PRIVACY POLICY

ONLINE PRIVACY POLICY

TELMA PRIVACY POLICY

Mail Order Sales (hereinafter referred to as the "Services") in TELMA OFFICIAL (hereinafter referred to as the "Website") is managed, operated and sold by BBF, Inc. (hereinafter referred to as the "Company").
In conducting our business operations, including the operation of the Services, we believe that in order for users to use this service without anxiety, it is most important that we comply with laws and regulations concerning the protection of personal information and ensure that proper collection, use, and management are carried out within the Company.

We hereby establish our Privacy Policy (hereinafter referred to as the "Privacy Policy") with regard to the policy for the use and management of personal information.

In the Privacy Policy, "Personal Information" shall mean "Personal Information" as set forth in the Act on the Protection of Personal Information (hereinafter referred to as the "Personal Information Protection Act"), and shall mean such Personal Information as may identify a specific individual by one or more of the following; name, sex, date of birth, member ID, password, e-mail address, address, telephone number, company name where he/she belongs, department name, title, occupation, history of purchasing, and other information concerning contact information and the purchase of products.

①When acquiring personal information, the Company and the Joint Users shall publicly announce or notify the Purpose of Use (including publication under this Privacy Policy). In the event that personal information is acquired directly from the individual through a contract or other document (including electromagnetic records), the Purpose of Use shall be clearly indicated in advance, and such personal information shall be acquired through lawful and fair means.
②The Company and the Joint Users shall appropriately protect personal information and shall not disclose or provide such information to any third party in a manner that allows the individual to be identified without the individual’s consent, except where permitted under the Act on the Protection of Personal Information or other applicable laws and regulations.
③The Company and the Joint Users may appropriately use personal information for the purposes of use set forth in (3) “Purposes of Use of Personal Information”
　below. In addition, the Company may entrust the personal information entrusted to it to contractors of the Company and the Joint Users, within the scope necessary to carry out the purposes of use set forth in (3) “Purposes of Use of Personal Information”
　below, for the purpose of promoting services for the operation of and users of this Website, in accordance with the Act on the Protection of Personal Information and other applicable laws and regulations. In such cases, the Company and the Joint Users shall select appropriate contractors in compliance with the Act on the Protection of Personal Information and other applicable laws and regulations, and shall appropriately manage and supervise such contractors.

In providing services on the Website to users, the handling of personal information may be entrusted in whole or in part for the purpose stated in the "Purpose of Use of Personal Information" above.
In doing so, we will select an outsourcee who meets sufficient standards for the protection of personal information and conclude an agreement concerning the protection of personal information before entrusting such handling.

We assign a personal information manager to the department in charge of managing personal information, implement appropriate management of personal information, and promote guidance on our efforts to protect personal information.

①We confirm that the user has the right to request disclosure, correction, addition, deletion, suspension of use, deletion, discontinuation of provision to a third party, or notification of the purpose of use of personal information in accordance with the Act on the Protection of Personal Information and other laws and regulations.
　In the event of such a request, we shall promptly respond to such request in accordance with our Regulations on the Handling of Personal Information.
　Provided, however, that in the event any one of the following applies due to disclosure, the Company may not disclose all or part of such information, and in the event the Company makes a decision not to disclose such information, the Company shall notify the user to that effect without delay.
・Cases where there may be a risk of harm to the life, body, property, or other rights or interests of the person or a third party;
・Cases that may significantly interfere with the proper performance of our business;
・Cases that may violate any of the laws and regulations.
②Complaints or consultations concerning personal information or procedures for disclosure of personal information shall require a document that confirms the identity of the person or representative.
③Please note that we will ask you to pay the prescribed fee for notification of the Purpose of Utilization or request for disclosure of Personal Information.

BBF, Inc.
Uchisaiwai-cho Tokyu Building 7F,
1-3-2 Uchisaiwai-cho, Chiyoda-ku, Tokyo 100-0011
Jun Tamura, Representative Director
e-mail：privacy@bb-f.jp
Please contact Customer Service.

