Privacy policy

This is an English translation for convenience. If it differs from the Japanese version, the Japanese version applies.

HANA Digital ("we" or "the Company") handles customers' personal information with care in running wpexperts.jp, a WordPress maintenance, security and speed service (the "Service"). We comply with the Act on the Protection of Personal Information (the "APPI") and other applicable laws and guidelines, and handle personal information as set out below.

1. Name, address and representative of the business

• Name: HANA Digital (Saitama, Japan)
• Address and representative: disclosed promptly if you ask through the contact point below.
• Enquiries about the handling of personal information:
  Contact form

2. Information we collect

We collect the following information.

(1) Information entered in our enquiry and application forms

Information you enter in our forms, such as your company name, your name, email address, the URL of the site concerned, and the details of your enquiry. When you sign up, we also collect billing information.

(2) Messages on LINE

If you contact us through our LINE Official Account, your LINE display name, profile image, message content, and the date and time of sending.

(3) Information from current clients

Login details we hold for maintenance work, such as for the WordPress admin, the server and the domain control panel, as well as the details of work requests and records of our correspondence.

(4) Payment information

Credit card payments are processed on the screens of our payment processor (Stripe). We do not receive or store card numbers. We only receive the information our payment processor sends us, such as the result of the payment, the card brand, the last four digits of the card number and the expiry date. For payment by invoice, we hold the billing company name, contact person's name, address and email address, and records of bank transfers.

(5) URLs entered in the free security check, and their results

The URL entered in the check tool, the result of the check, the date and time it was run, and the IP address it was sent from. The check only looks at public information that anyone can see from outside. It does not collect any information from inside the site being checked. A URL or check result alone does not usually identify a person, but where it can be linked to the content of an enquiry, for example, we treat it as personal information.

(6) Analytics information

We use Umami for analytics (run on infrastructure we manage). Umami does not use cookies. It records pages viewed, referrers, browser type, approximate region and similar information as statistics that do not identify individuals.

(7) Cloudflare traffic logs and security cookies

Our site uses services from Cloudflare, Inc. to protect it from unauthorised access and attacks. As a result, the following information is processed by Cloudflare: - Traffic logs such as IP address, date and time of access, URLs viewed and browser information - Security cookies used to tell bots from people (for example __cf_bm and cf_clearance) - Browser and device information used for bot protection on forms (Cloudflare Turnstile)

These cookies are needed to run the site securely, and are not used for advertising or tracking. If you disable cookies in your browser settings, some features (such as submitting forms) may not work.

3. Purposes of use

We use the information we collect within the scope of the following purposes:

1. To reply to enquiries and respond to requests for advice
2. To provide quotes, enter into contracts and provide the Service (maintenance work, monitoring, backups, reporting, etc.)
3. To bill fees, process payments and issue qualified invoices
4. To show the results of the free security check, and to improve the check tool
5. To send important notices, such as changes to contract terms or fees, maintenance and outages
6. To prevent unauthorised access, nuisance behaviour and abuse of the check tool, and to keep the site secure
7. To analyse usage statistically and improve the site and the Service
8. To tell you about our services, with your consent

If we wish to use information for any other purpose, we will obtain your consent in advance.

4. Provision to third parties

We do not provide personal data to third parties without your consent, except in the following cases:

• Where required by law
• Where it is necessary to protect a person's life, body or property and it is difficult to obtain your consent
• Where it is especially necessary to improve public health or promote the healthy development of children and it is difficult to obtain your consent
• Where we need to cooperate with a national agency, local government or similar body carrying out duties prescribed by law, and obtaining consent could interfere with those duties
• Other cases permitted under the APPI

Outsourcing as described in section 5 below does not count as provision to a third party for this purpose.

5. Outsourcing

We may outsource the handling of personal data to outside businesses to the extent necessary to achieve the purposes of use. We select contractors after confirming that they have systems in place to handle personal information properly, and we supervise them as necessary.

Our main contractors are as follows.

6. Provision to third parties in foreign countries

As shown in the table above, we use services from businesses located outside Japan, and personal data may be handled in those countries. In accordance with the APPI, we provide the following information.

Cloudflare, Inc. (United States)

• Country: United States of America
• That country's personal information protection system: The United States has no comprehensive federal law covering all sectors equivalent to Japan's APPI. There are sector-specific federal laws and state laws (such as the California Consumer Privacy Act). For details, see the "Survey of Personal Information Protection Systems in Foreign Countries" (外国における個人情報の保護に関する制度等の調査) published by the Personal Information Protection Commission.
• Measures taken by the contractor: Cloudflare protects personal information through measures such as participating in the EU-U.S. Data Privacy Framework, obtaining certifications such as ISO/IEC 27001, and entering into data processing agreements (DPAs).
• Our measures: We have reviewed Cloudflare's terms of service and its data processing agreement, and confirmed that personal information is handled in line with the intent of the APPI.

Zoho Corporation (United States) and Stripe, Inc. (United States)

• Country: United States of America
• That country's personal information protection system: As described under Cloudflare.
• Measures taken by the contractors: Both participate in the EU-U.S. Data Privacy Framework and hold certifications such as ISO/IEC 27001. Stripe complies with the highest level of the card industry's security standard (PCI DSS).

Hetzner Online GmbH (Germany and Finland) and netcup GmbH (Germany)

• Country: Germany and Finland (EU member states)
• That country's personal information protection system: The EU has the General Data Protection Regulation (GDPR), and the Personal Information Protection Commission has designated the EU as a region that protects personal information at a level equivalent to Japan.
• Measures taken by the contractors: We have entered into data processing agreements under the GDPR.

7. Retention periods

Information past its retention period is deleted in a way that cannot be recovered.

8. Security measures

We take the following measures to prevent leakage, loss or damage of personal data.

• Basic policy: We have set out this policy to ensure personal data is handled properly.
• Organisational measures: We decide who handles personal data and the scope of information each person can handle. We have procedures for reporting and responding to an actual or suspected leak.
• Personnel measures: Staff who handle personal data are trained in the rules for handling it and are bound by confidentiality.
• Physical measures: Devices used to handle personal data are managed so that third parties cannot view or remove them.
• Technical measures: We use encrypted connections (HTTPS), limit who has access, use two-factor authentication and a password manager, and monitor for unauthorised access. Login details we hold are stored encrypted.
• Understanding the external environment: When we use businesses outside Japan, we take security measures after understanding the system in that country, as described in section 6.

In the unlikely event of a leak of personal data, we will report it to the Personal Information Protection Commission and notify the affected individuals as required by law.

9. Requests for disclosure, correction, suspension of use, etc.

You may make the following requests about personal data we hold about you:

• Notification of the purposes of use
• Disclosure of the content (including disclosure of records of provision to third parties)
• Correction, addition or deletion of the content
• Suspension of use, erasure, or suspension of provision to third parties

Please send requests through the contact form. Once we have confirmed your identity, we will respond without delay in accordance with the law. If the request is made by an agent, we may ask for documents confirming their authority to act for you. We do not charge a fee for requests for notification of the purposes of use or for disclosure.

If we cannot meet a request because of a legal provision, we will tell you why.

10. Contact point

Please send questions or complaints about the handling of personal information to:

• Contact point: HANA Digital (WP Experts) Personal Information Enquiries
• How to contact us:
  Contact form

11. Changes to this policy

We may revise this policy to reflect changes in the law or in our services. If there are significant changes, we will announce them on this site. The revised policy takes effect when it is posted on this site.

Established: 20 October 2026 Last revised: 20 October 2026

HANA Digital