Japan Privacy Notice (APPI)

This notice explains how Tanqory Inc. (“Tanqory”, “we”, “us”) collects, uses, discloses, transfers, and protects personal information under Japan’s Act on the Protection of Personal Information (APPI) and guidance from the Personal Information Protection Commission (PPC). It is written for clarity and practical use, aligned with our Data Processing Addendum, and covers lawful processing, purpose limitation, consent, individual rights, cross-border transfers, security, data breach notification, handling of “Special Care-Required” information, youth protections, anonymized/pseudonymized information, and accountability.

Authoritative references:

• PPC APPI overview (English): https://www.ppc.go.jp/en/legal/
• PPC Guidelines (General Rules): https://www.ppc.go.jp/en/legal/ (Guidelines section)
• PPC FAQs and notices: https://www.ppc.go.jp/en/legal/
• APPI (Japanese, e-Gov): https://elaws.e-gov.go.jp/document?lawid=415AC0000000057
• PPC guidance on anonymized and pseudonymized information: https://www.ppc.go.jp/en/legal/ (Guidelines on Anonymously Processed/Pseudonymously Processed Information)
• PPC data breach notification guidance (2022): https://www.ppc.go.jp/news/press/2022/ (in Japanese)
• DPF/adequacy status: https://www.ppc.go.jp/en/news/ (for adequacy decisions)

---

Scope, purpose, and roles

• Scope: Applies to merchants, developers, end customers of merchants, users of our apps/services, and visitors whose personal information is processed under APPI.
• Roles: Tanqory acts as an entrusted party (委託先/processor) when handling merchant customer data under the DPA and as a Personal Information Handling Business Operator (PIHBO/controller) when providing services directly (e.g., merchant accounts, billing, payments, support, platform analytics).
• Coverage: Data you provide, data merchants provide about you, and data generated by Tanqory systems (logs, telemetry, analytics), including data exchanged with third-party providers and cross-border services.
• Language and openness: Notices, Statements of Reasons (SoR), and rights forms are available in English; a Japanese version will be provided to ensure “easily understandable” communication per PPC expectations. Key contact channels support Japanese.
• Accountability: We maintain Records of Processing Activities, clear role allocations in contracts, and risk/impact assessments for high-risk processing to evidence compliance with APPI.

Privacy by design and default

• Purpose limitation, data minimization, security, retention limitation, and openness are embedded into our product lifecycle.
• New or changed processing goes through security and privacy review; higher-risk changes trigger impact assessments and require approval before launch.
• Default settings favour minimal collection and least privilege; non-essential tracking is off by default.
• Identity numbers/passport numbers are avoided unless legally required or strictly necessary; if collected, they are encrypted, access-restricted, and retained for the shortest possible duration.
• Change management logs data flow changes, with rollback plans and audit trails to support accountability.

Openness and publication of purposes (APPI Arts. 27, 32)

• We publish clear purposes of use at or before collection (e.g., on sign-up pages, checkout, SDK prompts, and in-product notices), written in language users can readily understand.
• Material changes to purposes trigger renewed notice and, where required, fresh consent. Notices specify whether provision is voluntary, consequences of refusal, and the scope of third-party provision.
• When acting as an entrusted party, we follow the controller’s documented purposes and instructions; when acting as a PIHBO, we set and publish our own purposes and maintain internal records.
• Public disclosures (e.g., Privacy Policy, service-specific notices) are kept up to date and dated to evidence compliance with APPI’s “Openness” principle.
• We maintain a record of where and how purpose notices are presented (UX copy, screenshots, templates) to prove timing and content of notice.

What we collect, sources, and purposes

We collect only what is necessary for identified purposes. Categories include:

• Account and contact data (name, email, phone, business address, role, authentication credentials): To create/manage accounts, authenticate, support, invoice, and communicate. Basis: contract or consent (where required).
• Transaction and payment data (orders, refunds, disputes, payment tokens via providers, billing details): To deliver services, manage fraud/chargebacks, and comply with finance/tax/AML obligations. Basis: contract and legal obligation.
• Technical and event data (IP, device/browser/OS, app version, event logs, cookies/pixels, language/time zone, session IDs, telemetry): To secure services, prevent abuse, improve reliability/performance, and run non-essential analytics only with consent where required. Basis: legitimate interests and consent for non-essential cookies/trackers.
• Merchant customer data: Orders, fulfillment, communications, preferences, and related metadata processed on behalf of merchants. Merchant is controller; Tanqory is processor under the DPA.
• Special Care-Required personal information (要配慮個人情報) where necessary and lawful: health/medical information, beliefs, race/ethnicity, sexual orientation, disability, or other sensitive attributes collected only with explicit consent or as permitted by law, with strict access controls and encryption.
• Identity verification data: Identity documents, limited biometrics, or financial verification data for fraud/AML where necessary and lawful; RRNs are avoided and, if unavoidable, encrypted and access-restricted.
• Youth/minor data: Collected only with a lawful basis and parental/guardian consent where required; high-privacy defaults and limits on tracking apply.

