Privacy policy
Privacy Policy
CARRY THINGS / MrM Inc.
| Established | December 3, 2024 |
|---|---|
| Last updated | September 23, 2026 |
| Version | 1.2 |
Introduction
MrM Inc. ("we", "us" or "the Company") regards the appropriate handling of the personal data of our customers and business partners as a social responsibility in operating CARRY THINGS (https://carrythings.com).
This Privacy Policy (the "Policy") explains how we collect, use, manage and provide personal data. By using our services, you are deemed to have agreed to this Policy.
If you do not agree to this Policy, please refrain from using our services. You may withdraw your consent to specific processing at any time (see Article 13). Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Article 1 Applicable laws
We handle personal data in compliance with the following laws and guidelines.
- The Act on the Protection of Personal Information of Japan ("APPI") and its enforcement order and regulations
- Guidelines issued by the Personal Information Protection Commission of Japan
- The EU General Data Protection Regulation (GDPR) and the UK GDPR (where we process data of residents of the EU or the UK)
- Other applicable domestic and foreign laws and regulations
We may revise this Policy from time to time in line with amendments to laws and regulations.
Article 2 Business operator information
| Company name | MrM Inc. |
|---|---|
| Brand name | CARRY THINGS |
| Address | Banshō Building 3F, 1-9-10 Jinnan, Shibuya-ku, Tokyo 150-0041, Japan |
| Representative Director | Suguru Miyanaga |
| Privacy contact | privacy@carrythings.com |
| Data Protection Officer (DPO) | Yashiro (privacy@carrythings.com) |
| EU/UK representative (GDPR Art. 27) | Not appointed at present, as our processing falls within the exemption in GDPR Art. 27(2) and UK GDPR Art. 27(2) (occasional processing, no large-scale processing of special categories of data, low risk). A representative will be appointed and listed here once sales to the EU/UK reach a continuous scale. |
Article 3 Personal data we collect
We collect and store the following personal data in order to provide our services.
(1) Information you provide directly
- Name, address (billing and shipping), telephone number, email address
- Date of birth, gender
- Account information (username, password, security information)
- Credit card, debit card and other payment information
- Purchase history, return and exchange history, wishlist information
- Contents of inquiries and communications with customer support
- Reviews, survey responses and other submissions
- Occupation, job title and company name (for B2B transactions)
(2) Information collected automatically
- IP address, device ID, browser information, OS information
- Browsing and behavioral history collected via cookies and similar technologies (see Article 10 for details)
- How and when you access the service and page transitions
- Location information (GPS, etc., where you have given permission)
(3) Information obtained from third parties
- Transaction information obtained from payment processors and delivery companies
- Data provided by Shopify Inc.
- Information obtained from marketing partners and social media platforms (where you choose to link them)
(4) Anonymized and pseudonymized information
We do not currently create anonymized information (information processed so that a specific individual cannot be identified). Should we do so in the future, we will take security measures in accordance with the APPI and its guidelines and make a public announcement.
We may use pseudonymized information for purposes such as statistical analysis and service improvement. It is managed in accordance with the law and is not provided to third parties.
(5) Data of minors
If a minor uses our services and provides personal data, they must do so with the consent of a parent or other legal guardian. We do not knowingly collect personal data from minors without the consent of a legal guardian.
If it comes to light that a minor's data has been provided without the consent of a legal guardian, the guardian concerned should contact privacy@carrythings.com. We will promptly take appropriate measures, such as deleting the data.
The applicable age standards are as follows.
| Governing law | Definition of minor / consent requirement |
|---|---|
| Japanese law (Civil Code) | Under 18 (amended April 2022) |
| GDPR (EU / UK) | In principle, parental consent is required for those under 16 (member states may lower this to 13) |
| US COPPA | Parental consent is required for those under 13 |
If we sell to the EU, the UK or the US, we will comply with each of the above standards. For users in regions subject to the GDPR, we will obtain verifiable parental consent when processing the personal data of customers under 16.
Article 4 Purposes of use of personal data
We use the personal data we collect within the scope of the following purposes. We do not use it for any other purpose.
