In accordance with the Act on the Protection of Personal Information (Act No. 57 of 2003, as amended), and the guidelines of the Personal Information Protection Commission of Japan.

1.  Our Commitment to Data Protection  |  基本方針

Epsom College Tokyo (‘the College’), recognises that the personal data of our students, families, prospective families, staff, and website visitors is of the utmost importance and deserves the highest standard of care.

The College is committed to handling all personal information responsibly, transparently, and in full compliance with:

• The Act on the Protection of Personal Information (Act No. 57 of 2003, as amended; ‘APPI’)
• All guidelines and instructions issued by the Personal Information Protection Commission of Japan (‘PPC’)
• Any other applicable laws and regulations of Japan

The Japanese-language version of this policy is the authoritative text for regulatory purposes.

2.  Personal Information We Collect  |  収集する個人情報

The College collects personal information and sensitive personal data (as defined under applicable Japanese data protection law) from the following individuals:

• Students
• Parents and guardians
• Individuals appointed by parents or guardians in relation to the wellbeing or needs of a student
• Prospective families making enquiries or registering for events
• Staff and applicants for employment
• Website visitors

The categories of personal information collected include, but are not limited to:

• Full name, date of birth, and nationality
• Home address and contact details (telephone number, email address)
• Passport or identification details and immigration status
• Academic records, assessment results, and educational background
• Health and medical information, including physical and mental health data
• Religion and ethnicity (where required for pastoral, dietary, or safeguarding purposes)
• Financial information relevant to fee payment and applications
• Emergency contact and next-of-kin details
• CCTV footage, photographs, and video recordings taken on campus
• Website usage data (IP address, browser type, pages visited, cookies)

3.  Purpose of Use  |  利用目的

APPI Article 17 — Specification of Purpose of Use

The College processes personal information only for the following specified purposes. We will not use personal information beyond the scope of these purposes without first obtaining the individual’s consent, except where permitted by law.

3.1  Educational, Pastoral, and Safeguarding Purposes

• Administration of the admissions process, including assessment and selection
• Provision of educational programmes, curriculum delivery, and academic progression
• Pastoral care, student wellbeing, and safeguarding of students
• Medical and health management, including liaising with healthcare professionals
• Communication with parents and guardians regarding student progress and welfare
• Management of student records, reports, and references
• Secondary school application support

3.2  Operational and Administrative Purposes

• Fee collection, financial administration, and scholarship management
• School events, open days, founding families seminars, and school tours
• Staff recruitment, employment management, and training
• Security and access management, including CCTV monitoring
• Compliance with legal, regulatory, and reporting obligations
• School promotion and communications, including newsletters, the College website, social media, and marketing materials

3.3  Prospective Families and Website Visitors

• Responding to enquiries submitted through the website or by email or telephone
• Sending information about Epsom College Tokyo, upcoming events, and the admissions process
• Analysing website usage data to improve the performance and user experience of the College website

4.  Lawful Basis for Processing  |  個人情報の取扱いについて

Under the APPI, the College processes personal information on the following bases:

• Consent of the data subject (principally for prospective families, marketing communications, and the use of images)
• Performance of a contract or pre-contractual steps, including enrolment and educational service delivery
• Compliance with a legal obligation
• Protection of the vital interests of an individual (including safeguarding and medical emergencies)
• Legitimate interests of the College in operating and promoting a high-quality educational institution, where these do not override the rights of individuals

5.  Disclosure to Third Parties  |  第三者への提供

APPI Article 27 — Restrictions on Third-Party Provision

• The College will not provide personal information to any third party without the prior consent of the individual concerned, except in the following circumstances:
• Where required by law, regulation, or court order
• Where necessary to protect the life, body, or property of an individual and obtaining consent is not practicable
• Where necessary to support public health or the sound development of children
• Where necessary to cooperate with a national or local government body in the execution of statutory duties

The College may share personal data with the following categories of third parties for the purposes set out in Section 3:

• Educ8 Group (the entity and holding company)
• Epsom College UK (the partner and awarding institution)
• Epsom College Malaysia (the sister institution and affiliated campus)
• Examination boards, including Cambridge Assessment International Education and other awarding bodies
• Secondary schools, and educational institutions to which students apply
• Healthcare professionals, medical providers, and emergency services
• Regulatory authorities and government agencies, including the Ministry of Education, Culture, Sports, Science and Technology (MEXT)
• Approved third-party service providers (IT systems, cloud services, printing, translation) who are contractually bound to maintain equivalent data protection standards

The College will not sell personal information to third parties, nor will it share personal information for third-party marketing purposes without explicit consent.

