Privacy Policy

Article 2 Purpose of Use of User Information

The Company will use the acquired User Information for the following purposes. In addition, we may provide User Information to sellers of products in our services and other third parties for the following purposes only in cases that correspond to the contents specified in Article 3.

1. To sell products, rights, services, etc. of the Company or third parties
2. To ship and deliver products
3. To bill and calculate charges
4. To conduct a usage audit
5. To manage User Information
6. To advertise or promote the products and services of the Company or third parties (including sending faxes, mail magazines, flyers and other direct mails)
7. To provide the Company's or a third party's content optimized for each user and to deliver advertisements
8. To manage seminars and events
9. To implement campaigns, etc., to notify winners, and to send prizes, etc.
10. To conduct questionnaires, user interviews, etc.
11. To provide point services and affiliate services
12. To provide support for the Service and to respond to inquiries from users (including identification and refund correspondence)
13. To conduct marketing activities, including face-to-face marketing
14. To create and analyze statistical data regarding the use of the Service
15. To improve the quality of products and services of the Company or third parties
16. To plan, develop, and provide new plans, products, or services related to the services of the Company or third parties
17. To maintain the system and respond to problems
18. To respond to violations of the Terms of Service or other improper or inappropriate use of the Service
19. To assist with data entry and to ensure smooth use of the Service by users
20. To carry out entrusted operations when entrusted with the handling of personal information by partner companies, etc.
21. To provide other notices related to the Service and to make necessary operational contact
22. To exercise rights and perform obligations under contracts, laws and regulations, etc.
23. For other purposes individually specified in each of the Company's services, etc.

Article 3 Disclosure and Provision of User Information to Third Parties

1. The Company will not provide the acquired User Information to any third party, except in the following cases and in the second paragraph of this article.
   1. When prior consent to provide the information to a third party is obtained.
   2. When required by the Act on Personal Information Protection and other laws and regulations
   3. When it is necessary for the protection of the life, body, or property of an individual and it is difficult to obtain the consent of the principal.
   4. When it is particularly necessary to improve public health or promote the sound growth of children, and it is difficult to obtain the consent of the principal.
   5. When it is necessary to cooperate with a national agency, a local public body, or a person or organization entrusted by either of the foregoing in executing affairs prescribed by laws and regulations, and obtaining the consent of the principal may impede the execution of such affairs.
   6. In the event that the Company outsources part or all of the handling of User Information to an external company based on a consignment agreement(including the case where the Company outsources the management and analysis of information to a consignee for the purpose of storing it on the server and improving the quality of the Service). In this case, the Company will enter into an agreement with the contractor regarding the handling of User Information and will appropriately supervise the contractor to ensure the safe management of User Information.
   7. In case of succession of business due to merger, corporate separation, business transfer or other reasons
2. The Company may provide the following information to third parties after excluding information that can be used to directly identify specific individuals, such as names and addresses:
   • Device information (device model name, device manufacturer, device OS version, device identification information, computer name, IP address, browser type, browser language, etc.);
   • Advertising identifier (IDFA or Google Advertising ID, etc.);
   • Location information on smartphones, etc. (GPS, beacons, etc.);
   • Log information (the user's activity history on the Service (including browsing history, purchase history, etc.));
   • Encoded user account and other identifiers; and
   • User demographic information (including age, gender, hobbies, interests, etc.)
   • Statistics.

   [Examples of possible third parties]
   LY Corporation (Click here for information on how data is handled by the company)
   Blogwatcher Inc. (Click here for information on how data is handled by the company)

   User shall agree that such information may be used by the third party to improve the quality of the Company's or the third party's products and services, to consider new products and services, to provide content optimized for each user, to distribute advertisements (behavioral targeting advertisements), etc., in accordance with the privacy policy of the third party.
   Please refer to "About Behavioral Targeting Ads" for more information about behavioral targeting ads distributed by the Company or third parties.

3. When providing personal information to a third party in accordance with the preceding two paragraphs, the Company shall provide personal information to third parties only to the extent necessary, after carefully determining the impact on user privacy based on a comprehensive consideration of the necessity of providing the personal information to the third party, the method of providing the personal information to the third party, the implementation of safety management measures by the third party, and the relationship between the Company and the third party (relationship between services provided by the Company and those provided by the third party, existence of capital relationship, etc.).
4. Notwithstanding the provisions of the preceding three paragraphs, in the event that the Company receives the information specified in Paragraph 2 based on the privacy policy, etc. of a group company, the Company will not re-provide such information to a third party.

   * Group companies refer to Z Holdings Corporation and its parent company, subsidiaries, and affiliates (parent company, subsidiaries, and affiliates as defined in the "Regulations concerning Terms, Forms, and Preparation Methods of Financial Statements").

Article 4 Disclosure, etc. of Personal Information

If a user requests disclosure of personal information or notification of the purpose of use of personal information in accordance with the provisions of the Act on Personal Information Protection, the Company will disclose or notify the user without delay after confirming that the request is made by the user himself/herself (if the requested personal information does not exist, the Company will notify the user to that effect). However, this does not apply in cases where the Company is not obligated to disclose or notify the user under the Act on Personal Information Protection or other laws and regulations. Please note that a handling fee (1,000 yen per case) will be charged for the disclosure of personal information.

