How we handle your data.

CN Solar Labs GK is a godo kaisha (合同会社) incorporated in Japan and is the controller of the personal data described on this page. Our address is:

For anything to do with your data, including any request under the rights described in section 07, write to hello@cnsolarlabs.com. A person reads it.

It is worth stating the absences first, because they are the largest part of the answer and most privacy policies bury them.

There are two routes by which personal data reaches us. Both of them start with you choosing to contact us.

When you submit an enquiry form, the message is sent to our server, validated, and then delivered to us as a push notification so that a person sees it quickly. From that point it lives in our email and is handled by hand. It is not written to a customer database, it is not enriched from third-party sources, and it does not enter a marketing system.

A small number of providers process data on our behalf, under contract, and only on our instructions. They are:

Beyond those, we disclose personal data only where we are legally required to, where it is necessary to establish or defend a legal claim, or to our professional advisers under a duty of confidence. We do not disclose it to anyone else.

Where the EU or UK General Data Protection Regulation applies to our processing, we rely on the following grounds. Where Japan’s Act on the Protection of Personal Information (APPI) applies, this section together with section 03 is our notice of the purpose of use.

We keep things for as long as the reason for holding them lasts, and then we delete them. In practice:

Depending on where you are, you have some or all of the following rights over the data we hold about you. We do not charge for exercising them and we do not require a particular form of words.

Write to hello@cnsolarlabs.com. We aim to respond within 30 days, and we will tell you if a request will take longer and why. We may need to check that the request really came from you, which we will usually do by replying to the address we already hold.

We are established in Japan and our providers operate globally, so data you send us may be processed outside your own country, including in the European Economic Area, the United Kingdom, and the United States.

Japan holds an adequacy decision from both the European Commission and the United Kingdom, so transfers from the EEA and the UK to us do not require additional safeguards. Where a provider processes data elsewhere, we rely on that provider’s standard contractual clauses or an equivalent lawful transfer mechanism.

This site is served over TLS, the enquiry endpoint validates and length-limits every field before doing anything with it, and submissions are rate-limited and honeypot-screened. We hold no reader database, so there is no reader database to breach.

What we cannot promise is that any transmission over the internet is perfectly secure, or that our providers are. Send us what you need to send us to start a conversation, and no more than that. If we ever become aware of a breach affecting your data, we will tell you and the relevant authority as the law requires.

This site is aimed at people working in business and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us something, write to us and we will delete it.

If we change how we handle data, we will change this page and move the date below. If a change is significant and we hold your address because you contacted us, we will tell you directly rather than expecting you to check.

This policy sits alongside our terms of use and the notice on figures and reliance.