Version 1.0 — Effective 27 July 2026.

This is the second-layer detailed notice. The first-layer Privacy Label gives the key points in a fixed order and links here for complete explanations.

Controller and contact

NAT Consulting LLC operates Marimba.org and is responsible for the processing described in this notice.

  • Corporate number: 6012803002240
  • Registered address: 2-22-17 Naka, Kunitachi-shi, Tokyo 186-0004, Japan
  • Representative: Natsuhiko Sakimura
  • Privacy questions and requests: a spam-resistant and accessible electronic contact method is being prepared; postal requests may be sent to the registered address above

Processing activities

Editorial records about players and musical activity

Purpose. To provide accurate bilingual information and a historical record about marimba players, events, competitions, recordings, scores, and related musical activity.

Information. A professional or stage name, public biography, professional affiliations, roles and credits, event participation, awards, public social or official-site links, and images whose use has been authorised or is otherwise appropriate for editorial publication. Marimba.org does not intentionally publish private contact details or sensitive personal information merely because it is available online.

Collection method, timing, and source. Information is collected from official organiser, venue, institution, artist, publisher, distributor, and ticketing sources; public announcements; information submitted directly to Marimba.org; and the site’s preserved historical material. Collection can occur without prior interaction with the person concerned. Sources are checked before a new or materially updated Current record is published.

Use. The information is fact-checked, edited, translated, and published as static pages, lists, search results, sitemaps, and RSS items. It is not used for profiling or automated decisions about individuals.

Location and jurisdiction. Editorial source material and approved records are maintained by the operator in Japan and in access-controlled services that may process data in Japan, the United States, or other locations used by their providers. Public pages are served from hosting infrastructure in the United States and are accessible worldwide.

Recipients. Published information is available to the public and may be indexed, quoted, or archived by others. Hosting, repository, and backup providers process working copies for the operator. Information is not sold.

Basis. Where applicable law requires a stated basis, the operator relies on its legitimate interests in accurate editorial publication and historical preservation, balanced against the rights and expectations of the person concerned. Consent, permission, a licence, or another applicable basis is used where required for a particular image, submission, or other item.

Retention. Current editorial information is retained while it remains accurate, relevant, or necessary to explain a published record. It is corrected or removed when appropriate. Material in the clearly identified historical Archive is preserved as historical content; requests concerning inaccurate, unsafe, or unlawfully published personal information are assessed under the site’s editorial and restricted-access policy.

Choices, risks, and rights. Public publication can increase the visibility and persistence of professional information. A person concerned may request source information, correction, contextualisation, restriction, or removal. Marimba.org will assess the request against accuracy, privacy, freedom of expression, historical integrity, and applicable law.

Information submissions and music-class inquiries

Purpose. To evaluate and prepare submitted event, competition, player, recording, or score information; answer follow-up questions; arrange a music class trial; and, if a student enrols, administer lessons.

Information. The sender’s name and email address, message and attachments, the submitted source URLs and contact details, and, for a music-class inquiry, the student’s name, age or school year, preferred subject and day, and other information the sender chooses to provide. Please do not send information that is not needed for the request.

Collection method, timing, and source. The information is collected directly when a person sends a message. Contact surfaces should present a short just-in-time notice and a link to this full notice before the message is sent.

Use. Information submissions are checked, edited, translated, and, if accepted, used to prepare public editorial records. Music-class information is used to answer the inquiry, arrange a trial, prepare an in-person explanation, and administer lessons after enrolment. It is not used for unrelated marketing or automated decision-making.

Location and jurisdiction. Messages and necessary working records are processed in Japan and by the operator’s email and storage providers, which may process them in Japan, the United States, and other provider locations.

Recipients. Access is limited to the operator, relevant service providers, and, for lesson arrangements, the responsible instructor. Information selected for publication becomes public only through the editorial approval process.

Basis. Where applicable law requires a stated basis, processing is based on steps requested before a possible lesson agreement, performance of an agreement after enrolment, the operator’s legitimate interests in answering and documenting submissions, and applicable legal obligations. Optional information is used only for the purpose for which the sender provides it.

Retention. If a submission is not used or no enrolment follows, related correspondence is ordinarily deleted within one year after the last contact. For an accepted submission, the minimum source and correspondence needed to support corrections can be retained while the resulting record is published. For an enrolled student, necessary records are retained for lesson administration, the agreement, and applicable legal obligations, then deleted when those purposes no longer require them.

Choices and rights. Sending a message is voluntary, but Marimba.org might not be able to answer or act without the information necessary for the request. Before publication, a sender may withdraw information that has not otherwise been lawfully obtained. Requests concerning retained correspondence can be made through the contact method above.

Web server logs

Purpose. To deliver the site, maintain security, diagnose failures, and investigate abuse.

