Privacy Policy
Sanrio Company, Ltd. (“we,” “us,” or “our,” as applicable) hereby declares that, based on the recognition that personal information is an important right relating to the rights and interests of all customers, business partners, and other persons from whom we collect personal information (collectively, “Customers,” “you,” or “your,” as applicable), all officers, employees, and other workers shall comply with applicable laws and regulations relating to the protection of personal information and shall properly handle and protect personal information in accordance with the following policy.
Collection, Use, and Provision of Personal Information
We specify the purposes of use of personal information within the scope of our business activities and collect, use, and provide personal information fairly and appropriately to the extent necessary to achieve those purposes. We also take measures to prevent the use of acquired personal information for purposes other than those for which it was collected.
Compliance with Laws, Regulations, and Standards
We comply with laws and regulations relating to personal information, guidelines established by governmental authorities, other applicable standards, and social order, and strive to ensure the appropriate protection of personal information.
Appropriate Management of Personal Information
We fully recognize the risks of unauthorized access, loss, destruction, falsification, leakage, disappearance, or damage with respect to the personal information we handle, implement reasonable security measures, and take appropriate corrective actions when any problems arise.
Response to Inquiries
We respond appropriately to requests from individuals or their representatives concerning disclosure, correction, suspension of use, complaints, consultations, and other inquiries regarding personal information handled by us.
Continuous Improvement
We establish management rules and management systems concerning the protection of personal information, ensure their thorough implementation by all employees, regularly review them, and strive for the continuous improvement of our personal information protection management system.
Established on 24th September 2026
Sanrio Company, Ltd.
Tomokuni Tsuji
President and Representative Director
<Contact Information Regarding This Privacy Policy>
Personal Information Inquiry Desk
Address: Gate City Osaki, 1-11-1 Osaki, Shinagawa-ku, Tokyo, Japan
Email: sanrio-kojinhogo@sanrio.co.jp
About Personal Information Handled by Us
We are committed to the appropriate protection of personal information in accordance with this Privacy Policy. We hereby provide the following information regarding personal information that we acquire or retain for our business operations:
(1) Name, Address, and Representative of Business Operator Handling Personal Information
Business Operator: Sanrio Company, Ltd.
Head Office Address: Sanrio Company, Ltd. (Corporate Information)
Representative: Tomokuni Tsuji
(2) Name and Contact Information of Personal Information Protection Manager
Personal Information Protection Manager: General Manager of the DX Department
Email: sanrio-kojinhogo@sanrio.co.jp
(3) Purposes of Use of Personal Information
All personal information provided to us by customers, business partners, employees, job applicants, former employees, requestors making disclosure requests, and shareholders will be used within the scope of the following purposes:
1. Customer Information
Information We Collect
Information you provide about yourself, such as your name, date of birth, gender, address, telephone number, email address, nationality, occupation, job title, etc.
Information you provide about your family, such as your child’s name, date of birth, and gender.
Photographs, videos, audio recordings, comments posted on official websites, and any other information that customers may submit to us.
Usage histories for our services (including location information) and purchase histories of products, etc.
Information provided when using our services, including product delivery addresses and payment information such as credit card numbers.
Usage history and browsing history relating to official websites, etc.
Information provided in response to questionnaire surveys, voting and prize contests, and similar programs conducted by us.
Audio recordings of telephone calls to customer service and still images or video recordings captured by cameras or readers located in or around our facilities.
Purposes of Use
To advertise and provide information on products, services, or other offerings sold or provided to you, including notices regarding member benefits and gifts; notices regarding surveys; notices regarding campaigns and sales; notices regarding events and other information; and the display of personalized web content, advertising, and informational content directed to customers.
To ship products or services sold or provided to customers, verify and confirm payment settlement, and provide after-sales services.
To investigate and analyze the purchase and usage status of products or services.
To improve products and services and consider new products and services.
For statistical analysis for the purpose of improving customer convenience and service quality.
To register and manage customer information.
To respond to questions, requests, and other inquiries we receive from you.
