This policy covers personal data processed for customers, prospects, and users of the Thorn Field Crest SaaS platform tailored for restaurants, cafés, sushi bars, izakaya, and hotel F&B outlets in Japan.
We process data to provide and improve the service, ensure security, deliver support, and meet legal obligations. Legal bases: contract performance (APPI/GDPR Art. 6(1)(b)), legitimate interest (Art. 6(1)(f)) for security and service analytics, and consent where explicitly requested (e.g., marketing emails).
Account data is retained for the subscription term and up to 3 years after termination for legal defense unless a shorter statutory period applies. Logs older than 180 days are aggregated. Backups are retained 30 days.
Primary storage is in AWS Tokyo/Osaka. Cross-border transfers (if support escalations require) use SCCs where applicable. Subprocessors are limited to infrastructure, auth, and analytics providers; the current list is available on request.
APPI rights: disclosure, correction, suspension of use. GDPR data subjects: access, rectification, erasure, portability, objection, and restriction. Submit requests to info@thornfieldcrest.com; we verify identity before action.
We use essential cookies for authentication, and privacy-friendly analytics with IP truncation. No third-party advertising cookies. Do Not Track is honored where supported.
Security incidents are triaged by our 24/7 NOC. Affected customers are notified without undue delay with scope, impact, and remediation steps. Breach reports are available to auditors upon request.
Email: privacy@thornfieldcrest.com (routes to legal desk). Postal: Attn. DPO, Thorn Field Crest KK, 1-chōme-5-7 Sawamachi, Katsuyama, Fukui 911-0801.