Privacy Policy

Notice Regarding Updates to Our Privacy Policy

July 1, 2026

Japan Bio Products Co., Ltd. is currently reviewing and updating this Privacy Policy in connection with the handling of personal data on our international e-commerce website.

This review does not affect our ongoing commitment to handling personal data appropriately and securely in accordance with applicable data protection laws and regulations. The current Privacy Policy remains in effect until the updated version is published, and personal data already collected will continue to be handled in accordance with the current Privacy Policy and applicable laws and regulations.

For any questions regarding the handling of personal data, or for inquiries concerning your personal data, please contact us at:

jbp-onestop@placenta-jbp.co.jp

--------------

The following is the updated Privacy Policy, which will take effect on September 1, 2026.

Japan Bio Products Co., Ltd. (hereinafter referred to as "our company") has established the following privacy policy (hereinafter referred to as "this policy") regarding the handling of personal information of those who use our services (hereinafter referred to as "users"), and will promote the protection of personal information by building a system for protecting personal information, making all employees aware of the importance of protecting personal information, and thoroughly implementing such measures.

1. Scope of This Privacy Policy

This Privacy Policy describes how Japan Bio Products Co., Ltd. hereinafter referred to as the Company, we, us, or our, collects, uses, discloses, transfers, stores, and protects personal information in connection with its website, e commerce services, communications, and other related business operations. This Privacy Policy applies to all individuals who access our website, purchase our products, contact us, or otherwise interact with us in any manner, whether online or offline. This Privacy Policy is intended to apply globally. However, because privacy and data protection laws may vary by country, region, or jurisdiction, additional rights, obligations, or requirements may apply depending on where a user is located. Nothing in this Privacy Policy is intended to limit any rights granted to individuals under mandatory applicable law.

2. Definition of Personal Information

For the purposes of this Privacy Policy, Personal Information means any information relating to an identified or identifiable natural person. Such information includes, but is not limited to, a person’s name, address, telephone number, email address, date of birth, payment related details, order history, online identifiers, Internet Protocol address, device information, location related information, any other information that can directly or indirectly identify a specific individual. Where applicable law distinguishes between personal information, personal data, sensitive personal information, or similar legal concepts, such terms shall be interpreted in a manner consistent with the relevant law to the extent required.

3. Categories of Personal Information We Collect

The Company may collect various categories of Personal Information depending on the nature of the interaction between the user and the Company. Such information may include identifying information such as name, billing address, shipping address, telephone number, and email address. It may also include transactional information such as order details, purchase history, payment status, product selection, and customer service records. In addition, the Company may collect technical and usage related information such as IP address, browser type, operating system, device identifiers, access times, pages viewed, referring website addresses, and browsing activity on our website. The Company may also receive information relating to advertising engagement, website analytics, and communication preferences. Where necessary for lawful business purposes, we may also collect information voluntarily submitted by users through inquiry forms, email correspondence, promotional campaign participation, or other direct communications.

4. Methods of Collection

The Company collects Personal Information through several methods. First, we collect information directly from users when they place an order, submit an inquiry, sign up for communications, or otherwise provide information to us voluntarily. Second, we collect certain information automatically when users access or interact with our website, including information gathered through cookies and similar tracking technologies. Third, we may obtain information from third party service providers and business partners, including payment processors, website hosting providers, logistics and shipping providers, and advertising platforms, when such information is necessary to operate our services or where such collection is otherwise permitted by applicable law. The Company seeks to limit collection to information that is reasonably necessary for legitimate business and legal purposes.

5. Purposes of Use

The Company uses Personal Information for a range of purposes necessary for the operation, management, and improvement of its business and services. These purposes include processing and fulfilling orders, arranging shipment and delivery, processing payments, communicating with users regarding their purchases or inquiries, and providing customer support. Personal Information may also be used to manage customer relationships, maintain internal records, verify transactions, detect and prevent unauthorized or improper activity, and ensure the safety, stability, and security of our website and services. In addition, the Company may use Personal Information to improve its products, services, website functionality, and overall customer experience through internal analysis, research, and performance evaluation. Where permitted by law, Personal Information may also be used for marketing, advertising, and promotional communications, including personalized advertising and campaign optimization.

6. Legal Basis for Processing

Where the processing of Personal Information is subject to laws that require a legal basis, including the General Data Protection Regulation of the European Union, the Company processes Personal Information only where an appropriate legal basis exists. Such legal bases may include the necessity of processing for the performance of a contract with the user, compliance with a legal obligation to which the Company is subject, the legitimate interests pursued by the Company or a third party, and the consent of the user where consent is required under applicable law. The Company will determine and apply the appropriate legal basis depending on the nature of the Personal Information, the purpose of processing, and the legal requirements of the relevant jurisdiction.

