Privacy Policy (Personal Information Protection Policy)

Last Updated: September 6, 2026

Olive Oil Stories Inc. (hereinafter referred to as the "Company") considers it an important responsibility to appropriately handle and protect the personal information of our customers, business partners, and all other individuals involved with the Company.

The Company complies with the Act on the Protection of Personal Information (hereinafter referred to as the "Personal Information Protection Act"), other relevant laws and regulations, and guidelines, and hereby establishes this Privacy Policy (Personal Information Protection Policy) (hereinafter referred to as "this Privacy Policy") to ensure the appropriate acquisition, use, management, and protection of personal information.

1. Scope

This Privacy Policy applies to the handling of personal information and personally related information that the Company acquires in connection with browsing or using the websites, online stores, inquiry forms, and other services provided by the Company (collectively referred to as the "Services"), purchasing or reserving products, registering as a member, making inquiries, subscribing to email newsletters, applying for campaigns, and other transactions or communications with the Company.

Unless otherwise specified, the terms "personal information" and other terms used in this Privacy Policy shall have the meanings set forth in the Personal Information Protection Act.

2. Information We Acquire

The Company may acquire the following information to the extent necessary to provide and operate the Services.

• Contact information such as name, address, billing address, shipping address, phone number, and email address

• Transaction-related information such as product order details, reservation details, purchase history, and return, exchange, and cancellation history

• Membership registration information and account-related information

• Payment method, payment status, transaction identification information, and other payment-related information

• Information provided by customers through inquiries, consultations, surveys, campaign applications, and other means

• Information regarding the use of the Services, including IP address, cookies and other identifiers, device information, browser information, network connection information, browsing history, access date and time, product browsing and cart usage, and other usage-related information

• Other information provided to the Company by customers, business partners, and others

Regarding credit card numbers and other payment information, the Company may not acquire or store this information directly; instead, it may be acquired and processed by a payment service provider.

The Company does not acquire personal information through false or other improper means.

3. Methods of Acquiring Personal Information

The Company primarily acquires personal information through the following methods.

• Information provided directly by customers when they register as a member, purchase or reserve products, make inquiries, subscribe to email newsletters, and other actions

• Information automatically acquired through cookies and other technologies when customers browse or use the Services

• Information acquired from providers of Shopify, payment services, delivery services, and other services used by the Company

• Other methods permitted by laws and regulations

4. Purposes of Use of Personal Information

The Company uses the acquired personal information to the extent necessary to achieve the following purposes.

(1) Sale of products, pre-orders, and provision of the Services

• Receiving, confirming, and managing product orders and pre-orders

• Notifying customers about the expected arrival and shipping dates of pre-ordered products and other pre-order details

• Handling changes to or cancellations of order or pre-order details

• Shipping products, arranging delivery, and confirming delivery status

• Billing, processing payments, and confirming receipt of payment

• Handling returns, exchanges, refunds, and other after-sales services

• Registering, creating, maintaining, and managing memberships and accounts

• Displaying and recommending products based on purchase history and other information

• Other actions necessary to properly fulfill transactions with customers

(2) Responding to inquiries and other communications

• Responding to inquiries, consultations, and requests

• Verifying identity

• Making necessary communications regarding products, orders, reservations, or services

• Providing important notices regarding the Services

• Providing and improving customer support

(3) Providing information about products and services and marketing

• Providing information about new products, pre-orders, advance sales, arrivals, restocks, and product launches

• Providing information about campaigns and events

• Distributing information through email newsletters and other means

• Recommending products and services based on customers' purchase history, browsing history, and other usage information

• Distributing, displaying, optimizing, and measuring the effectiveness of advertisements

• Planning, implementing, and analyzing marketing initiatives

If laws or regulations require customer consent for advertising or promotional communications by email, the Company will obtain the necessary consent in accordance with those laws and regulations.

Customers may unsubscribe from email newsletters and other communications at any time using the method stated in the email or another designated method. However, the Company may continue to send communications necessary for fulfilling orders, reservations, account-related matters, and other aspects of providing the Services even after a customer has unsubscribed.