Sources

• Directly from you: account sign-up, support interactions, device/app telemetry you allow.
• From merchants: order/customer service information needed to process transactions.
• From service providers: payment authorizations, fraud signals, logistics/delivery events.
• From lawful third-party/public sources: sanctions/PEP lists for AML/CTF, fraud prevention.

Illustrative purpose mapping

• Service delivery: onboarding, checkout, fulfillment, shipping updates, invoicing, support.
• Security and fraud/abuse prevention: authentication, device/account integrity, sanctions/AML risk checks, chargeback management, anomaly detection.
• Product reliability and improvement: performance analytics, feature testing, error diagnostics, contextual experience tuning (non-essential analytics only with consent where required).
• Legal and compliance: tax/finance recordkeeping, AML/CTF, responding to lawful requests, enforcing terms, defending claims.
• Marketing (optional): product updates/offers with consent or applicable opt-out/soft opt-in, and in line with telecommunications/unsolicited communication rules.

Legal bases, notification, and consent

• Lawful grounds (APPI Arts. 16, 17, 23): consent; necessity for contract/performance; compliance with legal obligations; protection of life/health/property in emergencies; public interest/official requests; and legitimate interests consistent with APPI (applied cautiously and documented).
• Purpose specification: We state purposes clearly at or before collection and do not use data beyond stated purposes without new notice/consent where required.
• Consent: Specific, informed, unbundled from non-essential services, and easy to withdraw; consent/withdrawal receipts are retained. Separate consent is obtained for Special Care-Required information, third-party provision, and cross-border transfers where required.
• Change of purpose: We notify and seek consent again when purposes change materially, as required by APPI.

Handling Special Care-Required information and identifiers

• We avoid collecting Special Care-Required information unless necessary and lawful; if collected, explicit consent or another legal basis is obtained, with restricted access, encryption, and audit logs.
• Resident identification numbers are generally not collected; if legally required, they are encrypted, access-restricted, and retained briefly.
• Biometrics for security/verification are used only when necessary, with consent or another legal basis, and are deleted when no longer needed.

Lawful basis mapping (illustrative)

• Contract: account setup, authentication, checkout, payment processing, support.
• Legal obligation: tax/finance recordkeeping, AML/CTF, responding to lawful authorities, accounting/commercial code retention.
• Legitimate interests: security monitoring, fraud/abuse prevention, service reliability, limited analytics with minimization and opt-outs where required.
• Consent: marketing (where required), non-essential cookies/trackers, Special Care-Required information, and third-party provision/cross-border where required by APPI.
• Life/health/public interest: urgent protection of life/health/property, or cooperation with public institutions consistent with APPI exceptions, applied narrowly and documented.

Rights of individuals in Japan (APPI Arts. 28–35)

You may request:

• Disclosure/access to retained personal information.
• Correction/addition/deletion of inaccurate or incomplete information.
• Suspension of use/provision or deletion where processing is unlawful, no longer necessary, or consent is withdrawn (subject to legal obligations).
• Stopping third-party provision where APPI conditions are not met.
• Explanation of purposes and categories/recipients where required.

We aim to respond within 30 days; we will verify identity and may request additional information to locate data. If a request is refused or limited (e.g., risk to life/rights, significant business interference, legal obligations), we will explain the reason and reference the applicable APPI provision. Requests and outcomes are logged for accountability.

How to exercise your rights

• Email privacy@tanqory.com with “APPI request” in the subject, your contact details, the right you wish to exercise, and sufficient detail to locate your data.
• We may request additional verification (e.g., ID confirmation).
• If your data originates from a merchant, we may coordinate with that merchant consistent with controller/processor roles.
• Responses are provided securely; where feasible, we can provide structured, machine-readable exports for access requests.
• Complaints: you may contact the PPC (https://www.ppc.go.jp/en/) if you are dissatisfied; we will cooperate with any inquiry or direction.

