Attachment 1 (Information about Customers)
Information about Customer:

1.

(Details of content, retention period, and source of acquisition for each category)

The Company processes the following personal information and other personal information acquired by theCustomers in connection with the Company’s business activities (if required by applicable laws and regulations, theCompany will acquire such information after separately notifying the individual concerned).
The Company also process the personal information listed below for the purposes listed below and for other purposespermitted by applicable laws and regulations. The Company may also de-identify or create statistics of personalinformation.
No.
1

Data type

Category

Retention

Source ofperiodacquisition

Information about

Name, address, zip code, gender, date of birth,the Individual

telephone number, e-mail address, account ID, SNS[theaccount information, etc., membership number,Individual]＊

Customersdelivery address information (if the recipient is not theIndividual to whom the information is sent), and otherinformation declared by the Customers
2

Informationontransactions

Information regarding transaction details and purchase＊history, etc.; and Transaction amount

Customers[theIndividual]

34

Information

on

Information on financial accounts, information on

settlement accounts

settlements of accounts and their methods, etc., and[thepayment information

Individual]

Information
obtained

Cookie IDs and other online identifiers,
whenusing the service

device＊＊Customers

Customers

information of the Individual, browsing history and[theother service usage information (including access

Individual]

logs, IP addresses, browser information, browser
language settings, etc.)
5

Other

Information related to inquiries and communications＊

Customersfrom Customers to the Company, as well as the[thecontents of questionnaires, complaints, and claims

Individual](Customer Service Center, etc.)*To determine the appropriate retention period for personal information, the Company consider the volume, nature,and sensitivity of the personal information, the risk of potential damage from unauthorized use or disclosure of thepersonal information, the purposes for which the Company processes the personal information and whether theCompany can achieve those purposes by other means, and applicable legal requirements. If the Company no longer
needs the personal information the Company has collected about the Individual, the Company will delete oranonymize it, or if this is not possible (for example, if the personal information is stored in a backup archive), theOct. 01, 2023 (first edition)

Attachment 1 (Information about Customers)
Company will securely store the personal information of the Customers until the Company are able to delete it, after
which the Company will ensure that no new processing of the personal information of the Customers takes place.

2.

(Details of the purpose and legal basis of the process)

The Company processes personal information in accordance with applicable personal information protection
regulations. Where the GDPR is applicable, the Company processes personal information for the purposes describedbelow and on the legal basis set forth below. In some cases, the Company may obtain the Individual’s consent toprocess the personal information, but even in these cases, the legal basis for processing is "where processing isnecessary for the performance of a contract" or "where processing is necessary for the pursuit of legitimate interests"
or “where processing is necessary to comply with a legal obligations”, except in the cases described below in "Whereobtaining the Individual’s prior consent (Article 6-1 (a), , GDPR)". In addition, the Company will obtain the consent
of the individual to direct marketing to the individual in cases where such consent of the individual to direct marketingis required by law.
Purpose of processing (use)Data type No.

① When the Individual registers for

Legal basis

1

Consent of the Individual

1, 2, 3, 4Consent of the Individual

1, 2, 4, 5Consent of the Individual

the first time as a member on theCompany’s website② Whenreceivingordersandshipping products③ Advertising, PR, etc.
In case of Consent

Legitimate Interests

The information is obtained directly at the time of the Individual's application.

of the individual3.

(Details of sharing and disclosure of personal information and countries of cross-border transfer)

In order to fulfill the purposes of the processing described in the previous article, the Company shares and discloses
the personal information of the Customers to third parties in the following cases. In addition, please refer to theSection 2 of this Privacy Policy for the cases in which the information is provided on the basis of sharing under theJapanese Personal Information Protection Law.
No.

Data type

Details of sharing and disclosure

1Information about theThe Company may share the personal

Individual

information

among

theCountries of cross-border transfer
Not applicable

group

companies.
5OtherThe Company may share the personal
information

among

the

Not applicable

group

companies.

Oct. 01, 2023 (first edition)