Privacy & Data Protection Notice

This notice explains how Tokyo Consulting Firm Limited ("the Company", "we") handles personal data in Kizuna, its Order-to-Cash (O2C) platform — an internal business system used to manage quotations, orders, production, invoicing, payments, agreements, clients and employees.

For questions or to exercise your rights, contact the Company's data-protection contact at privacy@tokyoconsultinggroup.com.

• Clients — company details, contact persons, addresses, and identifiers such as passport / National ID where they appear on agreements.
• Employees — the internal staff directory and related employment records.
• System users — the login accounts of staff who use the platform (name, email, role).

The platform is not open to the general public and does not collect data from public website visitors.

• Client data — to prepare and deliver the services agreed with the client. Legal basis: performance of a contract.
• Employee data — to administer employment, payroll-related records and statutory registers. Legal basis: the employment relationship, legal obligations and labour/social-security requirements.
• Operational records — to run and secure the platform (orders, invoices, access logs). Legal basis: legitimate business interest and legal obligation.

We do not rely on consent for these purposes. Where any processing is optional, we ask for consent separately and you may withdraw it at any time.

We keep personal data only for as long as needed for the purpose above and to meet statutory record-keeping periods (for example, labour and tax records). We also maintain a register of processing activities as required by law. After the retention period, data is deleted or anonymised.

• Access requires a personal login; roles restrict who can see and change each type of data (least privilege).
• Passwords are stored only as one-way cryptographic hashes; data is encrypted in transit (HTTPS) and at rest.
• Access to sensitive records is limited and reviewed; we keep records of processing to support accountability and breach response.

The platform runs on secure managed cloud infrastructure that may be located outside Bangladesh. Where personal data is transferred abroad, we do so under the contract with the data subject or an equivalent lawful basis, to providers that apply appropriate technical safeguards, and in line with applicable cross-border transfer rules.

Subject to law, you may:

• Ask what personal data we hold about you and request a copy.
• Ask us to correct data that is wrong or incomplete.
• Ask us to delete data we no longer need to keep.
• Object to, or ask us to restrict, certain processing — including automated evaluation of performance.
• Withdraw any consent you have given, without affecting past processing.

To exercise a right, write to privacy@tokyoconsultinggroup.com. We will respond within the period the law allows and, where we correct data, inform others concerned within 30 days.

The platform uses only a single strictly-necessary session cookie to keep you signed in. It is not used for advertising or tracking, so no cookie consent banner is required.

The platform is a workplace tool intended for adults. Where data about a person under 18 is processed, it is handled under the applicable parental-consent and protection rules.

If you believe your data has been mishandled, contact us first so we can put it right. You also have the right to complain to the competent data-protection authority in Bangladesh.

We may update this notice as the law and our processing evolve. Material changes affecting how we use your data will be communicated, and where a new purpose requires it, we will seek fresh consent.