Fees, limits, and exemptions

• Reasonable cost-based fees may apply for repetitive/excessive access requests as permitted by APPI; we will disclose any fee in advance.
• We may refuse/limit requests where APPI exemptions apply (e.g., risk to life/body/property, third-party privacy, significant interference with operations, violation of other laws, trade secrets).
• Deletion/suspension may be deferred where retention is legally required (e.g., finance/tax, AML) or necessary for legal claims; data will be segregated and access-limited during required retention.

Appeal and escalation

• Request reconsideration with additional context if you disagree with our response.
• Escalate to the PPC using official channels; we cooperate with PPC investigations/directions.
• For merchant-related disputes (e.g., product/service issues), contact the merchant as controller; we will coordinate within agreed roles.

Youth and minors

• We apply high-privacy defaults for minors and disable behavioural tracking/targeted ads for identified minors.
• For users under the age thresholds applied in context (e.g., under 18 for restricted content, stricter controls under 13), parental/guardian consent is required for non-essential processing; age gates and proportionate age assurance are used.
• Age-restricted content/features are segregated; parental controls allow pause/deletion requests with audit trails.
• We consider relevant Japanese laws/guidelines (e.g., Consumer Contract Act, juvenile protection norms) to avoid unfair contracts with minors.

Automated decision-making (ADM) and profiling

• ADM/profiling (e.g., fraud/risk scoring, personalization) is subject to human oversight for decisions with legal or similarly significant effects.
• Where required, we provide meaningful information about logic/principal factors and consequences, and offer opt-out from direct marketing profiling.
• Models and thresholds are reviewed to reduce bias and unintended impacts; high-risk ADM undergoes impact/risk assessment.
• Adverse decisions may be escalated for human review unless immediate risk requires temporary holds.

ADM transparency and controls

• Logic summaries: Upon request and where required, we share principal factors influencing decisions and safeguards applied.
• Human intervention: Channels are available to request human review of significant ADM outcomes (e.g., account/transaction blocks).
• Bias monitoring: Periodic testing for false positives/negatives and bias across relevant segments; thresholds adjusted to mitigate unfair outcomes.
• Versioning/rollback: Model versions and changes are logged; rollback plans exist for unintended behaviour.
• Scope limits: Sensitive categories are excluded from ADM unless necessary and lawful; marketing profiling respects consent/opt-out.

Cookies and similar technologies

• Strictly necessary: for security, authentication, core functionality.
• Analytics/marketing: used only with consent where required.
• Preferences managed via cookie banner/control centre or browser/app settings. See Cookie Policy: https://legal.tanqory.com/legal/platform/cookie-policy.

Cross-border transfers (APPI Art. 28)

When personal information is transferred outside Japan, we provide prior notice and obtain consent where required, stating destination country/region, information on the recipient’s data protection system, safeguards (e.g., contracts, organizational/technical measures), purposes, data items, retention/use period, rights to withdraw/opt-out, and potential impacts of refusal. Safeguards include:

• Contractual protections: APPI-equivalent clauses, security/breach notice, onward transfer limits, audit/inspection rights where appropriate.
• Technical/organizational measures: encryption in transit/at rest, access controls, logging, minimization/tokenization.
• Transfer risk assessments and justifications recorded; contracts reviewed periodically.
• Hosting choices: Japan (e.g., AWS Tokyo) and regional options; alternative routing/replication plans if legal requirements change.
• Adequacy: EU/UK currently recognized; others require contracts/measures and, where needed, consent.

Third-party provision (Art. 27) and opt-out framework

• Consent is obtained before third-party provision unless an APPI exception applies. Notices include recipient, purpose, data items, retention/use period, and consequences of refusal.
• We do not use the opt-out framework (Art. 27-2) for cross-border transfers of personal data; if ever used domestically, required public notices, PPC filings, and opt-out mechanisms would be provided.
• Joint use (Art. 27-5) is not applied unless explicitly disclosed with required details (scope of parties, items, purposes, responsible party).

Records and traceability

• Provision logs (date/time, recipient, items provided, method, legal basis/consent) are retained for audit.
• Transfer assessments document destination risks (legal environment, security posture, access risks) and mitigation; reassessed if circumstances change.