1. We will implement the necessary and appropriate security control measures to prevent leakage, loss, or damage of personal data (including personal information that we have acquired or intend to acquire and that is expected to be treated as personal data; the same shall apply hereinafter).
   In addition, the Company shall provide necessary and appropriate supervision to employees and contractors (including subcontractors) handling personal information.
2. Regarding security control measures for personal data, we implement and respond to the security control measures for personal information from time to time based on the formulation of the Personal Information Protection Guidelines, organizational security control measures, personnel security control measures, physical security control measures, and technical security control measures.

The Company may use authentication services provided by credit card companies or other related organizations (such as 3D Secure) for the purpose of preventing unauthorized use of credit cards and verifying the identity of users.
In such cases, the Company may provide information such as the customer's name, card number, transaction information, and device information to the Company's payment service providers, credit card companies, international card brands, and other related parties.
Please note that authentication servers operated by international card brands or other related organizations may be located outside Japan, and such information may be transferred to those countries.

①The Website uses a technique called cookies (Cookies).
　Cookies are a mechanism for temporarily holding specific information as data to a user's communication device and identifying the user based on that data each time the connection is made.
②The Website provides services that are premised on the use of cookies.
　Therefore, if you do not allow the use of cookies, you may not be able to receive some of the services on the Website.
　Whether to allow cookies can be set in the user's browser. Check the settings if necessary.

We shall not be aware of any use of personal information independently collected on our business tie-up companies or websites to which we are linked, such as the websites and services of third parties accessible through the Website.
　Therefore, we do not assume any obligation or responsibility for independent regulations or activities in those companies or sites.
　Check the terms and conditions of each site.

In order to protect personal information, we may revise the Privacy Policy as necessary or to change laws and regulations.
　In this case, the latest privacy policy shall be posted on the Website and shall become effective when it is posted.

This Privacy Policy shall apply to all members from August 25, 2026.

TELMA LTD. (the “Company”) fully acknowledges that, as an entity handling personal information, it has a serious responsibility regarding the management of personal information. In addition to complying with the Act on the Protection of Personal Information and related laws and regulations, the Company has established a basic policy on personal information protection and ensures that all of its employees are fully aware of such policy.
Moreover, the Company reliably manages personal information and provides a continuous sense of security to specific individuals identified by personal information, including our customers (“Data Subjects”).

The Company prevents unauthorized access to, as well as the loss, destruction, alteration, leakage, etc. of personal information by clearly establishing regulations for handling personal information, ensuring that employees are fully aware of such regulations and taking necessary security measures. If the regulations are required to be improved as a result of an internal audit, an actual security accident, indication or request from a Data Subject, etc., the Company will promptly correct the regulations.

The Company will strictly manage personal information and will not disclose or provide any personal data to a third party without the relevant Data Subject’s consent unless:

The Company may outsource all or part of the handling of personal information to a third party to the extent necessary to achieve the purpose of use of personal information. In this case, the Company will, in addition to fully assessing the qualification of the outsourcee, prescribe matters concerning confidentiality obligations in executing an agreement with the outsourcee and provide necessary and appropriate supervision of the outsourcee.

1. If the Company is requested by a Data Subject to provide notice of the purpose of use of his/her personal data possessed by the Company that can identify the Data Subject, the Company will provide such notice to the Data Subject without delay; provided, however, that in any of the following cases, the Company may not disclose all or part of the purpose. If the Company decides not to disclose it, the Company will notify the Data Subject to that effect without delay:
(1) The purpose of use of personal data possessed by the Company is obvious;
(2) Giving notice of the purpose of use to the Data Subject is likely to harm the Data Subject’s or a third party’s life, person, property or other rights or interests;
(3) Giving notice of the purpose of use to the Data Subject is likely to infringe the Company’s rights or interests
(4) The Company is required to cooperate with national organizations or local public bodies in performing their statutory administrative work and giving notice of the purpose of use to the Data Subject is likely to hinder the performance of such administrative work;
2. If the Company is requested by a Data Subject to disclose his/her personal data possessed by the Company that can identify the Data Subject, the Company will disclose the relevant personal data to the Data Subject without delay; provided, however, that if the disclosure may result in any of the following cases, the Company may not disclose all or part of the relevant personal data. If the Company decides not to disclose it, the Company will notify the Data Subject to that effect without delay:
(1) The Data Subject’s or a third party’s life, person, property or other rights or interests are likely to be harmed; or
(2) The Company’s proper performance of its business is likely to be significantly interfered with.
3. In other cases that may result in the Company breaching laws and regulations; the provisions of the preceding paragraph apply mutatis mutandis to the case where the Company is requested by a Data Subject to disclose records provided by a third party related to personal data that can identify the Data Subject (excluding those for which revealing the existence of the records may result in any of the following cases; the same applies hereinafter):
(1) The Data Subject’s or a third party’s life, person or property is likely to be harmed;
(2) An illegal or wrongful act is likely to be promoted or triggered;
(3) National security is likely to be harmed, a relationship of trust with another country or an international organization is likely to be damaged, or it is likely to cause a disadvantage in negotiations with another country or an international organization; or
(4) The prevention, suppression or investigation of crimes, and the maintenance of public safety and public order are likely to be impeded.