To notify customers of safety issues, including problems involving purchased products and product recalls.
To investigate and prevent violations of terms and misconduct, etc.
To contact customers and verify their identity in connection with the foregoing purposes.
2. Business Partner Information
Information We Collect
Name, address, telephone number, and email address.
Purposes of Use
For business administration, various communications, invoicing, and payment management.
3. Employee, Job Applicant, and Former Employee Information
Information We Collect
Information provided, including name, date of birth, gender, address, telephone number, email address, and nationality.
Purposes of Use
For human resources administration, labor management, payment and administration of salaries, bonuses, and other compensation, employee benefits programs, procedures relating to social insurance and taxes, employee health and safety management, and personnel development and training.
For providing information relating to recruitment activities, determining hiring decisions, communicating regarding recruitment activities, and conducting other activities incidental to recruitment.
For communicating with former employees and responding to inquiries from former employees.
For corporate introductions, recruitment-related public relations activities, and branding activities.
In addition to the foregoing, for purposes separately specified in writing and for activities necessary for the appropriate and efficient operation of our business.
4. Information of Disclosure Requestors
Information We Collect
Information provided, including name and email address.
Purposes of Use
To respond to inquiries.
To respond to disclosure requests.
5. Shareholder Information
Information We Collect
Information provided, including name and address.
Purposes of Use
To exercise rights and fulfill obligations under the Companies Act and other applicable laws and regulations.
To send notices of convocation of shareholders’ meetings and other materials.
To pay dividends and conduct other shareholder administration activities.
To communicate with shareholders, conduct surveys, engage in investor relations (IR) activities, and implement other initiatives.
To respond to various inquiries.
To create and manage shareholder data as required by law.
(4) Contact Information for Inquiries Regarding Personal Information
For complaints, consultations, and inquiries regarding the handling of personal information, including matters relating to retained personal data, please contact the following inquiry desk:
Inquiry Desk
- Address: Gate City Osaki, 1-11-1 Osaki, Shinagawa-ku, Tokyo, Japan
- Personal Information Protection Manager: General Manager of the DX Department
- Email: sanrio-kojinhogo@sanrio.co.jp
Contact Information for Requests Concerning Your Rights Under Applicable Data Protection Laws
Act on the Protection of Personal Information
Email: sanrio-kojinhogo@sanrio.co.jp
GDPR
Telephone: +81-3-3779-8163
Email: overseas@sanrio.co.jp
EU Representative
Name: DataRep
Email: datarequest@datarep.com
Web Form: www.datarep.com/data-request
UK Representative
Name: DataRep
Email: datarequest@datarep.com
Web Form: www.datarep.com/data-request
CCPA
Telephone: 1-866-957-0006
Email: customercare@sanrio.com
Mailing Address: 1-11-1 Osaki, Shinagawa-ku, Tokyo, Japan
(5) Name of Accredited Personal Information Protection Organization to Which We Belong and Contact Information for Filing Complaints
None.
(6) Procedures for Disclosure Requests
We will promptly respond to requests from individuals concerning their retained personal data, including requests for notification of purposes of use, disclosure, correction, addition or deletion, suspension of use, erasure, suspension of third-party provision, and disclosure of records relating to third-party provision. If you wish to make such a request, we will respond within a reasonable period and scope after confirming that the requester is the individual concerned or his or her representative.
(7) Procedures and Contact Point for Requests for Disclosure, Etc.
If you wish to request disclosure or otherwise exercise your rights concerning retained personal data, please contact the Inquiry Desk described in Section (4) of this Policy. Upon receipt of your request, we will send you our prescribed “Request Form for Disclosure, Etc. of Retained Personal Data” by mail, fax, email, or other means. Please complete the form, enclose the necessary supporting documents, and submit them by mail, email, or other means. (Any delivery costs shall be borne by the requester.)
After confirming the identity of the individual concerned (or his or her representative), we will respond using the disclosure method requested by him or her.
(8) Security Control Measures Implemented for Personal Information
To ensure the strict handling of personal information, we have established internal rules and regulations concerning personal information based on a Privacy Policy that conforms to JIS Q 15001, and we operate a Personal Information Protection Management System.
