How OTH collects, uses, shares, and protects personal data when you use our wholesale trading card platform at oth.jp.
Effective date: [24/06/2026] · Last updated: [24/06/2026]
Contents
- Who we are
- Scope of this policy
- Personal data we collect
- How and why we use your data
- Cookies and tracking
- Who we share data with
- International data transfers
- How long we keep data
- How we protect your data
- Your rights
- EU/UK representative
- Other jurisdictions
- Children’s privacy
- Changes to this policy
- How to contact us
1. Who we are
oth.jp (“OTH“, “we“, “us“, “our“) is a wholesale platform for the sale of trading cards to business and trade customers worldwide. For the purposes of the EU General Data Protection Regulation (GDPR), the UK GDPR, and Japan’s Act on the Protection of Personal Information (APPI), the data controller responsible for your personal data is:
- Legal entity: [Registered company name]
- Registered address: [Street, City, Prefecture, Postal code, Japan]
- Company / registration number: [Corporate number]
- Privacy contact: privacy@oth.jp
- Data Protection Officer (if appointed): [Name / email, or “Not appointed”]
2. Scope of this policy
This policy applies to personal data we process about visitors, account holders, and authorised representatives of our trade customers when you visit oth.jp, register an account, place or manage wholesale orders, or otherwise communicate with us. Because OTH sells to customers around the world, this policy is written to meet the GDPR/UK GDPR standard, which we apply as our global baseline.
Although our customers are businesses, the data we collect often relates to individuals acting on their behalf (for example, a buyer or account administrator). That information is personal data and is protected by this policy.
3. Personal data we collect
Data you provide to us
- Account & business details — your name, job role, the company you represent, business registration or tax/VAT identifiers, and login credentials.
- Contact details — email address, telephone number, billing and shipping addresses.
- Order information — products purchased, order history, quotes, and wholesale pricing tiers associated with your account.
- Payment details — processed by our payment providers. We do not store full card numbers; we receive only confirmation and limited transaction data (see Section 6).
- Communications — messages, enquiries, and support requests you send to us.
Data we collect automatically
- Technical data — IP address, device and browser type, operating system, and language settings.
- Usage data — pages viewed, products browsed, referring URLs, and timestamps.
- Cookies & similar technologies — as described in Section 5.
Data from third parties
- Fraud-prevention, identity- or business-verification services, and our payment processors, where they share results with us to authorise an order or open a trade account.
4. How and why we use your data
Under the GDPR we must have a lawful basis for each use of your personal data. The table below sets out what we do and the legal basis we rely on.
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Create and manage your trade account; verify eligibility to buy at wholesale | Performance of a contract; legitimate interests (preventing fraud, verifying trade status) |
| Process, fulfil, ship, and invoice your orders | Performance of a contract |
| Provide customer support and respond to enquiries | Performance of a contract; legitimate interests |
| Keep accounting, tax, and customs records | Compliance with a legal obligation |
| Detect, prevent, and investigate fraud and platform abuse | Legitimate interests; legal obligation |
| Improve and secure the website and our services | Legitimate interests |
| Send marketing or product updates to trade contacts | Consent, or legitimate interests where permitted for existing B2B customers |
| Use non-essential cookies and analytics | Consent |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms, and you may ask us about this assessment at any time. Where we rely on consent, you may withdraw it at any time without affecting processing carried out before withdrawal. We do not use your personal data for automated decision-making that produces legal or similarly significant effects on you.
5. Cookies and tracking
We use cookies and similar technologies to operate the site, remember your preferences, and — only with your consent — to measure traffic and improve our services.
- Strictly necessary cookies — required for login, cart, security, and core functionality. These do not require consent.
- Functional cookies — remember your settings and preferences.
- Analytics & performance cookies — help us understand how the site is used (e.g. Google Analytics).
- Marketing cookies — used to deliver relevant communications, where applicable.
In the EU, UK, and other regions that require it, non-essential cookies are set only after you give consent through our cookie banner. You can change or withdraw your choices at any time via [cookie settings link], and you can also control cookies through your browser settings.
6. Who we share data with
We do not sell your personal data. We share it only with the following categories of recipients, who are required to protect it and use it solely for the purposes we specify:
- Payment processors — to take payment securely (e.g. WooPayments by Stripe).
- Shipping & logistics partners — to deliver orders and handle customs (e.g. Fedex).
