PRIVACY POLICY

Cotton Labo Co., Ltd. (hereinafter referred to as the "Company") respects the privacy of all corporate clients, business partners, organizations, and other entities (hereinafter collectively referred to as the "Corporate Client(s), etc.") that use any of the services (hereinafter referred to as the "Service(s)") that the Company provides and also the privacy of all individuals (hereinafter referred to as the "User(s)") that use the Services, and strives to manage and handle the Users' Personal Information (as defined below) with the utmost care. This Policy applies to all privacy policies and terms of use as specified by the Company for each of the Services it provides as well as other related regulations and the Services themselves.

DEFINITIONS

ARTICLE 1

"Personal Information" means the information that pertains to the Users as individuals, including their names, addresses, phone numbers, email addresses, school names, and other descriptions, etc. that can be used to identify them. Personal Information also includes information that alone is not sufficient to identify the Users but can be easily matched with other information and be used in combination to eventually identify the Users.

TYPES OF DATA OBTAINED BY THE COMPANY

ARTICLE 2

The types of User information that are obtained by the Company are the following depending on the obtainment method.

Information directly obtained from the Users
The Company may obtain the following information in connection with their use of the Services.

Communication and support	When a User contacts the Company (regardless of whether it has an account with the Company) with an intent to request support or report an issue or concern, the Company gathers and stores the User's contact information, message given, and other data specific to the User (including its name, email address, location, OS being used, IP address, and other data that are provided by the User or gathered by the Company using automatic means (as explained below)). The Company then uses the aforementioned data to respond to the User and investigate the matter that is the object of the User's inquiry or concern pursuant to this Privacy Policy.

Communication and support

When a User contacts the Company (regardless of whether it has an account with the Company) with an intent to request support or report an issue or concern, the Company gathers and stores the User's contact information, message given, and other data specific to the User (including its name, email address, location, OS being used, IP address, and other data that are provided by the User or gathered by the Company using automatic means (as explained below)). The Company then uses the aforementioned data to respond to the User and investigate the matter that is the object of the User's inquiry or concern pursuant to this Privacy Policy.

As the Company stores the data, it gets linked to the User's account.

System-obtained information
When a User accesses the Services, the Company automatically obtains the following information.

System data	Terminal type Terminal identifier Browser type Referer IP address Cookie Other advertisement identifiers
Usage data	Statistical data on the Users' use of this website (hereinafter referred to as the "Usage Data"), including without limitation the products accessed, time spent on the webpages and this or any other website being operated by the Company, functions used, click data, date and time data, and other data that indicate the status of the Users' use of the Services.dicate the status of the Users' use of the Services.

System data

Terminal type
Terminal identifier
Browser type
Referer
IP address
Cookie
Other advertisement identifiers

Usage data

Statistical data on the Users' use of this website (hereinafter referred to as the "Usage Data"), including without limitation the products accessed, time spent on the webpages and this or any other website being operated by the Company, functions used, click data, date and time data, and other data that indicate the status of the Users' use of the Services.dicate the status of the Users' use of the Services.

The aforementioned data are gathered using the server log files and other tracking technology. As the Company stores the data, they get linked to the Users' accounts.

PURPOSE OF USE OF PERSONAL INFORMATION, ETC.

ARTICLE 3

The purposes for which the Company obtains the data are as specified in ARTICLE 2 hereof, including their Personal Information, are set forth below (provided, however, that the data that are statistically processed as set forth in ARTICLE 8 hereof are excluded; the applicable data are hereinafter collectively referred to as the "Personal Information, etc."). The Company shall not use the Personal Information, etc. for any other unintended purposes.