Information. IP address, request date and time, requested URL, referrer, browser user-agent, response status, and related security information.

Collection method, timing, and source. Hosting infrastructure records this information automatically when a browser requests a page or asset.

Use. Logs are reviewed only as needed for operation, aggregate service understanding, troubleshooting, security, and legal obligations. Marimba.org does not use behavioural analytics or build visitor profiles.

Location and jurisdiction. Production logs are processed on hosting infrastructure in the United States and may be accessed by the operator from Japan.

Recipients. The operator and hosting or security providers have access according to operational need. Selected records can be disclosed when required by law or necessary to protect the site and its users.

Basis. Where applicable law requires a stated basis, processing is based on the operator’s legitimate interests in delivering and protecting the service and on applicable legal obligations.

Retention. Routine Apache logs are rotated daily and retained for up to 45 days. Selected records can be kept longer when reasonably necessary for a security incident, abuse investigation, or legal obligation.

Choices and rights. Essential connection logs cannot be disabled by a site setting because they are produced when a request is delivered. A person can contact the operator about a specific log record, subject to identity verification and applicable law.

Browser preferences

Purpose. To remember a language choice and whether external players should be loaded.

Information. The language value en or ja, or the external-content value allow or deny, together with the time the value was saved. A session-only external-content permission contains only allow.

Collection method, timing, and source. JavaScript stores the value in localStorage after an explicit choice, or in sessionStorage when external content is allowed for one session.

Use, location, and recipients. The values remain in the browser and are used only to apply the selected display behaviour. They are not sent to Marimba.org with web requests and have no external recipient.

Basis. The browser acts on the visitor’s explicit request. Because these values remain on the device, the operator does not receive them as PII.

Retention. Persistent values expire after 180 days. A session value ends with the browser session.

Choices and rights. The site works without saved preferences. Language choices can be removed by clearing site data. External-content choices can be changed or cleared at any time through External content settings in the footer; declining is as easy as allowing. A persistent external-content choice applies to everyone using the same browser profile. On a shared device, use the session-only or ask-each-time option and clear the choice after use.

Purpose. To let a visitor play referenced music or video without loading a third-party player by default.

Information and collection. Before activation, Marimba.org serves a local facade and does not request the player from Apple or Google. After a visitor loads a player, the browser connects directly to the selected provider and sends connection information such as an IP address, browser or device details, and an HTTP referrer. If the visitor is signed in to that provider, the provider may associate the interaction with that account.

Use, location, and recipients. Apple or Google processes the connection under its own terms, potentially in multiple countries. Marimba.org does not receive the visitor’s player-account details or a report of listening or viewing activity. YouTube embeds use youtube-nocookie.com; Google describes this privacy-enhanced mode as preventing an embedded view from being used to personalise the viewer’s YouTube experience or advertising.

Basis. Marimba.org initiates the optional connection only after the visitor’s intentional choice. Apple and Google determine their own bases for the processing they perform under their notices.

Retention. Provider retention is governed by the selected provider’s policy. Marimba.org retains only the browser preference described above.

Choices, risks, and rights. Loading a player exposes connection data to an independent provider and can allow that provider to recognise a browser or account. The visitor can decline, allow one session, remember a choice, clear it later, or follow an ordinary external link instead.

Client-side search and RSS

Pagefind search runs in the browser against static index files. The site-wide search form sends the search term to Marimba.org in the page URL as a query parameter, so it can appear in ordinary server logs; it is not sent to an external search provider. Requests for search assets also appear in ordinary server logs. RSS is a static file: a feed reader requests it like any other page, producing only ordinary server-log information.

Security

Marimba.org minimises collection by using static pages without public accounts, comments, advertising, behavioural analytics, or a web inquiry form. Access to non-public records is limited according to operational need. The operator uses provider authentication and access controls, keeps the historical Archive separate from the Current publishing system, and applies the retention criteria above. Further information about safeguards can be requested unless disclosure would itself create a security risk.

Your rights and how to exercise them

Depending on applicable law, a person may request notice of purpose, access or disclosure, correction, addition, deletion, suspension of use, erasure, restriction, objection, cessation of third-party provision, or information about sources and recipients. A person may also complain to the data-protection authority with jurisdiction over them.

Use the contact method above and describe the information and action requested. The operator can request information reasonably necessary to verify identity or authority and will respond within the period required by applicable law. No fee is normally charged for a request made electronically; any lawful exception will be explained before processing.

Changes and prior versions

Material changes will be shown on this page with a new version and effective date. A new choice will be requested before a materially expanded optional external-content use takes effect. Prior versions associated with a saved choice will be retained for reference while that choice remains relevant.

Privacy pages preserved inside the WordPress and XOOPS Archive are historical records. They do not describe operation of the current static site.