Peraichi

A Peraichi page sets a session cookie and a CSRF token cookie when the visitor interacts with a form. Additional cookies appear if the page owner enables Google Analytics, ad pixels or other marketing tags, in which case the cookies of these tags also become part of the page.

Peraichi sets peraichi_session (session, strictly necessary) and peraichi_ga (basic analytics, requires consent). Any embedded third-party tag (GA4, Meta Pixel, LINE Tag) sets its own cookies separately and requires its own consent and disclosure.

Consent is not required for the strictly necessary session and CSRF cookies. Consent is required for the optional analytics or marketing tags that the page owner adds, and the operator must inform visitors about the form data processing and the transfer of data to Japan.

You do not need consent for the strictly necessary session cookie. The built-in analytics cookie and any embedded third-party trackers require prior consent under Art. 5(3) ePrivacy. Block third-party tags behind a CMP until the visitor accepts.

Hosting and basic visit counting rely on legitimate interest under Article 6(1)(f) GDPR. Form data processing relies on the lawful basis chosen by the operator (consent, contract or legal obligation). Analytics and marketing tags rely on consent under Article 6(1)(a) GDPR.

If the form supports a service the visitor explicitly requested (e.g. a contact form, demo request, newsletter signup), the basis is contract or pre-contract performance. For marketing communications you need separate, granular consent. Peraichi acts as your data processor for submitted form data.

Yes, to Japan. The transfer is covered by the EU Japan adequacy decision (Implementing Decision (EU) 2019/419), so Standard Contractual Clauses are not required. The privacy notice must still disclose the transfer, name Peraichi Inc. as the recipient and cite the adequacy decision as the transfer mechanism.

Yes, to Japan. The transfer is covered by the EU-Japan adequacy decision of 23 January 2019, provided Peraichi falls within scope. Embedded third-party tags may add separate US transfers (Google, Meta) requiring SCCs or EU-US DPF coverage.

Not generally for a simple landing page. A DPIA becomes relevant when the page collects sensitive form data, runs paid acquisition with extensive remarketing or hosts high traffic campaigns targeting EU audiences.

A streamlined DPIA is recommended whenever the page collects more than a basic email address, especially for lead-generation campaigns, marketing automation, or pages targeting children. Standard contact forms with minimal data often do not require a full DPIA.

Sign the Peraichi DPA, mention Peraichi Inc. as a processor in the privacy notice and cite the adequacy decision. Limit form fields to what is strictly necessary, gate any analytics or marketing tag behind a CMP, configure retention to delete form data within a defined period and provide a clear way to exercise data subject rights.

Add a CMP banner, block embedded tags before consent, minimise form fields, link a clear privacy notice covering Peraichi (Japan) and third parties, configure retention for form submissions, and document the processing in your Record of Processing Activities.

EU-based alternatives include Webflow (with EU hosting), Carrd (UK, simple LPs), Strikingly (EU options), Tilda (Latvia and EU regions), and Unbounce (US but enterprise EU options). For maximum simplicity and EU hosting, Tilda is a frequent choice; for advanced analytics integration without leaving EU, self-hosted on a French or German provider.

For hosted landing page builders, alternatives include Carrd, Unbounce, Instapage, Leadpages, Webflow and the free Google Sites. EU based alternatives include Tilda Publishing (Latvia) and Strikingly (US). For EU only data residency, self hosting on a static site generator is the simplest path.

List the strictly necessary cookies (session, CSRF) with names and durations. Add a clear note about Peraichi Inc. as a processor in Japan and the EU adequacy decision. If you enable analytics or marketing tags on top of the page, list those cookies separately with their own purpose, retention and recipient.

List peraichi_session, peraichi_ga, and any embedded third-party cookies with purpose, duration and category. In the linked privacy notice, identify Peraichi Inc. as a data processor, mention the Japan transfer with the EU adequacy decision, list each embedded third party, and describe data subject rights and retention.