zig-zag, Inc. (hereinafter referred to as “Company”) stipulates this privacy policy (hereinafter referred to as “Policy”) with regard to the collection and use of the information on its customer on services provided by the Company (hereinafter referred to as “Service”), and the Company shall comply with applicable privacy and data protection laws in other countries, including the GDPR (General Data Protection Regulation) (hereinafter referred to as “Applicable Privacy and Data Protection Laws”) and other related laws and regulations.
Article 1 Definition of Customer Information
In this Policy, ‘Customer Information' means the information provided by customers, action history information on communication services used by customers, other information generated or accumulated in customers’ device information, information on customers that the Company collects in relation to the provision of affiliated service by the Company’s partner company (hereinafter referred to as “Partner”), and information collected by the Company pursuant to this Policy.
Article 2 The Customer Information to be Collected on the Service
In the Service, the Company will collect the Customer Information detailed below with the consent of customers or based on legal basis under the Applicable Privacy and Data Protection Laws. The Customer Information includes information as detailed below. Customers who do not provide the Company with all or a part of the Customer Information, may not be able to use the Service. The Company will directly collect the Customer Information from customers.
(1) Information to be Provided by a Customer
- Basic information: name (corporate name), date of birth, gender, post code, address (location), phone number, and e-mail address related to customers (including customers specified in the shipping address),
- Other information: Bank account, Payment information, and Information on purchased goods.
- Customer Identification Data: Driver's license information, Passport information, and other information required when confirming a customer's identity as prescribed by laws and regulations including the Japanese Secondhand Goods Business Act.
(2) Information to be Collected by the Company
- Information on terminal devices: The Company may collect information on terminal devices (individual identification information of ID for an information device used by customers.
- Logging information and Action history information: The Company may collect the customer's purchase history of goods, customer’s browsing history of goods, IP address automatically created and stored when using the Service, Date and time of requests made by a customer, and information on operation history on the Company’s website.
- Cookies: The Company may use a technology called ‘Cookies’, or other similar technology namely IDFA, Advertising ID, geolocation technology, and sensor information in the Service to collect the Customer Information.
- Information related to affiliated services: The Company may collect information on contracts between the Partner and customers, type of such affiliated service, the effective date of such contracts, invoice and payment, data collected throughout affiliated services, information sent or received by a customer throughout each affiliate service, usage history, Facebook ID of the Customer Information on coupons or points, information obtained through questionnaire or monitoring survey, and other information obtained through the provision of affiliated services (including applications history, request and inquiries).
Article 3 Consent
By using the Service, customers shall be deemed to have agreed to this Policy. Customers may always withdraw their consent by contacting the Company. However, the withdrawal of the consent shall not affect the legality of the Company’s use of the Customer Information prior to such withdrawal.
Customers under the age of 16 may not use the Service.
Article 4 Purpose of Use
- The Company will not use the Customer Information collected through customer use of the Service beyond the scope of the purpose of use without the consent of the customers. The Company will properly handle obtained the Customer Information in accordance with the purpose of use and within the scope of such purpose of use. In addition, employees or representatives of the Company will, to the extent necessary, access the Customer Information for the purpose of achieving each purpose of use set forth below or pursuant to laws and regulations.
| Purpose of Use | Details of Purpose of Use | Information to be Used | Legal Basis |
|
【Mandatory】 Operation, provision, maintenance, and improvement of the Service. |
・To verify customers' identity and prevent unauthorized use of the Services. ・To execute a purchase agreement ・To deliver goods ・To carry out processing procedures to receive the payment for purchased goods. ・To legally perform work as a postal service (post office box) stipulated in the Japanese Act on Prevention of Transfer of Criminal Proceeds. |
Basic information: Name, Date of birth, Gender, Postal codes, Address, Phone number, E-mail address. Other information: Bank account information, Credit card information, and other information such as payment information Customer Identification Data: Driver's license information, Passport information, and other information required when confirming the customer's identity as prescribed by Japanese Act on Prevention of Transfer of Criminal Proceeds. |
For the performance of a contract with a customer |
|
【Mandatory】 Providing notifications to customers and responding to customers.
