Handling of Personal Information

Article 1 Business Operator

Article 2 Scope

Article 3 Personal Information We Collect

1. Account and contact information: name, username, email address, telephone number, language, country or region, account credentials and profile details.
2. Social login information: if you choose to sign in with a third-party account, such as a Google or Apple account, the identifiers and profile information that provider shares with us.
3. Identity and verification information: date of birth, nationality and identity-document details, only where reasonably required for fraud prevention, dispute handling, legal compliance or another notified purpose.
4. Order and transaction information: products, quantities, bids, purchase price, fees, seller or marketplace, order history, recipient details and delivery destination.
5. Payment information: payment card, wallet or bank details are collected directly by payment providers. We receive limited payment status, account reference, billing and fraud-screening information.
6. Shipping, warehouse and customs information: recipient name, address, telephone number, package details, tracking information, export or import information and delivery instructions.
7. Communications and support information: enquiries, chat or email content, complaints, dispute records, survey responses and records of interactions with us.
8. User-submitted content: product requests, photographs or files you choose to submit.
9. Device, log and usage information: IP address, browser type, device type, operating system, app version, time zone, pages or screens viewed, referring URL, clicks, session data, app instance identifiers, advertising identifiers, cookie identifiers, crash logs and diagnostic data.
10. Location information: approximate location inferred from IP address, and precise location only if a feature requires it and you grant permission.
11. Information from third parties: marketplaces, sellers, payment providers, delivery partners, fraud-prevention providers, advertising and analytics partners and social login providers.

Article 4 How We Collect Personal Information

1. Directly from you when you create an account, place or bid on an order, make a payment, arrange delivery, contact support, submit content or otherwise use the Services.
2. Automatically through cookies, software development kits (SDKs), pixels, tags, logs and similar technologies (see Articles 7 to 9).
3. From third parties involved in providing the Services, as described in Article 3.

Article 5 Purposes of Use

1. To create, authenticate, maintain and administer accounts and user preferences.
2. To provide the purchasing, bidding, resale, warehouse, inspection, consolidation, shipping, customs and delivery functions you request.
3. To process payments, refunds, credits, invoices and related transaction records.
4. To communicate about orders, service notices, account activity, support requests, disputes and policy changes.
5. To verify identity where necessary, prevent fraud or abuse, secure accounts and systems, enforce our Terms of Use and investigate prohibited activity.
6. To operate, troubleshoot, measure, analyse and improve the Services, and to develop new features.
7. To personalise content and recommendations and, subject to your choices and applicable law, to deliver and measure advertising (Article 8).
8. To send marketing communications with your consent where required (Article 10).
9. To comply with legal, tax, accounting, sanctions, customs, consumer-protection and regulatory obligations; to respond to lawful requests; and to establish, exercise or defend legal claims.
10. To carry out corporate administration, audits and professional advice.

Article 6 Legal Bases (Users in the EEA, UK and Switzerland)

1. Items (1) to (4): performance of a contract with you.
2. Item (5): our legitimate interests in preventing fraud and keeping the Services secure, and compliance with legal obligations where applicable.
3. Item (6): our legitimate interests in operating and improving the Services.
4. Items (7) and (8), including non-essential cookies: your consent.
5. Item (9): compliance with legal obligations, and our legitimate interests in defending legal claims.
6. Item (10): our legitimate interests in running our business, and compliance with legal obligations.

Article 7 Cookies and Similar Technologies

1. Strictly necessary: log-in, security, shopping cart and other core functions. These do not require consent.
2. Preferences: remembering your language, region and settings.
3. Analytics: understanding usage, measuring performance and diagnosing errors.
4. Advertising and attribution: delivering, personalising and measuring advertising, and attributing app installs and conversions.

Article 8 Google Advertising and Analytics

1. The Company uses Google services, including Google Analytics, Google Ads and Google Tag Manager, to measure website and app use, understand campaign performance, prevent abuse and display or measure advertisements.
2. Third-party vendors, including Google, use cookies or device identifiers to serve Rakufun advertisements based on your prior visits to or use of Rakufun and other websites or apps. Information collected may include IP address, browser or device information, advertising identifiers, referring pages, interactions and conversion events.
3. To measure advertising effectiveness and show relevant advertising, we may share contact information such as your email address or telephone number with Google in hashed (irreversibly encoded) form, through Google's enhanced conversions or Customer Match features. Google acts as a service provider for this purpose.
4. For information about how Google uses data from sites or apps that use its services, please see https://policies.google.com/technologies/partner-sites.
5. You can manage personalised advertising through Google Ads Settings (https://adssettings.google.com/) and disable Google Analytics by installing the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).

Article 9 Mobile Applications

1. Our mobile applications may request access to device functions, such as the camera, photos and notifications, only when you use the related feature. You can change permissions in your device settings; disabling a permission may prevent the related feature from working.
2. Where we collect or share data in a way you may not reasonably expect, we will show a clear in-app notice and ask for your consent before collection begins.
3. We use analytics, diagnostics and attribution SDKs, such as those provided by Google and AppsFlyer. These providers may receive device identifiers, IP address, app events, campaign information and diagnostic data. We treat these identifiers as personal information.
4. Details of the information collected through the applications are set out in the Application Privacy Policy at the end of this document.

