Company

This document is an English translation of the Japanese Privacy Policy, provided for convenience purposes only. The Japanese original shall constitute the governing and legally binding version. In the event of any conflict, ambiguity, or inconsistency between this translation and the Japanese original, the Japanese original shall prevail in all respects.

CLOUD HEART JAPAN Co., Ltd. (registered office: ARK Hills Front Tower RoP 1205, 2-23-1 Akasaka, Minato-ku, Tokyo; Representative Director: Kaname Nagayama; hereinafter "the Company." The Company is a wholly owned subsidiary of OBI HOLDINGS PTE LTD) sets forth the following Privacy Policy (hereinafter "this Policy") regarding the handling of users' personal information in the EC service "CLOUD HEART" (hereinafter "the Service") provided by the Company in connection with sporting goods and related products.

1. Article 1 — Definition of Personal Information

   In this Policy, "personal information" refers to information relating to a living individual as defined under Japan's Act on the Protection of Personal Information (Act No. 57 of 2003; hereinafter "APPI"), including information that can identify a specific individual through name, date of birth, address, telephone number, email address, or other descriptions. As the Company processes part of its personal data on servers located in the Republic of Singapore, Singapore's Personal Data Protection Act 2012 ("PDPA") is also referenced where applicable.

2. Article 2 — Methods of Collecting Personal Information

   In connection with users' use of the Service, the Company may collect the following information:

   • Registration information such as name, address, telephone number, and email address

   • Transaction-related information such as payment information and delivery address

   • Service usage history, access logs, browsing history, and similar information

   • Information obtained through cookies, device identifiers, and similar technologies

3. Article 3 — Purpose of Use

   The Company uses collected personal information for the following purposes:

   • To provide, operate, maintain, and improve the Company's EC site (the Service)

   • To process product orders, pack and ship products, process payments, and communicate delivery status

   • To respond to inquiries and verify identity

   • To deliver information via email regarding new products, sales, campaigns, and other updates related to sporting goods handled by the Company

   • To analyze users' purchase history, browsing history, and similar information to provide product recommendations and deliver targeted advertising based on individual preferences. However, for users detected as accessing from the EU/EEA, the Company does not analyze behavioral history for advertising purposes, and limits such display to recently-viewed items within the Service.

   • To detect, prevent, and respond to fraudulent orders, unauthorized access, and other improper activities in the Service

   • For other purposes incidental to the above

4. Article 4 — Changes to Purpose of Use

   The Company may change the purpose of use of personal information to the extent that a reasonable connection to the original purpose is recognized. Any such changes will be published on the Service.

5. Article 5 — Management of Personal Information

   The Company will implement necessary and appropriate measures to maintain the accuracy of personal information and manage it securely.

   The Company handles personal data on servers located in the Republic of Singapore provided by its parent company, OBI HOLDINGS PTE LTD, and implements necessary and appropriate security management measures with a proper understanding of Singapore's personal information protection framework (PDPA). Measures to prevent unauthorized access, leakage, falsification, and loss include:

   • Encryption of personal data (during transmission, reception, and storage)

   • Access controls (only authorized personnel may access personal data)

   • Implementation of unauthorized access detection systems and regular security audits

6. Article 6 — Provision to Third Parties

   The Company will not provide personal information to third parties without the user's consent, except in the following cases:

   • When required by law

   • When necessary to protect a person's life, body, or property

   • When required to comply with a request from a public authority

   • When provided to a business contractor within the necessary scope

7. Article 6-2 — Joint Use with Group Companies

   Pursuant to Article 27, Paragraph 5, Item 3 of the APPI, the Company may jointly use personal data with its parent company, OBI HOLDINGS PTE LTD, as follows:

   • Items of personal data subject to joint use: Name, address, telephone number, email address, purchase history, and delivery address

   • Scope of joint users: OBI HOLDINGS PTE LTD (Address: 83 Clemenceau Avenue, #18-01 UE Square, Singapore 239920)

   • Purpose of use by joint users: Group management, consolidated reporting, and brand operation oversight

   • Party responsible for the management of personal data: CLOUD HEART JAPAN Co., Ltd. (Address: ARK Hills Front Tower RoP 1205, 2-23-1 Akasaka, Minato-ku, Tokyo; Representative Director: Kaname Nagayama)

8. Article 6-3 — Transfer of Personal Data to Foreign Countries

   The Company may store and process users' personal data on servers located in the Republic of Singapore provided by its parent company, OBI HOLDINGS PTE LTD, and may also provide such data, within the scope of outsourced duties, to its affiliate OBI MEDIA PTE LTD (Singapore), which is engaged to operate part of the Service. An overview of Singapore's personal information protection framework is as follows:

   • Singapore has a comprehensive personal data protection law, the Personal Data Protection Act 2012 (PDPA), which applies to the private sector.

   • Singapore participates in the APEC Cross-Border Privacy Rules (CBPR) system, which provides a framework for cross-border data transfers.

