Privacy Policy

Who we are

GALULU offers the Heisei GAL Experience, a Heisei-era GAL (gyaru) fashion makeover experience for visitors, in Shinjuku, Tokyo. The business responsible for your personal information under Japan’s Act on the Protection of Personal Information (APPI) is:

• Operator: ROVE LLC (合同会社ROVE)
• Representative: Saki Hoshi (星 紗季), Representative Member
• Address: 3-11-39-6 Mure, Mitaka-shi, Tokyo 181-0002, Japan
• Email: info@galulu.com
• Phone: +81-90-1138-5695 (10:00–21:00 Japan time)

In this policy, “GALULU”, “we”, “us” and “our” mean this operator. This policy covers our website (galulu.com), bookings for the Heisei GAL Experience, your session with us, and any messages you send us.

Information we collect

We collect only what we need to run our website, your booking and your session.

When you visit our website: galulu.com is a simple static website. It has no social media embeds, contact forms or user accounts, and our fonts and images are served from the same server as our pages. It remembers your cookie choice in your browser’s local storage. Each page loads Google Tag Manager, a script from Google that starts our analytics only after you accept. If you accept cookies in our cookie banner, we use Google Analytics, an analytics tool provided by Google, to understand how our website is used (for example the pages you view and the booking buttons and links you use), and the Meta Pixel, an advertising tool provided by Meta, to measure and improve our ads. Both set cookies and send information about your visit to Google or Meta, which may process it in the United States. We do not run Google Analytics or the Meta Pixel unless you accept, and you can change your choice at any time with “Cookie settings” at the bottom of each page. Like any website, the server that delivers our pages automatically receives standard technical information from your browser: your IP address, browser type (user agent), the page you asked for, the page you came from (referrer), and the date and time. Our hosting provider, Xserver (a Japanese hosting company), keeps this information in server access logs. We use these logs only to run and protect the website, and we do not use them for advertising or to build profiles of visitors. See our Cookies Policy for more details.

When you book: we take online bookings through RESERVA, a Japanese online reservation service. When you book, we receive the information you enter in the booking form. Depending on the form, this may include:

• your name
• your contact details, such as your email address and phone number
• your chosen plan, date and time, and the number of guests
• any requests or notes you add to your booking
• your booking history, including payments, changes, cancellations and refunds

If you book for other people (for example, on a Duo, Trio or Quad Plan), please make sure they are happy for you to share their details with us, and point them to this policy.

Payment: all bookings are prepaid online at the time of reservation. Card payments are processed by RESERVA Payment, RESERVA’s own card payment service. We cannot see your full card number. Card details are handled by RESERVA and its payment service.

Information you tell our staff: before or during your session, you may tell us things that help us look after you, such as allergies or skin sensitivities to products used in your makeover, or other health or accessibility needs. Some health-related information may be “special care-required personal information” under APPI, so we ask for your consent before we collect it, and we use it only to provide your session safely. You do not have to share it, but if you do not, we may be less able to adjust the experience for you.

Photos: if your plan includes a photoshoot (such as the Makeover + Photoshoot Plan), we take photos of you during your session. See “Photos from your session” below.

Messages: when you contact us, we receive your message, your name and contact details, and anything else you choose to include.

How we use your information

We use personal information only for these purposes:

• to take, confirm, manage and change your booking
• to process payments, rescheduling, cancellations and refunds under our Cancellation & Rescheduling Policy (refunds are made to the credit card used for your booking)
• to contact you about your session, for example to send the exact meeting location to confirmed guests, or to tell you about severe weather, transport disruption or a cancellation by GALULU
• to provide your makeover and, if included, your photoshoot safely and comfortably, taking account of any allergies or needs you tell us about
• to deliver your photos to you, if your plan includes them
• to answer your questions and handle requests and complaints
• to run, maintain and protect our website, including detecting and preventing misuse
• to keep tax and accounting records and meet our other legal obligations
• to use photos of you for marketing, and to send you news or offers, only if you have given your consent
• if you accept cookies on our website, to understand how our website is used with Google Analytics, and to measure and improve our advertising with the Meta Pixel (see our Cookies Policy)

We will not use your information for any other purpose without your consent, unless the law allows it. We do not sell your information, and we do not use it for automated decision-making. Apart from the Meta Pixel, which runs only if you accept it and lets Meta use information about your visit to measure and improve our ads (see our Cookies Policy), we do not use your information for profiling.