Provision and operation of services
- Member registration, login and account management
- Sale of products and services and arrangement of shipping
- Payment processing, billing calculation and refunds
- Processing of orders, returns, exchanges and cancellations
- Provision of points and coupon services
- Service-related notifications to customers (delivery status, etc.)
Customer support and after-sales service
- Responding to inquiries, complaints and objections
- Post-purchase follow-up
Marketing and advertising
- Delivery of email newsletters, direct mail and push notifications (on the basis of consent)
- Delivery of personalized advertising based on behavioral and purchase history
- Running campaigns and surveys
Service improvement and development
- Marketing research and preparation of statistical materials
- Research and development of new services and features
- Improvement of website performance
Legal obligations and security management
- Fulfillment of legal obligations (tax, accounting, etc.)
- Detection and prevention of unauthorized access, misuse and fraud
- Exercise of contractual rights and performance of obligations
- Investigation of and response to violations of our terms
Other operations
- Recruitment activities
- Consideration of business alliances, M&A and the like
- Performance of work entrusted by clients
If you do not provide the necessary information, you may be unable to use some or all of our services.
Article 5 Retention period of personal data
We retain personal data only for the period necessary to achieve the purpose of use. The retention period is determined taking the following factors into account.
- The period necessary to maintain the account and provide services
- Statutory retention periods (e.g. 7 years for tax-related records, e-commerce-related requirements)
- The period necessary for dispute resolution and responding to legal claims
- The period necessary to enforce applicable contracts and policies
Personal data that is no longer needed is securely erased or anonymized.
Article 6 Relationship with Shopify
Our services are hosted by Shopify Inc. (Canada), and we provide our services using the Shopify platform.
Information provided when you use the services is transmitted to and shared with Shopify and its affiliates for the provision and improvement of services. Shopify bears independent responsibility for this data processing.
For how Shopify handles your personal data and how to exercise your rights against Shopify, please see the following.
- Shopify Consumer Privacy Policy: https://www.shopify.com/legal/privacy/app-users
- Shopify Privacy Portal (for exercising your rights): https://privacy.shopify.com/en
We also use certain enhanced Shopify features based on your interactions across our services, other merchants and Shopify as a whole, which allow us to provide a shopping experience tailored to you.
Article 7 Provision of personal data to third parties
We do not disclose personal data to third parties without your consent, except in the following cases.
(1) Provision to service providers
To provide our services, we may provide personal data to service providers such as the following (see the list of service providers in Article 11).
- Payment processors
- Shipping and fulfillment providers
- IT system management and cloud storage providers
- Marketing and advertising delivery providers
- Customer support system providers
- Data analysis and analytics tool providers
(2) Provision to marketing partners
Through Shopify's partner programs, we may provide personal data to marketing partners to support the delivery of personalized advertising based on your online activity on other merchants and websites.
You have the right to opt out of the sale or sharing of your personal data for targeted advertising purposes (see Article 13).
(3) Group companies (joint use)
Please see Article 8 for details.
(4) Where required by law
- Responding to legitimate requests from courts, administrative agencies and law enforcement
- Responding to illegal activity such as money laundering
- Where necessary to protect the rights, property or safety of the Company, users or third parties
- In connection with business transactions such as mergers and business transfers (we will notify you in accordance with applicable law)
(5) At your direction
We disclose data based on your direction or consent, such as when you choose social login integration or integration with external services.
Article 8 Joint use of personal data
We jointly use personal data with our group companies under the following conditions.
| Items jointly used | All personal data listed in Article 3 (1) (name, address, contact details, purchase history, etc.) |
|---|---|
| Scope of joint users | MrM Inc. and our group companies (including companies that join the group in the future) |
| Purposes of use | As set out in Article 4 |
| Party responsible for management | MrM Inc., Representative Director Suguru Miyanaga |
| Contact | privacy@carrythings.com |
Article 9 Matters relating to the EU, the UK and overseas sales (GDPR / UK GDPR)
This Article sets out our policy when providing products and services to customers residing in the EU or the UK.
