Policy on Handling of Customer’s Personal Information
Pertaining to MUJI Vietnam’s Website
(Privacy Policy)

1. About Us and Privacy Policy

a. About Us

We are MUJI RETAIL (VIETNAM) LIMITED LIABILITY COMPANY (hereinafter referred to as “Company”), a subsidiary of RYOHIN KEIKAKU CO., LTD., a company duly established and operating under Japanese laws, and a member of RYOHIN KEIKAKU Group.

Within the scopes and for the purposes of using Personal Data described herein, the Company and RYOHIN KEIKAKU CO., LTD. will be collectively referred to as “We” or “Us”.

b. Privacy Policy

The Privacy Policy is to inform Customer of how we acquire and handle the Customer’s Personal Data when the Customer accesses to the Website and uses the products or services supplied by us.

The Website is not intended for individuals of less than 16 years old, and we do not intentionally acquire data on individuals of less than 16 years old. In case where we obtain data on children, we will comply with the relevant applicable laws and regulations. In addition, we hereby expressly disclaim any and all liabilities under applicable laws in the case where Customer accidentally or intentionally provides us with false information about your age.

In addition to this Privacy Policy, we may from time to time provide the Customer notices concerning the collection, storage and use of the Personal Data. The Customer shall read all of such notices in order to be fully informed of the reasons and methods for our collection, managing and using of Personal Data. This Privacy Policy supplements those notices and is not intended to invalidate those notices.

We reserve the right to amend this Privacy Policy at any time to the extent permitted by the applicable laws and regulations. We will notify you of any significant changes to this Privacy Policy by posting it on the Website or by any other means we deem appropriate. The amended Privacy Policy will become effective when the Customer is notified in a reasonable manner as set forth by us or when posted on the Website.

2. Contact Details of the Data Controller/Processor

As the Data Controller/Processor, the Company is responsible for properly collecting and processing Personal Data.

In case where (i) you have any questions or comments in relation to this Privacy Policy or our collection or processing of Personal Data, (ii) you want to update, correct or remove your Personal Data, or (iii) any breach to this Privacy Policy and/or relevant laws and regulations of personal data protection is detected, you can contact us by sending a courier or an email to the following addresses, or calling us with the following phone number:

• Name of corporation: MUJI RETAIL (VIETNAM) LIMITED LIABILITY COMPANY
• E-mail address: info@muji.vn
• Address: Unit 9.11, 9th Floor, The Landmark, 5B Ton Duc Thang Street, Ben Nghe Ward, District 1, Ho Chi Minh City, Vietnam
• Phone number: 028 71088388

Upon the receipt of an e-mail or a courier or a phone call from the Customer, we will respond appropriately to the Customer in accordance with applicable laws and regulations.

3. Third-Party Links

Subject to our discretion to upgrade the Website’s functionality to include online shopping function through an online individual account, the Website may include links to third-party websites, plugins and applications (e.g.: Facebook and Instagram). If you select these links, you will be able to obtain your data from such third party to log up/in the Website. We do not administer the third party's websites and are not responsible for the handling Personal Data collected, managed and used by such third parties. You should read the third party's privacy policy, and take all responsibilities when agreeing to such third parties for sharing your Personal Data.

4. Personal Data Obtained

In this Privacy Policy, Personal Data means information that contributes to identifying a specific Customer that can be identified by the individual information, including information listed below.

During the course of the Customer’s use of the Website, and subject to our discretion to upgrade the Website’s functionality to include online shopping function through an online individual account, we may collect and process the following data as the Personal Data from time to time:

1. Identity information includes the user ID, profile photo, user name (nickname) or similar identifier, date of birth and gender.
2. Contact information includes name, email address, and telephone number.
3. Transaction data includes payments to or from the Customer and details of the products and services the Customer has purchased from us and information which you enter into the application form on the Website when you apply for the event which we conduct, such as your name, e-mail address, phone number, and the products which the Customer purchased.
4. Technical data obtained via Cookie (as defined in item a Section 17 below) includes the Internet Protocol (IP) address, your account log-in data, the type and version of the browser, the time zone configuration and region, location data of our store where the Customer checked in, the type and version of the browser plugin, the operation system, the platform and other technology on the device used to access the Website.
5. The account profile data includes the user ID, user name (nickname), password, any purchases or orders made by the Customer, Customer’s interests, preferences, feedback, and survey responses.
6. The usage data includes information on how the Customer uses the Website and our services.
7. Marketing and communication data include a preference for the receipt of marketing information from us and a preference for the manner in which such marketing information is received.

