1. Data Controller and Contact Details
SERRUDO 合同会社, identified in English as SERRUDO LLC and the operator of Aiyu Japan, is the controller of the processing activities it determines for its services. Aiyu's operations are managed from Japan. Our corporate details and registered address are provided in the Company Profile.
For privacy inquiries, email info@aiyujapan.com with the subject line "Privacy."
2. Data We May Need
On smaller screens, scroll the table horizontally to view additional columns.
| Category | Data and Primary Purpose |
|---|---|
| Account and contact details | Name, email address, telephone number, country, and AJ ID to manage our relationship and communications. |
| Purchases and parcels | Links, variants, quantities, invoices, addresses, tracking information, inventory records, and instructions required to fulfill the order. |
| Payments and accounting | Amount, status, payment provider references, account holder, and billing details required to verify and record payments. |
| Customer support and claims | Messages, photographs, and documents submitted to resolve inquiries and incidents. |
| Technical security | Access logs, IP addresses, and browser data strictly necessary for security and operation, according to the configuration in use. |
| Compliance | Identification or tax information when required and provided due to shipping, customs, payment, or legal requirements. |
| Voluntary programs | Public link, social media account, shipment, and content submitted to review participation in Aiyunboxing. |
Do not submit data unrelated to the matter at hand. If an authority requires identification, we will explain what is needed, how it will be used, and which authorized channel to use. We do not request full payment card numbers or authentication codes by email or chat.
3. Sources of the Data
The data comes from the customer, persons acting with the customer's authorization, and providers involved in the transaction, such as payment providers, sellers, and carriers. Social media links are reviewed solely for the program requested; they do not authorize access to private messages or personal contacts.
If you provide data concerning a different recipient, you must be authorized to provide it and must ensure that the recipient is made aware of the relevant privacy information.
4. How We Use the Data
We use the data to administer your account; process instructions; purchase, receive, prepare, and deliver orders; handle claims; issue documents; verify payments and prevent fraud; comply with legal obligations; and protect rights in the event of a dispute.
The use of data for advertising, promotional communications, or optional analytics requires separate disclosure and the appropriate legal basis. Acceptance of the Terms of Service does not constitute consent to advertising or non-essential tracking.
5. Legal Basis and International Scope
In Japan, Aiyu will process data for the disclosed purposes and under the conditions required by the APPI. Where another law applies, the relevant legal basis will be identified: performance of a contract, compliance with a legal obligation, a legitimate interest compatible with your rights, or consent.
For the European Economic Area or the United Kingdom, where applicable, the contract may provide the legal basis for processing necessary to fulfill an order; consent may provide the basis for optional communications or technologies; and an assessed legitimate interest may provide the basis for proportionate fraud prevention. We do not claim that all collection is mandatory or that a single consent covers every purpose.
6. Recipients of the Data
We share only the information necessary with parties involved in each transaction: stores or sellers, carriers and customs agents, payment providers, technology service providers, and accounting or legal advisers. Data may also be disclosed to public authorities where there is a legal obligation or other valid legal basis.
Services we use include Stripe and PayPal for payments and freee for accounting, with the data required for each function. The term provider includes a company that processes payments, hosts the website, stores files, or enables communications management; it does not refer solely to the stores from which products are purchased.
Payment and shipping providers may act as independent controllers for certain aspects of their activities. Their respective privacy notices also apply. Aiyu does not sell personal data or authorize any third party involved in an order to use that data freely for advertising purposes.
7. International Transfers
The fact that Aiyu is managed from Japan does not mean that all data remains exclusively in Japan. To deliver an international parcel, the recipient's data must be disclosed to the carriers handling the route and delivery in the destination country.
External payment or technology services may also process data in other countries in accordance with their infrastructure, contracts, and notices. For example, the policies of Stripe and PayPal provide for international data transfers.
Where the law requires specific disclosures, safeguards, or consent for a transfer, Aiyu must satisfy those requirements before making the transfer. You may request information about the processing applicable to your transaction by contacting us at the privacy contact address.
8. Retention
Aiyu reviews the need to retain data annually. There is no single retention period for all categories: the purpose, pending transactions, claims, and applicable statutory periods are taken into account. The annual review does not mean that all data is deleted after one year.
On smaller screens, scroll the table horizontally to view additional columns.
| Category | Retention Criteria |
|---|---|
| Standard photographs of products or parcels | Available for approximately seven days and deleted thereafter. The customer must save a copy during that period. |
| Evidence relating to an incident | Necessary images and documents may be retained for as long as a claim remains pending or a legal retention obligation applies, with access restricted. |
| Account, orders, and communications | For as long as necessary to provide the service and resolve pending transactions, subject to annual review and legal obligations. |
| Invoices, payments, and customs documents | In accordance with the mandatory retention period applicable to each document; the seven-day rule does not apply to their deletion. |
| Identification and technical logs | Only for the period necessary for their purpose and applicable obligations. |
| Aiyunboxing applications | Links, status, and history necessary to review and substantiate the reward; the seven-day rule for standard photographs does not shorten the campaign review period. |
Deleting files under Aiyu's control does not delete posts hosted on the participant's social media accounts. Closing an account also does not automatically delete documents that must be retained by law.
9. Your Rights and How to Exercise Them
Subject to applicable law, you may request access and disclosure, correction, erasure, restriction or cessation of use, information about disclosures, objection, data portability, or withdrawal of consent. Not all rights are absolute or apply in the same manner to every processing activity.
Send your request from the email address associated with your account to info@aiyujapan.com. We will verify your identity only to the extent necessary. We will respond within the applicable statutory period and explain any denial or permitted extension. You may lodge a complaint with the competent authority, including Japan's Personal Information Protection Commission where applicable.
10. Security and Incidents
Access to data must be limited to personnel and services that require it to perform their functions, with technical and organizational measures appropriate to the risk. We do not guarantee absolute security, nor do we transfer to the customer responsibility for failures attributable to Aiyu.
If a data breach occurs that is subject to notification, Aiyu will notify the authority and affected individuals as required by law. You may request human review of an incident relating to your account.
11. Cookies and Marketing
Strictly necessary technologies enable essential functions. Optional technologies are enabled only after providing the information and choice required by law. You can change your selection under Cookies and Preferences. Withdrawal of consent does not render unlawful any processing that was valid before consent was withdrawn.
Opting out of promotional communications does not prevent you from receiving necessary communications about your orders, payments, or security.
12. Changes and Contact Details
Changes will be published with the relevant date and, where appropriate due to their significance, communicated to you. Merely continuing to browse does not authorize a new, incompatible purpose or constitute any required consent. See the Terms for the contractual terms; privacy rights are not subject exclusively to any forum where the law does not permit such restriction.
Japan's PPC publishes the governing data protection framework.