In order to protect personal information and personal information that we intend to acquire from leakage, loss, damage, falsification, misuse, and unauthorized access, we implement the following security control measures:
Establishment of Basic Policy
We have established this Policy in order to appropriately handle and protect personal information.
Development of Rules Governing Handling of Personal Information
To prevent leakage of personal information and otherwise ensure the secure management of personal information, we have established internal rules, related guidelines, and other rules that clearly define persons responsible for handling personal information, the scope of handling, methods of handling, etc.
Systematic Security Control Measures
For each organization or department that handles personal information, we appoint an information management officer and clearly define the personnel responsible for handling personal information and the scope of their handling. We have established response procedures for situations where facts or indications of violations of laws or internal rules are identified and have designated reporting channels. In addition, we conduct periodic self-assessments and audits concerning the handling of personal information.
Human Security Control Measures
We provide internal rules regarding the proper handling of information containing personal information and conduct periodic training for employees concerning the handling of personal information.
Physical Security Control Measures
In areas where personal information is handled, we manage employee entry and exit, restrict the devices and equipment that may be brought into those areas, and establish access controls to prevent unauthorized persons from viewing personal information. To prevent theft, loss, or similar incidents involving devices, electronic media, documents, or other materials containing personal information, we implement measures such as locating servers containing personal information in designated areas with appropriate information security controls.
Technological Security Control Measures
We implement access controls and other measures for information systems handling personal information, limiting access to authorized personnel and the scope of handling, and establishing appropriate access permissions. We have introduced mechanisms to protect information systems handling personal information from unauthorized external access and malware.
Assessment of External Environment
We implement security control measures after understanding the personal information protection systems applicable in Japan and in the countries where servers used for services utilized by us are located.
(9) Provision of Personal Information to Third Parties in Foreign Countries
Contractors to whom we outsource all or part of our personal information handling operations may be located in foreign countries. In those cases, we confirm that the contractors have established systems that satisfy the standards prescribed under the Act on the Protection of Personal Information.
For further details, please contact the Inquiry Desk described in Section (4) of this Policy.
(10) Special Provisions Regarding GDPR
This section applies, in accordance with the General Data Protection Regulation and the UK General Data Protection Regulation (collectively, the “GDPR”), to the processing of personal information of customers located in the European Economic Area (the “EEA”) and the United Kingdom (the “UK”).
For the purposes described in Section (3) of “About Personal Information Handled by Us” of this Policy, we obtain and process the personal information described therein on the following legal bases under Article 6 of the GDPR:
consent to the processing of your personal information;
entering into a contract with a customer or fulfilling obligations under a contract with a customer;
legitimate interests (including the investigation, analysis, and improvement of products or services, notifications regarding issues, recalls, and safety matters, and the investigation and prevention of violations of terms and misconduct); and
compliance with applicable laws and regulations.
Personal information may be transferred to entities located in countries or jurisdictions outside the EEA and the UK (including Japan) where necessary for the purposes described in Section (3) of “About Personal Information Handled by Us” of this Policy. Please note that those countries or jurisdictions may not have data protection laws equivalent to those of the EEA and the UK and may not provide many of the rights afforded to customers located in the EEA and the UK. We ensure that any such international transfers are subject to appropriate safeguards required by the GDPR and other relevant laws. In doing so, we comply with applicable data protection requirements and implement appropriate safeguards for the security of personal information, including entering into Standard Contractual Clauses. You may obtain additional information regarding these safeguards, including a copy of the Standard Contractual Clauses that we have entered into, by contacting us through any of the methods described in Section (4) of “About Personal Information Handled by Us” of this Policy.
We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.
You have the right to request access to, correction of, and deletion of your personal information, restriction of processing, objection to processing, and data portability, as well as the right to withdraw your consent at any time (which shall not affect the lawfulness of processing based on consent prior to its withdrawal).
We may disclose your personal information to our employees, group companies, service providers, public authorities, successors in business transactions, and other recipients.