1. If personal data possessed by the Company that can identify a Data Subject is incorrect, the Company will, upon request from the Data Subject, correct, add to or delete the personal data in accordance with the procedures prescribed by the Company (such act shall be hereinafter referred to as “Correction, Etc.”).
2. Upon receiving a request from the Data Subject as set forth in the preceding paragraph, if the Company determines that the Company needs to comply with such request, the Company will make Correction, Etc. of the relevant personal information and notify the Data Subject thereof without delay. If the Company decides not to make Correction, Etc., the Company will notify the Data Subject to that effect without delay.

1. If the Company is requested by a Data Subject to suspend the use of personal data possessed by the Company that can identify the Data Subject or to delete such personal data, based on the allegation that the personal data falls under any of the following items (such suspension of use or deletion shall be hereinafter referred to as “Suspension of Use, Etc.”), the Company will conduct a necessary investigation without delay, perform the Suspension of Use, Etc. of the relevant personal data possessed by the Company to the extent necessary based on the results of the investigation and in accordance with laws and regulations, and notify the Data Subject of the performance of the Suspension of Use, Etc. (or a decision not to perform the Suspension of Use, Etc., if applicable); provided, however, that if the Suspension of Use, Etc. of personal data possessed by the Company would require a significant amount of expenses or is otherwise impracticable and if the Company can take an alternative measure necessary to protect the Data Subject’s rights and interests, the Company will take such alternative measure.
(1) The personal data has been handled beyond the scope of the purpose of use (or the purpose of use before succession if the personal data has been obtained in connection with business succession);
(2) The personal data contains personal information obtained by deception or other wrongful means or special care-required personal information obtained without the Data Subject’s consent (excluding that obtained pursuant to laws and regulations);
(3) The personal data has been used in a way that is likely to promote or trigger an illegal or wrongful act;
(4) The personal data possessed by the Company that can identify the Data Subject no longer needs to be used;
(5) A leakage, loss of, or damage to, (“Leakage, Etc.”) personal data containing special care-required personal information occurs or is likely to occur;
(6) A Leakage, Etc. of personal data that may cause property damage as a result of the wrongful use of the personal data occurs or is likely to occur;
(7) A Leakage, Etc. of personal data, which may have been made for a wrongful purpose, occurs or is likely to occur;
(8) A Leakage, Etc. of personal data of more than a thousand Data Subjects occurs or is likely to occur; or
(9) The handling of the personal data possessed by the Company is likely to harm the Data Subject’s rights or legitimate interests.
2. If the Company is requested by a Data Subject to suspend the provision to a third party of personal data possessed by the Company that can identify the Data Subject, based on the allegation that the personal data falls under any of the following items, the Company will conduct a necessary investigation without delay, suspend the provision to the third party of the relevant personal data possessed by the Company to the extent necessary based on the results of the investigation and in accordance with laws and regulations, and notify the Data Subject of the suspension (or a decision not to suspend the provision to the third party, if applicable); provided, however, that if suspension of the provision to a third party of personal data possessed by the Company would require a significant amount of expenses or is otherwise impracticable and if the Company can take an alternative measure necessary to protect the Data Subject’s rights and interests, the Company will take such alternative measure.
(1) The personal data possessed by the Company that can identify the Data Subject has been provided to a third party in breach of Article 3 hereof; or
(2) In the case of Items 4 through 9 of the preceding paragraph.

