Privacy Policy

Privacy Policy for Personal Data that is Subject to GDPR (Personal Data related to customers or potential customers)

Version from 29th April 2025

This Privacy Policy stipulates the processing of Personal Data (defined below) related to customers or potential customers (hereinafter referred to as the “Customers’ Personal Data”) in cases where People Co., Ltd. (hereinafter referred to as the “Company”) processes Personal Data of natural persons residing in the European Economic Area (27 EU Member States plus Iceland, Liechtenstein and Norway; hereinafter simply referred to as the “EU”) and such processing of Personal Data is subject to the General Data Protection Regulation (Regulation (EU) 2016/679) stipulated by the European Union and the United Kingdom (hereinafter referred to as “UK”) as saved in UK law (hereinafter both referred to as the “GDPR”).

This Privacy Notice applies to data processing activities managed by People Co., Ltd. (the “Company”), with Pointblank Promotions Ltd acting as the UK Representative in accordance with Article 27 of the UK GDPR. Pointblank Promotions Ltd is not the data controller but operates only as a local contact point and fulfilment coordination partner under the instruction of People Co., Ltd.

Article 1
Contents of Personal Data processed by the Company, Purposes of and Legal Basis for Processing, and Storage Periods

The contents of Personal Data (as defined in Article 4 of the GDPR) obtained by the Company, the purposes of processing, the legal basis for processing, and the retention periods are as follows:

• Customers’ Personal Data
  • (I)Contents:
    • (a)Contract related: [Name, e-mail address, phone number,billing address, shipping/delivery address, payment information (such as credit card number), and purchase history]
    • (b)Questionnaire related: [Name, age, residential address, and email address and relationship of Customer’ child who is subject to questionnaire].
  • (II)Purposes of processing and its legal basis:
    • (a)Conclusion of contracts and fulfilling existing ones: The Company processes the data under point (i)(a) for the conclusion of contracts with Customers relating to our products or any necessary pre-contractual measures as well as for fulfilling existing contracts according to Article 6 (1) (b) of the GDPR.
    • (b)Fulfilment of a legal obligation: The Company may process the data under point (i) for the purpose of fulfilling various legal obligations according to Article 6 (1) (c) of the GDPR.
    • (c)Marketing: The Company processes the data under point (i)(a) and (b) for marketing purposes (except emails and phone calls) based on its legitimate interest in advertising products to customers according to Article 6 (1) (f) of the GDPR.
    • (d)Consent: If the Customer freely consents to the processing of data (for example concerning direct marketing via email or phone), the processing is carried out in accordance with the purposes set out in the declaration of consent and to the extent stipulated therein according to Article 6 (1) (a) of the GDPR. 
  • (III)Retention periods:
    • (a)Conclusion of contracts and fulfilling existing ones: The Company processes the data for purposes of point (ii)(a) only as long as they are necessary for the fulfilment of its obligations. In addition, in individual cases, the Company processes the data until the end of a legal dispute or until the expiry of the statute of limitations if claims for damages are asserted.
    • (b)Fulfilment of a legal obligation: The Company processes the data for purposes of point (ii)(c) for how long the specific legal obligation requires it to do so.
    • (c)Consent: The Company processes the data based on consent until this consent is withdrawn,

Article 2
Provision of Personal Data to Third Parties

The Company provides data to the extent necessary to the following external service providers (processors) who assist it in providing its services. All the processors process the data only on the Company's behalf and based on its instructions so that the Company can provide its services. The service providers are as follows:

• Customers’ Personal Data
  • (I)Delivery service providers
  • (II)IT service providers and/or providers of data hosting solutions or similar services.
  • (III)Other service providers, tool providers and software solution providers who also assist the Company in the provision of its services and act on its behalf (including E-commerce service providers, marketing tool providers, communication service providers).

Please note that our online store is powered by Shopify Inc. Shopify may also collect and process personal information independently in accordance with its own privacy policy. For more information, please refer to Shopify’s Privacy Policy.

In addition, the Company transmits data to the following recipients (controllers) to the extent necessary:

• Customers’ Personal Data
  • (I)Legal representatives in the event of legal proceedings, courts as well as collection agencies (the legitimate interests of the Company).
  • (II)Auditors, authorities, courts and other public bodies to the extent required by law.

Article 3
Transfer of Personal Data to Outside the European Union and/or the UK

There are cases in which the Company transfers Personal Data obtained by it to third countries. In such cases, in the absence of an adequacy decision pursuant to Article 45 (3) of the GDPR by the Commission, the Company takes appropriate safeguards as prescribed in the GDPR, including conclusion of a contract that contains standard data protection clauses or obtains explicit, freely given consent for individual cases as defined in Article 49 (1) (a) of the GDPR or the transfer is necessary for the performance of a contract with the Company or the implementation of pre-contractual measures.

Article 4
Rights of Data Subjects

Data subjects of Personal Data obtained by the Company have each the following rights:

• Right to request from the Company access to Personal Data (Article 15 of the GDPR)

• Right to request from the Company rectification or erasure of Personal Data or restriction of processing concerning the data subject (Articles 16 to 18 of the GDPR)

• Right to object to processing of Personal Data by the Company (Article 21 of the GDPR)

• Right to request the Company to offer the convenience of data portability (Article 20 of the GDPR)

• Right to lodge a complaint with a supervisory authority (Article 77 of the GDPR).

Article 5
Withdrawal of Consent

If the legal basis for the acquisition of Personal Data obtained by the Company is the consent of the data subject of the Personal Data, the data subject shall have the right to withdraw his or her consent at any time, provided, however, that such withdrawal of consent shall not affect the lawfulness of processing based on the consent before its withdrawal.

Article 6
Requirement for the Provision of Personal Data

Customers’ Personal Data is required when concluding a contract with the Company.

Article 7
Contact details

For any inquiry or question about this privacy policy, please contact the following desk:

Location: People Co., Ltd.　2-15-5 Higashinihonbashi, Chuo-ku, Tokyo 103-0004 Japan
Department: Overseas Sales Department
Telephone No.: +81-3-3862-3747
Fax No.: +81-3-3862-8584
Email:1-curiosity@people-kk.co.jp

For data subjects residing in the United Kingdom, you may also contact our UK Representative:
Pointblank Promotions Ltd
Gilmoora House, 57–61 Mortimer Street, London W1W 8HS, United Kingdom
Email: info@pointblankpromo.com

Article 8
Updates to this Privacy Policy

The Company may make appropriate changes to this privacy policy from time to time, and we will provide you with a new privacy policy when we make substantial updates. We may also notify you in other ways from time to time about the processing of your personal data.