Article 5 Correction and Suspension of Use of Personal Information

When a user requests (1) correction, addition, or deletion of the contents of personal information (a "Correction, etc.") based on the provisions of the Act on Personal Information Protection on the grounds that the personal information is not true, (2) stop of use or erase of personal information based on the provisions of the Act on Personal Information Protection on the grounds that the personal information is handled beyond the scope of the purpose of use announced in advance or that the information was collected through deception or other wrongful means or (3) stop of provision of personal information to a third party based on the provisions of the Act on Personal Information Protection on the grounds that the personal information has been provided to a third party without the consent of the principal, the Company will conduct the necessary investigation without delay after confirming that the request is made by the user himself/herself, and based on the results of the investigation, the Company will conduct Correction, etc., stop of use or stop of provision to a third party of the content of the personal information and notify the user to that effect (if the Company decides not to conduct Correction, etc., stop of use or stop of provision to a third party, the Company will notify the user to that effect). However, this does not apply in cases where the Company is not obligated to conduct Correction, etc., stop of use or stop of provision to a third party under the Act on Personal Information Protection or other laws and regulations.

Article 6 Secure Management of Information

The Company will take necessary and appropriate measures to prevent the leakage, loss or damage of the User Information it collects and ensure secure management, in accordance with the laws and regulations concerning the protection of personal information and this Policy.

Article 7 Amendments to the Privacy Policy

The Company may amend this Policy in order to continuously improve the handling of User Information.

In this case, the amended Policy shall be posted on the website managed by the Company.

In addition, in the case of amendments to the content that require the user's consent under laws and regulations, the user's consent shall be obtained in a manner prescribed by the Company.

Article 8 Handling of Personal Information of Residents of the EEA

In addition to the foregoing Policy, this Article (this “GDPR Policy”) shall apply to the handling of personal information of residents of the EEA where the General Data Protection Regulation is applicable. In the event of conflict or inconsistency between the foregoing Policy and this GDPR Policy, this GDPR Policy shall prevail.

1. In this GDPR Policy, the following word has the following meaning:
   1. Applicable Privacy Legislation means the General Data Protection Regulation ("GDPR") and the relevant national implementation acts.
   2. Personal data means any information concerning an identified or identifiable natural person that is processed by the Company.
   3. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
   4. Controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
2. The Company processes your personal data for the purposes set out in this Policy. The Company treats the personal data based on any of the legal grounds set forth in Articles 6 and 7 of the GDPR. The Company also treats personal data that require special consideration, such as the union membership, religious opinions, and health conditions of the Customers etc., in accordance with the standards stipulated in Articles 9 and 10 of the GDPR. The Company has legitimate interests in the handling of personal data in particular for the promotion of its economic activities, provision of its services and products to users, etc. and management of the businesses and employees of the Company.

   If the Company intends to further process the personal data for a purpose other than those for which the personal data have been collected, the Company will provide you with information about that other purpose and all relevant further information before that further processing.

3. The Company may not transfer personal data to the counties outside the EEA unless:
   • the transfer to a country may take place where the European Commission has decided that the country ensures an adequate level of protection of Personal Information;
   • the transfer to a third party with whom the Company executed the standard data protection clauses approved by the European Commission; or
   • the transfer takes place on one of the conditions listed in Article 49, Paragraph 1 of GDPR.

   Your personal data will be initially collected and stored in Japan, which is considered by the European Commission to provide an adequate level of protection of Personal Information.

4. The Company will store the personal data for the period necessary to comply with the Company’s legal obligations or to ensure that appropriate services are provided. The Company may retain personal data for a longer period in the event of complaint by the data subject, or, if the Company reasonably believes that there is a prospect of litigation with the data subject.
5. A resident of the EEA has the following rights in connection with his/her own personal data handled by the Company;
   • access (disclosure),
   • rectification,
   • erasure,
   • restriction of processing,
   • data portability,
   • object to processing, and
   • refusal of automated decisions.

   For exercise the right above, please contact the Company as set forth in Article 7 of this Policy.

6. By accepting this Policy you shall be deemed to have agreed to the handling of personal data by the Company in accordance with this Policy. However, you may withdraw such consent at any time.
7. A resident of the EEA may file an objection with supervisory authorities in the event of any objections regarding the Company’s handling of his/her personal data or in the event of any objections regarding how the Company handles his/her personal data.
8. The user is not legally or obligated to provide personal data. However, if the user does not provide personal data, the Company may not be able to provide part or all of its service or respond to inquiries, etc.
9. The Company does not use the provided personal data for automated processing (including profiling) to analyze and predict the personal preferences and actions of the data subject, or make decisions that may have a legal impact on the data subject.

June 9, 2017, Enacted.
December 1, 2017, Amended.
March 30, 2018, Amended.
May 29, 2018, Amended.
October 9, 2019, Amended.
March 31, 2020, Amended.