1. Information we collect

Account details: name, email address and email language. For email-and-password accounts, passwords are stored as a salted one-way hash.
Delivery details: address and phone number
Order details: items bought, amounts, shipping method and status, and any note you add to your order
Payment details: full card numbers and security codes are handled by Stripe; we do not receive or store them. We may receive and keep limited payment information, such as the card brand, last four digits and payment identifiers.
Sign in with Google: if you sign in with Google, we receive your name and email address from Google and use them to identify you and sign you in. We do not receive or store your Google password.
Usage information: pages viewed, search terms, dates and times of use, IP address, device and browser information, and cookie data

2. How we use it

To sell and ship items and to contact you about your orders
To charge payments and make refunds
To answer your questions
To prevent fraudulent orders and misuse
To improve the Service
To keep records required by Japan's Secondhand Articles Dealer Act and other laws

3. Sharing with third parties

We do not share personal information with third parties without your consent, except:

where disclosure is based on laws and regulations;
where needed to protect someone's life, body or property and it is difficult to obtain your consent;
where cooperation with a national or local public authority, or a person entrusted by it, is necessary for duties prescribed by law, and obtaining your consent could hinder those duties.

Handling by our own personnel and provision in connection with outsourcing within the scope necessary to achieve our stated purposes of use do not constitute third-party provision for the purposes of Article 27 of Japan's Act on the Protection of Personal Information (APPI). We entrust the following providers with handling personal information only to the extent necessary. Provision to providers outside Japan is separately subject to Article 28.

Payments: Stripe Japan, Inc. (card processing). Stripe Payments Europe, Limited (Ireland) is also a party for the processing of personal data.
Hosting and email: Amazon Web Services, Inc. (servers that store and process the Service's data, and delivery of emails such as six-digit one-time email-verification codes and order notifications)
Operations and customer support: service providers who help operate the Service and assist customers. Our own personnel or these providers may access personal information from outside Japan (see section 4).
Delivery: Yamato Transport Co., Ltd. and Japan Post Co., Ltd. (delivery address, name and phone number)

4. Transfers outside Japan

Personal data we provide to Stripe for payments may be handled by Stripe group companies outside Japan, including in Ireland, the United States and India. Stripe states that when it transfers personal data to countries not recognized as adequate by Japan's Personal Information Protection Commission, it takes measures such as written contracts with the recipients. Information on each country's data protection system is available on the Commission's website (https://www.ppc.go.jp/personalinfo/legal/kaiseihogohou/#gaikoku). Where we rely on equivalent measures to provide personal data to a third party outside Japan, we periodically check the recipient's implementation of those measures and whether any laws or systems in that country may affect their implementation. If an obstacle arises, we take necessary and appropriate action and stop the provision if continued implementation cannot be ensured. Upon your request, we provide information about these measures as required by law. Please contact us using the details in section 10.

The Service's servers are operated by Amazon Web Services in Singapore, so personal information you provide is stored and processed in Singapore. Singapore's Personal Data Protection Act 2012 governs the handling of personal data there. Information on Singapore's data protection system is available on the Personal Information Protection Commission's website (link above).

Our own personnel or service providers who help operate the Service and assist customers may access personal information from outside Japan. We apply security controls and supervise our own personnel under internal rules and other applicable arrangements. Where we rely on APPI-equivalent measures to provide personal data to a service provider outside Japan, we ensure their continued implementation through contracts binding on that provider or other appropriate and reasonable arrangements, and conduct the periodic checks and other actions described in this section. For this overseas handling, upon your request we provide, without delay and in accordance with law, information about the countries concerned, the data protection systems we have assessed in those countries, and the security measures we have taken, together with the legally required information about APPI-equivalent measures (see section 10).

For deliveries outside Japan, the recipient's name, address, phone number and the contents of the parcel are provided to the postal operators, carriers and customs authorities of the destination country.

5. How long we keep it

We keep account details until you delete your account. Order and transaction records are kept for the period required by the Secondhand Articles Dealer Act and tax law, even after your account is deleted.

6. Security

We take the following measures to prevent unauthorized access to, leaks of and loss of personal information.

Organizational and staff measures: only staff who need it can see customer information, and staff are bound by confidentiality obligations.
Technical measures: connections are encrypted, data is stored on servers with access controls, and passwords are stored as a one-way hash.
Handling outside Japan: where personal data is handled outside Japan, we take the necessary measures after understanding the data protection system of that country.

Except where it would undermine security, we answer questions about these measures without delay.

7. Your rights

You may contact the office listed in section 10 to request disclosure, correction, addition, deletion, cessation of use or erasure of retained personal data, cessation of its provision to third parties, or disclosure of third-party provision records subject to disclosure by law. We verify your identity through a confirmation link or one-time code sent to your registered email address, or through sign-in to your account with us. There is no fee. We will respond without delay in accordance with applicable law.
You can change your name, address and other details in your account settings. You can delete your account under Account → Profile, except while you have an order that has been paid but not yet delivered. This restriction does not prevent you from making the statutory requests described above.

8. Cookies

We use cookies to keep you signed in and remember your language. We do not currently use third-party analytics or advertising cookies; if we introduce them, we will first name the provider and purpose in this policy. You can turn cookies off in your browser, but some features, such as signing in, will then not work.

9. Changes to this policy

We change the purposes of use only within a scope reasonably related to the original purposes, and we notify or publish the new purposes. Where the law requires consent for use beyond those purposes or for sharing, we obtain it before starting. Publishing a change to this policy does not by itself count as that consent.

10. Contact

Company: Enso Enterprises Ltd.
Representative: Dang Thu Ngan, Representative Director
Address: 598-4 Matsuishi, Satte, Saitama 340-0105, Japan
Email: business@en-so.asia