Provision of the Services
Identity verification and User authentication
Quality measurement, quality maintenance, and quality improvement of the Services
New service development and marketing
Provision of customized Services and new services
Distribution and sending of various communications, email newsletters, direct mails, notifications, etc. from the Company
Gathering of the Users' opinions, requests, etc. to check their circumstances during and after their use of the Services and to improve the Services, etc.
Editing of information, conversion to statistics, and analysis for publication on websites and other media
Development and provision of services ancillary to the Services
Handling of inquiries, consultations, and complaints, and resolution of disputes
Distribution and displaying of advertisements, contents, etc. and provision of the Services based on the Users' attributes, terminal information, location data, behavioral logs, etc.

VOLUNTARY PROVISION OF PERSONAL INFORMATION, ETC.

ARTICLE 4

If a User chooses not to enter any of the information items that are necessary for their use of the Company's website, they may not be able to receive the concerned service.

PROVISION OF PERSONAL INFORMATION, ETC. TO THIRD PARTIES

ARTICLE 5

The Company may enter into contract with third parties (including without limitation payment processing service companies, product transport companies, etc.) stipulating matters concerning the proper handling of Personal Information and provide the Personal Information, etc. that the Company receives from the Users by sending documents, delivery in person, and other methods as specified by the Company from time to time as needed, in order to provide the Services. In this connection, the Company may provide the Personal Information to any third parties not specified above in the following cases:

if the Company deems that the User to which the Personal Information pertains has a detrimental effect on a third party;
if it is particularly necessary for the Company to do so for public health improvement purposes or to promote the healthy development of youth but it is difficult to obtain the consent of the User;
if it is necessary for the Company to cooperate with any national government agency, municipality, or another party contracted by the aforementioned to execute any administrative task under the law, but the Company's obtainment of the User's consent could interfere with such administrative task execution;
if the Company is requested by a court, the Public Prosecutors Office, police, or any other similar public authority to disclose the Personal Information;
if the Company receives an express request from the User to disclose or provide the Personal Information to the third party;
if the Company is permitted by law to disclose or provide the Personal Information; or
if the Company's business is succeeded by another entity due to a corporate merger or another circumstance and the Personal Information must be provided for such a purpose but within the scope of the intended use that was specified before the business succession.

DISCLAIMERS ON PROVISION OF PERSONAL INFORMATION, ETC. TO THIRD PARTIES

ARTICLE 6

The Company shall be exempted from all responsibility for any instance of a third party obtaining Personal Information, etc. in the following cases:

if a User discloses their Personal Information, etc. to a third party using the function of any of the Services or by another method (if you have any question about the terms of personal information handling by a third party in such a case, please direct it to the third party);
if any information entered by a User through their use of the Services has been used to identify the User unexpectedly;
if a User provides their Personal Information or if their Personal Information is used at an external website that is linked from the Services; or
if another party that is not a User obtains information (ID, password, etc.) with which the User can be identified.

OUTSOURCING OF PERSONAL INFORMATION, ETC. PROCESSING

ARTICLE 7

The Company may hire an outside contractor to outsource to it all or any of the Company's operational tasks that involve handling of the Personal Information, etc. In this case, the Company will take responsibility for such outside contractor's handling of the Personal Information, etc.

USE OF STATISTICALLY PROCESSED DATA

ARTICLE 8

The Company may create statistical data from the Personal Information, etc. provided by the Users by processing them in such a manner that none of the Users' identities can be discerned from the data. The Company may freely use such statistical data without any restriction as long as the Users cannot be identified from the data.

CHANGING, ETC. OF PERSONAL INFORMATION, ETC.

ARTICLE 9

In principle, only each User may request the Company to notify the purpose of use of Personal Information, or to disclose, correct, add, delete, cease use of, or cease provision to third parties of the User's Personal Information that is registered with the Company (hereinafter collectively referred to as "Personal Information Change, etc."). As for the specific procedure through which to make such a request, please send an inquiry to the personal information manager whose contact information is provided below; provided, however, that the Company may not accept a User's request to effect a Personal Information Change, etc. in any of the following cases:
1. if there is a risk that the User's or a third party's life, physical body, property, or any of their rights, benefits, or interests could be jeopardized by it;
2. if it could significantly interfere with the Company's proper provision of the Services; or
3. if it might otherwise violate any law.
Notwithstanding the provisions of the preceding paragraph, if the Company's implementation of a Personal Information Change, etc. requires a significant amount of cost or is difficult for any other reason, while there is another alternative measure available that is necessary to protect the User's rights, benefits, and interests, the Company may refuse to accommodate the request to implement the Personal Information Change, etc.