We will not acquire any sensitive Personal Data, including details concerning your race or ethnicity, religious or philosophical beliefs, sexual life, sexual orientation, political opinion, trade unions, health information, genetic and biological data, nor any information concerning criminal convictions or crimes.

Provided, however, Personal Data as stipulated in the preceding paragraph does not include anonymized data. For the Customer’s ease of understanding, in this regard, we may obtain and use statistical data (e.g.: demographic data). In particular, we may aggregate the data of your usage to calculate the percentage of users who access the functionality of a particular application or website. The data on which the statistical figure is based may be extracted from the Personal Data without revealing the identity of the Customer, whether directly or indirectly. In case where the statistical figure is integrated or combined with a specific Customer’s Personal Data in a form that directly or indirectly identifies such Customer, we shall treat the integrated data as Personal Data in accordance with this Privacy Policy.

In accordance with applicable laws and regulations, we request that you provide us with Personal Data that is accurate and up-to-date, and that if you provide any third party’s Personal Data to us (if any), we will ask you to provide us such Personal Data after confirming that you have obtained consent from the owner of such Personal Data.

5. Refusal to Disclose Personal Data

We reserve the right not to provide our services and goods, including the use of the functions of the Website to you in the case where you do not provide the Personal Data to us in accordance with this Privacy Policy and applicable laws. In this case, and subject to our discretion to upgrade the Website’s functionality to include online shopping function through an online individual account, we may have to cancel your order or reservation after sending you a notification about the cancellation by suitable means; however, we will not assume any liability for any damage or loss incurred by you and caused by the refusal to disclose Personal Data.

6. Methods of Personal Data Collection

During the course of the Customer’s use of the Website, and subject to our discretion to upgrade the Website’s functionality to include online shopping function through an online individual account, we may acquire Personal Data in the following manners:

a. Direct Acquisition:

We may ask you to provide your nickname, name, e-mail address, date of birth, gender, or contact information by filling in a form or by mail, telephone, e-mail, or any other suitable means in the following cases:

• Creation of accounts in the Website
• Applying for an event planned by us
• Subscription for services provided by us
• Subscription to our services or publications
• Request to transmit marketing information
• Participation in competition, promotion or research
• Providing feedback to us

b. Automated Technology:

When the Customer uses the Website, we are entitled to automatically obtain technical data on the Customer's device, browsing behavior, and browsing patterns by using Cookie. In addition, we may receive technical data about you when you visit other websites that use our Cookie.

c. Third parties or publicly available sources:

We may receive the Personal Data from the various third parties listed below:

• Technical data, location information, terminal identification information, etc. from analytics providers and search information providers (Google, Amazon Web Services etc.);
• Contact information and transaction data from providers of technology, payment and delivery services for the purpose of executing and performing goods/services sales and purchase contracts;
• Identification and contact information from publicly available sources.

If required by applicable laws and regulations, we will identify the third party from which the Personal Data of the Customer is obtained and notify the Customer before processing or using the Personal Data.

7. Purposes of Personal Data Collection

Subject to our discretion to upgrade the Website’s functionality to include online shopping function through an online individual account, we may collect and use Personal Data for the following purposes only:

1. To provide our services to the Customer via the Website.
2. To recommend to the Customer the personalized products and services, which are analyzed based on the Customer's viewing history of the Website, via the Website.
3. To promote and advertise our products and services by sending the Customer news about our stores, products and services.
4. To discover defects and improve the functions of the Website.
5. To protect our legitimate interests or any third party’s legitimate interests under the agreements with us (if any).
6. To protect the Customer’s rights and legal interests in accordance with laws and the agreements with us.
7. To prepare business plans, reports and forecasts.
8. To research, organize contests, lucky draw, surveys, or events.
9. To comply with legal and guideline obligations.

In cases where there is any change in any of the foregoing purposes, we will update and notify you by sending a notice in an appropriate manner about such change and its legal basis.

8. Scope of Personal Data Usage

The Personal Data collected upon your express consent will be used for the activities specified herein only, except for the cases where (i) a separate agreement between us and the Customer on using Personal Data for purposes and scopes other than those expressly stipulated herein exists, or (ii) we provide products or services as requested by you, or (iii) we perform our obligations in accordance with applicable laws and regulations.