1. The Company will respond to a request from a Data Subject for the disclosure of personal data possessed by the Company, notice of the purpose of use, Correction, Etc., Suspension of Use, Etc. or suspension of provision to a third party, or disclosure of records provided by a third party related to personal data that can identify the Data Subject (“Disclosure, Etc.”) unless:
(1) It cannot be confirmed that the Data Subject is the person to whom the personal data belongs;
(2) The attorney’s power of attorney cannot be confirmed; or
(3) In other cases where Disclosure, Etc. may be avoided pursuant to laws and regulations.
2. If a Data Subject requests Disclosure, Etc. as set forth in the preceding paragraph, the Data Subject shall make a request pursuant to the following procedures:
(1) Destination of request for Disclosure, Etc.
Customer SupportDesk
TELMA LTD.
E-mail：cs@store.telma.jp
(2) Procedures for disclosure
(i) Via mail or email: Please fill out a form designated by the Company and send it to the Company; or
(ii) By telephone: Please provide the Company with the same details as those to be filled out on the form set forth in (i) above by telephone.
(3) Method of identity verification upon request for Disclosure, Etc.
(i) Via mail or email: A driver’s license, an individual number card (only the front side), a copy of an official certificate with a face photo such as a passport; or
(ii) By telephone: Information from which the Company can determine that the Data Subject is the person to whom the relevant personal data belongs, including name, address, date of birth, telephone number.
(4) Request by an agent for Disclosure, Etc.
If the person who requests Disclosure, Etc. is a statutory representative of a Data Subject or a minor who does not have sufficient ability to make a proper judgement or an adult ward, or an attorney-in-fact engaged by the Data Subject to make a request for Disclosure, Etc., the person needs to submit the following certificates in addition to the documents set forth in the preceding item:
(i) If the person is a statutory representative:
Any document issued within the past 90 days that certifies the person’s qualification, such as a copy of a family register, an abstract of a family register, a certificate of registered information; and
A driver’s license, passport or other document that certifies that the person is a legal representative.
(ii) If the person is an attorney-in-fact:
A power of attorney signed and sealed by the Data Subject, a certificate of a seal impression (of the seal used for the power of attorney) or other document that certifies the attorney’s power of attorney
A driver’s license, passport or other document that certifies that the person is an attorney-in-fact.
(5) Fee for requesting notice of the purpose of use and for disclosure of personal data possessed by the Company and records provided by a third party.
The fee for making a request is 800 yen (including postage for registered mail). Please send a postage stamp(s) in the amount of 800 yen together with the application documents. If the fee is underpaid, the Company will notify the applicant thereof. Please pay the deficiency within the prescribed period. If the deficiency is not paid within said period, the Company will deem that no application has been made.
* Actual expenses such as a fee for the issuance of a certificate, postage fees and travel expenses shall be borne by the applicant.
(6) Method of response to request for disclosure and notice of the purpose of use.
Disclosure or notice will be made by the method designated by the Data Subject or his/her agent; provided, however, that if disclosure by such method would require a significant amount of expenses or is otherwise impracticable, the Company will make such disclosure or notice by delivering a document.

The Company reviews the content of this Privacy Policy, as appropriate, and endeavors to improve it. The content of this Privacy Policy may be amended unless otherwise prescribed by laws and regulations or other provisions of this Privacy Policy. An amended privacy policy shall take effect when Data Subjects have been notified by the method prescribed by the Company or when it is published on the Company’s website.

The Company complies with applicable laws, regulations, directives and other various rules in handling personal information and works on continual improvement to ensure that personal information is properly handled.

The Company will receive complaints and consultation from Data Subjects in connection with the handling of personal information, and properly and promptly respond thereto. In addition, the Company will promptly and properly respond to a request from a Data Subject for the disclosure, correction, addition to, deletion, use or non-provision, etc. of personal information.

If you have an inquiry about the Company’s handling of personal information, please contact:
Customer Support Desk of the Company
TELMA LTD.
E-mail：cs@store.telma.jp

August 2026
28-1 Jingumae 3-chome, Shibuya-ku, Tokyo
TELMA LTD.
Takeo Nakazawa, Representative Director