We collect the personal information described in Section (3) of “About Personal Information Handled by Us” of this Policy from you, your devices, or third parties such as Sanrio group companies.
We will conduct the necessary investigation without delay upon receiving a request based on any of the foregoing rights and will provide personal information to you or your designated third party, or otherwise respond to your request without undue delay.
In most cases, you will not suffer any disadvantages if you choose not to provide personal information. However, there may be circumstances in which we need to collect personal information in order to process your instructions or perform a contract with you. In those situations, we may be required to terminate the contract between you and us, and we will notify you accordingly.
If you wish to submit a request concerning access, rectification, or related rights, please contact us through any of the methods described in Section (4) of “About Personal Information Handled by Us” of this Policy.
You also have the right to lodge a complaint with your local data protection authority regarding our processing of your personal information.
(11) Special Provisions Regarding CCPA
Last Updated: [YYYY/MM/DD]
This section applies, in accordance with the California Consumer Privacy Act of 2018 (the “CCPA”), as amended by the California Privacy Rights Act of 2020, to the processing of personal information of customers who are classified as California “consumers” pursuant to the CCPA.
The personal information that we intend to collect and use, and that we have collected during the past 12 months, is described in Section (3) of “About Personal Information Handled by Us” of this Policy.
Identifiers: name, postal address, email address, and similar information (including information relating to customers’ family members).
Other Personal Information: telephone number.
Protected Classification Characteristics: date of birth, gender and similar information (including information relating to customers’ family members), and nationality.
Commercial Information: records of use of our services (including location information) and purchase histories relating to products and other items, information provided when using our services (including product delivery addresses and payment information such as credit card numbers), and information provided in response to questionnaire surveys, voting and prize contests, and similar activities conducted by us.
Internet or Other Electronic Network Activity Information: usage history and browsing history relating to official websites, etc., as well as access log information concerning customers’ browsing activities on those websites collected through cookies (including similar technologies).
Geolocation Data: location information included in records of customers’ use of our services.
Audio, Electronic, Visual, and Similar Information: photographs, videos, audio recordings, audio recordings of calls made to customer service, and still images or video recordings captured by cameras or readers located in or around our facilities.
Professional or Employment-Related Information: occupation and job title.
We collect the personal information described above from customers, customers’ devices, or third parties such as Sanrio group companies.
The business or commercial purposes for which we collect personal information are set forth in the purposes of use described in Section (3) of “About Personal Information Handled by Us” of this Policy.
During the past 12 months, we have not sold personal information to third parties or shared personal information for cross-context behavioral advertising, including personal information of minors under the age of sixteen.
During the past 12 months, we may have disclosed the personal information described in Section (3) of “About Personal Information Handled by Us” of this Policy for business purposes. The third parties to whom those disclosures may have been made are service providers such as server management service providers, web analytics service providers, and web design service providers.
Unless a longer retention period is required or permitted by law, we retain the personal information described in Section (3) of “About Personal Information Handled by Us” of this Policy only for as long as necessary to fulfill the purposes described in this Policy.
If you are a California consumer, you may make the following choices with regard to your personal information:
Access
You have the right, twice during any 12-month period, to request that we disclose the following information regarding the personal information that we have collected, used, or disclosed about you:
the categories of personal information we have collected about you;
the categories of sources from which the personal information was collected;
the business or commercial purposes for collecting the personal information;
the categories of third parties to whom we disclose personal information; and
the specific pieces of personal information we have collected about you.
Right to Delete
You have the right to request that we delete the personal information that we have collected from you.
Right to Correct
You have the right to request that we correct inaccurate personal information we hold about you, subject to applicable legal exceptions.
Because we do not sell or share your personal information, we do not respond to opt-out preference signals from the Global Privacy Control. In addition, because we do not use or disclose your sensitive personal information for purposes other than those specified in the CCPA, the right to limit the use and disclosure of sensitive personal information does not apply. Furthermore, because we do not use automated decision-making technology as defined by the CCPA, the rights to opt-out of or access information regarding the use of automated decision-making technology do not apply.