Article 10 Marketing Communications

1. The Company sends marketing communications only where you have consented or where otherwise permitted by law.
2. Marketing may cover Rakufun proxy-purchasing and forwarding services, products available through Japanese marketplaces, and Rakufun promotions, coupons and campaigns. We may use your name, contact details, language, order history and stated preferences for this purpose.
3. For users in Hong Kong: we will not use your personal data for direct marketing unless we have received your consent (including an indication of no objection) after providing the information in item (2). We will not provide your personal data to any third party for its own direct marketing without your separate written consent.
4. You may withdraw consent at any time, free of charge, by using the unsubscribe link in any message, changing your settings in My Page, or emailing service@rakufun.com.
5. We will continue to send non-promotional communications that are necessary for your account, orders, security or legal matters.

Article 11 Provision of Personal Information to Third Parties

1. Service providers acting on our behalf: Rakufun group companies and providers of cloud hosting, security, communications, customer support, analytics, diagnostics, attribution and advertising providers, bound by contract to use the information only for our purposes.
2. Parties needed to fulfil your orders: Japanese marketplaces, auction platforms and sellers; payment processors and fraud-prevention providers; warehouse operators, carriers, postal operators, customs brokers and insurers.
3. Authorities and advisers: regulators, courts, law-enforcement bodies, professional advisers and auditors, where required by law or reasonably necessary to protect rights, safety and security.
4. Corporate transactions: a buyer, investor or successor in connection with a merger, financing, reorganisation or sale of assets, subject to confidentiality and legal safeguards.

Article 12 Transfer of Personal Information outside Japan

1. Google LLC: United States (analytics, advertising and app diagnostics)
2. AppsFlyer: outside Japan (app install and campaign attribution)
3. Cloud hosting, communications and customer-support providers, and Rakufun group companies: Hong Kong, the United States and other countries where they operate (hosting, storage, customer support and operations)

Article 13 Retention of Personal Information

1. Account information: while your account is active, and deleted within a reasonable period after account deletion, except as set out below.
2. Order, payment and accounting records: for the period required by Japanese tax and accounting law.
3. Shipping and customs records: for the period required by customs law and as needed to handle carrier claims.
4. Support and dispute records: until the matter is resolved and for as long as needed to handle related claims.
5. Fraud-prevention records: for as long as reasonably necessary to prevent fraud and abuse.
6. Logs, analytics and advertising data: for limited periods set in our analytics and advertising tools.
7. Marketing consent records: while consent is valid and for as long as needed to demonstrate consent.
8. Backups: overwritten on a regular cycle.

Article 14 Security

1. Organisational measures: a designated person responsible for personal information and internal rules on its handling.
2. Personnel measures: confidentiality obligations and regular training for staff.
3. Physical measures: controls on entry to areas where personal information is handled, and measures to prevent theft or loss of devices and documents.
4. Technical measures: access controls, authentication, system monitoring and protection against unauthorised access and malware.
5. Understanding the external environment: where personal information is stored in foreign countries, we assess the personal information protection systems of those countries (see Article 12).

Article 15 Disclosure, Correction and Other Requests

1. notification of the purposes of use of your personal information;
2. disclosure of your personal information and of records of its provision to third parties;
3. correction, addition or deletion of your personal information;
4. suspension of use, erasure, or cessation of provision to third parties;
5. restriction of, or objection to, processing, and a portable copy of your personal information;
6. withdrawal of consent, and opt-out of marketing or personalised advertising.

Article 16 Account Deletion

1. You can request deletion of your account in the app at My Page → Settings → About → Delete Account, where available, or by emailing service@rakufun.com.
2. When your account is deleted, we delete your account profile, contact details, saved addresses, preferences and marketing data, and instruct our service providers to do the same.
3. We retain order, payment, accounting, customs and dispute records for the periods in Article 13 where required by law or needed for fraud prevention or legal claims.
4. Deletion is completed within a reasonable period after your request. Active orders, balances, returns or disputes may need to be resolved first.

Article 17 Children and Minors

Article 18 Changes to this Privacy Policy

Article 19 Language

Article 20 Contact

Application Privacy Policy

Article 1 Name of the Application Provider

Article 2 Information Collected, Purposes and Collection Methods

1. Account information (name, email address, telephone number): for account management, orders and support; entered by you; required.
2. Login ID and password: for member authentication; entered by you; not shared; required.
3. Social login information: for member authentication; provided by the login provider when you choose to use it; optional.
4. Order and purchase history: to provide the Services and customer support; collected through your use of the Application; shared with marketplaces, sellers and carriers as needed to fulfil orders.
5. Shipping address and recipient details: for delivery and customs procedures; entered by you; shared with warehouses, carriers and customs brokers; required.
6. Payment status and references: for payment processing and fraud prevention; received from payment providers.
7. Photos and files: for product requests and support; selected by you; optional.
8. Support messages: for customer support; entered by you; optional.
9. Activity history (screens viewed, taps, in-app events): for analytics, service improvement and advertising measurement; collected automatically through SDKs; shared with analytics and attribution providers such as Google and AppsFlyer.
10. Device and app identifiers (app instance ID, advertising ID): for analytics, attribution and advertising; collected automatically through SDKs; shared with analytics, attribution and advertising providers such as Google and AppsFlyer. You can reset your advertising ID in your device settings.
11. Crash logs and diagnostic information: to improve the stability of the Application; collected automatically through diagnostic SDKs.
12. Device token: to send push notifications; collected automatically with your permission; optional.
13. Approximate location (from IP address): for region, language and fraud prevention; collected automatically.

Article 3 Consent

Article 4 External Transmission and Provision to Third Parties

1. Provider: Google LLC; purpose: analytics and diagnostics; privacy policy: https://policies.google.com/privacy
2. Provider: AppsFlyer; purpose: app install and campaign attribution; privacy policy: available on the AppsFlyer website

Article 5 Uninstalling and Account Deletion

Article 6 Contact

Article 7 Changes