Global Privacy Policy

HR Evolution Inc. (“we” or “HR Evolution”) hereby establishes this Global Privacy Policy (this “Policy”) as follows, with respect to the processing of personal data on “CROSSY GLOBAL,” a platform service of HR Evolution for matching cross-border job seekers with potential employers and their respective related parties (the “Service”).

As used in this Policy, the term “personal data” means any information relating to an identified or identifiable natural person. An identifiable natural person refers to one who can be identified, directly or indirectly, based on a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. The definition of “personal data” shall be in accordance with the applicable data protection and privacy laws (in particular, the definition of “personal data” under the EU and UK General Data Protection Regulation (GDPR)).

In this Policy, Chapter 1 sets forth matters applicable to all data subjects (“Data Subjects”) regardless of the country or area in which they are located, and Chapter 2 and subsequent chapters set forth matters that may be applicable to Data Subjects depending on the country or region in which they are located. In the event of any inconsistency between the provisions of Chapter 1 and those of Chapter 2 or any subsequent chapter, the provisions of Chapter 2 or such subsequent chapter shall prevail. Furthermore, in the event of any inconsistency between this Policy and any other policy or terms of use, this Policy shall prevail.

By clicking the “Agree” button for this Policy, Data Subjects are deemed to have confirmed their full understanding of our policies, practices, and purposes regarding the processing of personal data, and to have agreed to all of the aforementioned personal data processing purposes.

Chapter 1. Matters Applicable to All Data Subjects

1. Data Controller Information

We collect and process personal data of Data Subjects in our capacity as a data controller. For further information about HR Evolution, please refer to the “Company Overview” section of our website (available here in Japanese only).

2. Personal Data We Collect

The types of personal data we collect are as follows:

•
Basic information of job seekers
This information includes full names, phonetic names (furigana), genders, dates of birth, ages, nationalities/regions, countries of residence, postal codes, addresses, email addresses, telephone numbers, profile pictures, information on official identification documents (e.g., passports, residence cards, driver’s licenses), residence statuses, and emergency contact information.
•
Basic information of potential employers and their related parties
This information includes company names, representative names, contact person names, department names, job titles, postal codes, addresses, telephone numbers, email addresses, corporate website URLs, countries/regions, business descriptions, license and approval information, fee-based employment agency license numbers, registered support organization registration numbers, and supervising organization license numbers.
•
Hiring information
This information includes resumes, curricula vitae (CVs), ID photos, self-introduction information, desired job types, desired work locations, desired salaries, educational backgrounds, work experience, certifications, language proficiency, Japanese-Language Proficiency Test (JLPT) results, other language test results, specified skilled worker evaluation test results, health checkup results, interview evaluations, references, residence status information, family registration forms, sending organization information, registered support organization information, supervising organization information, and accepting company information.
•
Status and performance information
This information includes membership registration statuses, identity verification statuses, job application statuses, history and progress, selection statuses (e.g., document screenings, interviews, and job offers), statuses, history and progress of contacts from potential employers, outgoing and incoming message history, service usage history, matching results, placement results, and inquiry history.
•
Payment information
This information includes credit card information, bank account information, billing information, invoice information, payment history, settlement history, refund history, and usage fee information.
•
Online activity history information
This information includes login date and time, access date and time, IP address, cookie information, device information, browser information, operating system (OS) information, browsing history, search history, click history, application history, message usage history, advertisement viewing history, email opening history, location information, and activity history information obtained using cookies and other similar technologies, online identifiers, internet protocol addresses, and other similar identifiers, etc.

The sources of personal data we collect are as follows:

•
Information provided by Data Subjects
This information includes information provided by Data Subjects at the time of their communications with us via entering a form for the Service, or in person, by telephone, email, or any other means.
•
Information we collect or generate
This information includes information concerning Data Subjects that is collected or generated through automated technologies, including cookies, and other interactions in the Service.
•
Information collected from third parties
We may collect personal data of Data Subjects from third-party service providers, sending organizations, registered support organizations, supervising organizations, accepting companies, and other publicly available sources of information.