We will use Personal Data for the scopes as mentioned in the table below:

9. Obtaining Customer’s Separate Consent to Use Personal Data for Marketing Purposes

We will not use the Personal Data for marketing purposes unless we have obtained the Customer’s consent through a separate mechanism, through which the Customer may choose to “Allow” or “Deny”.

In particular, if you choose to “Allow”, we may use your identity, contact information, technical information, usage and profile information to form our ideas about your needs and interests; based on which, we will conduct marketing and advertising activities, including sending you the information on clothing, miscellaneous clothing, daily necessities, foodstuffs, other products and/or services that we provide in accordance with applicable laws and regulations, as well as the information on promotion (collectively referred to as “marketing information”).

Even after you have chosen to “Allow”, you still can ask us to stop sending marketing information at any time by any of the following ways:

1. Following opt-out links in marketing messages sent to you, or
2. Contact us (at any time) following Contact Details mentioned in Section 2 hereof.

10. Subjects Accessing to and Using Personal Data

a. The Company

As the units of Personal Data collection and management, the Company, its relevant managers and staff are entitled to access to and use Personal Data for the purposes and within the scopes stipulated herein.

b. Third parties

Within the scopes and the purposes of use stated herein, we may disclose your Personal Data to RYOHIN KEIKAKU CO., LTD for the purpose of improving our products and services.

In addition, we may outsource all or a part of the handling of Personal Data to a third party for the purposes of use in the development, maintenance, and other operations of the system. In this case, we will select a third party who is deemed to appropriately handle Personal Data in light of the security control measures taken by the relevant third party, appropriately stipulate matters concerning the handling of personal data, such as security control, confidentiality and conditions for re-entrustment, as well as the status of the handling of personal data by the relevant third party in the entrustment agreement, and implement necessary and appropriate supervision.

c. State Authorities

We may disclose Personal Data to competent state authorities when being required to discharge our legal duties in accordance with applicable laws and regulations.

d. Separate Consent and Confidentiality Agreement

We will establish an appropriate mechanism to obtain your express consent in advance before sharing or disclosing your Personal Data to any third parties other than the parties stated in section b above. We will not share, disclose or transfer Personal Data with any third parties or irrelevant person for any purposes other than those stipulated herein if we have not obtained the explicit consent of the Customer in advance (opt-in).

We will ensure that any individual or organization third parties, who may duly access to and use Personal Data will be obliged to keep Personal Data secret under an effective and binding confidentiality agreement. Access to and usage of your Personal Data are granted only to those who need it to complete tasks assigned by us in accordance with our instructions.

11. Cross-border Relocation

1. We will store your Personal Data in Vietnam and Japan.
2. When transferring your Personal Data overseas, we will implement the appropriate protection measures in accordance with applicable laws and regulations to protect your Personal Data.
   If required by Vietnam's laws and regulations, we will take necessary action to ensure that Personal Data received in Japan will be protected with the measures at least equivalent to the ones set forth in Vietnam's laws and regulations. In Japan, the Personal Data received is subject to Japanese laws; the courts, governments, executive agencies, regulatory bodies and security authorities of Japan may have access to your Personal Data without notice to you.

12. Data Security

We will take appropriate measures to ensure the safety and security of Personal Data, and prevent the theft or unauthorized use, unauthorized access, modification, or destruction of your Personal Data.

13. Personal Data Retention

a. Personal Data Retention Period

We will retain your Personal Data to the longest term permissible under the applicable law and regulations except for the case where there is any request to remove from you. In certain cases, we will anonymize your Personal Data for research or statistical purposes (which will result in revealing no relationship between you and your Personal Data). In such cases, such information may be used without any additional notice to the Customer and without any time limitation as described above

We will retain or keep the acquired Personal Data in an electromagnetic form that is recorded by our server or server of a third party contracted with us.

b. Destruction of Personal Data After Retention Period

We will destroy Personal Data without delay when the retention period stipulated by the applicable laws and regulations has expired. In the event where Personal Data must be kept in accordance with the applicable laws and regulations after the expiration of the retention period, the Personal Data concerned shall be transferred to a separate database or stored in a different safe location. In such cases, we will select the Personal Data that should be destroyed and destroy it with the approval of our Data Protection Officer. We will destroy Personal Data recorded and stored in the form of electronic files so that they cannot be reproduced. Personal Data recorded and stored in paper documents shall be crushed by a crusher or incinerated for destruction.