Consent and legal basis

Under APPI, we use your personal information only for the purposes listed in this policy. We ask for your consent where the law requires it, for example before we collect health information that counts as special care-required personal information, or before we share your information with third parties other than as described in “Who we share your information with”. We also ask for your consent wherever this policy says we will, such as before we use your photos for marketing or send you marketing messages.

If the data protection law of another country applies to us and requires a “legal basis” for using personal information (for example, the EU GDPR or the UK GDPR), we rely on:

• Contract: to take and manage your booking and provide your session.
• Consent: for health-related information, marketing use of photos, marketing messages, and Google Analytics and the Meta Pixel on our website. You can withdraw your consent at any time.
• Legitimate interests: to keep our website running and secure, and to answer your enquiries.
• Legal obligation: to keep tax and accounting records and to respond to lawful requests from authorities.

You do not have to give us personal information, but we cannot take a booking without your name, contact details and payment.

Photos from your session

Photos in which you can be identified are your personal information, and we treat them with care.

• Delivery: we send your photos as a Google Drive download link by email: original photos within about 1 week, and retouched photos within about 2 weeks after you choose them.
• Storage: we keep your photos for 30 days after we deliver them, so that you have time to download them and we can help if you have trouble receiving them. After that, we delete them, unless you have agreed that we may use them for marketing.
• Marketing: we will not use photos in which you can be identified on our website, on social media (such as Instagram or TikTok) or in advertising unless you give us separate, explicit consent. At your session, you can choose on the consent form whether we may use your photos on our website, social media and advertising. Saying no will not affect your booking or your session.
• Changing your mind: you can withdraw your consent at any time by contacting us. We will then promptly stop using those photos in new materials and remove them from our website and our own social media accounts. We cannot recall copies that others have already shared or downloaded.
• Group photos: we will use a photo that shows more than one guest for marketing only if everyone who can be identified in it has agreed.

Who we share your information with

We do not sell your personal information or share it with others for their own marketing. We share it only as described here.

Service providers:

• RESERVA, our online reservation service, which processes and stores booking information
• RESERVA Payment, RESERVA’s own card payment service, which processes payments and refunds
• Xserver, our website hosting provider, which receives technical request data and keeps server access logs
• Google, which we use for email, to deliver your photos (Google Drive), and for Google Tag Manager and, if you accept it, Google Analytics on our website
• Meta, for our Instagram and Facebook accounts and the messages you send us there

Where these providers handle your information on our behalf, we choose them carefully, allow them to use it only to provide their services to us, and supervise them as APPI requires. Some providers, such as payment companies, may also handle information under their own privacy policies, for example to prevent fraud.

We may also share your information:

• with the people who deliver your session for us, such as stylists and photographers, only as far as they need it
• when the law requires it, for example in response to a lawful request from a court, the police or another public authority
• when it is needed to protect someone’s life, health or property and it is difficult to get your consent
• if our business is merged, sold or transferred, with the new operator, who may use it only for the purposes in this policy
• with Google, through Google Analytics on our website, only if you accept it in our cookie banner (see our Cookies Policy)
• with Meta, through the Meta Pixel on our website, only if you accept it in our cookie banner (see our Cookies Policy)
• with anyone else, only with your consent

International transfers

GALULU is based in Japan, and we handle your personal information in Japan. If you live outside Japan, your information will be transferred to Japan when you book or contact us. Japan’s data protection law (APPI) may differ from the law in your country, but we protect your information as described in this policy.

Some of our service providers may store or process information outside Japan: Google (email, photo delivery, Google Tag Manager and Google Analytics) and Meta (Instagram, Facebook and the Meta Pixel) may store or process it in the United States and other countries. When we provide personal information to a third party in another country, we do so only as APPI permits, for example with your consent after telling you about that country’s data protection system, or where the recipient has put in place protections that meet APPI standards.

How long we keep your information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the law requires. After that, we delete it securely or make it anonymous.