(4) Improving and planning products and services

• Surveying and analyzing usage and purchase data for the Services

• Conducting surveys and interviews

• Improving products, services, and the website

• Planning and developing new products, services, and content

• Providing services tailored to customers' preferences and usage

• Improving the quality of the Services

(5) Security and prevention of unauthorized use

• Authenticating accounts

• Preventing, detecting, investigating, and responding to unauthorized access, fraudulent orders, fraudulent payments, and other improper activities

• Ensuring the security of information systems and the Services

• Confirming and responding to violations of the Services' Terms of Use and other rules established by the Company

• Protecting the rights, property, and other interests of customers, the Company, and third parties

(6) Compliance with laws and regulations

• Creating and maintaining records required by laws and regulations

• Responding to lawful requests from courts, government agencies, investigative agencies, and other public authorities

• Responding to disputes, litigation, and other legal proceedings

• Fulfilling other legal obligations

(7) Creating statistical information

Creating statistical information processed in a form that does not identify individuals and using it for product and service improvements, business operations, marketing, and other purposes.

5. Use of Shopify

The Company's online store is operated using an e-commerce platform provided by Shopify.

Some of the information provided or acquired when customers browse or use the Services and purchase or reserve products may be collected and processed by Shopify to provide the Services, process orders and payments, ensure security, conduct analysis, improve services, and provide other services offered by Shopify.

Furthermore, if the Company uses "Shopify Network Intelligence" or other advanced services provided by Shopify, Shopify may combine information obtained when customers interact with our store, other Shopify stores, and Shopify services to process it for service improvements, fraud prevention, analysis, personalization, advertising and marketing, and other functions provided by Shopify.

Some of this processing may be performed by Shopify under its own responsibility.

Information acquired through the Services may be transmitted to or shared with Shopify, Shopify's affiliates, and service providers, which may be located outside Japan.

For information about how Shopify handles personal information, as well as the privacy rights and choices Shopify provides to customers, please refer to Shopify's publicly available "Shopify Consumer Privacy Policy" and "Shopify Privacy Portal."

6. Outsourcing the handling of personal information

The Company may outsource all or part of the handling of personal information to third-party providers to the extent necessary to provide and operate the Services.

Outsourced providers include, for example, the following:

• Shopify and other e-commerce platform providers

• Payment service providers

• Delivery and logistics providers

• Providers of email distribution, customer support, and other services

• Website operation, maintenance, and other IT service providers

• Cloud service providers

• Analytics, advertising, and marketing-related service providers

When selecting outsourced providers, the Company will select appropriate providers based on the nature and risks of the information handled and other factors, and will require appropriate handling of personal information through contracts or other means as necessary, while providing necessary and appropriate oversight.

7. Provision of personal data to third parties

The Company will not provide personal data to third parties without obtaining the individual's prior consent, except in the following cases and other cases permitted by laws and regulations.

1. When required by laws and regulations

2. When necessary to protect the life, body, or property of an individual and obtaining the individual's consent is difficult

3. When especially necessary for the improvement of public health or the promotion of the sound development of children and obtaining the individual's consent is difficult

4. When it is necessary to cooperate with a national or local government agency, a local public body, or an entity entrusted by such a body in performing duties prescribed by laws and regulations, and obtaining the individual's consent may impede the performance of those duties

5. Other cases permitted by the Personal Information Protection Act or other laws and regulations

Furthermore, the Company may provide personal data to outsourced providers to the extent necessary for product delivery, payment processing, system operation, and other business activities outsourced to third parties.

When customers use credit cards or other payment methods, necessary information may be provided to card issuers and other related businesses through payment service providers to process payments and detect and prevent fraudulent use.

Furthermore, if a customer selects integration with a third-party service and instructs, requests, or consents to the provision of information to a specific third party, the Company may provide information to the extent of that consent.

8. Handling of personal information outside Japan

As a result of the Company's use of Shopify and other cloud services, customers' personal data may be stored or processed outside Japan.

When handling personal data outside Japan, the Company will understand the personal information protection system of the foreign country, the measures taken by the service provider to protect personal information, and other necessary matters, and will implement necessary and appropriate security control measures in accordance with the Personal Information Protection Act and other relevant laws and regulations.

Furthermore, if laws or regulations require customer consent or other procedures for providing personal data to a third party located outside Japan, the Company will take the necessary actions in accordance with those laws and regulations.

9. Use of cookies and other technologies

The Company may use cookies and other similar technologies on its website and online store to ensure the proper operation of the Services, improve customer convenience, understand and analyze usage of the Services, improve products and services, distribute and optimize advertisements, and measure their effectiveness.

Information acquired through cookies and other technologies may include IP addresses, information about browsers and devices, identifiers, pages viewed, access dates and times, product browsing history, cart usage, and other information regarding usage of the Services.