3. Purposes of Use of Personal Data

The purposes of and legal basis for our processing of personal data are as follows:

Purposes of Use	Legal Basis
•To provide the services forming the Service, such as user registration, identity verification at the time of use, and management of user information	•As required for the performance of agreements, or to take measures at the requests of Data Subjects prior to entering into agreements; and •As required for compliance with legal obligations.
•To contact users as necessary, such as for maintenance and important notices (including for changes to this Policy or the Terms of Service); •To respond to user feedback and inquiries, etc., regarding the Service; •To report the usage status of the Service to users; and •To identify users who have violated the Terms of Service or who attempt to use this Service for fraudulent or improper purposes, and to deny their use of the Service.	•Our legitimate interests (for business operations); and •As required for compliance with legal obligations.
•To provide personal data between job seekers and potential employers, and their related parties, for matching purposes.	•Our legitimate interests (for business operations); and •The relevant Data Subject’s consent (where required by applicable law)
•To improve and enhance the contents of the Service, and to develop new services; and •To request cooperation in surveys and interviews related to the Service, or participation in various events, and report the results, etc. thereof.	•Our legitimate interests (for the development and improvement of services, and for business operations)
•To provide information about materials, new features, updates, campaigns, etc. of the Service, and other services offered by us (including by sending emails, flyers, and other direct mail); and •To investigate and analyze browsing history, usage history, etc. related to our services, and to utilize the results thereof for improving and developing our services and for delivering advertisements.	•Our legitimate interests (for the implementation of marketing activities); and •The relevant Data Subject’s consent (where required by applicable law)

4. Personal Data Retention Period

We retain the personal data of Data Subjects for periods necessary to achieve the purposes for which such personal data was collected. In determining the appropriate retention periods for personal data, we take into consideration the purposes of the processing, the ongoing status of contractual relationships, retention obligations under laws and regulations, the necessity for responding to legal claims, and other relevant circumstances.

5. Disclosure of Personal Data to Third Parties

Personal data of Data Subjects may be provided to third parties in specific situations as specified below:

•
Service providers / Professional advisors
We may disclose the personal data specified in “2. Personal Data We Collect” (such data, the “Personal Data” in this Section 5) to service providers and professional advisors falling under each of the following categories for the purposes of use set forth in “3. Purposes of Use of Personal Data”: (a) Companies providing infrastructure and IT services; (b) Marketing, advertising and communication agencies; and (c) Financial auditors and various advisors.
•
Job seekers and potential employers and their respective related parties
In order to support business matching, we may disclose Personal Data to job seekers and potential employers and their respective related parties (e.g., sending organizations, registered support organizations, supervising organizations, accepting companies).
•
Third parties under laws and regulations
In order to comply with legal or regulatory obligations, we may be required to disclose Personal Data under certain situations (e.g., we may need to disclose Personal Data to the police, regulatory authorities, governmental organizations, or judicial or administrative authorities).
•
Third parties related to business transfers
We may disclose Personal Data to third parties in connection with corporate reorganizations, restructuring measures, mergers, acquisitions, or transfers of assets, as long as the parties to receive any Personal Data agree to handle such Personal Data in accordance with this Policy.
•
Business partners
We may disclose Personal Data to our advertising distribution business partners for the purposes of introducing our products and services, providing campaign information, and conducting other advertising, public relations, and marketing activities.

6. International Transfer of Personal Data

We may be required to transfer the personal data of Data Subjects to jurisdictions outside of the countries/regions in which the Data Subjects reside. Such transfers will be carried out after implementing appropriate safeguards, including confirming adequacy decisions and executing standard contractual clauses, in accordance with applicable laws, regulations and regulatory requirements. To obtain further details regarding the specific mechanisms for the international transfer of personal data, please contact us at the point of contact set forth in Section 8 below.

7. Rights of Data Subjects

Data Subjects shall have the following rights in accordance with applicable laws, regulations and regulatory requirements:

•
Right of access
Data Subjects shall have the right to request confirmation from us as to whether their personal data is being processed, and, where this is the case, to obtain access to such personal data. Data Subjects shall also have the right to obtain a copy of their personal data that is undergoing processing.
•
Right to rectification
Data Subjects shall have the right to request the rectification of any inaccurate or incomplete personal data concerning them that we retain.
•
Right to erasure
Data Subjects shall have the right to request the erasure of their personal data processed by us; provided, however, that we shall not have the obligation to erase personal data where retention is necessary for compliance with any legal obligation or for the establishment, exercise, or defense of any legal claim.
•
Right to restriction of processing
Data Subjects shall have the right to request the restriction of processing in cases where the personal data is inaccurate, unlawfully processed, or no longer necessary for a specific purpose (except where erasure is not possible for legal or other grounds, or the relevant Data Subject does not wish to proceed with such erasure).
•
Right to data portability
Data Subjects shall have the right to receive, in a structured, electronic format, and to transmit to another data controller: (i) their personal data that they have provided us; and (ii) their personal data held by us, in cases where we process the aforementioned data based on their consent or for the performance of an agreement with them.
•
Right to object
In cases where our legitimate interests constitute the legal basis for our processing of personal data, Data Subjects shall have the right to object to such processing based on their specific situations. We will comply with objections from Data Subjects unless we have legitimate grounds for the processing which override the interests and rights of the relevant Data Subject, or unless continuation of processing is necessary for the establishment, exercise or defense of any legal claims.
•
Right to withdraw consent
In cases where Data Subjects have consented to our processing of personal data, they shall have the right to withdraw such consent at any time, free of charge. This includes the right to opt out of receiving marketing communications.
•
Right to lodge a complaint
In cases where Data Subjects consider that we are not complying with applicable data protection laws, they shall have the right to lodge a complaint with the local data protection supervisory authority in accordance with applicable laws and regulations.

