Privacy policy

This Privacy Policy describes how HARMONICA Corporation ("HARMONICA", "we", "us", or "our") — operator of the website tcgmartexpress.com (the "Site") — collects, uses, and discloses your Personal Information when you visit or make a purchase from the Site.

1. Data Controller and Contact

Data Controller: HARMONICA Corporation Address: 1-1-20 Kyomachi, Kawasaki-ku, Kawasaki-shi, Kanagawa 210-0848, Japan Email: info@tcgmartexpress.com Phone: +81 3-6821-6141 Corporate Number: 7020001150538

For questions about our privacy practices, to exercise your rights, or to make a complaint, please contact us using the details above.

2. Personal Information We Collect

In this Privacy Policy, "Personal Information" means any information that identifies, relates to, or could reasonably be linked to an identifiable individual.

2.1 Device & Site-Usage Information

• Collected: Browser type, IP address, time zone, operating system, cookie identifiers, pages viewed, search terms, and interactions with the Site.
• Source: Automatically collected through cookies, log files, web beacons, tags, and pixels.
• Purpose: To load the Site accurately, maintain security, prevent fraud, and analyse Site usage.
• Legal basis (GDPR): Legitimate interest (operating the Site securely); consent for non-essential cookies.

2.2 Order & Account Information

• Collected: Name, billing address, shipping address, email address, phone number, payment information (handled directly by payment providers — we do not store full card numbers), order history.
• Source: Provided directly by you at checkout or account registration.
• Purpose: To process orders, arrange shipping with our fulfillment partner, send order confirmations and tracking, communicate about your order, screen for fraud, and (where you have opted in) send marketing communications.
• Legal basis (GDPR): Performance of contract; legal obligation (tax / accounting records); legitimate interest (fraud prevention); consent (marketing).

2.3 Customer Support Communications

• Collected: Information you provide when contacting us (email contents, attachments).
• Source: Provided directly by you.
• Purpose: To respond to your enquiries.
• Legal basis (GDPR): Legitimate interest; performance of contract.

3. How We Share Your Personal Information

We share Personal Information only with the service providers and partners necessary to operate our store and deliver your orders. We do not sell Personal Information.

3.1 Fulfillment Partner — KAMECOLLE Inc.

We have engaged KAMECOLLE Inc. (1-10-7-101 Taihei, Sumida-ku, Tokyo 130-0012, Japan) under a written business-commission agreement to provide inventory management, packaging, and shipping services on our behalf. To deliver your order, we share the following with KAMECOLLE: recipient name, shipping address, phone number, and order details.

KAMECOLLE is contractually bound to handle your Personal Information only for the agreed fulfillment purposes and to apply appropriate security measures. We supervise their handling of your data as required under the Japanese Act on the Protection of Personal Information (APPI).

3.2 Platform & Service Providers

Each provider processes your data under their own privacy policies and data-processing agreements with us.

We do not currently use Meta (Facebook/Instagram) advertising pixels or Google Ads conversion tracking. If we add these services in the future, this Privacy Policy will be updated accordingly.

3.3 Legal Compliance

We may disclose Personal Information when required by applicable laws, regulations, valid legal processes, or lawful requests from public authorities.

4. International Transfers

Because we use cloud-based service providers (notably Shopify, headquartered in Canada with global infrastructure), your Personal Information may be transferred to and processed in countries outside Japan, including Canada, the United States, and the European Union. These transfers are protected by:

• contractual safeguards equivalent to those required by the APPI and GDPR;
• standard data-processing agreements with each provider;
• the providers' own privacy frameworks (e.g., Shopify's Consumer Privacy Policy at https://www.shopify.com/legal/privacy/consumers).

Customers in the EU/EEA: where we transfer your data outside the EEA, we rely on the European Commission's Standard Contractual Clauses or equivalent mechanisms.

5. Your Rights

5.1 All customers

You have the right to:

• Access the Personal Information we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data, subject to legal retention obligations.
• Object to or restrict processing.
• Withdraw consent at any time where processing is based on consent (e.g., marketing).

To exercise any of these rights, email info@tcgmartexpress.com. We will respond within 30 days (or sooner where required by applicable law).