6.  Cross-Border Transfer of Personal Data  |  海外への個人情報の提供

APPI Article 28 — Cross-Border Third-Party Provision

Personal data collected by the College may be transferred to and processed in the following countries as part of the College’s operational infrastructure:

Neither Malaysia nor the United Kingdom is currently designated by the PPC as a country with equivalent personal data protection. Accordingly, by submitting personal information to the College, individuals are providing their consent to the cross-border transfer of their data on the basis described above, after having been informed of the personal information protection systems applicable in those countries.

The College ensures that contractual safeguards are in place with all overseas recipients to ensure personal data is protected to a standard equivalent to APPI requirements. The College also monitors ongoing compliance by overseas recipients and will, upon request, provide information on the safeguards in place.

7.  Security Management Measures  |  安全管理措置

APPI Article 23 — Duty to Implement Security Control Measures

The College implements appropriate technical, organisational, and physical security measures to protect personal information from unauthorised access, disclosure, loss, destruction, alteration, or leakage. These measures include:

• Restriction of access to personal data to authorised staff only, on a need-to-know basis
• Use of secure, password-protected computer systems and encrypted storage
• Use of reputable and secure cloud-based systems and backup services for operational continuity
• Storage of physical documents containing personal data in secured, access-controlled areas
• Regular review and assessment of security measures
• Training of all staff in their obligations under APPI and the College’s data protection procedures
• Appropriate supervision of third-party service providers handling personal data on behalf of the College

In the event of a personal data breach that is likely to result in a risk to the rights and interests of individuals, the College will notify the Personal Information Protection Commission and, where required, the affected individuals, without undue delay and in accordance with APPI requirements.

8.  Use of Images and Audio-Visual Material  |  写真・動画の利用

When promoting and celebrating the life of the College, Epsom College Tokyo may use photographs, video recordings, and other images of students and staff in the following materials and channels:

• The College website (epsomcollegetokyo.jp)
• Newsletters, publications, and prospectuses
• Admissions and marketing materials
• Event programmes, brochures, and presentations
• Social media platforms (Instagram, Facebook, LinkedIn, YouTube)
• Press and media communications
• Promotional video content, including the College’s animated introductory film

The College will endeavour to ensure that no personal residential address or sensitive personal information is disclosed alongside images. The College will take reasonable care to ensure that all images used are appropriate, respectful, and used in a manner that reduces the risk of misuse by third parties.

Consent for the use of images is obtained from parents and guardians at the point of enrolment, as part of the Acceptance Form to the Letter of Offer. Parents and guardians who wish to withdraw or amend their consent at any time should contact the Admissions team.

9.  Cookies and Website Data  |  Cookieとウェブサイトデータ

The College’s website uses cookies and similar technologies to improve the browsing experience and to understand how visitors use the site. Cookies are small text files stored on your device that allow the website to recognise and remember your visit.

9.1  Types of Cookies Used

• Essential cookies — necessary for the website to function and cannot be disabled
• Analytics cookies — used to understand how visitors interact with the website (e.g. Google Analytics)
• Marketing cookies — used to display relevant content and measure the effectiveness of marketing campaigns

Where cookies involve the collection or processing of personal information, the College will seek your consent prior to their use. You may withdraw consent or manage your cookie preferences at any time through your browser settings or the cookie preference centre on the website.

10.  Retention of Personal Data  |  個人情報の保存期間

The College will retain personal information only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law or regulation. Upon the expiry of the retention period, the College will take reasonable steps to ensure that personal data is securely destroyed, permanently deleted, or anonymised.

