Legal Explanation on Data Transfer outside of Japan

Rakuten Group companies transfer personal information to countries outside of Japan in order to achieve the purposes notified or otherwise made available to you by Rakuten Group, Inc. or other Rakuten Group companies. The transfer may occur in the following cases:

• ・Where part of business operations is outsourced to foreign third parties including Rakuten Group companies
• ・Where the service you requested requires disclosure of personal information to foreign business operators*
  * Rakuten Ichiba merchants, Rakuten Travel hotels, Rakuten GORA golf courses etc.
• ・Where personal information is provided to foreign partner companies that provide advertisement delivery service etc. in order to display advertisements
• ・Where otherwise personal information is provided based on Rakuten Group, Inc. and other companies’ privacy policies or based on separate consent

Upon transferring personal information, we evaluate legal systems related to data protection in the destination countries/regions. In addition, we have appropriate security measures (contractual agreements, etc.) to assure the security of personal information in accordance with applicable laws.

Information about the personal information protection legal systems outside Japan

Learn more about the personal information protection legal systems in countries outside Japan to which we may transfer personal information in the website published by the Personal Information Protection Commission (PPC).

Research on Personal Information Protection Legal Systems in Foreign Countries (Japanese only)

For the countries that are not on the above website, please refer the materials below.

(Japanese only. This list will be updated as needed.)

• Republic of Uzbekistan
• Republic of Chile
• Arab Republic of Egypt
• New Caledonia
• Federal Democratic Republic of Ethiopia
• Papua New Guinea
• Commonwealth of the Northern Mariana Islands
• Republic of Palau
• Democratic Socialist Republic of Sri Lanka
• Republic of Fiji
• Republic of Seychelles
• Brunei Darussalam
• Tahiti
• Macao

Furthermore, in case the destination country does not have measures in place to comply with the OECD Privacy Guidelines, we transfer personal information upon entering into contracts with the obligation on the data recipient to achieve the level of protection stated in these Guidelines.

Countries/Regions of Rakuten Group Companies that Are Based outside of Japan

* The list only includes Rakuten Group companies to which personal information may be provided from Japan.

Countries/Regions of Partner Companies based outside of Japan that Provide Advertising Delivery Service etc.

Google LLC [U.S.A.]
Meta Platforms, Inc. [U.S.A.]
The Trade Desk, Inc. [U.S.A.]
MediaMath, Inc. [U.S.A.]
Twitter Asia Pacific Pte. Ltd. [Singapore]