|
・To announce the Service and respond to inquiries. ・To announce and provide new services relating to the Service. ・To provide notice regarding the change in the Service’s Terms of Service and/or this Policy, the suspension and discontinuation of the Service, the termination of the contract concerning the Service, and other important information on the Service. ・To cure a breach of the Service's Terms of Service. ・To respond to problems and lawsuits. |
Basic information: Postal codes, Address, Phone number, E-mail address. Other information: Bank account information, Credit card information, and other information such as payment information Customer Identification Data: Driver's license information, Passport information, and other information required when confirming the customer's identity as prescribed by Japanese Act on Prevention of Transfer of Criminal Proceeds. Logging information and Information on action history. Information on terminal devices. Information related to affiliated services. |
For the performance of a contract with a customer |
|
【Mandatory】 Creation of statistical data and provision of such data to third parties. |
・To create and use statistical data being processed in a form that is no longer individually identifiable by analyzing the information on the right column (hereinafter simply referred to as “Statistical Data”). ・To provide the Statistical Data to third parties. *The Company and the third party who receives the Statistical Data from the Company will use such Statistical Data for the following purposes. ・To indicate advertising information that match the needs and interests of customers. ・To analyze advertising effectiveness. ・To carry out market analysis and marketing. |
Basic information: Address Information on terminal devices Logging information and Information on action history. Cookies. Information related to affiliated services. |
For legitimate interests |
|
【Mandatory】 Marketing of the Services
|
・To provide information on the Service and other companies’ services that match the needs and interests of customers and other information including information on Japan. ・To provide services such as issuance of coupons provided in the Service. |
Basic information: Name, Address, Phone number, E-mail address, Date of birth, and Gender. Other information: Information on purchased goods. Logging information and Information on action history.
|
For legitimate interests |
|
【Optional】 To provide the Customer Information to a third party, Meta Platforms, Inc. (hereinafter referred to as “Meta”) to offer marketing services operated by Meta.. |
・For Meta to offer marketing services which provide information on other companies’ services that match the needs and interests of customers and other information including information on Japan.
|
E-mail address | Based on the consent of customers |
2. In addition to what is provided for in this Policy, the Company may, to the extent necessary for the achievement of the purposes detailed in the preceding paragraph and with the prior consent of the customer, mutually provide to the partner and other third parties with the Customer Information including personal information.
3. Except as otherwise permitted under the Applicable Privacy and Data Protection Laws and other laws and regulations, the Company will not use the Customer Information to carry out automated decision-making.
Article 5 Changes in Purpose of Use
The Company may, within a range that is reasonably recognized to be relevant to the purpose of use before the change, change the purpose of use in the preceding Article. If the Company changes the purpose of use, the Company will notify the fact that it will change the purpose of use and information on such change to customers in a manner separately specified by the Company.
Article 6 Collection of the Customer Information
1. The Company will appropriately collect the Customer Information without deceit and other unfair means.
2. If the Company collects the Customer Information in other manners than through that customers’ use of the Service, the Company will provide the customer with prior notice of the purpose of use for such collected the Customer Information and any other information that the Company is required to provide to customers as prescribed by the Applicable Privacy and Data Protection Laws, other laws and regulations, or rules.
Article 7 Security Control Measures
- The Company will prevent the Customer Information from any leakage, loss, and damage, and otherwise, take necessary and appropriate measures to securely manage the Customer Information. Also, the Company will exercise necessary and appropriate supervision over the provision of the Customer Information to its employee or contractors (including subcontractors) and comply with the Applicable Privacy and Data Protection Laws.
- Formulation of the basic policy
The Company formulated the basic policy to ensure the proper handling of the Customer Information. - Establishment of rules for the handling of the Customer Information
The Company established the rule for the handling of the Customer Information concerning how to organize the data, responsible person, personnel and their duties at each stage of collection, utilization, storing, provision, deletion, and disposal of the Customer Information. - Systematic security control
Having a person who is responsible for the handling of the Customer Information as Representative Director & CEO, the Company also specify the employees to handle the Customer Information, defines the scope of the Customer Information to be handled by such employees, establishes the system which enables such employees to report or contact the responsible person in a case where the employee becomes aware of the fact or indicationsignof violation of the Applicable Privacy and Data Protection Laws, and/or regulations for the handling personal information. Also, the Company regularly performs self-inspection and conducts a corporate audit by other departments or an external auditor of the handling of the Customer Information. - Human security control measures
The Company regularly provides its employees with training on points to be considered when handling the Customer Information. Also, the Company prescribes matters concerning the confidentiality of the Customer Information in its employment regulation. -
Physical security control measures.