- IT, hosting & software providers — who operate our website, cloud infrastructure, and business tools on our behalf as data processors.
- Fraud-prevention & verification providers — to confirm trade eligibility and protect against fraud.
- Professional advisers — accountants, auditors, and lawyers, where necessary.
- Authorities — where required by law, court order, or to protect our legal rights.
- Business transfers — to a buyer or successor in the event of a merger, acquisition, or sale of assets.
Where a recipient acts as our processor, we put in place a written data-processing agreement that meets the requirements of GDPR Article 28.
7. International data transfers
OTH is based in Japan and serves customers globally, so your personal data may be transferred to and processed in countries outside your own, including Japan.
Transfers from the EU/EEA to Japan. The European Commission has recognised Japan as providing an adequate level of data protection (the EU–Japan adequacy decision). Personal data can therefore flow from the EEA to OTH in Japan without additional safeguards, subject to the supplementary rules that apply to data received under that decision.
Other transfers. Where we transfer personal data to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where relevant), together with any supplementary measures needed. You may request a copy of the safeguards we use by contacting privacy@oth.jp.
8. How long we keep data
We keep personal data only for as long as necessary for the purposes set out in this policy, and then delete or anonymise it. In practice:
- Account data — for as long as your account is active, and a reasonable period afterwards.
- Order, invoice & tax records — for the period required by accounting and tax law (for example, several years under Japanese and other applicable tax rules).
- Marketing data — until you unsubscribe or withdraw consent.
- Support communications — for a limited period after your query is resolved.
9. How we protect your data
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including encryption in transit (HTTPS/TLS), access controls, secure hosting, and staff confidentiality obligations. No system is completely secure, but we maintain protections appropriate to the risk. If a personal data breach is likely to result in a risk to your rights, we will notify the relevant supervisory authority, and you where required, in line with applicable law.
10. Your rights
Subject to applicable law, you have the following rights over your personal data. To exercise any of them, contact privacy@oth.jp.
| Right | What it means |
|---|---|
| Access | Obtain a copy of the personal data we hold about you. |
| Rectification | Correct inaccurate or incomplete data. |
| Erasure | Ask us to delete your data in certain circumstances. |
| Restriction | Limit how we use your data while a query is resolved. |
| Portability | Receive your data in a portable format or have it transferred. |
| Objection | Object to processing based on legitimate interests or direct marketing. |
| Withdraw consent | Withdraw consent at any time where we rely on it. |
| Complain | Lodge a complaint with a supervisory authority (see below). |
We will respond within the timeframe required by law (generally one month under the GDPR). Exercising these rights is free of charge in most cases, and we may need to verify your identity before acting.
Right to complain. If you are in the EU/EEA, you may complain to the data protection authority in your country. In the UK, the supervisory authority is the Information Commissioner’s Office (ICO). In Japan, it is the Personal Information Protection Commission (PPC). We would, however, appreciate the chance to address your concerns first.
11. EU/UK representative
Because OTH is established outside the EU and the UK but offers goods to customers there, we have appointed representatives under Article 27 of the GDPR and the UK GDPR. You may contact them on any matter relating to our processing of your personal data:
- EU representative: [Name, address in an EU member state, email]
- UK representative: [Name, UK address, email]
Note: if your processing of EU/UK residents’ data is only occasional and low-risk, an Article 27 representative may not be required. Confirm your position with your legal adviser and remove this section if it does not apply.
12. Other jurisdictions
Japan (APPI). We handle personal data in accordance with the Act on the Protection of Personal Information. You may request disclosure, correction, or suspension of use of your retained personal data as provided by the APPI.
California (CCPA/CPRA). If you are a California resident, you have rights to know, delete, and correct your personal information, and to opt out of its “sale” or “sharing.” We do not sell personal information. To exercise these rights, contact privacy@oth.jp.
Where local law grants you additional rights, we honour them.
13. Children’s privacy
OTH is a wholesale platform intended for businesses and trade professionals. It is not directed to children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
14. Changes to this policy
We may update this policy from time to time to reflect changes in our practices or the law. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Please review this page periodically.
15. How to contact us
For any question about this policy or to exercise your rights, contact us:
| Data controller | [Registered company name] |
| Address | [Registered address, Japan] |
| privacy@oth.jp | |
| Website | oth.jp |
| EU representative | [EU representative] |
| UK representative | [UK representative] |
| Data Protection Officer | [If appointed] |