(1) Application of the GDPR / UK GDPR
In addition to Japan, we sell products to customers residing in the EU and the UK. When we handle the personal data of residents of the EU or the UK, we comply with the GDPR and the UK GDPR.
(2) EU/UK representative
We consider that our processing of the personal data of EU and UK residents is occasional, arising from the sale of products from Japan, does not include large-scale processing of special categories of personal data, and is unlikely to result in a risk to the rights and freedoms of individuals. We have therefore not appointed an EU/UK representative at present, in accordance with Article 27(2) of the GDPR and Article 27(2) of the UK GDPR.
Should sales to the EU or the UK reach a continuous scale, we will promptly appoint a representative and list it in this Policy.
(3) Handling of the personal data of EU and UK residents
- Lawful basis for processing: performance of a contract (order processing, shipping and payment), compliance with legal obligations, legitimate interests (fraud prevention and service improvement), and consent (email newsletters and advertising cookies)
- Cookies for marketing and analytics purposes are used for EU/UK residents only after obtaining prior consent through a consent management banner (CMP)
- When processing the personal data of users under 16, we obtain verifiable parental consent
- Transfers of data outside the EEA and the UK are carried out under appropriate safeguards such as Standard Contractual Clauses (SCCs) or the IDTA (see Article 11)
(4) To customers residing in the EU/UK
Requests to exercise your rights under the GDPR and the UK GDPR (access, rectification, erasure, restriction of processing, data portability, objection, etc.) are accepted at privacy@carrythings.com. For supervisory authorities to which you may lodge a complaint, see Article 14.
Article 10 Cookies and tracking technologies
We use cookies and similar technologies (local storage, pixels, etc.) to improve the convenience of our services, measure traffic and provide personalized experiences.
(1) What are cookies?
Cookies are small data files that a website stores on your device. They are used to remember login information, maintain your cart, count visits and so on. You can disable cookies in your browser settings, but if you do, some features of our services may become unavailable.
(2) Global Privacy Control (GPC)
We support Global Privacy Control (GPC). If you visit with the GPC signal enabled, depending on your region, it is automatically processed as a request to opt out of targeted advertising for the device and browser you are using.
Learn more about GPC here: https://globalprivacycontrol.org/
We do not currently respond to Do Not Track (DNT) signals other than GPC.
(3) Marketing and advertising purposes
We deliver online advertising through the following third-party providers.
| Google LLC |
Privacy policy: https://policies.google.com/privacy?hl=ja Ad settings: https://myadcenter.google.com/ |
|---|---|
| Meta Platforms, Inc. |
Cookie policy: https://mbasic.facebook.com/privacy/policies/cookies Privacy policy: https://mbasic.facebook.com/privacy/policy/ Ad settings: https://www.facebook.com/help/1075880512458213 |
| LY Corporation (LINE Yahoo) |
Privacy policy: https://www.lycorp.co.jp/ja/company/privacypolicy/ Opt-out: https://btoptout.yahoo.co.jp/optout/index.html LINE opt-out: https://optout.tr.line.me/ |
| X Corp. |
Privacy policy: https://x.com/ja/privacy Ad privacy controls: https://help.x.com/ja/safety-and-security/privacy-controls-for-tailored-ads |
| A8.net (F@N Communications, Inc.) |
Privacy: https://www.a8.net/privacy.html Opt-out: https://www.fancs.com/btapolicy |
(4) Performance improvement and analytics purposes
We use the following tools to improve the performance and convenience of our website.