7. Purposes of Use of cookies

Our website uses cookies and similar tracking technologies to improve the information and services we provide, improve website usability, and otherwise create a better website. Information collected through cookies may include IP addresses, device identifiers, and browsing history, which may constitute personal information under applicable laws.

Our website uses cookies for the following purposes,

To provide customized services to customers by referencing their saved registration information when they log in to the authentication service.
To display the most appropriate advertisements on other companies' websites based on the content you are interested in and your usage of our website
To maintain security, to prompt customers who have not used the service for a certain period of time to re-enter their password (re-authentication)
To investigate the number of users and traffic of certain content
To improve services provided through our website
For some content, to understand how customers use e-mail and improve our services
We may also combine the information we collect from certain content tags and cookies with other information we have previously collected from you. We may use this information to improve our website, personalize your online experience, tailor our communications to you, measure the effectiveness of our advertising, and for other internal business purposes.

For users located in the EEA, the United Kingdom, or Switzerland, we obtain prior consent through a cookie consent banner displayed upon first visit, in accordance with the GDPR and the ePrivacy Directive. Consent may be withdrawn at any time by adjusting cookie settings on our website or by following the opt-out instructions provided by the relevant advertising service providers.

8. Disclosure of Personal Information to Third Parties

The Company may disclose Personal Information to third parties where such disclosure is necessary for the purposes described in this Privacy Policy or where otherwise permitted or required by law. Such recipients may include website hosting providers, payment service providers, logistics and shipping companies, cloud service providers, and advertising or marketing platforms. For example, the Company may disclose necessary information to Wix for website operation, Stripe for payment processing, shipping providers for delivery, and Meta for advertising related activities. The Company may also disclose Personal Information to legal, regulatory, judicial, or governmental authorities when required to do so by applicable law, regulation, court order, or other legally binding request. In all such cases, the Company takes reasonable steps to ensure that disclosed Personal Information is handled appropriately and only to the extent necessary for the relevant purpose.

9. International Transfer of Personal Information

Because the Company operates in an international business environment and uses service providers that may operate in multiple jurisdictions, Personal Information may be transferred to, stored in, or processed in countries outside the user’s country or region of residence, including Japan. The data protection laws in such countries may differ from those of the user’s jurisdiction and may not provide the same level of legal protection.

Where required under applicable law, the Company will implement appropriate safeguards for international transfers of Personal Information. Such safeguards may include, where applicable, reliance on adequacy decisions, the execution of standard contractual clauses, and the implementation of organizational, technical, and contractual measures. These measures may include access control, data encryption, system monitoring, internal data handling policies, and ensuring that third party service providers are subject to appropriate data protection obligations.

The Company will ensure that any international transfers of Personal Information are carried out in compliance with applicable data protection laws and that appropriate safeguards are in place to protect such information.

10. Retention of Personal Information

The Company retains Personal Information only for as long as necessary to fulfill the purposes[健齋1] for which it was collected.

Transaction and purchase records: Seven (7) years from completion of the transaction, in accordance with applicable Japanese tax and corporate law obligations.
Customer account information: For the duration of the active account, plus two (2) years thereafter.
Inquiry and customer support records: Three (3) years from the date of resolution.
Marketing-related Personal Information: Until the withdrawal of consent or two (2) years from the last interaction, whichever occurs earlier.
Cookie-based information: In accordance with the expiration period of each cookie (maximum thirteen (13) months).

The Company may retain Personal Information beyond these periods where required to comply with legal obligations, resolve disputes, defend legal claims, or pursue legitimate business interests. When Personal Information is no longer required, the Company will delete, anonymize, or otherwise securely dispose of it.

11. Security Measures

The Company implements appropriate organizational, physical, human, and technical security measures to protect Personal Information against unauthorized access, use, disclosure, alteration, loss, or destruction. Such measures may include access controls, password protections, internal handling rules, staff education, system monitoring, security software, log management, and encryption or similar safeguards where appropriate. The Company also seeks to ensure that service providers handling Personal Information on its behalf maintain suitable security measures. However, despite the Company’s efforts to protect Personal Information, no method of transmission over the Internet, no electronic storage system, and no security measure can be guaranteed to be completely secure. Accordingly, the Company cannot guarantee absolute security of Personal Information in all circumstances. In the event of a Personal Information breach, the Company will, in accordance with applicable law, notify the relevant supervisory authority without undue delay and, where feasible, within seventy-two (72) hours of becoming aware of the breach (where the GDPR applies). Where the breach is likely to result in a high risk to the rights and freedoms of data subjects, the Company will also notify the affected data subjects without undue delay.

