privacy-rights requests; (6) meet accounting, tax and legal obligations and address disputes; and (7) maintain and secure the service and analyze usage without unnecessarily identifying individuals. Information collected for commission administration will not be repurposed for unrelated advertising without an explanation. Optional promotional communications will have separate consent where needed and a way to unsubscribe. Important contractual, payment, and security notices are distinguished from optional advertising.

4. Referral cookies and server-side attribution

We process referral IDs and related information in first-party cookies and on our servers to record registrations made through referral links. Users who register through a referral link qualify as referrals without a time limit. Once a referral relationship is established at registration, it is stored on our servers; deleting a cookie does not immediately delete that record. You can restrict or delete cookies through your browser settings, but doing so may affect accurate referral tracking. For cookies or similar technologies requiring consent, we will explain their purposes and providers and provide the necessary consent and choice mechanisms when introduced. Agreement to this Policy alone is not treated as consent to advertising tracking unrelated to referral attribution.

5. Information shown to referrers and the network

Information displayed to referrers and upstream partners is limited to what they need to manage their own commissions, such as qualification status, amounts, and identifiers. A referral relationship does not itself grant access to candidates’ names, contact information, application documents, interview content, private profiles, or companies’ nonpublic recruitment information. Aliases or identifiers may be used in network displays. If another information-sharing feature is introduced, we will explain the recipients, purposes, and scope in advance.

6. Service providers and third-party disclosures

We may allow service providers to process information as needed for hosting, authentication, notifications, payments, identity verification, tax and accounting work, monitoring, or support. We select and supervise providers and use contracts and access restrictions. We do not disclose personal data to third parties without consent or another required legal basis, except where permitted by applicable law, including lawful requests or protection of life, bodily safety, or property. In a business succession, we will comply with applicable law and consider continuing purposes of use and necessary notices.

7. International processing

Depending on our service providers and storage infrastructure, information may be processed outside your country of residence. When providing personal data from Japan to a third party in another country, we will obtain consent, provide required information, or ensure appropriate safeguards as required by applicable law. We will provide necessary information under applicable law about actual destination countries, categories of recipients, relevant data-protection systems, and the safeguards applied.

8. Retention and deletion

Account information is retained as needed to administer participation; referral relationships and qualification records as needed for attribution, commission review, and settlement; accounting and tax records for legally required periods; and security records as needed for fraud investigation and security. Retention may be extended for disputes or legal obligations, limited to the information necessary. Records needed for legitimate settlement, audit, or tax purposes may remain after withdrawal. Information no longer needed will be deleted or made non-identifying. Backups are erased according to the established replacement cycle.

9. Security measures

We use security measures proportionate to the risks, including access controls, authentication, protection of communications, activity logs, staff training, and service-provider oversight. Commission adjustments and cancellations are recorded in an auditable manner. If a personal-information breach occurs, we will investigate, limit harm, and notify authorities and affected individuals as required by law.

10. Requests for access, correction, deletion, and other rights

Subject to applicable law, you may request notification of purposes of use, disclosure of retained personal data or third-party disclosure records, correction, addition or deletion of information, cessation of use, erasure, or cessation of third-party disclosure. Contact us to submit a request. We will perform reasonable identity checks using a secure method and respond within legally required time limits where applicable. If we cannot fulfill all or part of a request because of legal retention obligations, protection of others’ rights, or other applicable grounds, we will explain the reason as required by law. If a fee applies, we will explain its basis and amount in advance. Do not send passwords, bank login information, or identity documents through ordinary email.

11. Rights of United States residents

Depending on your state of residence and whether its laws apply to the Company, you may have rights to access, correct, delete or obtain data; opt out of certain processing; submit requests through an authorized agent; or appeal a denied request. We will not unlawfully discriminate against you for exercising applicable rights. We assess actual data flows against the legal definitions of “sale,” “sharing,” and targeted advertising. Where processing falls within those definitions, we will provide required notices at collection, choices, and responses to signals such as Global Privacy Control. Covered states, applicability criteria, and specific response procedures will be explained in applicable United States supplemental notices.

12. Review and automated processing

Automated processing may be used to detect duplication or fraud, check qualifications, and calculate commissions. We accept inquiries and requests for reconsideration regarding disputed events or payment holds. Where applicable law requires explanations, human review, or other measures, we will provide them. Requests will not be rejected solely on an automated result without any opportunity for explanation or review.

13. Minors

Participation in this program is limited to people aged 18 or older. If we become aware of information about someone who does not meet the eligibility requirements, we will take appropriate steps to verify, suspend use, and delete information as required by law. Eligibility to use ZipUpp itself is governed by the service terms.

14. Changes and contact

For material changes, we will explain the changes and effective date and obtain consent where required by law. Previously collected information will also be handled in accordance with applicable law. Responsible entity: Nagasaki Private Tours Co.,Ltd. (Japanese legal name: Nagasaki Private Tours株式会社) Address: 2F-C, Shibuya Dogenzaka Tokyu Building, 1-10-8 Dogenzaka, Shibuya-ku, Tokyo 150-0043, Japan Privacy and rights requests: info@zip-upp.com Using “Partner Program Privacy” in the subject line will help us route your inquiry.