| Google Analytics / Firebase Analytics (Google LLC) |
Information collected: visitor identifiers, device information, session information, location information, behavioral history https://policies.google.com/privacy?hl=ja |
|---|---|
| HubSpot (HubSpot Inc.) |
Information collected: visitor identifiers, device information, location information, browsing history, cookie consent status https://legal.hubspot.com/jp/privacy-policy |
| SATORI (SATORI, Inc.) |
Information collected: browsing history, visitor identifiers, behavioral history https://satori.marketing/privacy-policy/ Opt-out: https://satori.marketing/optout/ |
| KARTE (PLAID, Inc.) |
Information collected: visitor identifiers, browsing history, session information, behavioral history, location information, device information https://karte.io/karte-policy.html Opt-out: https://karte.io/optout/ |
| ad ebis (YRGLM Inc.) |
Information collected: visitor identifiers, browsing history, session information, behavioral history https://yrglm.co.jp/policy/ |
| Microsoft Clarity (Microsoft) |
Information collected: log events, page titles, screen resolution, session information, device information, location information https://clarity.microsoft.com/terms |
| Re:lation (Ingage Inc.) |
Information collected: customer information, input contents, channel information, response history https://ingage.co.jp/policies |
| ChatGPT (OpenAI, LLC) |
Information collected: text data, session information, identifiers https://openai.com/ja-JP/policies/terms-of-use/ |
You can disable cookies or opt out via each tool provider's opt-out page or privacy policy. The information collected is, as a rule, anonymized and does not include information that identifies individuals.
Article 11 Cross-border transfer of personal data and service providers
We may transfer personal data outside Japan. In such cases, we confirm the legal system of the destination and take appropriate protective measures under the APPI and the GDPR (such as standard contractual clauses).
| Shopify Inc. |
Country: Canada Protective measures: measures equivalent to or exceeding the standards of the APPI (Shopify DPA concluded) Reference: https://www.ppc.go.jp/files/pdf/canada_report.pdf |
|---|---|
| Shopify Commerce Singapore Pte Ltd. |
Country: Singapore Protective measures: measures equivalent to or exceeding the standards of the APPI Reference: https://www.ppc.go.jp/files/pdf/singapore_report.pdf |
| Google LLC |
Country: United States (California) Protective measures: measures equivalent to or exceeding the standards of the APPI (standard contractual clauses) Reference: https://www.ppc.go.jp/files/pdf/california_report.pdf |
| OpenAI, LLC |
Country: United States (California) Protective measures: measures equivalent to or exceeding the standards of the APPI (standard contractual clauses) Reference: https://www.ppc.go.jp/files/pdf/california_report.pdf |
| HubSpot Inc. |
Country: United States (Massachusetts) Protective measures: Standard Contractual Clauses (SCCs) or equivalent protective measures |
| Meta Platforms, Inc. |
Country: United States Protective measures: Standard Contractual Clauses (SCCs) or equivalent protective measures |
| Microsoft Corporation |
Country: United States Protective measures: Standard Contractual Clauses (SCCs) or equivalent protective measures |
Supervision of service providers
When we entrust the handling of personal data, we conclude an agreement on the handling of personal data (such as a DPA) with the service provider and exercise necessary and appropriate supervision. Where a service provider wishes to subcontract, we require prior approval.
Article 12 Security
We take the following measures to prevent unauthorized access to, and leakage, alteration or loss of, personal data.
Technical measures
- Encryption of communications using TLS (Transport Layer Security)
- Deployment of firewalls and anti-virus software
- Recording and monitoring of access logs
- Regular application of security patches
Organizational measures
- Minimization and management of access rights to personal data
- Personal information protection training for staff
- Regular security audits and risk assessments
- Establishment of incident response procedures
While we do our utmost to protect personal data, no security measure is perfect and we cannot guarantee absolute safety.
Article 13 Your rights
You have the following rights regarding the personal data we hold. These rights are not absolute, and exceptions may apply under the law.
| Right of access | You may request disclosure of the personal data we hold about you |
|---|---|
| Right to rectification | You may request correction of or addition to inaccurate or incomplete personal data |
| Right to erasure (right to be forgotten) | You may request deletion of personal data under certain conditions |
| Right to suspension of use / erasure | You may request suspension of processing or erasure where there has been a violation of law or the like |
| Right to suspension of third-party provision | You may request suspension of provision to third parties |
| Right to data portability | You may request a copy or transfer of your personal data in electronic form (where the GDPR applies) |
| Right to object to processing | You may object to processing based on legitimate interests and to direct marketing |
| Right to request notification of purposes of use | You may request notification of the purposes of use of the personal data we hold |
| Right to withdraw consent | For processing based on consent, you may withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal) |
| Right to opt out of targeted advertising |
You may opt out of the sale or sharing of personal data for behavioral targeted advertising. This is also processed automatically when the GPC signal is enabled |
How to exercise your rights: please apply via the contact below (privacy@carrythings.com) or by the procedure set out in Article 15.