Indicative retention periods:

• Prospective families (enquiries only): up to 3 years from last contact, or until a formal application is received
• Enrolled students: for the duration of enrolment and for up to 7 years thereafter (or as required by applicable law)
• Financial records: as required by Japanese tax and accounting law
• Staff records: for the duration of employment and up to 7 years thereafter
• CCTV footage: typically 30 days unless required for an ongoing incident or investigation

11.  Rights of Individuals  |  開示等のご請求について

APPI Articles 33–35 — Rights of Data Subjects

In accordance with the APPI, individuals have the right to make the following requests in relation to personal information held by the College:

• Disclosure — to be informed of the personal information held and the purposes for which it is used
• Correction, addition, or deletion — to request that inaccurate or incomplete data is corrected
• Cessation of use — to request that the College ceases to use personal data where it is not being used in accordance with the stated purpose, or where it has been unlawfully acquired
• Cessation of third-party provision — to request that the College ceases to provide personal data to third parties where this is not in accordance with APPI

All requests must be made in writing to the contact set out in Section 13, together with sufficient information to verify the identity of the requester. The College will respond without undue delay. In limited circumstances, a reasonable administrative fee may be charged for disclosure requests in accordance with the APPI.

The College may decline a request in certain circumstances permitted by law, and will provide a written explanation in such cases.

12.  Consent and Enrolment  |  個人情報の利用に関する同意

The College obtains consent for the collection, retention, use, disclosure, and processing of personal data from the point of enquiry or application. Consent from enrolled families is confirmed upon signing the Acceptance Form to the Letter of Offer.

For specific processing activities requiring explicit consent under APPI — including the use of sensitive personal data, cross-border data transfer, and the use of images in promotional materials — the College will seek separate and specific consent.

Parents and guardians are responsible for ensuring that the personal information provided to the College remains accurate and up to date. Any changes should be notified to the relevant school contact promptly.

13.  Contact for Personal Information Enquiries  |  個人情報に関するお問い合わせ窓口

For any enquiries, requests, or complaints relating to the handling of personal information, please contact:

Personal Information Enquiries  /  個人情報に関するお問い合わせ

Epsom College Tokyo — Admissions & Administration

エプソムカレッジ東京 — 入学担当・管理部門

Address:  2-13-9 Uchikanda, Chiyoda-ku, Tokyo, 101-8525, Japan

Email:    admissions@epsomcollegetokyo.jp

Tel:      +81 80-3368-0300

Office hours:  Monday–Friday, 08:30–17:00 (JST)

               Excluding Japanese public holidays and school holiday periods

The College will acknowledge all personal information requests within five working days and will endeavour to respond in full within 30 days. Where a request is particularly complex or extensive, the College will notify the requester of the expected response timeline.

14.  Complaints  |  苦情・ご相談

If you believe that the College has not handled your personal information in accordance with this policy or with the requirements of APPI, you are encouraged to contact the College in the first instance using the details in Section 13.

You also have the right to raise a concern or complaint directly with the Personal Information Protection Commission of Japan:

Personal Information Protection Commission (PPC)  /  個人情報保護委員会

Website:  https://www.ppc.go.jp/en/

Tel:      +81-3-6457-9849

Address:  3-2-1 Kasumigaseki, Chiyoda-ku, Tokyo 100-0013, Japan

15.  Links to External Websites and Third-Party Services  |  外部サイトへのリンク

The College’s website may contain links to external websites and third-party services (including social media platforms). The College is not responsible for the privacy practices of those third parties. We encourage visitors to read the privacy policies of any external sites they visit.

16.  Review and Updates  |  本方針の改定

This Privacy Policy will be reviewed and updated periodically to reflect changes in our data handling practices, applicable law (including any amendments to APPI), or operational requirements. The current version will always be published on the College website.

Material changes that affect how the College processes personal data will be communicated to affected individuals directly and/or by notice on the College website.

This policy was last reviewed and updated in May 2026.