   • However, Singapore has not received an adequacy decision from the EU under Article 45 of the GDPR, and is not designated as a country with a personal information protection framework equivalent to Japan's under Article 28 of the APPI.

   In connection with the above data transfers, the Company will obtain the user's consent to the provision of personal data to a third party located in a foreign country, pursuant to Article 28, Paragraph 1 of the APPI.

   The Company continuously implements in Singapore measures equivalent to those required of personal information handling businesses under Chapter 4, Section 2 of the APPI, and has implemented measures corresponding to the eight principles of the OECD Privacy Guidelines.

   In the event that additional countries or regions in which personal data is stored or processed are added in the future, this Policy will be updated and published on the Service.

9. Article 6-4 — Special Provisions for Users Located in the EU/EEA

   For personal data of users residing in the EU/EEA, and in light of Japan having received an adequacy decision from the European Commission under the GDPR, the Company handles such data in compliance with the "Supplementary Rules" established by Japan's Personal Information Protection Commission regarding the handling of personal data transferred from the EU on the basis of the adequacy decision.

   The Company determines, on the basis of geolocation using IP address and similar signals, whether a user is accessing from the EU/EEA. Where a user is so identified, the Company does not offer the Marketing/Advertising Cookie category at all, and does not carry out any associated profiling. The processing of personal data for such users is limited to what is necessary to provide the Service (order processing, delivery, inquiry response, core functions via Necessary Cookies, and Analytics Cookies used only for first-party purposes). On this basis, the Company considers its processing of EU/EEA users' personal data to be occasional within the meaning of GDPR Article 27(2)(a), not to involve large-scale processing of special categories of data, and, given its nature, scope, context and purposes, unlikely to result in a risk to the rights and freedoms of natural persons. The Company therefore relies on this exemption and has not appointed a representative in the EU under Article 27 of the GDPR. The Company periodically reviews the proportion and volume of EU/EEA traffic, and will promptly appoint an EU representative if the processing comes to exceed the scope of occasional processing.

   Where the Company further transfers such data to Singapore — to its parent company OBI HOLDINGS PTE LTD (joint use, Article 6-2) or to its outsourcing partner OBI MEDIA PTE LTD (outsourcing, Article 7) — the Company implements appropriate safeguards under Article 46 of the GDPR, including the execution of Standard Contractual Clauses (SCCs), separately for that onward transfer.

   The Company further confirms the following with respect to users residing in the EU/EEA:

   1. The Company processes personal data within the purposes set out in Article 3, on the basis of contractual necessity, the user's consent, or the Company's legitimate interests.
   2. Users have the right to access, rectify, erase, and restrict the processing of their personal data; the right to data portability; the right to object (including to direct marketing); and the right to withdraw consent. To exercise these rights, please contact us at the address in Article 15.
   3. The Company does not provide behavior-based recommendations or deliver targeted advertising to users residing in the EU/EEA.
   4. Users have the right to lodge a complaint with the data protection supervisory authority of their country of residence (for residents of France, the CNIL).

10. Article 7 — Outsourcing

    The Company may outsource part of the operations related to the Service (such as site operation and content production) to its affiliate OBI MEDIA PTE LTD (Singapore) or other contractors. In doing so, the Company will enter into agreements with such contractors requiring appropriate management of personal information and will exercise necessary and appropriate supervision.

11. Article 8 — Use of Cookies

    The Company uses cookies and similar technologies for the following purposes in connection with the provision of the Service. The types of cookies used, their retention periods, and the recipients thereof are set out in the Cookie Policy.

    (1) Necessary Cookies: used without the user's consent, as they are required to provide core functions of the Service (e.g., cart, login).

    (2) Analytics/Marketing Cookies: used for access analysis and to optimize advertising delivery, and are used only where the user has given consent. Users may change or withdraw their consent at any time via "Cookie Settings" on the site.

    Where the Service automatically determines, based on IP address and similar signals, that a user is accessing from the EU/EEA, the Marketing/Advertising Cookie category is not displayed or offered to that user.

12. Article 9 — Access Analysis Tools

    The Company may use access analysis tools such as Google Analytics to improve the Service. The handling of information obtained through such tools (including cookies and IP addresses) is governed by Article 8 and the Cookie Policy.

13. Article 10 — Disclosure of Personal Information

    Users may request disclosure of their own personal information held by the Company. The Company will respond appropriately in accordance with applicable laws and regulations.

14. Article 11 — Correction, Deletion, and Suspension of Use

    Users may request the correction, addition, deletion, or suspension of use of their own personal information. The Company will respond promptly within a reasonable scope.

15. Article 12 — Use by Minors

    When minors use the Service, parental or guardian consent shall be obtained as necessary. In addition, where a user located in the EU/EEA is under the age of 16, the consent of a parent or legal guardian shall be obtained.

