Privacy Policy

MID Inc. ("MID", "we", "us" or "our") operates an e-commerce business selling consumer products through online marketplaces. We recognize that personal information must be handled with care and respect for the individual, and we comply with the Act on the Protection of Personal Information of Japan (APPI) and other applicable laws, regulations and guidelines. This Privacy Policy explains what information we collect, how we use it, how we protect it, and how you can contact us.

This English text is provided for convenience. In the event of any inconsistency, the Japanese version shall prevail.

1. Identity of the Business Operator

Company name	MID Inc. (MID株式会社)
Address	Osaka Ekimae Dai-2 Building 12-12, 1-2-2 Umeda, Kita-ku, Osaka-shi, Osaka 530-0001, Japan
Representative	Takayuki Yamashita, Representative Director
Data Protection Manager	Takayuki Yamashita, Representative Director
Website	https://mid003.com/
Contact	info@mid003.com / Tel. +81-6-6147-2325

2. Scope

This Policy applies to personal information collected through our website at https://mid003.com/ (the "Site"), through our product sales on online marketplaces such as Amazon.co.jp, and through the internal systems and applications we use to operate our business.

Third-party websites and services linked from the Site are governed by their own privacy policies, which are outside the scope of this Policy.

3. Information We Collect

(1) Information you provide directly

• Name, company or organization name, department and job title
• Postal address, telephone number, e-mail address and other contact details
• The content of inquiries, requests, and return or exchange requests
• Bank account and billing information, to the extent required for business transactions (for suppliers and partners)
• Information contained in résumés and other documents submitted for recruitment purposes

(2) Information received from marketplace operators

When we sell products on online marketplaces such as Amazon.co.jp, the marketplace operator may provide us with the following information to the extent necessary to fulfil orders:

• Name, shipping address and telephone number of the purchaser and recipient
• Order number, order date, products purchased, quantity, amount and delivery status
• The content of messages sent through the marketplace's messaging function

Payment card numbers and other payment credentials are processed by the marketplace operators and payment service providers; we do not collect or store them.

(3) Information collected automatically on the Site

• IP address, browser type and version, operating system, referring URL
• Access logs, including date and time of access and pages viewed
• Identifiers generated by cookies and similar technologies

(4) Information obtained through advertising APIs

We use advertising platform APIs, including the Amazon Advertising API, to manage and analyze our own advertising accounts. Information obtained through such APIs consists principally of business data relating to our own advertising accounts; its handling is described in Section 5.

4. Purposes of Use

We use personal information only to the extent necessary to achieve the following purposes:

1. To accept orders, invoice and process payments, ship products and provide delivery updates
2. To handle returns, exchanges, repairs, refunds and other after-sales support
3. To respond to inquiries, consultations and complaints
4. To improve product and service quality, and to plan and develop new products and conduct market analysis
5. To send information about our products, services and campaigns, where you have consented or where otherwise permitted by law
6. To operate and maintain the Site, analyze usage and improve usability
7. To deliver advertising and to measure, analyze and improve advertising performance
8. To conclude and perform contracts with suppliers and partners and to administer such transactions
9. To conduct recruitment screening and communicate with applicants
10. To prevent and investigate fraud, unauthorized access and impersonation, and to protect our rights, property and safety
11. To comply with legal obligations and respond to requests from public authorities
12. For any purpose incidental or related to the above

We will not use personal information beyond the scope necessary to achieve these purposes without your prior consent, except where permitted or required by law.

5. Handling of Data Obtained through the Amazon Advertising API

We use the Amazon Advertising API (the "API") for the purpose of monitoring and optimizing the performance of advertising accounts that we ourselves own and operate. In using the API, we comply with the Amazon Ads API License Agreement, the Amazon Ads API Acceptable Use Policy and all related data protection requirements.

(1) Data obtained

• Advertising account information (profile ID, account name, marketplace, currency, etc.)
• Configuration data for campaigns, ad groups, keywords and creatives
• Performance report data such as impressions, clicks, advertising spend, orders, sales, ACOS and ROAS
• Authorization credentials issued through Login with Amazon (access tokens and refresh tokens)

(2) Purposes of use

• Aggregating, visualizing and reporting on the performance of our advertising accounts
• Analyzing and optimizing bids, budget allocation, keyword selection and other campaign settings
• Evaluating advertising return on investment to support internal business decisions

(3) Our commitments

• Data obtained through the API is used solely for the purposes stated in (2) above and for no other purpose.
• We do not sell, rent, license or otherwise disclose such data to any third party, except as required by law or as processed by the service providers described in Section 8 under contract and to the minimum extent necessary.
• We do not combine such data with other information for the purpose of identifying individual end users.
• Authorization credentials (access and refresh tokens) are stored in encrypted form, and access is restricted to personnel who require it for their duties.
• Data is retained only for as long as necessary for the purposes stated in (2) and is thereafter promptly deleted or destroyed in a manner that prevents restoration.
• If Amazon requests deletion of data obtained through the API, or if we cease using the API, we will promptly delete that data together with the associated credentials.
• Security controls applied to API data are equivalent to or stronger than those described in Section 7.

6. Cookies and Analytics

The Site may use cookies and similar technologies to improve usability and to understand how the Site is used. You may refuse or delete cookies through your browser settings, although some functions of the Site may then become unavailable.