To exercise any of the rights listed above, please contact us at the contact point specified in Section 8 below. In order to ensure the privacy and security of Data Subjects, we may request supporting evidence and additional information to verify the identity of Data Subjects. We will make our best efforts to provide the requested information or to implement the requested changes in accordance with applicable laws and regulations.

8. Contact Information

For any feedback, questions, complaints, or other inquiries regarding the processing of personal data, please contact us via the following methods:

•
Our contact information:
Personal Data Inquiry Desk HR Evolution Inc. B1F, Toranomon 3-chome Building 3-1-1 Toranomon, Minato-ku, Tokyo privacy@hr-evolution.jp

9. Procedures for Changing this Policy

We reserve the right to update this Policy from time to time. If we make any changes, additions, or deletions to any part of this Policy, we will post a notice on our website.

This Policy was last updated on July 1, 2026.

Chapter 2. Provisions Applicable to India

With respect to the processing of personal data of Data Subjects located in India, this Chapter 2 shall apply in addition to Chapter 1, pursuant to the provisions of India's personal data protection laws and their related laws and regulations. In the event of any discrepancy between the provisions of Chapter 1 and the provisions of this Chapter 2, the provisions of this Chapter 2 shall prevail.

1. Sharing of Personal Data Without Data Subjects’ Consent

Personal data may be shared, without obtaining the Data Subjects' prior consent, with government agencies having authority under the laws and regulations to obtain personal data, for the purposes of identity verification, or the prevention, detection, investigation, prosecution, and punishment of offences including cyber cases.

Personal data may be disclosed to third parties pursuant to an order under laws and regulations in force at the relevant time.

2. Obligations of Data Subjects as Data Providers

•Data Subjects must comply with all applicable laws and regulations in force at the relevant time when exercising their rights under local laws or this Policy.
•Data Subjects must not impersonate another person when providing personal data or sensitive personal data for a specific purpose.
•Data Subjects must not conceal material information when providing personal data or sensitive personal data for documents, unique identifiers, identity verification documents, or proof-of-address documents.
•Data Subjects must provide only information whose authenticity can be verified, when exercising the right to rectification or erasure.

3. Additional Rights of Data Subjects

•Data Subjects shall have the right to file an appeal and seek remedy in relation to the performance of our obligations under this Policy.
•Data Subjects shall have the right to nominate another individual to exercise their rights under this Policy on the Data Subjects’ behalf in the event of their death or incapacity.
•Data Subjects shall have the right to obtain a summary of the personal data being processed and the processing activities conducted in relation to such personal data.

Chapter 3. Provisions Applicable to Indonesia

With respect to the processing of personal data of Data Subjects located in Indonesia, this Chapter 3 shall apply in addition to Chapter 1, pursuant to the provisions of Indonesia's personal data protection laws and their related laws and regulations. In the event of any discrepancy between the provisions of Chapter 1 and the provisions of this Chapter 3, the provisions of this Chapter 3 shall prevail.

