Who We Are
RubiLabs Inc ("RubiLabs", "we", "us", or "our") is a financial crime intelligence company incorporated in Japan. We operate the Lapis compliance intelligence platform and related services (collectively, the "Services").
Our registered address is in Tokyo, Japan. We are the data controller for personal data collected through our website and Services.
If you have any questions about this Privacy Policy or our data practices, please contact us at privacy@rubilabs.io.
Scope of This Policy
This Privacy Policy applies to personal data we collect when you:
β’ Visit our website at rubilabs.io β’ Submit an enquiry or contact form β’ Use or evaluate the Lapis platform β’ Subscribe to our research publications or newsletters β’ Attend events or webinars hosted by RubiLabs
This Policy does not apply to data processed by our customers through the Lapis platform on behalf of their own clients. Our customers are independent data controllers for that data, and their own privacy policies govern its use.
What Personal Data We Collect
We collect the following categories of personal data:
Identity and contact data β name, job title, institutional affiliation, work email address, telephone number, and country of operation.
Enquiry and correspondence data β the content of messages submitted through our contact form, including the nature of your enquiry, your institution type, and any free-text information you choose to provide.
Usage and technical data β IP address, browser type and version, operating system, referral source, pages visited, and interaction events on our website. This data is collected through analytics tools and is primarily used in aggregated, pseudonymised form.
Communications data β records of your consent preferences, email open and click events (where applicable), and opt-in records for our research or marketing communications.
We do not knowingly collect sensitive personal data (such as health data, political opinions, or financial account numbers) through our website or contact forms.
Legal Basis for Processing (GDPR)
Where the General Data Protection Regulation (EU) 2016/679 ("GDPR") or the UK GDPR applies to our processing of your personal data, we rely on the following legal bases:
Legitimate interests (Article 6(1)(f)) β We process identity, contact, and enquiry data to respond to your enquiries, to assess potential commercial relationships, and to understand how our website is used. We have carried out legitimate interests assessments where required.
Contractual necessity (Article 6(1)(b)) β Where you enter into a contract with us for the provision of Services, we process your data as necessary to perform that contract.
Consent (Article 6(1)(a)) β Where we send marketing communications or research publications, we rely on your freely given, specific, and informed consent. You may withdraw consent at any time by contacting us or using the unsubscribe mechanism in any communication.
Legal obligation (Article 6(1)(c)) β We may process personal data where necessary to comply with applicable law, including anti-money laundering obligations, tax law, and regulatory requirements in Japan and other relevant jurisdictions.
You have the right to object to processing based on legitimate interests. Please see Section 9 for details of your rights.
Data Sovereignty and Cross-Border Transfers
RubiLabs is headquartered in Japan and operates primarily within the Asia-Pacific region. We take data sovereignty seriously and apply the following principles to all cross-border transfers of personal data:
Primary storage β Personal data submitted through our website and Services is stored on infrastructure located in Japan and/or Singapore. We do not routinely transfer personal data to jurisdictions without an adequate level of data protection.
Transfers to the EEA or UK β Where we receive personal data from individuals located in the European Economic Area ("EEA") or the United Kingdom, we rely on the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419) as the legal mechanism for data transfers from the EEA to Japan. For transfers involving data processed in other jurisdictions, we use Standard Contractual Clauses ("SCCs") as approved by the European Commission, or the International Data Transfer Agreement ("IDTA") for UK transfers.
Subprocessors β We engage a limited number of third-party subprocessors (including cloud infrastructure providers and analytics tools). Where these subprocessors are located outside Japan or the EEA, we ensure appropriate transfer mechanisms are in place and conduct due diligence on their security and privacy practices. A current list of subprocessors is available upon request.
Government access requests β We do not voluntarily disclose personal data to any government authority unless required to do so by applicable law. Where a disclosure request is received, we will, to the extent permitted by law, notify affected individuals before complying.