Data localization and infrastructure choices

• Primary hosting for Japan-facing services is available in Japan (e.g., AWS Tokyo) to reduce cross-border movement; regional redundancy is configured with controls that respect APPI transfer requirements.
• Content delivery and DDoS protection may use global infrastructure; data is minimized, encrypted, and subject to contractual safeguards.
• For latency or resilience, data may be replicated outside Japan; such replication follows Article 28 safeguards, with notice/consent where required and documented risk assessments.
• If laws or adequacy findings change, we can adjust routing/replication, implement additional encryption/key management controls, or localize workloads further.
• Payment data is handled through PCI DSS–compliant providers; tokens rather than full card data are stored where feasible.

Security measures (APPI Art. 23 and PPC Guidelines)

• Administrative: security/privacy policies, defined roles/responsibilities, employee training, risk assessments, vendor management, and incident response plans.
• Technical: encryption (TLS 1.3/AES-256), RBAC/MFA, least privilege, segregation of duties, 24x7 monitoring (SIEM/SOC), vulnerability management, anti-malware, WAF/IDS/IPS, secure SDLC/code review.
• Physical/environmental: through vetted data centres/hosting providers with access controls and resilience.
• Subprocessor security: due diligence and contractual safeguards aligned to standards (e.g., SOC 2, ISO 27001, PCI DSS for payments).

Security implementation details

• Access control: RBAC with least privilege, periodic access reviews, MFA enforced for privileged roles, and hardware security keys for production access where feasible.
• Data protection: Encryption in transit and at rest, key management with separation of duties, tokenization for payment flows, and strict segregation between environments (prod/non-prod).
• Secure development: Code reviews, dependency scanning, SAST/DAST, secret scanning, infrastructure as code with peer review, and change approval workflows.
• Monitoring and response: Centralized logging, anomaly detection, playbooks for common incidents, tabletop exercises, and recovery time objectives defined per service tier.
• Business continuity: Backups tested periodically; disaster recovery plans include region failover where supported by the provider.
• Third-party testing: Periodic penetration testing and independent assessments; remediation tracked to closure.
• Employee safeguards: Confidentiality obligations, acceptable use policies, joiner/mover/leaver processes, and device management (disk encryption, EDR).

Retention and destruction

• Retention is limited to what is necessary for stated purposes and legal obligations (e.g., tax/finance, AML, accounting).
• Upon purpose completion or service termination, personal information is destroyed without delay, or segregated if retention is legally required, then destroyed at end of that period.
• Destruction methods: secure wiping for electronic data; shredding/incineration for paper; deletion from backups on scheduled cycles.
• Retention schedule: https://legal.tanqory.com/legal/data-protection/data-retention-policy (Japan-specific summaries available on request).
• Destruction logs are kept for audit; proof can be shared under NDA if required.

Retention illustrations

• Account and billing data: Contract duration plus statutory finance/tax periods.
• Payments/transactions: Retained per financial/AML obligations and chargeback windows.
• Security logs: Retained for periods needed for incident investigation and compliance.
• Marketing consents/suppressions: Retained to evidence compliance and honour opt-outs.
• Backups: Purged on rolling cycles with documented timelines.

Retention governance and controls

• Retention rules are codified in data lifecycle playbooks and applied via automated policies where feasible; manual overrides require documented justification.
• Periodic reviews confirm retention rules align with current legal obligations (e.g., Commercial Code, tax laws) and business needs; changes are logged and communicated to system owners.
• Where deletion is delayed due to legal holds or accounting obligations, data is access-restricted and segregated until deletion is permissible.
• Proof of deletion (e.g., destruction certificates, system logs) can be provided under NDA for audits or regulator requests.

Anonymized and pseudonymized information (匿名加工情報 / 仮名加工情報)

• Anonymized information: Created per APPI requirements; identifiers are removed/irreversibly processed. Categories used and processing methods are disclosed. Re-identification and combination with other data are prohibited; safeguards prevent matching.
• Pseudonymized information: Used internally for analytics/quality/R&D; keys/mapping tables are separated, access-restricted, and not shared externally. Pseudonymous data is not used for decisions with legal/similar significant effects without additional safeguards/notice.
• If purposes change in ways that affect individuals, notices are updated and consent sought where required.

