Last update: February 28, 2024

We are committed to building strong and lasting relationships with our customers based on trust and transparency. In accordance with this philosophy, the protection of your Personal Data ("Data" i.e. any information about or relating to you) is essential to us and we wish to inform you via this Privacy Policy of how we collect and process this Data in accordance with the European General Regulation on Data Protection (Regulation 2016/679, "GDPR").

This Privacy Policy ("Policy") explains how we use the Data we may collect when you interact with us when you are using our website (hereinafter referred to as the "Site"). It contains a general overview of the way We process your Data, as well as detailed description of Our processing activities (see Annex 1).

Specific privacy and data protection information notices and/or consent requests will, if necessary, be communicated to you in specific situations not covered in this Policy where we may process your Data. Such data protection information notices and/or consent requests may however refer to this Policy.

1. WHO CONTROLS THE PROCESSING OF YOUR DATA?

BANDAI SPIRITS CO., LTD. ("BSP"), a company incorporated in Japan whose registered office is at 3-5-19, Mita, Minato-ku, Tokyo, 108-0073, Japan and BANDAI SAS ("BSAS"), a company incorporated in France, registered in the Lyon trade register under n°828 019 489 and whose registered office is at 15 rue Félix Mangini, CS 90618, 69258, Lyon Cedex 09, France are joint controllers of the processing of your Data.

This means that BSAS and BSP jointly determine for what reasons (i.e., the purposes) your Data is processed as well as the resources (i.e., the means) allocated to such processing and are responsible for the processing of your Data.

BSP's DPO is Internet Initiative Japan Inc.: [bnhd-dpo-office@iij.ad.jp]
BSAS's DPO is Lexing Alain Bensoussan Avocats: [PremiumBandai_DPO@bandai.fr]

Please note that to exercise your rights or for any further questions related to the use of your Data, BSP and BSAS have designated a single point of contact, which can be contacted by writing to support@eu-pbandai.zendesk.com

BSAS and BSP are hereafter designated or referred to as "We", "Our" or "Us".

2. WHAT DATA DO WE COLLECT AND FROM WHAT SOURCES?

Depending on how you interact with Us (online, offline, by phone, etc.), we may collect various categories of Data from you, which are described in more details below.

Unless otherwise indicated, or if the collection of your Data is subject to your prior consent, all Data collected by Us is required. If you do not provide such Data, We may not be able to perform Our contract with you, provide you with any information that you may have requested or deliver the products you have ordered.

a) Data you provide to Us

You may provide the following categories of Data when you interact with us for instance when you order products on our Site, when you create a customer account, etc.

• Identification information: this includes information such as your name, age, date of birth, gender, etc.
• Contact information: this includes any information that would allow us to personally contact you, such as your residential and email address, phone number, etc.
• Order and product information: this includes details of the products you have purchased and ordered, receiver's name, shipping address, telephone number, and email address of the receiver, etc.
• Habits and preferences: this includes any information related to your preferences and interests such as your consumption history, category classification of purchased products, unit price of purchased products, etc.
• Payment and transaction-related information: This includes any information you use to make a purchase, such as your payment method. We do not have access to your credit card information processed by our payment service provider.

b) Automatically collected Data

• Technical information: such as your IP address, the browser you use, etc.
• Connection data: logs (identifiers, date and time of connection to our Site, etc.).
• Data relating to your use of our Site: Browser Language, selected area, etc.

For more information about the Data we collect from you and the sources from which we obtain such Data, please refer to Annex 1.

3. SENSITIVE DATA

Article 9 of the GDPR defines sensitive data as any information revealing racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, or data concerning the sex life or sexual orientation of a person.

We do not process sensitive data about you on Our Site.

4. ON WHICH LEGAL GROUNDS DO WE PROCESS YOUR DATA?

We generally use your Data based on the following grounds:

• The performance of the contract we have with you: in certain circumstances, we need your Data to execute our contractual obligations. For example, if you buy products through our Site, we need your name and contact details so we can communicate with you and deliver the products you ordered. If you do not provide your Data, we will not be able to provide you with the requested products;
• Your prior consent: in certain cases, we may ask for your consent before using your Data. For instance, we will always ask for your permission to send you promotional communications;
• Compliance with a legal obligation applicable to us: sometimes we have to collect and use your Data in order to comply with our own legal obligations. For example, in order to enable you to exercise your rights in relation to the processing of your personal data, we need to collect information about your request. Enabling the exercise of these rights is indeed a legal obligation.
• Our legitimate interests: this is a legal term in data protection law which means we have a good and fair reason to use your Data and we do so in ways which does not hurt your interests and rights. For instance, we collect technical information related to your use of our Site to enable and facilitate your navigation on Our Site.

For more information about the legal basis applicable to the processing of your Data, please refer to Annex 1.

5. FOR WHAT PURPOSES DO WE USE YOUR DATA?

We may collect, use and disclose your Data for the purposes listed in Annex 1 of this Privacy Policy.

