Good Smile Company achieves CCPA/CPRA readiness with Ketch

Since their founding, the mission at Good Smile Company has been to support creators and bring Japanese pop culture to the world whilst stimulating the figure industry as a whole. Their business includes the production and sale of popular toys, goods, and figures. They’ve enhanced manufacturing teams and factories and made many business partners within the animation industry, establishing new locations in the US and China. 

“We needed to move from homegrown compliance to scalable, futureproof privacy tech. Ketch is a great solution for us. Today we’re complying with privacy regulations and respecting people’s privacy choices in every data system.” 

Taylor Locke, Director of IT, Good Smile Company

Challenge: Approaching regulatory requirements + limited internal support = business risk

Good Smile Company is in the business of expansion, with a mission to bring Japanese pop culture to the world. To support this consistent growth, their business processes and supporting technology must be ready for scale. 

Following the establishment of new locations in the United States, Good Smile needed to consider a new time-sensitive requirement: complying with local data privacy regulations.

Of critical importance was CCPA/CPRA compliance in California. CCPA is widely recognized to be one of the strictest US privacy regulations, and one of the first to be enforced: CCPA went into effect on January 1, 2023, closely followed by the CPRA amendment on July 1, 2023. 

Read more: CCPA vs CPRA

Until this point, Good Smile had been managing data privacy compliance with a homegrown solution. But Taylor Locke, Director of IT, knew this wouldn’t scale. 

“We needed to move to a better solution with as little manual intervention as possible,” says Taylor. 

Manual intervention and effort was a serious concern. The Good Smile IT and Engineering teams were spending significant time fulfilling data subject rights requests (DSRs): manually handling the processes of accessing and deleting consumer data across their internal and external data systems.

With a potential influx of DSRs from California residents, Good Smile needed a better solution for finding and acting on sensitive consumer data across their business systems. 

Read further: CCPA compliance checklist

‍Solution: Future-proof, all-in-one technology for regulatory compliance and data control

With regulatory compliance being the immediate priority, Good Smile and Ketch started with deploying consent and preference management. 

Ketch consent and preference management provides Good Smile with a centralized interface for policy creation and privacy notice customization. They used Ketch templates for CCPA/CPRA compliance to deploy jurisdictionally-aware privacy notices for California residents. The Ketch policy center includes templates for every major data privacy law, with flexibility to customize according to specific business requirements.

‍

‍

Using Ketch tag orchestration, Good Smile connected their web visitors’ data collection preferences directly to the tags firing on their websites. This ensures they respect people’s data collection preferences, a key aspect of the California privacy regulations. 

With consent and preference management live, Good Smile was confidently collecting people’s consent choices. Now they could move on to respecting those choices across the business data ecosystem. 

Ketch deployed data discovery and classification to enable Good Smile to understand sensitive and personal data location and status in every system and application across the business. This process included: 

1. Direct connection to every Good Smile data system: Ketch conducted automated discovery, using responsive machine learning models to give Good Smile a complete and growing picture of data across their organization.
2. Automatic classification of personal & sensitive information: Ketch automatically crawled through data systems to find personally identifiable information. From a centralized user interface, Good Smile can set and enforce policies according to data processing purpose, while data remains decentralized across their systems. 
3. Native integration with Ketch DSR fulfillment: As part of Ketch’s all-in-one, integrated platform approach, tables, columns, and other assets are automatically crawled to fulfill privacy requests. Good Smile has a comprehensive view of personal data processing, including always-on documentation. 

With a strong understanding of which systems contained sensitive and personal data, Ketch knew which systems required API connections to fulfill automated data subject rights requests. Ketch built custom API integrations to internal and external systems – such as MySQL, ShipStation, and SKU Vault – to enforce consumer rights including access, deletion, and opt-out. 

Good Smile used Ketch drag-and-drop workflows to architect automated DSR processes, ensuring that consumer requests were fulfilled in a timely manner with limited manual intervention and delays. 

Result: Automated regulatory compliance, future-proofed for scale in new markets 

Previously, the Good Smile IT and Engineering teams were bogged down with manual data subject rights requests and maintenance of their homegrown compliance tools. 

Today, those challenges have gone away. Good Smile leverages Ketch for an integrated solution across data discovery and classification, consent management, and data subject rights fulfillment. The team no longer has to manually fulfill customer privacy requests. Furthermore, they’re leveraging Ketch custom APIs to connect to internal and external data systems, eliminating the need for extensive scripting and development time. 

Good Smile will continue to rely on Ketch for API configuration as new systems come up. Ketch consistently adds new connectors to the integration database, including customer requests. 

“I feel like we’re set up for success. No matter what jurisdictions or systems come up in the future, I know we can rely on Ketch to help us expand in an automated, simplified way,” says Taylor. 

‍