Data breach notification

• Thresholds: Notifications to the PPC and affected individuals occur when breaches involve Special Care-Required information, risk of property/rights harm, improper use, or 1,000+ data subjects (per 2022 PPC guidance).
• Timeline: Notify controllers/merchants within 24 hours of confirmation; notify PPC promptly and no later than 5 days after determining the breach is notifiable; full report typically within 30 days (up to 60 for complex cases). Notify affected individuals “promptly.”
• Content: Incident details, data affected, timing, likely impacts, mitigation, and user guidance.
• Process: Contain/mitigate immediately, rotate keys/credentials, preserve evidence, conduct post-incident review, and log decisions/timing for audit.

Subprocessors and payments (entrustment)

• Third-party providers (hosting, cloud, security, analytics, payments) operate under contracts requiring APPI-equivalent protection, confidentiality, breach notification, and PCI DSS for payment data.
• Japan-based providers (e.g., AWS Tokyo, regional payment gateways such as Stripe Japan/PayPay/GMO/Rakuten Pay/Konbini) are used where appropriate to minimize transfers.
• Overseas subprocessors follow Article 28 safeguards, with consent/notice where required. Current subprocessors: https://legal.tanqory.com/legal/data-protection/subprocessor-list.

Operator/entrusted party commitments

• Process only on documented instructions; maintain confidentiality; enforce technical/organizational measures; assist controllers with security, breach notices, and data subject requests where applicable; allow oversight/audit where contractually agreed; delete/return data at end of processing unless law requires retention; maintain processing records for services provided as an entrusted party.

Third-party provision vs. entrustment

• Entrustment (委託) to subprocessors is governed by contracts and disclosed via the subprocessor list.
• Third-party provision (第三者提供) as independent controllers requires consent unless an APPI exception applies; disclosures include recipient, purpose, data items, retention/use period, and consequences of refusal. We do not sell personal information.
• Legal exceptions (e.g., life/health emergencies, legal obligations) are applied narrowly and documented.

Record-keeping, governance, and training

• RoPA maintained for APPI-covered processing (purposes, categories, recipients, transfers, retention, safeguards).
• Impact/risk assessments for high-risk processing (e.g., profiling, sensitive data, cross-border changes).
• Governance: accountable owners, change management logs, regular audits, and policy reviews.
• Training: onboarding and periodic refreshers on APPI, security, incident response, handling Special Care-Required information, consent/marketing/DNC-like rules, and privacy by design/default. Role-based modules for engineering/product, support, and sales/marketing. Completion and effectiveness are tracked.

Vendor oversight and audits

• Due diligence on vendors/operators (security, privacy, compliance, financial stability); contracts include breach notification, audit/inspection rights where appropriate, and flow-down obligations.
• High-risk vendors may face periodic reassessment, certification reviews, and requests for control evidence.
• Supply chain security is monitored; incident cooperation clauses are enforced.

Complaints, questions, and redress

• Contact privacy@tanqory.com for privacy questions or complaints, specifying “APPI complaint” in the subject and providing relevant context.
• We acknowledge complaints promptly and aim to provide a substantive response within 30 days, including corrective actions where applicable.
• If you are unsatisfied, you may escalate to the PPC using official channels; we will cooperate fully with PPC directions.
• For merchant-controlled data, we may route or coordinate complaints with the merchant consistent with role allocation.

Marketing and communications

• Direct marketing is sent only where lawful, with clear opt-outs in every channel.
• Channel-specific consent is used where required; soft opt-in is applied only where legally permitted.
• Preferences are enforced promptly via suppression lists; minors are excluded from behavioural targeting.
• Telemarketing/SMS comply with telecommunications and unsolicited communication rules.
• If electronic marketing uses external platforms, contracts require lawful contact acquisition, and suppression lists are synchronized to avoid re-contact.
• Consent withdrawals take effect without undue delay; evidence of consent/withdrawal is retained for audit.
• Marketing content avoids sensitive inferences unless explicitly consented; frequency caps and quiet hours are applied where required by telecom rules.

Interaction with other Tanqory terms

This notice supplements the Tanqory Privacy Policy, DPA, Cookie Policy, and service terms. If there is a conflict, the stricter or more specific document or applicable law prevails. Product- or region-specific notices may add complementary requirements.

Governing law and dispute resolution

This notice is governed by the laws stated in the applicable service agreement/DPA (typically Singapore law), without limiting your rights to seek recourse with the PPC or other competent Japanese authorities under APPI. Contractual dispute resolution (e.g., arbitration) is described in the applicable agreement.

Change history