12. Rights of Users

Depending on the jurisdiction in which a user is located and the laws applicable to the processing of that user’s Personal Information, the user may have certain rights in relation to such information. These rights may include the right to request access to Personal Information held by the Company, the right to request correction or deletion of inaccurate or unnecessary Personal Information, the right to request restriction of processing, the right to object to certain types of processing, the right to request transfer of Personal Information in a portable format where applicable, and the right to withdraw consent where processing is based on consent. The Company will review and respond to such requests in accordance with applicable law, subject to any lawful limitations, exceptions, or verification requirements.

13. Children’s Personal Information

The Company does not knowingly collect Personal Information directly from children under the age of 16 without legally valid parental or guardian consent where such consent is required. Our website and services are not intended for direct use by young children, and the Company does not intentionally design its services to solicit information from children who are below the applicable legal age threshold. If the Company becomes aware that Personal Information has been collected from a child without appropriate authorization, it will take reasonable steps to delete that information as soon as practicable, unless retention is required by law.

14. Third Party Websites and Services

Our website may contain links to third party websites, platforms, applications, or services that are not owned, operated, or controlled by the Company. This Privacy Policy does not apply to the privacy practices of such third parties. The Company is not responsible for the content, security, or privacy practices of any external websites or services. Users who access such third party websites or services are encouraged to review the privacy policies and terms applicable to those third parties before providing any personal information or engaging in any transaction.

15. Changes to This Privacy Policy

The Company may amend, revise, supplement, or otherwise update this Privacy Policy from time to time in order to reflect changes in applicable laws, regulatory guidance, business operations, service content, technologies, or data handling practices. When changes are made, the updated version of this Privacy Policy will be posted on the relevant website together with the revised Last Updated date. Where required by applicable law, the Company will provide additional notice or obtain consent in relation to material changes. The Company intends to review this Privacy Policy periodically and at least once each year in order to maintain its appropriateness and accuracy.

16. Global Application and Legal Variations

This Privacy Policy is intended to provide a general framework for the Company’s handling of Personal Information on a global basis. However, privacy, consumer protection, electronic communications, and data protection laws differ across jurisdictions, and certain provisions of this Privacy Policy may need to be interpreted or supplemented considering those legal requirements. While the Company makes reasonable efforts to keep this Privacy Policy current and appropriate, it does not represent or warrant that this Privacy Policy will always fully satisfy every legal requirement in every jurisdiction at all times. To the maximum extent permitted by applicable law, the Company disclaims liability for claims, losses, or damages arising solely from differences in local legal requirements or reliance on jurisdiction specific interpretations not expressly stated in this Privacy Policy. Nothing in this section shall exclude or limit any rights that users may have under mandatory law.

17. Governing Law and Jurisdiction

This Privacy Policy, and any dispute, claim, or matter arising out of or in connection with this Privacy Policy or the Company’s handling of Personal Information, shall be governed by and construed in accordance with the laws of Japan, without regard to conflict of laws principles. Any legal proceedings relating to this Privacy Policy shall be brought exclusively before the Tokyo District Court as the court of first instance. However, if mandatory laws of the user’s country or region of residence provide for different rights, remedies, or forum protections that cannot be waived, those mandatory provisions shall apply to the extent required by law.

18. Language

In the event of any discrepancy, inconsistency, or conflict between the English version and any translated version, the English version shall prevail and control, except to the extent that applicable mandatory law requires a different language version to take precedence.

19. Severability

If any provision of this Privacy Policy is held by a court or other competent authority to be invalid, illegal, or unenforceable under applicable law, that provision shall be deemed modified to the minimum extent necessary to make it valid and enforceable, or if such modification is not possible, it shall be deemed severed from this Privacy Policy. The invalidity or unenforceability of any provision shall not affect the validity or enforceability of the remaining provisions, which shall remain in full force and effect.

20. Contact Information

If any user has questions, comments, concerns, or requests regarding this Privacy Policy or the Company’s handling of Personal Information, the user may contact the Company at the following address. Japan Bio Products Co., Ltd., 4F Maplewood Building, 1-30-22 Tomigaya, Shibuya ku, Tokyo 151 0063, Japan.

Email: jbp-onestop@placenta-jbp.co.jp.

Ⅱ　GDPR ANNEX (EU / EEA USERS)

Scope of GDPR Annex

This GDPR Annex applies exclusively to individuals located in the European Economic Area, the United Kingdom, and Switzerland, where the processing of Personal Information is subject to the General Data Protection Regulation or equivalent laws. In the event of any inconsistency between this Annex and the main Privacy Policy, this Annex shall prevail to the extent required by applicable law.

