Privacy Policy
[Registered address — set PLATFORM_ADDRESS]
contact@requestjapan.com
1. Controller
The controller is the operator of RequestJapan.com identified at the top of this page. For any question about your data: contact@requestjapan.com.
2. Data processed
- Account and company — name, business email address, role, language; legal name, registration number, VAT number, store address and phone, logo.
- Trading activity — published requests, offers, negotiation messages, transactions, ratings, claims and their attachments.
- Payment — amounts, currencies, transaction identifiers. Card data is handled directly by Stripe and never reaches our servers.
- Seller payouts — bank details entered by the seller.
- Shipping — delivery address, tracking number.
- Technical — access logs, IP address, timestamps, session cookie.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and run the account, perform transactions | Performance of the contract |
| Vet applicant companies | Legitimate interest (fraud prevention) |
| Machine-translate content | Performance of the contract |
| Process payments and payouts | Performance of the contract |
| Handle claims | Performance of the contract / legitimate interest |
| Issue and retain invoices | Legal obligation (accounting) |
| Service notification emails | Performance of the contract |
| Security, logging, abuse prevention | Legitimate interest |
The platform does not use data for advertising and does not sell it.
4. Recipients and processors
- The other party to the transaction — the buying store's contact details are passed to the seller for shipping and customs, and vice versa.
- Stripe (payments) — Ireland / United States.
- Amazon Web Services (hosting, photo storage, email delivery) — European Union.
- OpenAI (machine translation of request and offer text) — United States. This processing can be disabled on request.
- Carriers and the tracking provider — tracking number and delivery address.
5. Transfers outside the European Union
The service exists to connect European and Japanese businesses, so data necessary to a transaction is transferred to Japan. Japan benefits from a European Commission adequacy decision. Transfers to the United States (Stripe, OpenAI) rely on standard contractual clauses.
6. Retention
- Active account: for the duration of the contractual relationship.
- After account closure: 3 years, then deletion or anonymisation.
- Invoices and accounting records: 10 years (legal obligation).
- Technical logs: 12 months.
- Claims: 5 years after resolution.
7. Your rights
You have rights of access, rectification, erasure, restriction, objection and portability. Exercise them at contact@requestjapan.com; we respond within one month.
Some data cannot be erased while it remains necessary to complete a transaction in progress or to meet an accounting obligation.
You may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or with your own national authority.
8. Cookies
The platform sets only a session cookie, strictly necessary to keep you signed in. No advertising or third-party analytics cookies are used, so no consent banner is required.
9. Security
Traffic is encrypted in transit (TLS). Passwords are stored as bcrypt hashes. Administrator access can be protected with two-factor authentication. Sensitive actions on a transaction are written to an append-only audit log.
10. Changes
This policy may be updated. Material changes are notified by email to the users concerned.