You also have the right not to receive discriminatory treatment from us for exercising any of your rights under the CCPA.
If you submit a request to access, delete, or correct your personal information, we will take steps to verify your identity before responding to your request to protect your privacy and maintain security. When we receive a request for access or deletion, or a similar request, we will first ask you to provide information necessary to verify your identity, such as your name and email address, depending on the services provided. We will then verify your identity by comparing the information you provide with information we already have in our possession. If you use an authorized agent to submit a request for access, deletion, or correction, we will require that the authorized agent provide signed permission demonstrating that you have authorized the agent to act on your behalf. In addition, we may require that you (1) verify your identity directly with us as described above or (2) directly confirm to us that you have authorized the agent to submit the request on your behalf. If you wish to submit a request relating to access, deletion, or correction, please contact us using any of the methods described in Section (4) of “About Personal Information Handled by Us” of this Policy.
(12) Joint Use of Personal Information
In connection with the purposes of use described in Section (3) of “About Personal Information Handled by Us” of this Policy, we acquire personal information that is necessary for performance of our business operations. In order to facilitate the efficient conduct of those operations, that personal information will be jointly used by us and our group companies as set forth in Table 1 below.
In connection with that joint use, we will establish reasonable security control measures between us and the companies participating in the joint use arrangement in order to appropriately protect personal information.
Name, Address, and Representative of Business Operator Responsible for Management of Personal Information Subject to Joint Use
Business Operator: Sanrio Company, Ltd.
Person Responsible for Handling of Personal Information Subject to Joint Use: General Manager of the DX Department
Head Office Address: Gate City Osaki, 1-11-1 Osaki, Shinagawa-ku, Tokyo 141-860, Japan
Representative: Tomokuni Tsuji
Table 1
Scope of Joint Use
Personal Information Subject to Joint Use
Purposes of Use by Joint Users
Sanrio Entertainment Co., Ltd.
①②③④⑤⑥⑦⑧⑨⑩⑪
a, b, c, d, e, f, g, h, i, j, k, l, m, o, p, q, r
Sanrio Enterprise Co., Ltd.
①④⑤⑧⑩⑪
b, f, g, h, i, j, l, n, p, q, r
Kokoro Co., Ltd.
①③④⑩⑪
b, f, g, h, i, j, l, n, p, q, r
Sanrio Music Publications Co., Ltd.
⑨⑪
k, q, r
Sanrio, Inc. (United States)
⑩
l, p
Sanrio GmbH (Germany, Italy, India)
⑩
l, p
Sanrio do Brasil Comercio e Representacoes Ltda. (Brazil)
⑩
l, p
Sanrio Shanghai International Trade Co., Ltd. (China)
⑩
l, p
Sanrio Taiwan Co., Ltd. (Taiwan)
⑩
l, p
Sanrio Korea (Korea)
⑩
l, p
Sanrio Hong Kong Co., Ltd. (Hong Kong)
⑩
l, p
Sanrio Global Asia Ltd. (Hong Kong)
⑩
l, p
Sanrio Wave Hong Kong Co., Ltd. (Hong Kong)
⑩
l, p
Sanrio Far East (Shenzhen) Co., Ltd. (China)
⑩
l, p
Sanrio Southeast Asia PTE. LTD. (Singapore)
⑩
l, p
Mister Men Ltd. (UK)
⑩
l, p
Sanrio Global Ltd. (UK)
⑩
l, p
THOIP (UK)
⑩
l, p
Sanrio UK Finance Ltd. (UK)
⑩
l, p
Note: The numerical and alphabetical references in the table correspond to the categories of personal information collected and the purposes of use described in Section (3) of “About Personal Information Handled by Us” of this Policy.
(13) Changes to This Policy
We may revise this Policy without prior notice.
Any revised version of this Policy will be posted on our official website and will become effective at the time of posting. Please note that we may not provide individual notice of changes. Accordingly, whenever you use our official website, etc., we encourage you to review this Policy each time.