The Site may use Google Analytics, provided by Google LLC, which collects traffic data using cookies. Such data is collected anonymously and does not identify individuals. Please refer to the Google Privacy Policy for details, and to the Google Analytics Opt-out Browser Add-on to disable this collection.

7. Security Measures

We implement the following measures to prevent the leakage, loss or damage of personal data and otherwise to manage it securely:

• Governance — Internal rules and this Policy govern the proper handling of personal data.
• Organizational — We appoint a Data Protection Manager, define which employees may handle which categories of personal data, monitor how personal data is handled, and maintain a reporting line for suspected or actual violations.
• Personnel — Employees receive periodic training on the handling of personal data and are bound by confidentiality obligations under our work rules and written undertakings.
• Physical — Access to areas where personal data is handled is controlled, equipment and documents are kept locked, and devices or media containing personal data are password-protected when taken off site.
• Technical — We apply access controls (individual credentials, least-privilege permissions), encryption of data in transit (TLS) and at rest, anti-malware software, and measures to prevent unauthorized access.
• Awareness of the external environment — Where personal data is handled in a foreign country, we ascertain that country's data protection regime and take appropriate measures accordingly.

8. Outsourcing

We may entrust all or part of the handling of personal data to external service providers to the extent necessary to achieve the purposes of use, including:

• Delivery and logistics companies
• Payment service providers and financial institutions
• Providers of system development, maintenance and cloud services (servers, storage, business systems)
• Providers of data analytics, advertising operations support and customer support services
• Accounting, tax and legal professionals

We select service providers that meet appropriate data protection standards, impose contractual obligations regarding the secure handling of personal data, and exercise necessary and appropriate supervision over them.

9. Disclosure to Third Parties

We do not disclose personal data to third parties without your prior consent, except in the following cases:

1. Where required by law
2. Where necessary to protect the life, body or property of an individual and it is difficult to obtain consent
3. Where specially necessary for improving public health or promoting the sound growth of children and it is difficult to obtain consent
4. Where cooperation is required for a national or local government body to perform statutory duties and obtaining consent would impede those duties
5. Where handling is entrusted to service providers as described in Section 8
6. Where personal data is transferred in connection with a merger or other business succession

We do not sell personal information to third parties.

10. Cross-Border Transfers

In connection with our use of business systems, cloud services and online marketplaces, we may provide personal data to third parties located outside Japan, including cloud service providers and marketplace operators located in the United States and other countries. In such cases we either obtain your prior consent or confirm that the recipient has established a system conforming to the standards prescribed under the APPI, and we take the measures necessary to ensure the continued proper handling of the data.

Information about the countries concerned and their data protection regimes is available on request from the contact point in Section 13.

11. Retention and Deletion

We retain personal data only for as long as necessary to achieve the purposes of use. Where a retention period is prescribed by law, we retain the data for that period. Otherwise, we delete or destroy the data, in a manner that prevents restoration, without undue delay after a reasonable period following the end of the transaction or the completion of our response to your inquiry.

12. Your Rights (Disclosure, Correction, Suspension of Use)

You, or your authorized representative, may request notification of the purpose of use, disclosure, correction, addition or deletion, suspension of use or erasure, suspension of provision to third parties, and disclosure of third-party provision records with respect to retained personal data. We will respond without undue delay in accordance with applicable law.

• How to request — Contact us using the details in Section 13; we will provide our request procedure and form.
• Identity verification — We may ask for identification documents (and, for representatives, a power of attorney).
• Fees — No fee is charged for requests for notification of the purpose of use or for disclosure.
• Response — We will normally respond in writing or by e-mail.
• Limitations — We may be unable to comply where we are not legally obliged to do so or where identity cannot be verified; in such cases we will explain the reason.

13. Contact Us

For questions, comments or complaints regarding the handling of personal information, please contact:

Contact point	MID Inc. — Personal Information Inquiry Desk
Person in charge	Takayuki Yamashita, Representative Director
Address	Osaka Ekimae Dai-2 Building 12-12, 1-2-2 Umeda, Kita-ku, Osaka-shi, Osaka 530-0001, Japan
E-mail	info@mid003.com
Telephone	+81-6-6147-2325
Hours	Weekdays 10:00–17:00 JST (excluding weekends, public holidays and the year-end/New Year period)

14. Minors

Where a minor provides personal information, we ask that it be provided with the consent of a parent or legal guardian. If we learn that we have collected a minor's personal information without such consent, we will promptly delete it upon request from the parent or legal guardian.

15. Data Breach Response

In the event of any leakage, loss or damage of personal data or any other incident affecting its security, we will immediately investigate the facts, take the measures necessary to prevent further harm and recurrence, and report to the Personal Information Protection Commission and notify affected individuals as required by law.

16. Continuous Improvement and Changes to this Policy

We continuously review and improve our management of personal information. We may amend this Policy in response to changes in law or in our business. The amended Policy takes effect when posted on the Site, and we will give clear notice on the Site of any material change.

17. Governing Law and Jurisdiction

This Policy is governed by and construed in accordance with the laws of Japan. Any dispute relating to the handling of personal information shall be subject to the exclusive jurisdiction of the Osaka District Court as the court of first instance.

Effective date: July 24, 2026
Last updated: July 24, 2026
MID Inc.