ACCURACY OF PERSONAL INFORMATION, ETC.

ARTICLE 10

The Company will endeavor to accurately process as data the Personal Information, etc. that are provided by the Users; provided, however, that it is each User's responsibility to make sure that the Personal Information, etc. they provide are all accurate and up-to-date.

RESTRICTION ON OBTAINMENT OF SENSITIVE PERSONAL INFORMATION

ARTICLE 11

In principle, the Company does not obtain any Personal Information that contains the following types of information; provided, however, that the preceding provision shall not apply to cases where such information is provided by the Users themselves:

matters related to their thought, beliefs; and religious matters:
matters related to their race, ethnicity, family origin, domicile (except for prefectural information), physical and mental disorders, criminal history, and other matters that may give rise to social discrimination;
matters related to workers' rights to unite, engage in collective bargaining, and conduct other organized activities;
matters related to their participation in mass demonstrations, exercising of petition rights and other political rights; and
matters related to their health care and sexual life.

IDENTITY VERIFICATION

ARTICLE 12

The Company uses the Users' identification information (such as names, addresses, phone numbers, dates of birth, email addresses, membership numbers, passwords, etc.) to verify their identifies when processing instances of their Service registration, use of the Services, or requests to disclose, correct, delete, or cease use of their Personal Information, etc.; provided, however, that if any other party besides the Users obtains and uses such information that can identify the Users, the Company shall be fully exempted from all responsibility.

OBTAINMENT AND USE OF USER ATTRIBUTES, TERMINAL INFORMATION, LOCATION DATA, BEHAVIORAL LOGS, ETC.

ARTICLE 13

The Company uses cookies to protect the Users' privacy, improve usability, distribute advertisements, and obtain statistical data. The Company may also use technology such as cookies, JavaScript, etc. to obtain information on the Users that they provide that cannot be used to identify them, including their attributes such as age, sex, occupation, residential region, etc. (only limited to the types of information that cannot be used alone or in combination to identify the Users), terminal information, behavioral logs indicating the Users' actions occurring on the Company's Service website (e.g., accessed URLs, contents, order in which they are viewed, etc.) as well as their location data sent based on the Users' consent or request when they are using smartphones, etc.; provided, however, that none of the aforementioned cookies, behavioral logs, etc. shall include any Personal Information. In this connection, when providing the Services, the Company may use a behavioral targeting advertisement service in order to distribute advertisements that are suitable for each User. If a User intends to deactivate such a behavioral targeting advertisement service as set forth above, they can learn how to do so by sending an inquiry to the Company's designated contact point for Personal Information inquiries.
When a User uses the Services, the Company may identify the User, check their pre- and post-login behavioral logs, etc., and distribute or display advertisements, contents, etc., and provide the Services accordingly. If a User desires to unsubscribe from such advertisement distribution, etc., they can learn how to do so by sending an inquiry to the designated contact point for Personal Information inquiries as specified below.

PERSONAL INFORMATION MANAGER

ARTICLE 14

Makoto Ito is the designated personal information manager at the Company.
If you have any inquiry on Personal Information, please send it to the following:
Inquiry:marketing_info@cotton-labo.co.jp

AMENDMENT OF PRIVACY POLICY

ARTICLE 15

The Company may amend this Privacy Policy from time to time as needed. When this Policy is amended, the Company will post the amended version at a certain webpage that will be linked from the top page of the Company's website. After two weeks of the Company's posting of the amendment, the Users that are still using the Services shall be deemed to have consented to the amended version of this Privacy Policy.