Privacy Policy
Last updated: 20 July 2026
This policy explains how Penrose Japan Ltd collects, uses, and protects personal data when you use this website or contact us. It is written to meet our obligations under the UK GDPR and the Privacy and Electronic Communications Regulations (PECR).
Who we are (the controller)
The data controller is Penrose Japan Ltd, a company registered in England and Wales (Company No. 14875423), registered office 86-90 Paul Street, London EC2A 4NE, United Kingdom. For any privacy question or to exercise your rights, contact us at info@penrose-japan.co.uk.
What we collect
We collect only what you give us and the minimal technical data our hosting produces:
- Public-notes subscription form: your email address, so we can send the notes and announcements you ask for.
- Contact and enquiry channel: your name, email address, firm, and any message you send us — whether through the enquiry form or by emailing us directly.
- Technical data: basic information such as your IP address and browser type, recorded in standard server logs by our hosting provider.
Why we use it, and our lawful basis
- To send the publications and announcements you have subscribed to — lawful basis: your consent (Art. 6(1)(a)). You can withdraw it at any time using the unsubscribe link in any email or by contacting us.
- To respond to your enquiries and provide research and advisory services — lawful basis: our legitimate interests in responding to people who contact us, and, where we work together, the performance of a contract (Art. 6(1)(f) and 6(1)(b)).
- To keep the website secure and operational — lawful basis: our legitimate interests in running a safe service.
Who we share it with
We do not sell your data. We share it only with service providers who process it on our behalf, under contract and on our instructions:
- Resend — email delivery, to send confirmation and subscription emails.
- Supabase — database and authentication, to store subscriber and enquiry records and to sign clients in.
- Vercel — website hosting, which produces the standard server logs described above.
Some of these providers may store or process data outside the UK. Where that happens, the transfer is protected by appropriate safeguards, such as the UK’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep it
We keep subscription data until you unsubscribe, after which we remove you from the list. We keep enquiry and client data for as long as we need it to handle the relationship, plus any period required by law (for example, tax and accounting records). Server logs are kept only for the short period our hosting provider retains them.
Your rights
Under UK data protection law you have the right to access, rectify, or erase your data; to restrict or object to our processing; to data portability; and to withdraw consent at any time. To exercise any of these, email info@penrose-japan.co.uk. If you are unhappy with how we handle your data, you can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
Cookies
This website uses only strictly necessary cookies. If you sign in to the client portal or the admin area, our authentication provider (Supabase) sets session cookies that keep you signed in. The public pages set no analytics, advertising, or tracking cookies, and we do not use third-party analytics.
Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last changed.