While this information may not identify a specific individual on its own, it may constitute personal information when combined with other information held by the Company or service providers. In such cases, the Company will handle it appropriately in accordance with this Privacy Policy and relevant laws and regulations.

Customers may be able to limit or refuse cookies through their browser settings or privacy settings provided on the Services. However, disabling cookies necessary for the provision of the Services may prevent some parts of the Services from operating properly.

10. Analytics and advertising services

The Company may use Google Analytics and other analytics services to understand usage of the website and online store and to improve products, services, and the Services.

The Company may also use advertising and marketing services to provide information about products and services, distribute advertisements, and measure their effectiveness.

These services may use cookies and other technologies to collect information such as access data, browsing history, and device information.

The collected information will be handled in accordance with the privacy policies and other provisions established by each service provider.

11. Security management of personal information

To prevent leaks, loss, damage, unauthorized access, and other risks associated with personal data, the Company will implement necessary and appropriate security control measures based on the nature, volume, and intended use of the personal information handled.

Key security control measures include the following:

• Establishing basic policies and procedures for the proper handling of personal information

• Appropriately managing individuals who handle personal information and the scope of information to which they have access

• Providing necessary and appropriate oversight of individuals who handle personal information

• Appropriately managing accounts, access privileges, and authentication information

• Implementing technical measures to protect information systems from unauthorized access, malicious software, and other threats

• Encrypting communications using TLS (SSL) and other technologies

• Appropriately selecting and overseeing outsourced providers when personal information handling is outsourced

• Understanding the systems of foreign countries and implementing necessary security control measures when personal data is handled outside Japan

However, the Company does not guarantee that all risks associated with the transmission and reception of information over the internet and other information processing can be completely eliminated. The Company will endeavor to continue implementing reasonable and appropriate security control measures.

If inquired about the details of the security control measures, the Company will provide information to the extent required to be disclosed under the Personal Information Protection Act and other laws and regulations.

12. Retention period of personal information

The Company will retain acquired personal information for the period necessary to achieve its intended purpose and for the period required by laws and regulations.

The retention period will be determined by considering the Company's business relationship with the customer, account usage, statutory retention obligations, responses to disputes, and other circumstances.

Personal information that is no longer necessary to achieve its intended purpose will be deleted or discarded using appropriate methods, unless retention is required by laws, regulations, or other legitimate reasons.

13. Requests for disclosure, correction, suspension of use, etc. of personal information

As provided by the Personal Information Protection Act and other laws and regulations, customers may make the following requests regarding their own personal data held by the Company:

• Notification of the purpose of use

• Disclosure of retained personal data

• Disclosure of records of provision to third parties

• Correction, addition, or deletion of content

• Suspension of use or deletion

• Suspension of provision to third parties

If you wish to make a request, please contact the inquiry desk listed in "15. Contact Information."

After confirming that the requester is the individual or their lawful representative, the Company will conduct the necessary investigation without delay in accordance with the Personal Information Protection Act and other relevant laws and regulations, and will respond appropriately based on the results.

The Company may be unable to comply with a request if there is no obligation to do so under laws and regulations or if there are other legitimate reasons. In such cases, the Company will inform the customer of this to the extent necessary in accordance with laws and regulations.

Furthermore, if laws or regulations in the country or region where the customer resides grant rights regarding personal information other than those listed above, the Company will respond in accordance with those laws and regulations.

For personal information processed by Shopify under its own responsibility, customers may be able to exercise available privacy rights directly with Shopify through the publicly available "Shopify Privacy Portal."

14. Changes to this Privacy Policy

The Company may change this Privacy Policy as necessary due to revisions to laws and regulations, changes to the Services, changes to external services used, changes to the handling of personal information, or other reasons.

If a material change is made, the Company will notify customers of the content and effective date through this website and other appropriate means.

If laws or regulations require customer consent for a change, the Company will obtain the necessary consent in accordance with those laws and regulations.

15. Contact Information

For inquiries regarding the handling of personal information, this Privacy Policy, requests for disclosure of personal information, complaints, or other personal information-related matters, please contact the following:

Personal Information Handling Business Operator

Olive Oil Stories Inc.
Representative Director: Yumi Nakamura
107-0062
2-2-15 Minamiaoyama, Minato-ku, Tokyo

Inquiries: Inquiry form on this website