5.2 EU / EEA / UK customers (GDPR)

In addition to the rights above, you have the right to data portability and the right to lodge a complaint with your national data-protection authority. You can find your country's authority at https://edpb.europa.eu/about-edpb/about-edpb/members_en (EEA) or https://ico.org.uk (UK).

5.3 California customers (CCPA / CPRA)

California residents have additional rights including the right to know, delete, correct, and opt-out of the sale or sharing of Personal Information, and the right not to be discriminated against for exercising these rights. We do not sell your Personal Information.

6. Data Retention

We retain Personal Information only for as long as necessary to fulfil the purposes described in this Policy or as required by law:

• Order & transaction records: 7 years from the date of transaction, in accordance with Japanese tax and accounting law.
• Account information: retained for as long as your account remains active. You may request deletion at any time; we will delete data not subject to a legal retention obligation.
• Newsletter subscriber data: retained until you unsubscribe.
• Customer-support correspondence: retained for 3 years from the date of last contact.
• Analytics data: retained according to Google Analytics retention settings (default: 26 months).

After the applicable retention period, data is deleted or anonymised.

7. Security

We implement reasonable technical and organisational measures to protect your Personal Information, including HTTPS/TLS encryption for all data transmission, restricted access controls within our team, encrypted handling of payment data by certified payment providers, and contractual obligations on our service providers (including KAMECOLLE Inc.) to maintain equivalent security standards.

No system is 100% secure; we cannot guarantee absolute security but strive to protect your data using industry-standard practices.

8. Cookies

Cookies are small data files placed on your device. We use the following categories:

• Essential / Functional cookies: required for the Site to operate (cart, login, checkout). Cannot be disabled.
• Performance & analytics cookies: Google Analytics and Shopify analytics, used to understand Site usage and improve performance.
• Advertising cookies: we do not currently deploy advertising-network cookies (Meta Pixel, Google Ads, etc.). This may change in the future, in which case this Policy will be updated.

Cookie durations range from session-based (deleted when you close the browser) to persistent cookies of up to 24 months.

You can manage your cookie preferences through the cookie consent banner shown when you first visit the Site, or through your browser settings. Disabling essential cookies may affect Site functionality.

More information: https://www.allaboutcookies.org

9. Behavioural Advertising & Opt-Out

We do not currently use behavioural advertising networks (Meta Pixel, Google Ads conversion tracking, etc.). If we begin using such services in the future, this Privacy Policy will be updated and you will be able to opt out through the providers listed below:

• Google: https://www.google.com/settings/ads/anonymous
• Facebook / Meta: https://www.facebook.com/settings/?tab=ads
• Digital Advertising Alliance: https://optout.aboutads.info/
• European Interactive Digital Advertising Alliance (EU): https://www.youronlinechoices.com/

10. Do Not Track

Because there is no consistent industry standard for "Do Not Track" signals, we do not currently alter our data-collection practices in response to such signals.

11. Minors

The Site is not intended for individuals under 18 years of age. We do not knowingly collect Personal Information from children. If you believe a minor has provided us with Personal Information, please contact info@tcgmartexpress.com so we can delete it.

12. Shopify Network Intelligence

Shopify may use Personal Information from our store in an aggregated and anonymised manner to provide enhanced services known as Shopify Network Intelligence — fraud prevention, analytics, marketing optimisation, and overall platform performance and security. Shopify processes such data in accordance with its Consumer Privacy Policy: https://www.shopify.com/legal/privacy/consumers

13. Changes to this Policy

We may update this Privacy Policy from time to time. The updated version will be effective on the date posted at the top of this page. Material changes will be communicated through a banner on the Site or by email where appropriate.

14. Complaints

If you have a complaint about how we handle your Personal Information, please contact us first at info@tcgmartexpress.com. If you are not satisfied with our response, you may lodge a complaint with:

• Japan: Personal Information Protection Commission (PPC) — https://www.ppc.go.jp/en/
• EU / EEA: Your national data-protection authority
• UK: Information Commissioner's Office — https://ico.org.uk

---

Operator: HARMONICA Corporation Registered office: 1-1-20 Kyomachi, Kawasaki-ku, Kawasaki-shi, Kanagawa 210-0848, Japan Email: info@tcgmartexpress.com Phone: +81 3-6821-6141