We do not discriminate against you for exercising your rights. Before processing your request, we may ask you to verify your identity (email address, account information, etc.). Applications by a representative are possible, but a formal power of attorney may be required.
We respond to requests within the periods set out in applicable law (disclosure requests under the APPI: in principle within 2 weeks; requests under the GDPR: in principle within 1 month).
Unsubscribing from emails
You can unsubscribe from promotional emails at any time via the unsubscribe link in the email. After unsubscribing, transactional emails such as order confirmations and shipping notifications will continue to be sent.
Article 14 Complaints
If you are dissatisfied with our handling of personal data, please first contact the contact below. We will respond in good faith.
If the matter is not resolved, you have the right to lodge a complaint with the following supervisory authorities.
| Japan (complaints under the APPI) |
Personal Information Protection Commission https://www.ppc.go.jp/ Consultation desk: https://www.ppc.go.jp/personal/guidance/ |
|---|---|
| EU residents (complaints under the GDPR) |
The data protection authority (Supervisory Authority) of your EU member state List: https://edpb.europa.eu/about-edpb/about-edpb/members_en |
| UK residents (complaints under the UK GDPR) |
Information Commissioner's Office (ICO) https://ico.org.uk/ |
Article 15 How to request disclosure of personal data, etc.
To request disclosure, correction, addition, deletion, suspension of use, erasure, suspension of third-party provision, notification of purposes of use, withdrawal of consent or disclosure of third-party provision records, please apply using the following procedure.
- Fill in the required details on the prescribed request form. (Request the form by email to privacy@carrythings.com.)
- Attach a copy of an identity document (driver's license, passport, etc.).
- If sending by post, send it to the address below. Applications by email are also accepted.
- For disclosure requests, enclose the prescribed fee (¥1,000 per request) and, if you wish to receive the disclosure in writing, the postage.
| Postal address for requests | Banshō Building 3F, 1-9-10 Jinnan, Shibuya-ku, Tokyo 150-0041, Japan MrM Inc., Personal Information Desk |
|---|---|
| Email for requests | privacy@carrythings.com |
| Fee | ¥1,000 per request (tax included) * We may be unable to respond if the fee is insufficient |
| Method of response | In writing (by post) or by email (please specify) |
| Response deadline | In principle within 2 weeks of receipt |
We may be unable to respond in the following cases.
- Requests that do not meet the requirements of the APPI
- Where identity cannot be verified
- Where there is a risk of significant hindrance to the proper conduct of our business
- Where responding would violate other laws
Article 16 Links to external services
Our services may contain links to websites operated by external services. We are not responsible for the privacy, security or accuracy of information of external services that we do not control. Please review the privacy policy of the relevant service before accessing it.
Article 17 Changes to this Privacy Policy
We may revise this Policy from time to time due to amendments to laws, changes in our business or other reasons. When we make significant changes, we will notify you by appropriate means such as posting on this website or by email. The revised Policy takes effect when posted.
Article 18 Contact for personal data inquiries
For opinions, complaints or consultations regarding the handling of personal data, please contact the following.
| Company name | MrM Inc. |
|---|---|
| Address | Banshō Building 3F, 1-9-10 Jinnan, Shibuya-ku, Tokyo 150-0041, Japan |
| Privacy contact email | privacy@carrythings.com |
| Data Protection Officer (DPO) | Yashiro |
| EU/UK representative | Not appointed at present, as our processing falls within the exemption in GDPR Art. 27(2) and UK GDPR Art. 27(2) (occasional processing, no large-scale processing of special categories of data, low risk). A representative will be appointed and listed here once sales to the EU/UK reach a continuous scale. |
| Hours | Weekdays 11:00–17:00 (JST) |
End