1. About this policy
In this notice, we provide you with information related to the Processing of your Personal Data. This notice sets out the basis on which any Personal Data that you provide to us, or that we obtain about you from other sources, will be Processed by us. Please take the time to read and fully understand this notice.
2. Information about us
For the purposes of data protection law, Sanrio Company, Ltd. (“we”, “us,” and “our”) is a data controller or equivalent term under applicable data protection laws in respect of your Personal Data, and we are committed to respecting your privacy. Our contact details are as follows:
(a) Main office address: 1-11-1, Osaki, Shinagawa-Ku, Tokyo 141-8603
(b) Tel: +81-3-3779-8163
(c) Email: sanrio-kojinhogo@sanrio.co.jp
3. Definitions
In this policy:
(a) “Personal Data” means any data/information which relates to you from which you can be identified, as well as other data/information defined as “personal data,” “personal information,” or equivalent term under applicable data protection laws. It includes your contact details, other personal information, and photographs; and
(b) “Processing” means any activity or operation that is carried out in respect of your Personal Data, as well as any other activity or operation defined as “processing,” or equivalent term under applicable data protection laws. It includes collecting, storing, using, transferring, or deleting your Personal Data.
4. How we collect your Personal Data and what Personal Data we collect
We may Process Personal Data about you collected through your completion of forms on or access to our websites, or otherwise. Such Personal Data typically includes your name, company, address (including postal code), access region, telephone number, e-mail address, credit card information, IP address, language setting, browsing history, payment history, sales information, and bank account registration details. If you don’t provide some or all of your Personal Data above, you may be unable to use part or all of the services offered by Sanrio Online Shop Direct from Japan.
When you visit our websites, we may automatically collect, store, and use technical information about your equipment and your interaction with our websites, including cookies and browsing history. Please see our cookie policy for more information about our use of cookies and how to disable them.
5. Purpose of Processing Personal Data
We Process the Personal Data about you for the following purposes:
- Providing e-commerce services including account management, reward programs and issuance of coupons;
- Shipping of purchased items;
- Payment and tax procedures;
- Coordination of sales territories;
- Identity verification;
- Marketing and promoting our products and services;
- Sending direct marketing materials;
- Responding to questions, requests and other inquiries we receive from you;
- System maintenance and operation, and bug fixing;
- Reviewing and analyzing responses to questionnaires;
- Managing or transferring our assets or liabilities, for example in the case of an acquisition, disposition or merger;
- Protecting us, yourself and others from fraud and error and to safeguard our business interests; and
- Submitting various applications and reports to the government, public agencies and other third parties as required by any applicable laws or if it is considered to be necessary.
6. Disclosure of Personal Data to recipients
We may share your Personal Data with recipients in the following situations:
(a) Internal use by us: Our employees who are authorized and who have a need to access such data;
(b) Service providers: We may share your Personal Data with third-party service providers that perform certain services, such as providing IT services;
(c) Legal procedures and security: We may disclose your Personal Data to legal or government regulatory authorities as required by any applicable laws. We may also disclose your Personal Data to third parties as required by any applicable laws in connection with any claims, disputes, or legal proceedings, when otherwise required by any applicable laws, or if we determine that such disclosure is necessary to protect the health and safety of you or any other person, or to enforce our legal rights or contractual commitments that you have made; and
(d) Business transfers: Your Personal Data may be disclosed as a part of a corporate business transaction, such as a merger, acquisition, company split, business transfer, joint venture, or the financing or sale of company assets, and may be transferred to a third party as one of the business assets in such a transaction. Your Personal Data may also be disclosed in the event of insolvency, bankruptcy, or receivership.
We jointly use your Personal Data with our group companies within the following scope in accordance with the Act on the Protection of Personal Information of Japan (Act No.57 of 2003).
|
Scope of the joint users |
Sanrio Company, Ltd., Sanrio Entertainment Co., Sanrio Enterprise Co., Ltd., Kokoro Company Ltd., Sanrio Music Publications Co., Ltd. |
|
Purpose for which the Personal Data will be used |
・Providing e-commerce services including account management, reward programs and issuance of coupons; ・Shipping of purchased items; ・Payment and tax procedures; ・Coordination of sales territories; ・Identity verification; ・Marketing and promoting our products and services; ・Sending direct marketing materials; ・Responding to questions, requests and other inquiries we receive from you; ・System maintenance and operation, and bug fixing; ・Reviewing and analyzing responses to questionnaires; ・Managing or transferring our assets or liabilities, for example in the case of an acquisition, disposition or merger; ・Protecting us, yourself and others from fraud and error and to safeguard our business interests; and ・Submitting various applications and reports to the government, public agencies and other third parties as required by any applicable laws or if it is considered to be necessary. |
|
Personal Data that will be used jointly |
Name, company, address (including postal code), access region, e-mail address, telephone number, credit card information, IP address, language setting, browsing history, payment history, sales information, and bank account registration details. |
|
Name of the joint user responsible for managing the Personal Data |
Sanrio Company, Ltd. Please see the corporate website about the address and the name of the president. |
We may disclose or provide your Personal Data to the following categories of third-parties in accordance with the Act on the Protection of Personal Information of Japan (Act No.57 of 2003) and other applicable data protection laws.