1. Rights of Personal Data Subjects

If Data Subjects are subject to Indonesia's personal data protection laws and their related laws and regulations, Data Subjects have the following rights:

•The right to obtain information regarding the identity, legal basis, purposes, and accountability of the party requesting and using the personal data;
•The right to withdraw consent previously given to us for the processing of personal data. We will cease the processing of the relevant Data Subject’s personal data within 3 x 24 hours;
•The right to supplement, update, and/or rectify errors or inaccuracies in personal data relating to the Personal Data Subjects, in accordance with the purposes of the personal data processing;
•The right to access to and obtain a copy of the Personal Data Subjects’ personal data;
•The right to suspend, erase, and/or destroy the processing of the Personal Data Subjects’ personal data;
•The right to file objection to decisions which produce legal effects concerning the Personal Data Subjects or significantly affect the Personal Data Subjects based on automated processing, including profiling;
•The right to postpone or restrict the processing of personal data in accordance with the purposes of processing the personal data;
•The right to obtain and/or use the Personal Data Subjects’ personal data from the data controller in a structured, commonly used, and machine-readable format;
•The right to cause the Personal Data Subjects’ personal data to be used by, or transferred to, another data controller, provided that the systems used can communicate with each other securely in accordance with the principles of personal data protection; and
•Any other rights granted to Personal Data Subjects under the Indonesian personal data protection law.

Please note that exceptions may apply to Data Subjects' rights. In particular, Data Subjects' rights may be restricted under applicable Indonesian personal data protection laws and regulations in relation to certain interests concerning national defense and security, law enforcement, public interest, supervision of the financial sector, statistics, and scientific research.

2. Data Transfers

We undertake to implement the security measures and safeguards necessary to protect Data Subjects' personal data for international data transfers, in accordance with personal data protection laws and regulations. Before transferring personal data outside Indonesia, we will confirm that the recipient country or international organization has a level of personal data protection that is equivalent to or higher than the level of protection required under Indonesian personal data protection laws and regulations. If such level of protection is not ensured, we will confirm that appropriate and binding personal data protection measures are in place. If these requirements are not satisfied, Data Subjects' prior consent will be required.

3. Retention of Personal Data

Data Subjects' personal data stored on our website and other systems will be retained for a minimum period of five (5) years unless a different retention period is prescribed by specific laws or regulations.

4. Notification Procedures in the Event of a Personal Data Breach

If we fail to protect Data Subjects' personal data and a personal data breach occurs, we will notify the relevant Personal Data Subjects and the competent authority within 3 x 24 hours in accordance with Indonesian personal data protection laws and regulations. In certain circumstances prescribed by Indonesian personal data protection laws and regulations, we may also notify the general public. The notification will include the following matters:

•The personal data that was leaked;
•The date, time, and manner in which the personal data was leaked; and
•The measures taken by us to respond to and recover from the data breach.

5. Children’s Personal Data

In the event that we collect children's personal data, such processing will be conducted appropriately in accordance with applicable laws and regulations, including obtaining the consent of parents and/or guardians, as necessary.

6. Application to Job Seekers

This Policy also applies to job seekers in Indonesia, in addition to individuals already covered by this Policy, such as website visitors, customers, suppliers, shareholders, and business partners. In the recruitment process, we collect, use, retain, and process personal data provided by Data Subjects through application platforms, email, or other means. Such data will be used for the purposes of evaluating Data Subjects' applications, conducting background checks (within the scope permitted by laws), and managing the recruitment process.

By submitting an application, Data Subjects consent to the processing of their personal data for these purposes and for the other purposes set forth in this Policy. Data Subjects also authorize us to request and obtain relevant information from third parties, such as former employers and educational institutions, to verify Data Subjects' qualifications, and such third parties shall be released from liability in this regard to the extent permitted by applicable laws. Data Subjects' data will be retained only for as long as necessary to achieve these purposes or for the period required by the laws and regulations.

Chapter 4. Provisions Applicable to Vietnam

With respect to the processing of personal data of Data Subjects located in Vietnam, this Chapter 4 shall apply in addition to Chapter 1, pursuant to the provisions of the laws and regulations on Vietnam's personal data protection. In the event of any discrepancy between the provisions of Chapter 1 and the provisions of this Chapter 4, the provisions of this Chapter 4 shall prevail.

1. Legal Basis for Processing

We process Data Subjects' personal data based on Data Subjects' consent and in strict compliance with the Personal Data Protection Law No. 91/2025/QH15 of Vietnam and Decree No. 356/2025/ND-CP detailing certain articles of, and measures for implementing, the Personal Data Protection Law.

For certain processing activities (including, without limitation, direct marketing activities), we rely on Data Subjects' consent. In cases where we rely on consent, such consent must be clear, given freely at will, and genuine, and Data Subjects may withdraw such consent at any time. Withdrawal of consent will not affect the legality of the processing of personal data conducted based on the consent Data Subjects had previously given to us.