The Company carries out access control of its employee and limits devices which can be brought into areas to handle the Customer Information and takes measures so that no individuals or entities other than those who are entitled to handle the Customer Information can easily view the Customer Information. Also, the Company takes measures to prevent devices, electronic mediums, and documents from being stolen or lost and to make the Customer Information not readable from such devices and electronic mediums when such devices and mediums are carried around including their relocations within an office. - Technical security control measures
The Company carries out access control, designates personnel and databases containing the Customer Information to be handled by the personnel, and implements the mechanism to protect such information system handling the Customer Information from any illegal access or any illegal software. - Understanding External Factors
Prime Manpower Japan LLC is a company that processes personal data in Makati, Republic of the Philippines and is entrusted with the handling of the Customer Information of the Company. The Company is aware of the system related to the protection of personal information in Republic of the Philippines and takes safety control measures. The Customer Information may be accessed lawfully by courts or law enforcement agencies of the country in which the Customer Information is stored.
Meta is a third party to which the Company provides the Customer Information, and Meta processes the Customer Information in the United States of America.
The Company is aware of the system related to the protection of personal information in the United States of America and takes safety control measures. The Customer Information may be accessed lawfully by courts or law enforcement agencies of the country in which the Customer Information is stored.
- Formulation of the basic policy
- If the Company entrusts all or a part of the handling of the Customer Information to a third party, the Company will execute a Non-Disclosure Agreement with such third party in advance, in which contents of such agreement will follow this Policy and the Company will exercise necessary and appropriate supervision of such third party over security control measures of the Customer Information. The Company will inform of any important information that is necessary to be informed to all customers of the Company (including a case where the Company is affected by a data breach that may have a significant impact on customers) in a manner specified by the Company. Furthermore, customers are requested to provide the Company with the detail of the outsourcing contractor for the process of the Customer Information retained by the Company and the type of the Customer Information to be handled by such outsourcing contractor in a form separately provided by the Company.
- The Company assures the security of the handling of the Customer Information; however, the Company does not guarantee the reliability and complete security of the online communication. If there is a security breach, the Customer Information may likely to be exposed to threats such as identity theft. In the event that such breach occurs, the Company will promptly mitigate the risks therefrom, and will promptly notify the customer if there are any actual risks that may cause significant damage to customers or if the notification of risks is required by laws and regulations.
- The Customer Information is normally stored in a data center located in Japan.
Article 8 Joint Use
The Company may, to the extent necessary for the provision of affiliated services, jointly use the customers’ personal information with the Partner. In such a case, the Company shall publicly announce the name of the Partner, the purpose of joint use, the type of information for joint use, and the chief privacy officer to jointly use such information.
Article 9 Information Collection Module
The Service is incorporated with information collection modules and items similar thereto in order to analyze the Customer Information. Along with this, the Company will provide the Customer Information to providers of information collection modules. These information collection modules use Cookies and collect the Customer Information without including information that can identify individuals. The collected information will be managed pursuant to the privacy policy of the provider of the information collection module and other rules. Please refer to the following URL for the privacy policy and Opt-out in relation to each information collection module.
Google Analytics and Firebase Crashlytics provided by Google Inc.
Privacy Policy
https://policies.google.com/privacy?hl=en
Information about Opt-out
https://tools.google.com/dlpage/gaoptout?hl=en
ONE Intelligence provided by VMware, Inc.
Privacy Policy
https://www.broadcom.com/company/legal/privacy/policy
Information about Opt-out
https://www.broadcom.com/company/legal/privacy/cookie-policy
Flurry provided by Flurry Inc.
Privacy Policy
https://legal.yahoo.com/us/en/yahoo/privacy/index.html
Information about Opt-out
https://legal.yahoo.com/us/en/yahoo/privacy/dashboard/index.html
PartyTrack provided by Adjust Co., Ltd.
Privacy Policy
https://www.adjust.com/terms/privacy-policy/
Information about Opt-out
https://www.adjust.com/forget-device/
Facebook SDK provided by Meta
Privacy Policy
https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0
Information about Opt-out
https://www.facebook.com/help/568137493302217
Hubspot provided by HubSpot, Inc.
Privacy Policy
https://legal.hubspot.com/jp/privacy-policy
Information about Opt-out
*Note: The Privacy Policy includes Hubspot’s opt-out policy.
Article 10 External Services and Link
1. The Company may provide the Service in tandem with services provided by external providers such as Meta and, X Corp. (America) (hereinafter referred to as “External Services”). If a customer wishes to use the Service in tandem with the External Services, the Company may provide the provider of the External Services with the Customer Information which includes address, date of birth, gender, postal code, location, phone number, e-mail address, and other necessary information for the achievement of purpose outlined in Article 4 hereof. Customers acknowledge that the Company may provide the providers of the External Services with such Customer Information; however, customers may request the Company to cease the provision of such Customer Information to the providers of the External Services. Please contact our customer services regarding the procedures for making such request.