Such purposes include:

• Creating and managing your member account;
• Managing your product orders;
• Sending newsletters about our products and our activity, coupons and loyalty offerings;
• Processing your questions and any post-sales inquiries;
• Exercising our legal rights in the event of proceedings;
• Handling your requests concerning your Personal Data;
• Protecting your privacy and the security, integrity and availability of our Site;
• Facilitating your navigation on our website.
• Accessing websites and recognizing users;
• Managing cookies on internal websites;
• Direct marketing.
etc

For more information about the purposes for which we process your Data, please refer to Annex 1.

6. AUTOMATED DECISION MAKING

We do not use automated decision-making.

7. WITH WHOM DO WE SHARE YOUR DATA?

Depending on the type of Data and purpose of processing, access may be granted to the following authorized persons:

• Third party providers: your Data may be accessible to selected third-party providers acting on our behalf and our instructions, for the needs of the purposes described above in section 4. For example, our transporters will need to access your Data to deliver the products you ordered, our email publisher agency will need to access your Data to send you our newsletter, etc.
  
  In any case, we require such third parties to:
  • be subject to strict contractual data protection and confidentiality obligations;
  • undertake to comply with all applicable data protection laws and exclusively for the purposes specified in the contract with have with them;
  • implement appropriate technical and organizational security measures designed to protect the integrity and confidentiality of your Data.
• Public and judicial authorities: we might need to share your Data with public and judicial authorities in the event of a litigation.
• Our professional advisers: we also may share your Data, when necessary, with our professional advisers, such as our accountants, auditors, lawyers, insurers, etc.

In any case, please rest assured that We only grant access to your Data on a need-to-know basis, and that such access is limited to the Data that is strictly necessary to perform the purpose for which such access is granted to recipients in their capacity as Data controller or Data processor. We will never rent, trade or sell your Data to third party companies.

For more information about the recipients with whom we share your Data, please refer to Annex 1.

8. WHERE DO WE TRANSFER YOUR DATA?

BANDAI is an international group of companies with worldwide subsidiaries, partners and processors. BSP and BSAS may therefore need to transfer certain Data to other countries, including outside the European Economic Area (EEA).

Your Data is in particular transferred to Japan, where BSP is incorporated. The EU Commission considers that the laws of Japan provide an adequate protection of personal data (Decision 2019/419).

For all other Data transfers, We ensure that adequate safeguards, as required under applicable data protection law, are in place. Such safeguards may include The standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission.

For more information about international transfers of your Data, please refer to Annex 1.

9. HOW DO WE PROTECT YOUR DATA?

We know how much data security matters to all Our customers and take all appropriate steps to protect your Data from unauthorized access, alteration, disclosure, or destruction.

10. HOW LONG DO WE RETAIN YOUR DATA?

We will retain your Data for the period necessary to fulfil the purposes outlined in this Policy.

The criteria used to determine such retention periods include:

i. the length of time We have an ongoing relationship with you;
ii. whether there is a legal obligation to which We are subject;
iii. whether a longer retention period is required or permitted by law.

We regularly review data retention periods according to applicable laws.

At the end of the relevant retention periods, your Data may be archived in separate and secured IT environments for the sole purpose of complying with our legal and tax obligations or to exercise our legal rights in case of proceedings.

11. YOUR RIGHTS AND CHOICES

In accordance with applicable data protection law, you have the right to request:

• Access to the Data We hold about you. You also have the right to obtain confirmation as to whether Data concerning you is being processed or not;
• The correction of your Data if they are incomplete or inaccurate;
• The erasure of your Data, in the cases provided by law. Please note that in some cases, We may be obliged to retain your Data anyway, for legal or legitimate reasons;
• The interruption of the use of your Data, by objecting to the use of such Data where the legal basis for the processing of your Data is Our legitimate interests and We have no compelling overriding legitimate grounds to continue the processing of your Data. You also have the right to object at any time to the processing of your Data for direct marketing purposes;
• The restriction of the use of your Data, if provided by applicable law;
• Withdraw your consent at any time for future processing, when you have consented to any personal data processing activities;
• A copy of the Data you provided Us, in a structured, commonly used and machine-readable format, to transmit it to another data controller, if provided by applicable law. This right only applies when the processing of your Data is based on your consent or on a contract and such processing is carried out by automated means.

In accordance with article 48 of the Law n°78-17 of January 6, 1978 relating to data processing, files and freedoms ("French Data Protection Act") you have the right to define directives relating to the fate of your Data after your death. These directives can be general or specific and can be modified or revoked at any time.

In the absence of directives or of any mention to the contrary in these directives, your heirs may exercise your rights after your death under the conditions of article 85 of the French Data Protection Act.

For more information about your rights under applicable data protection law, you can refer to the French data protection authority's website: https://www.cnil.fr/fr/les-droits-pour-maitriser-vos-donnees-personnelles

Please note that to exercise your rights or for any further questions related to the use of your Data, BSP and BSAS have designated a single point of contact: support@eu-pbandai.zendesk.com

If you feel that your Data has not been handled correctly, or you are unhappy with Our response, you have the right to lodge a complaint with your local data protection authority.

12. MODIFICATION OF THIS POLICY

We may update this Privacy Policy from time to time to improve Our transparency towards You and to reflect any change in the way We are processing your Data. You will be informed in writing of important modifications of this Privacy Policy.