16. Article 13 — External Links

    The Company assumes no responsibility for the handling of personal information on external websites linked from the Service.

17. Article 14 — Changes to This Policy

    The Company may revise this Policy in response to changes in laws and regulations or the content of the Service. Revised content will take effect upon publication on the Service.

18. Article 15 — Contact

    For inquiries regarding this Policy, or to request disclosure, correction, deletion, or suspension of use of personal information, please contact us at:

    CLOUD HEART JAPAN Co., Ltd. — Customer Support

    Registered office: ARK Hills Front Tower RoP 1205, 2-23-1 Akasaka, Minato-ku, Tokyo

    Email: support@cloudheart.com

Last updated: September 22, 2026

CLOUD HEART JAPAN Co., Ltd. (operator of the "CLOUD HEART" EC service at cloudheart.com and shop.cloudheart.com; hereinafter "the Company") sets out this Cookie Policy (hereinafter "this Policy") regarding the use of cookies and similar technologies on this website. This Policy supplements Article 8 of the Privacy Policy and forms part of it.

1. 1. What is a Cookie

   A cookie is a small text file stored in your browser when you visit a website. Cookies allow a website to remember your actions and preferences (such as login status and language settings) for a period of time.

2. 2. Types of Cookies We Use

   The Company uses cookies in the following four categories. Cookies other than "Necessary Cookies" are used only where the user has given consent. Users may change or withdraw their consent at any time via "Cookie Settings" on the site.

   • Necessary Cookies (always active; no consent required)

   • Functional Cookies

   • Analytics Cookies

   • Marketing/Advertising Cookies (not offered to users accessing from the EU/EEA — see Section 3)

3. 3. Handling of Access from the EU/EEA

   Based on geolocation using IP address and similar signals, the Company determines whether a user is accessing from the EU/EEA. Where a user is so identified, the "Marketing/Advertising Cookies" category is not shown as a consent option and such cookies are not used at all. As a result, no behavior-based advertising or profiling is carried out for users accessing from the EU/EEA. Due to the nature of geolocation, accuracy may be affected by VPN use and similar circumstances.

4. 4. Cookie List

   The main cookies used by the Company are listed below (updated as implementation progresses).

   Necessary Cookies

   Cookie Name (example)

   Purpose

   Provider・Retention

   cart, _secure_session_id

   Cart retention, login session, order processing

   Cart retention, login session, order processing (Shopify, Inc. / Session – 2 years)

   Shopify, Inc. / Session – 2 years

   csrftoken

   CSRF protection

   CSRF protection (The Company / Session)

   The Company / Session

   locale

   Language / region setting

   Language / region setting (The Company / 1 year)

   The Company / 1 year

   Functional Cookies

   Cookie Name (example)

   Purpose

   Provider・Retention

   wishlist_id

   Wishlist retention

   Wishlist retention (The Company / 1 year)

   The Company / 1 year

   recently_viewed

   Personalized browsing history

   Personalized browsing history (The Company / 30 days)

   The Company / 30 days

   Analytics Cookies

   Cookie Name (example)

   Purpose

   Provider・Retention

   _ga, _ga_*

   Site usage analysis via Google Analytics 4

   Site usage analysis via Google Analytics 4 (Google LLC / 2 years)

   Google LLC / 2 years

   _gid

   Short-term user identification

   Short-term user identification (Google LLC / 24 hours)

   Google LLC / 24 hours

   shopify_analytics

   Store usage analytics

   Store usage analytics (Shopify, Inc. / 30 days)

   Shopify, Inc. / 30 days

   Marketing(excluded for EU/EEA)

   Cookie Name (example)

   Purpose

   Provider・Retention

   _fbp

   Ad delivery optimization and measurement via Meta Pixel

   Ad delivery optimization and measurement via Meta Pixel (Meta Platforms, Inc. / 90 days)

   Meta Platforms, Inc. / 90 days

   _ttp

   Ad delivery optimization via TikTok Pixel

   Ad delivery optimization via TikTok Pixel (TikTok Pte. Ltd. / 13 months)

   TikTok Pte. Ltd. / 13 months

   _gcl_au, IDE

   Google Ads / retargeting ad delivery and measurement

   Google Ads / retargeting ad delivery and measurement (Google LLC / 90–540 days)

   Google LLC / 90–540 days

5. 5. Managing Your Cookie Preferences

   Users may change their consent for any category other than Necessary Cookies at any time via "Cookie Settings" on the site (for users accessing from the EU/EEA, the Marketing/Advertising option is not shown, as described above). Users may also restrict or block cookies via their browser settings, though doing so may limit certain features of the Service.

6. 6. Changes to This Policy

   The Company may revise this Policy from time to time in response to changes in laws or in our cookie usage. Material changes will be announced on this website.

7. 7. Contact

   For inquiries regarding this Policy, please contact us at:

   Email: support@cloudheart.com

Last updated: September 22, 2026