Privacy policy — mirumi online store

1. What counts as personal data

Yukai Engineering Inc. (“the Company”) treats as personal data the information relating to a living individual defined in Japan’s Act on the Protection of Personal Information (“the Act”) — name, date of birth and any other information that identifies a particular person — together with email addresses, user IDs, passwords, payment card details and other information used in connection with a particular person, and information about interests, household, age or other personal attributes where it forms a set with personal data. Unless stated otherwise, the definitions in the Act apply throughout this policy.

2. Cookies and IP addresses

Cookies and IP addresses do not on their own identify a particular person, so we do not treat them as personal data. They are treated as personal data where they are used together with personal data. On the platforms we operate, we disclose the purpose and means of any use of cookies and IP addresses, even where they do not identify a particular person. Cookies can be refused in your browser settings; where refusing them prevents access to a service, we say so as well.
Where it is foreseeable that a third party will obtain personal-related information (within the meaning of Article 2(7) of the Act, and limited to information forming part of a database of such information under Article 16(7)) as personal data, the Company will not pass that information to the third party without first checking the following points in the manner set by the Personal Information Protection Commission — except in the cases listed in Article 27(1) of the Act:
1. that the individual has consented to the third party obtaining the information passed on by the Company as personal data identifying them;
2. where the third party is based abroad, that the individual has been given in advance, in the manner set by the Commission, the relevant information about the data protection regime of the country concerned and the measures taken by that third party.
Where the Company passes personal-related information to a third party, it creates and keeps a record in accordance with Article 31 of the Act.
Where the Company receives personal-related information from a third party, it carries out the necessary checks and creates and keeps a record of those checks, in accordance with Article 31 of the Act.

3. Why we use personal data

The Company uses personal data for the following purposes:

to provide its various services;
to give information about its services and to answer enquiries;
to give information about its products and services;
to deal with breaches of the terms and policies applying to its services;
to notify changes to the terms applying to its services;
to analyse how people use its services in order to improve existing services and develop new ones;
to dispatch products bought through the e-commerce service known as “Yukai online store” (including, where the name or content of the service changes for any reason, the service as changed), and to send a newsletter to the email address registered on that service;
to manage employment and internal procedures (personal data of directors and staff) and to assess and contact applicants during recruitment (personal data of applicants);
to manage shareholders and comply with company law and other legal procedures (personal data of shareholders, holders of share options and others);
to produce statistics relating to its services that do not identify any individual;
to measure the effectiveness of advertising for its products and services (the Company may obtain, from tools operated by third parties, information about the adverts clicked before arriving at “Yukai online store” and match it against order information);
for any other purpose ancillary to those above.

4. Limits on our use of personal data

The Company does not handle personal data beyond what is needed to achieve the stated purposes without first obtaining the individual’s consent. Where personal data has been obtained through a merger or for another reason, the Company does not handle it beyond the earlier purposes without prior consent. This does not apply where:

the law so provides;
handling is necessary to protect a person’s life, physical safety or property and it is difficult to obtain their consent;
handling is particularly necessary to improve public health or to promote the healthy development of children and it is difficult to obtain that consent;
it is necessary to cooperate with the State, a local authority or a delegated body in carrying out a task laid down by law, and obtaining consent would risk hindering that task;
the data is passed to an academic research body that needs to handle it for research purposes (including where that purpose is only partial), unless there is a risk of unjustified interference with individual rights and interests.

5. Fair collection of personal data

The Company collects personal data fairly and does not use deception or any other improper means.

6. Telling you why we collect personal data

The Company publishes the purposes of use in advance when it collects personal data. This does not apply where:

notifying or publishing the purposes would risk harming the life, physical safety, property or other rights and interests of the individual or a third party;
it would risk harming the Company’s rights or legitimate interests;
it is necessary to cooperate with the State or a local authority in carrying out a task laid down by law and notification or publication would risk hindering that task;
the purpose is obvious from the circumstances of collection.

7. Changing the purposes of use

The Company changes the purposes for which it uses personal data only within what can reasonably be regarded as related to the earlier purposes, and notifies or publishes the changed purposes.

8. Keeping data secure and supervising staff

To prevent the leaking, loss or corruption of personal data and otherwise keep it secure, the Company has established personal data protection rules and exercises the necessary and appropriate supervision over its staff. The specific security measures applying to the personal data the Company holds are set out below.

A general policy

This privacy policy serves as the general policy for the proper handling of personal data, covering in particular compliance with applicable laws and guidelines and the contact point for questions and complaints.

Rules for handling personal data

Personal data handling rules set out, for each stage (collection, use, storage, disclosure, deletion and destruction), the handling methods, the people responsible and in charge, and their duties.

Organisational measures

appointment of a person responsible for the handling of personal data, identification of the staff authorised to handle it and of the scope of the data they handle, and a reporting line to the responsible person where a breach of the law or the rules is found or suspected;
periodic self-assessment of how personal data is being handled, together with audits by other departments or by third parties.