2. Use of a mobile device’s applications with a device on version iOS 9 or later will start the “Spotlight” search feature. With this feature, customers are able to find the information they need from location information and date and time information. This feature is provided by the Company in compliance with the condition of use prescribed by Apple Inc. Customers acknowledge that any searched information using the Spotlight search feature will only be stored on a dedicated device. Also, customers agree that the Company will provide the Customer Information to Apple Inc. or third parties. Unless Apple’s condition of use is amended, the Customer Information will not be provided to Apple or other third parties. Customers are able to invalidate indexing and search features in the Service by changing the setting of Spotlight; however, some search features may be restricted.
Article 11 Disclosure and Sharing of the Customer Information
Except for otherwise permitted by the Applicable Privacy and Data Protection Laws or other laws and regulations, and without the approval of customers, the Company will not disclose or share the Customer Information to any third parties. However, exceptions are made in the following cases
A case where the handling of the Customer Information using the Service is outsourced to settlement system companies, credit companies, or banks for the purpose of charging customers for the use of the Service.
A case where the Customer Information is provided to providers of information collection modules or providers of the External Services pursuant to the provisions of the two preceding articles.
A case where necessary measures are taken when a customer conducts an act that damages others or violates public orders while using the Service, or if the customer is about to conduct such an act.
A case where it is in an emergency, and when there is imminent danger to human life and/or asset
A case where disclosure of the Customer Information is requested by public institutions such as courts and police pursuant to laws and regulations.
The Company may transfer the Customer Information to a country or an international organization where the European Commission has not determined of having an adequate level of protection of personal data . In such a case, the Company will take measures which are required by laws and rules (taking appropriate safeguards) and obtain explicit consent from the customer after providing information on risks that may arise from such transfer.
Article 12 Targeted Advertising
The Company will use information collection modules to collect the following information and accumulate or use thereof when providing the Service or affiliated services in order to deliver targeted advertising (advertising technique to deliver advertisement that meets the needs or interests of customers) by the Company or a third party such as an advertisement distribution company.
Information on action history (information that may be used to analyze the needs or interests of customers by accumulating purchase history of goods or use history of the Service and that does not identify specific individuals)
Information on a terminal device
Account information
The Company will provide information collected pursuant to the preceding paragraph to a company distributing advertisement (hereinafter referred to as “Advertisement Distribution Company”) delivering behavioral targeting advertising for the following purposes.
Provision of the Service: Provide contents that improve the convenience of the Service for customers and that deems advantageous to customers.
Advertisement and Marketing: Deliver advertisement that is suitable to each customer, Use them as Statistical Data.
-
The Company may use the following identifiers:
(1) IDFA
Identifier issued by Apple Inc. to identify the terminal device for the purpose of target advertisement. IDFA identifies the terminal device used by a customer, not the customer as an individual. The setting of target advertisement, which is based on IDFA, may be changed on iOS6 device or later; however, such change may limit the availability of the Services in whole or in part. (Please refer to Terms of Use and Privacy Policy provided by Apple Inc. for more details).(2) Advertising ID
Identifier issued by Google Inc. to identify the terminal device for the purpose of target advertisement. Advertising ID identifies the terminal device used by a customer, not the customer as an individual. The Advertising ID may change the setting of devices; however, such change may limit the availability of the Services in whole or in part. (Please refer to Terms of Use and Privacy Policy provided by Google Inc. for more details).(3)Cookies: Cookies are an industry standard technology for the Web server to identify computers used by customers. Cookies may identify computers used by the customer but not identify any individual. The setting of all or a part of Cookies may be invalidated by accessing the Company's website and adjusting settings through the website’s setting menu. However, by doing so, all or a part of the Service may become unavailable.
The Company will retain information on action history collected by customers only for the period that is lawful and necessary for business.
The Company shall endeavor to take the following measures to prevent any leakage, loss and damage of information on action history and for other safety management if such information is provided to the Advertisement Distribution Company.
The Company will not disclose the mechanism to encrypt information on action history.
The Company will provide the Advertisement Distribution Company with information on action history on the condition that such information will be used only within the scope of the purpose of use set forth in Article 12.2
If the Advertisement Distribution Company further provides information on action history to other third parties, the Company will impose the Advertisement Distribution Company the obligation to provide such information on action history to such third parties by attaching the same conditions set forth in the preceding item.