• Booking, payment and refund records: 7 years, as required by Japanese tax law.
• Allergy and other health information: only as long as needed for your session, and no longer than 30 days after your session.
• Photos: 30 days after delivery, unless you have agreed to let us use them for marketing (see “Photos from your session”).
• Messages and enquiries: 1 year.
• Website server logs: kept by Xserver for 30 days (access logs) and 7 days (error logs).
• Google Analytics (only if you accept cookies): detailed information about your visits for 14 months (see our Cookies Policy).

How we protect your information

We take reasonable organizational, human, physical and technical steps to protect your personal information against loss, misuse, unauthorized access, alteration and leaks. These include:

• limiting access to the people who need it to manage your booking or run your session
• requiring our staff and the people who work with us to keep personal information confidential, and training them on how to handle it
• keeping devices and any paper records secure to prevent loss or theft
• using access-controlled accounts for our booking system and other tools, and keeping devices and software up to date
• choosing service providers that protect personal information, and supervising how they handle it
• checking the data protection rules of any country outside Japan where personal information is stored

If you would like more detail about these measures, contact us and we will reply without undue delay, except where sharing a detail would put security at risk.

No system is completely secure. If a data breach happens that could harm you, we will act promptly and, where the law requires, report it to Japan’s Personal Information Protection Commission and let you know.

Your rights

Under APPI, you can ask us to:

• tell you the purposes for which we use your personal information
• disclose the personal information we hold about you (you can ask for an electronic copy), and records of any sharing with third parties
• correct, add to or delete information that is wrong
• stop using or delete your information, for example if we use it beyond the purposes in this policy, obtained it improperly or no longer need it, if it was affected by a data breach we must report, or if its use could harm your rights or legitimate interests
• stop sharing it with third parties, where the law allows

Depending on where you live, you may also have rights under your own country’s laws, such as the right to object to certain uses or to receive a copy of your data in a portable format. We will respect those rights where they apply to us.

How to make a request: email us at info@galulu.com with your name, your booking details (if you have booked) and what you would like us to do. Someone you authorize, or the parent or guardian of a minor, can also make a request for you. We may ask you to confirm your identity, or ask for proof that a representative can act for you, before we act. We do not charge for requests, and we will reply without undue delay. If we cannot do what you ask, we will explain why.

You can withdraw any consent you have given, for example for photo use or marketing messages, at any time. This does not affect anything we did before you withdrew it.

If you have a concern, please contact us first so we can try to put it right. You can also contact Japan’s Personal Information Protection Commission or the data protection authority in your country.

Children

Any age requirements for taking part are set out in our Terms of Service. For guests under 18, a parent or guardian should make the booking, share any health information on the child’s behalf, and agree to how we handle the child’s information.

We will not use photos of guests under 18 for marketing unless a parent or guardian has given explicit consent. If you think we have collected a child’s information without proper consent, contact us and we will delete it, unless the law requires us to keep it.

Links to other services

Our website may link to other services, such as the RESERVA booking pages and our Instagram and TikTok accounts (@galulu.tokyo). When you follow these links, you leave our website, and those services’ own terms, privacy policies and cookie policies apply. They may use cookies and collect information about you independently of us.

The booking information you give us through RESERVA is handled as described in this policy. Apart from that, we do not control how these services handle your information, so please read their policies. If you message us through Instagram or TikTok, we may see the information they make available to us, such as your profile name and your messages, and we handle that information under this policy.

Changes to this policy

We may update this policy from time to time, for example if we start using new tools on our website or change how we take bookings. We will post the updated version on this page with a new effective date.

If a change is significant, such as using your information for a new purpose, we will tell you in advance and ask for your consent where the law requires it.

Contact us

For questions about this policy, to make a request about your personal information, or to raise a complaint, contact:

• ROVE LLC (合同会社ROVE)
• Address: 3-11-39-6 Mure, Mitaka-shi, Tokyo 181-0002, Japan
• Email: info@galulu.com
• Phone: +81-90-1138-5695 (10:00–21:00 Japan time)
• Instagram and TikTok: @galulu.tokyo

Please do not send card numbers or other payment details by email. See also our Terms of Service, Cookies Policy and Cancellation & Rescheduling Policy.