14. Right to access, correct, delete, obtain copies of Personal Data and withdraw your consent

a. Subject to our discretion to upgrade the Website’s functionality to include online shopping function through an online individual account, you are entitled to the following rights in relation to your Personal Data:

• Request for access to Personal Data
  Customer can request copies of their Personal Data in our possession and confirm that we are lawfully processing your Personal Data.
• Request for correction of Personal Data
  Customer may request correction of incomplete or inaccurate Personal Data in our possession. However, in this case, we may need to confirm the authenticity of the new information provided by you.
• Request for deletion of Personal Data
  Customer may request us to delete your Personal Data. However, at the time of invoicing, we may not always be able to comply with your removal request for certain legal reasons (which will be notified to you if applicable).
• Objection to the handling of Personal Data
  If the handling of Personal Data by us or any third party makes you feel that it affects your fundamental rights or freedoms under the specific circumstances in which you are placed, you may object to the handling of Personal Data.
• Request for Restrictions or Cessation on the handling of Personal Data
  Customer may request a cessation on the handling of your Personal Data if: (a) Customer requires us to ensure the accuracy of data; (b) Customer does not need the Personal Data but requires us to extract the data in our possession for the purposes of establishing, exercising, or defending legal claims and seeks the maintenance of such data; or (c) we need to provide justifiable grounds evidencing that we have collected, stored and used data properly in case where Customer has challenged us in our handling of the data.
• Request for transfer of Personal Data
  We will provide you or a third party designated by you with your Personal Data in a structured, commonly-used machine and legible format. However, such rights are limited to automated information when you have agreed to let us use in advance, or when we have used it to perform contracts with you.
• Withdrawal of your consent
  Customer reserves the right to withdraw consent at any time if you do not want us to process Personal Data anymore. However, this will not affect the legality of the handling of Personal Data prior to the withdrawal of consent. In addition, you acknowledge that if you withdraw your consent, we may not be able to provide you with a particular product or service. In this case, we will inform you when you withdraw your consent.

b. No expenses required

In principle, you are not required to pay for access (or otherwise exercise) to your Personal Data. However, if your request is not clear, factual, repetitive or excessive, which results us in carrying out support activities that go beyond our normal handling process, and incurring unnecessary charges, you may have to pay a compensation amount equivalent to the actual cost incurred. Alternatively, in such cases and where applicable law permits, we may reject your request.

c. Confirmation of Customer’s request

Before we respond to any of your requests as stipulated in item a above, we may have to request specific information from you for the purpose of identifying you. This is a part of our security measures to ensure that Personal Data is not disclosed to persons who are not entitled to receive such information. In addition, we may request additional information to expedite our response.

15. Measures and Tools for Modification or Deletion of Personal Data

Subject to our discretion to upgrade the Website’s functionality to include online shopping function through an online individual account, you may modify, delete or exercise any action in relation to your Personal Data as stated in item a of preceding section by using any of the following measures:

1. Using function/mechanism “My account” in the Website; or
2. Contacting us by using any of communication channels stipulated in Section 2 above.

16. Glossary

a. “Cookie”

“Cookie” means a small text file created by the Website, which is stored in the Customer’s device either temporarily for that session only or permanently on the hard disk for the purpose of providing technical data about the Customer’s access as stated in item d Section 4 above so that the Website can recognize the Customer and keep track of Customer’s preferences.

b. “Legitimate interests”

“Legitimate interests” means the Company’s lawful interests in operating and managing our business so that we can provide our Customer with the highest quality service, products, and the safest experience. Before handling your Personal Data for legitimate benefit, we will always review and compare the potential impact on you, your rights and legal interests. We will not use the Customer’s Personal Data for any particular activity other than the purposes and scopes agreed by Customer (except the cases with the Customer’s separate consent or as required as an obligation by the prevailing laws). If the Customer needs more detailed information about how we have assessed our legitimate benefits over potential impacts on Customers in a particular activity, the Customer can contact us at the information specified in Section 2 hereof.

c. “Fulfillment of contractual obligations”

“Fulfillment of contractual obligations” means the handling of Personal Data necessary for the performance of contractual obligations to which the Customer is a party or to which the Customer intends to respond upon request prior to execution.

d. “Observance of legal and regulatory obligations”

“Observance of legal and regulatory obligations” refers to the complying with applicable laws and regulatory obligations when we handle the Customer’s Personal Data.

This Privacy Policy will be considered our official notification on the collection and processing of your Personal Data and we will not send any separate notification to you for the same matter.