How We Use Your Personal Data
We use the personal data we collect for the following purposes:
β’ To respond to your enquiries and manage our relationship with you β’ To assess the suitability of our Services for your institution's compliance requirements β’ To provide, maintain, and improve the Lapis platform and related Services β’ To send you research publications, product updates, and event invitations, where you have given consent or where we have a legitimate interest β’ To comply with legal and regulatory obligations applicable to us in Japan and other relevant jurisdictions β’ To detect, prevent, and respond to fraud, security incidents, and misuse of our Services β’ To conduct internal analytics and improve our website and user experience
How We Share Personal Data
We do not sell personal data. We share personal data only in the following circumstances:
Service providers β We share data with trusted third-party service providers who assist us in operating our website and Services (including cloud infrastructure, email delivery, and analytics). All service providers are bound by contractual obligations to process data only on our instructions and to maintain appropriate security standards.
Corporate transactions β In the event of a merger, acquisition, or sale of assets, personal data may be transferred to the acquiring entity, subject to the same protections described in this Policy.
Legal requirements β We may disclose personal data where required by law, court order, or regulatory authority, or where we believe disclosure is necessary to protect the rights, property, or safety of RubiLabs, our customers, or the public.
Professional advisors β We may share data with lawyers, accountants, auditors, and insurers where necessary in the course of professional services they provide to us, under duties of confidentiality.
We do not share personal data with third parties for their own marketing purposes.
Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law.
Enquiry and contact data β Retained for up to 3 years from the date of last contact, or longer where a commercial relationship is established.
Contractual data β Retained for the duration of the contract and for a period of 7 years thereafter, in accordance with Japanese commercial law and applicable tax regulations.
Analytics and technical data β Retained in identifiable form for up to 13 months, after which it is aggregated or deleted.
Marketing and communications data β Retained until you withdraw consent or opt out, after which we will suppress your data rather than delete it, to ensure we honour your preferences.
Where we are required by law to retain data for longer periods (for example, under anti-money laundering regulations), we will retain data for the legally required duration.
Your Rights
Depending on your location, you may have the following rights in relation to your personal data:
Right of access β You may request a copy of the personal data we hold about you.
Right to rectification β You may request correction of inaccurate or incomplete data.
Right to erasure β You may request deletion of your personal data in certain circumstances (the "right to be forgotten").
Right to restriction β You may request that we restrict processing of your data in certain circumstances.
Right to data portability β You may request that we provide your data in a structured, machine-readable format.
Right to object β You may object to processing based on legitimate interests or for direct marketing purposes. Where you object to direct marketing, we will stop processing immediately.
Rights related to automated decision-making β We do not make solely automated decisions that produce legal or similarly significant effects.
GDPR and UK GDPR rights β If you are located in the EEA or the UK, all of the above rights apply to you under the GDPR and UK GDPR respectively.
APPI rights β If you are located in Japan, you have equivalent rights under the Act on the Protection of Personal Information (APPI), including the right to request disclosure, correction, and cessation of use of your personal information.
To exercise any of these rights, please contact us at privacy@rubilabs.io. We will respond within 30 days. We may need to verify your identity before processing your request. You also have the right to lodge a complaint with a supervisory authority β in Japan, the Personal Information Protection Commission (PPC); in the EEA, the relevant data protection authority in your member state; in the UK, the Information Commissioner's Office (ICO).
Cookies and Tracking Technologies
Our website uses cookies and similar tracking technologies. We use:
Strictly necessary cookies β Required for the website to function. These cannot be disabled.
Analytics cookies β Used to understand how visitors interact with our website. We use pseudonymised data only, and analytics are processed in aggregate. You may opt out of analytics cookies through our cookie preference centre or by enabling "Do Not Track" in your browser.
We do not use advertising or profiling cookies.
A full list of cookies used on our website is available in our Cookie Policy.
Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, and destruction. These measures include:
β’ Encryption of data in transit (TLS 1.2+) and at rest (AES-256) β’ Role-based access controls and least-privilege principles β’ Regular security assessments and penetration testing β’ Incident response procedures and data breach notification processes in accordance with applicable law
No method of transmission over the internet is completely secure. While we take all reasonable precautions, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by applicable law.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, Services, or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or a prominent notice on our website.
We encourage you to review this Policy periodically. Your continued use of our website or Services after any changes constitutes acceptance of the updated Policy.
Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:
RubiLabs Inc Privacy Office Tokyo, Japan privacy@rubilabs.io
For GDPR-related enquiries from individuals in the EEA, you may also contact our EU representative at the above address, marked for the attention of "GDPR Enquiry".