Measures relating to staff

regular staff training on the precautions to take when handling personal data;
confidentiality obligations relating to personal data set out in the staff handbook.

Physical measures

control of staff entry and exit and restrictions on the equipment brought into areas where personal data is handled, together with measures preventing unauthorised people from viewing it;
measures to prevent the theft or loss of the equipment, electronic media and documents containing personal data, and measures to prevent that data being easily identified when such equipment or media is moved, including within our premises.

Technical measures

access controls limiting who may handle the data and the scope of the databases handled;
systems protecting the information systems that handle personal data against unauthorised access and malicious software.

Understanding the environment abroad

The Company applies its security measures having taken account of the personal data protection regimes in force in Canada and the United States, where the data is hosted.

9. Supervising our suppliers

Where the Company entrusts all or part of the handling of personal data to a third party, it enters into a contract with that supplier that includes a confidentiality clause, or requires them to accept the terms it sets, and exercises the necessary and appropriate supervision so that the data is kept secure at the supplier.

10. Limits on passing data to third parties

The Company does not pass personal data to third parties without the individual’s prior consent, except where:

the law so provides;
passing the data is necessary to protect a person’s life, physical safety or property and it is difficult to obtain their consent;
it is particularly necessary to improve public health or to promote the healthy development of children and it is difficult to obtain that consent;
it is necessary to cooperate with the State, a local authority or a delegated body in carrying out a task laid down by law, and obtaining consent would risk hindering that task;
the data is passed to an academic research body that needs to handle it for research purposes (including where that purpose is only partial), unless there is a risk of unjustified interference with individual rights and interests;
the matters set out in Article 27(2) of the Act have been notified or published in advance.

The following are not treated as passing data to third parties:

passing personal data as a result of entrusting all or part of its handling to a supplier, within what is needed to achieve the stated purposes;
passing personal data as a result of a universal transfer of business, following a merger or for another reason;
using personal data jointly with specified parties, where that fact, the categories of data concerned, the parties involved, their purposes of use and the name, address and representative of the party responsible for managing that data have been notified to the individual in advance or made readily accessible. Where the purposes of use or the name, address or representative of the party responsible change, the Company notifies or makes readily accessible the content of that change.

11. Information we make available

The Company makes the following available to individuals, or answers without delay on request:

the purposes for which personal data is used (other than those for which the Act imposes no such obligation; where the Company decides not to answer, it tells the individual without delay);
the contact point for questions about personal data.

12. Right of access

Where an individual asks for access to their personal data, the Company provides it without delay. However, in the following cases the Company may withhold all or part of the data, and will then notify its decision without delay:
1. where there is a risk of harm to the life, physical safety, property or other rights and interests of the individual or a third party;
2. where there is a risk of serious disruption to the proper conduct of the Company’s business;
3. where it would breach another legal provision.
Information other than personal data, such as access logs, is not normally disclosed.
The preceding paragraph applies by analogy to the records of transfers to third parties created under Article 29(1) of the Act and the records of receipts from third parties created under Article 30(3) of the Act, in respect of personal data identifying the individual.

13. Right to have data corrected

Where an individual asks for their personal data to be corrected, added to or deleted on the ground that it is inaccurate, the Company carries out the necessary checks without delay, within what is needed to achieve the stated purposes and unless a specific procedure is laid down by another legal provision, makes the corresponding corrections on the basis of those checks and tells the individual. This does not apply where the Act or another legal provision places no such obligation on the Company.

14. Right to object and right to erasure

The Company carries out the necessary checks without delay, applies the requested measure on the basis of the results and tells the individual, where that individual asks, in accordance with the Act, for: (1) the use of their personal data to stop or the data to be erased, on the ground that it is being handled beyond the published purposes, is being used in a way likely to encourage or induce unlawful or improper acts, or was obtained by deception or another improper means; (2) the passing of their data to third parties to stop, on the ground that it was passed on without their consent; or (3) the use of their data to stop, or the passing of it to stop, on the ground that the Company no longer needs to use it, that one of the situations set out in Article 26(1) of the Act has arisen, or that the handling risks harming their rights or legitimate interests. Where the requested measure would involve substantial cost or would otherwise be difficult to carry out, and an alternative measure sufficient to protect the individual’s rights and interests is possible, the Company takes that alternative measure. This does not apply where the Act or another legal provision places no such obligation on the Company.

15. Explaining our decisions

Where, despite the individual’s request, the Company decides:

not to notify the purposes of use;
not to disclose all or part of the personal data;
not to stop using or erase the personal data;
not to stop passing it to third parties,

it endeavours to explain the reasons when notifying its decision.

16. Contact

For any question about this privacy policy, please write to us at:

162-0067
Musashiya Sky Bldg 101, 16-11 Tomihisa-chō, Shinjuku-ku, Tokyo, Japan
Yukai Engineering Inc. (Chief Executive Officer: Shunsuke Aoki)

You can also use our contact form or write to [email protected].

[Revised version of 30 August 2022]