In addition to cases justified solely by Data Subjects' consent, we are legally permitted to process Data Subjects' personal data without their prior consent in the following cases: (i) where it is necessary to protect Data Subjects' or another person's life, health, honor, dignity, lawful rights, or interests in case of emergency, or to protect, by necessary means, Data Subjects' or another person's legitimate rights or interests, or the interests of the State, an agency, or an organization, from an act of infringement; (ii) where it is necessary to resolve an emergency situation, eliminate a threat to national security (which does not reach the level of a declared state of emergency), prevent or combat riots or terrorism, or prevent or combat crimes or violations of laws and regulations; (iii) where it is necessary to serve the activities of State agencies or State management activities in accordance with the laws and regulations; (iv) where it is necessary to perform an agreement with Data Subjects; or (v) in other cases prescribed by the laws and regulations.

2. Rights of Data Subjects

•
Right to be informed
Data Subjects shall have the right to be informed about the processing of personal data, unless otherwise provided by the laws and regulations.
•
Right to consent
Data Subjects shall have the right to give or withhold consent to the processing of their personal data, except in cases prescribed by the laws and regulations.
•
Right of access
Data Subjects shall have the right to access, correct, or request correction of their personal data unless otherwise provided by the laws and regulations.
•
Right to rectify or request rectification
Data Subjects shall have the right to rectify or request rectification of their personal data unless otherwise provided by the laws and regulations.
•
Right to withdraw consent
Data Subjects shall have the right to withdraw consent unless otherwise provided by the laws and regulations.
•
Right to data erasure
Data Subjects shall have the right to erase or request erasure of their personal data unless otherwise provided by the laws and regulations.
•
Right to restriction of data processing
Data Subjects shall have the right to request restriction of the processing of their personal data unless otherwise provided by the laws and regulations.
•
Right to request provision of data
Data Subjects shall have the right to request that a personal data controller or a personal data controlling or processing subject provide their personal data unless otherwise provided by the laws and regulations.
•
Right to object to data processing
Data Subjects shall have the right to object to the processing of their personal data by a personal data controller or a personal data controlling or processing subject, for the purpose of stopping or restricting the disclosure of personal data, or stopping or restricting the use of personal data for advertising or marketing purposes, unless otherwise provided by the laws and regulations.
•
Right to lodge complaints or accusations, or initiate lawsuits
Data Subjects shall have the right to lodge complaints or accusations, or initiate lawsuits in accordance with the laws and regulations.
•
Right to claim damages
Data Subjects shall have the right to claim damages in accordance with the laws and regulations if a violation of the laws and regulations concerning the protection of their personal data occurs, unless otherwise agreed between the parties or otherwise provided by the laws and regulations.
•
Right to self-defense
Data Subjects shall have the right to take self-defense measures in accordance with the Civil Code or other relevant laws and regulations, or to request a competent agency or organization to take measures to protect civil rights in accordance with Article 11 of the Civil Code.

3. Obligations of Data Subjects

Data Subjects have the following obligations:

•To protect their own personal data;
•To respect and protect the personal data of others;
•To provide their personal data completely and accurately in accordance with laws and regulations, contracts, or their consent to the processing of their personal data; and
•To comply with the laws and regulations concerning personal data protection and participate in the prevention of, and response to, acts that infringe upon personal data.

4. Processing of Sensitive Personal Data

We may process sensitive personal data, including data concerning race or ethnic origin, images of national ID cards, health status, criminal records or violations of the laws and regulations, credit card information, bank account information, payment history, and online activity history information (such as login date and time, access date and time, IP address, Cookie information, device information, browser information, OS information, browsing history, search history, click history, application history, message usage history, advertisement viewing history, email opening history, location information, online identifiers on behavioral history information obtained through Cookies or similar technologies, Internet Protocol addresses, or other similar identifiers).

5. Personal Data of Other Persons Provided by Data Subjects

In certain circumstances, Data Subjects may be required to provide us with personal data of other persons (such as close relatives and/or dependents). Data Subjects are responsible for ensuring that: (i) such other persons (as personal data subjects) have fully understood all matters specified in this Policy and given their full and explicit consent to the processing and transfer of their personal data; and (ii) such Data Subjects are duly authorized to provide such personal data to us and to receive privacy notices and other relevant information on behalf of such other persons (as personal data subjects).

6. Processing of Children’s Personal Data

When we process children's personal data for the purpose of publishing or disclosing information concerning a child's private life or personal secrets, the consent of such child must be obtained if the child is at least seven (7) full years of age, together with the consent of the child's parent or guardian in accordance with the laws and regulations. We will verify the child's age before processing the child's personal data.