1. Affiliates: We may disclose or provide your Personal Data to Sanrio group companies (*1).
*1: Sanrio Company, Ltd., Sanrio Entertainment Co., Ltd., Sanrio Enterprise Co., Ltd., Kokoro Company Ltd., Sanrio Music Publications Co., Ltd.
2. Employees: We may disclose or provide your Personal Data to our employees who are authorized and who have a need to access such data.
3. Service Providers: We may disclose or provide your Personal Data to service providers that perform certain services, such as IT service providers (including data servers, cloud service providers, AI service providers, digital wallet service providers), data analytics service providers, advertising or email distribution service providers, payment service providers.
7. Transfer of Personal Data to Foreign Countries
Your Personal Data may be transferred to third parties outside your resident country or territory. Where we transfer your Personal Data to third parties located in countries or territories outside those in which you are located, we comply with applicable data protection laws by methods such as ensuring either of the items below, or obtaining your consent thereto.
(1) The recipient destination is designated as countries and territories that ensure an adequate level of protection for the rights and freedoms that you possess with respect to Personal Data under the applicable data protection laws.
(2) The recipient enters into a contract with us into data transfer agreements as required by applicable data protection laws.
You may confirm additional details about the protection given if your Personal Data is transferred to outside your residence country or territory by contacting us using the contact details in section 2.
8. Storage limit of Personal Data
We will retain the Personal Data that we collect about you only for the period necessary to Process such Personal Data, except to the extent that we are required by law to retain it for a longer period of time, in which case, we will retain it for the period required by law. In regard to the storage period of cookies, please see our cookie policy.
Specifically, we will apply the retention period stated below for each of the specific categories of the Personal Data we collect for the Sanrio Online Shop Direct from Japan services, provided that we may retain such Personal Data for a longer period if required by law:
(a) Account registry information (email address, language setting): until up to 2 years after withdrawing from Sanrio Online Shop Direct from Japan services;
(b) Payment registry information (credit card information, company, address, region, and email address): until up to 2 years after withdrawing from Sanrio Online Shop Direct from Japan services;
(c) Pseudonymized data of the data above (a) stored on analytical infrastructure: until less than 6 years after withdrawing from Sanrio Online Shop Direct from Japan services; and
(d) Information you input in the contact form: until up to 3 years after collecting this information.
9. Your rights
You have several legal rights in relation to Personal Data that we hold about you. These rights may vary depending on where you are located and which data protection laws apply to the relationship between you and us, but typically will include the following rights:
(1) the right to obtain information regarding the Processing of Personal Data about you and to access Personal Data about you that we hold;
(2) the right to request that we correct your Personal Data if it is inaccurate or incomplete;
(3) the right to request that we erase your Personal Data in certain circumstances;
(4) the right to request that we restrict our Processing of your Personal Data in certain circumstances;
(5) the right to object to our Processing of your Personal Data;
(6) the right to receive any Personal Data in a structured, commonly used, and machine-readable format and/or to request that we directly transmit that Personal Data to a recipient, where doing so is technically feasible; and
(7) if we process your Personal Data on the basis of your consent, the right to withdraw your consent to our Processing of your Personal Data at any time, provided however withdrawal of consent does not affect the lawfulness of Processing of Personal Data before its withdrawal
You may exercise any of your rights by contacting us at the contact details set forth in section 2. You also may lodge a complaint with the relevant data protection authority if you believe that we have infringed any of your rights.
10. Security Control Measures
In addition to establishing rules on the Processing of Personal Data, we take necessary and appropriate measures to prevent any unlawful access to, leaks or loss of, or damage to your Personal Data to be processed, and otherwise to control the security of Personal Data, such as periodic self-inspection of the status of Processing Personal Data, periodic training of employees regarding the Processing of Personal Data, prevention of theft or loss of equipment for Processing Personal Data, implementation of access controls etc. We also exercise appropriate supervision over our contractors and employees who Process Personal Data to ensure they maintain the necessary and appropriate security measures. By contacting us using the contact details set forth in section 2, you may confirm additional details about security control measures implemented by us with regard to the Processing of Personal Data.
11. Changes to this Privacy Policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page, or any other measures required under applicable data protection laws are taken.
Addendum