Article 13 Rights of Customers
Customers may, to the extent permitted by the Applicable Privacy and Data Protection Laws or other related laws and regulations, make requests in writing or by e-mail for the notification of the purpose of use, disclosure, correction, addition or removal, suspension, deletion, suspension of the provision to third parties and disclosure of records of provision to a third party, making duplicates, restriction on the handling of the Customer Information, and, or for the exercising its right of objection against such processing activities, access rights, or right to data portability. (hereinafter collectively referred to as “Disclosure”). If a customer requests for the Disclosure, the customer shall fill out the information to identify itself such as name, e-mail address or address and make a request for the exercise of such rights to a contact person set forth in Article 17 hereof.
In a case where a request for the Disclosure is made pursuant to the preceding paragraph by a customer and the identity of the customer is confirmed, the Company, in principle, will disclose the Customer Information within one (1) month of such request and within reasonable limits. However, this shall not apply to a case where the Company is not obliged to disclose the Customer Information pursuant to Applicable Privacy and Data Protection Laws or other laws and regulations and also a case where the same request is repeatedly made by the customer without legitimate grounds. If the Company cannot meet such a request, the Company will notify thereof to the Customer.
Customers have the right to file a complaint against the supervisory authority regarding the use of the Customer Information by the Company.
In a case where a customer meets certain requirements, the customer reserves the right not to be subjected to a decision based solely on an automated process (including profiling) which produces a legal effect on the customer or has a similar significant impact on the customer.
If the Company lifts the restriction on the handling of the Customer Information regarding the Customer Information to which the Company has carried out restrict processing, the Company shall notify thereof to the customer in advance.
To the extent permitted by the Applicable Privacy and Data Protection Laws or other related laws and regulations, customers have the right to request an explanation of the rules regarding the handling of the Customer Information by the Company.
To the extent permitted by the Applicable Privacy and Data Protection Laws or other related laws and regulations, customers have the right to seek remedy for damage caused by the processing of personal information through a speedy and fair procedure.
The Company will not treat the customer differently from other customers for the reason that the customer exercised its right under laws and regulations or this Policy.
Article 14 Handling, Storage and Disposal of the Customer Information
All officers and employees of the Company, who require access to the Customer Information will handle the Customer Information for the achievement of purposes set forth in this Policy or as required or permitted by laws.
The Company shall make reasonable effort to ensure that the Customer Information is always accurate and complete.
If the Customer Information is no longer necessary to achieve the purpose of use, the Company will not store the Customer Information. Also, the Company will not store the Customer Information for other purposes of use not specified in this Policy. If the storage period specified by the Company has elapsed, except for a case where the Company is required to store such Customer Information by laws and rules, such Customer Information will be destroyed. As a specific example of this method, the Company will delete the Customer Information stored as an electromagnetic record to prevent restoration and will incinerate or dissolve any Customer Information written on paper such as a document.
Article 15 Amendment of This Policy
The Company shall make an endeavor to review the operational status with respect to the handling of the Customer Information from time to time and continue to improve such operation. The Company may amend this Policy without the prior consent of customers as necessary. Unless otherwise specified by the Company, the amended Policy shall become effective immediately after it is published on the Company's website. However, if the amendment of this Policy requires the consent of customers by laws, the Company shall obtain the consent of customers in a manner specified by the Company.
Article 16 Other Cautionary Notes
The Service may contain a link to other services than those services managed by the Company, and the Company shall not be liable for the content of such other services and the protection of the Customer Information stored therein.
Article 17 Inquiry
For any comments, questions, or complaints concerning the handling of the Customer Information by the Company or other matters concerning the handling of the Customer Information, please contact the Company by sending an e-mail to the following e-mail address.
Hatchery Shibuya, 14-1 Sakuragaoka-cho, Shibuya-ku, Tokyo, 150-0031
zig-zag, Inc.
E-mail: privacy@zig-zag.co.jp
(The Company accepts inquiries by email 24 hours a day; however, responses may be delayed, depending on the time of the day therefore please take that into consideration).
Article 18 Local Representatives（UK.EU）
The Company shall respect for the privacy and the data subject rights of customers. In addition, the Company shall appoint Prighter Group and its local partners (hereinafter collectively referred to as “Prighter”) as the representative of the Company and the point of contact for customers in following areas.
England (United Kingdom)
European Union (EU)
Prighter provides customers with the information on how to exercise their rights to privacy (including request for access to or deletion of the Personal Data). Customers are encouraged to visit the following website to contact the Company through Prighter or to exercise data subject rights.
https://prighter.com/q/14759318372
Established: February 1, 2016
Revised: March 19, 2020
Revised: June 1, 2024
Revised: October 23, 2026