2. Data Controller

For the purposes of applicable data protection laws, Japan Bio Products Co., Ltd. shall be considered the data controller of Personal Information processed in connection with its services. The Company determines the purposes and means of processing such Personal Information and is responsible for ensuring compliance with applicable data protection obligations.

3. Legal Basis for Processing

The Company processes Personal Information only where a valid legal basis exists under applicable law. Such legal bases include processing that is necessary for the performance of a contract with the data subject, processing necessary to comply with legal obligations, processing necessary for the legitimate interests pursued by the Company, and processing based on the data subject’s consent where required. Where processing is based on legitimate interests, the Company ensures that such interests are not overridden by the fundamental rights and freedoms of the data subject.

4. Data Subject Rights

Individuals located in the EEA, the United Kingdom, or Switzerland may have specific rights under applicable data protection laws. These rights may include the right to obtain confirmation as to whether Personal Information concerning them is being processed, the right to access such information, the right to request correction of inaccurate or incomplete data, the right to request erasure of Personal Information under certain conditions, the right to restrict processing, the right to object to processing based on legitimate interests or direct marketing, and the right to receive Personal Information in a structured, commonly used, and machine readable format where applicable. The Company will respond to such requests without undue delay and within the time limits prescribed by law, subject to any lawful exceptions.

5. Right to Withdraw Consent

Where the processing of Personal Information is based on consent, the data subject has the right to withdraw such consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Upon withdrawal, the Company will cease processing the relevant Personal Information unless another legal basis applies.

6. International Data Transfers under GDPR

Where Personal Information is transferred outside the European Economic Area, the Company will implement appropriate safeguards in accordance with applicable law. Such safeguards may include the use of standard contractual clauses approved by relevant authorities or other lawful transfer mechanisms. The Company takes reasonable steps to ensure that transferred Personal Information remains protected at a level consistent with applicable data protection standards.

7. Data Retention under GDPR

Personal Information will not be retained longer than necessary for the purposes for which it was collected. The Company considers the nature of the data, the purpose of processing, legal obligations, and potential risks in determining appropriate retention periods. Personal Information that is no longer required will be securely deleted or anonymized.

8. Right to Lodge a Complaint

Data subjects have the right to lodge a complaint with a competent supervisory authority if they believe that the processing of their Personal Information violates applicable data protection laws. The Company encourages individuals to contact us first so that we may address concerns directly.

9. Marketing and Direct Marketing Communications

The Company may process Personal Information for marketing, advertising, and promotional purposes, including the delivery of information about products, services, campaigns, and events that may be of interest to the data subject. Such marketing activities are conducted using contact information, including email addresses, provided directly by the data subject. The Company does not disclose or provide such Personal Information to third parties for their own marketing purposes.

Where required under applicable law, such processing shall be based on the data subject’s prior consent. In other cases, the Company may rely on its legitimate interests, provided that such interests are not overridden by the fundamental rights and freedoms of the data subject.

The subject of data has the right to object at any time to the processing of Personal Information for direct marketing purposes. Where the data subject objects to such processing, the Company will cease processing Personal Information for such purposes without undue delay.

Where marketing communications are sent by electronic means, the data subject may withdraw consent or opt out at any time by following the instructions included in such communications or by contacting the Company directly.

Ⅲ　CALIFORNIA PRIVACY SUPPLEMENT (CCPA / CPRA)

Compliance with Laws and Regulations

With respect to the handling of Personal Information of customers residing in the State of California, U.S., all officers and employees of Japan Bio Products Co., Ltd. will comply with the California Privacy Rights Act (CPRA).

2. Categories of Personal Information Collected

The Company may collect categories of Personal Information that include identifiers such as name, address, email address, and IP address, commercial information such as purchase history and transaction records, Internet or network activity such as browsing behavior and interaction with our website, and inferences derived from such information to create user profiles for service improvement and marketing purposes. The categories collected depend on the nature of the interaction between the user and the Company.

3. Purposes for Collection and Use

Personal Information collected from California residents is used for business and commercial purposes, including providing products and services, processing transactions, communicating with customers, improving services, conducting analytics, and delivering advertising. Such use is consistent with the purposes described in the main Privacy Policy.

4. Disclosure of Personal Information

The Company may disclose Personal Information to service providers and contractors that perform functions on our behalf, including payment processing, website hosting, logistics, customer support, analytics, and advertising. Such disclosures are made for business purposes and subject to contractual restrictions that limit the use of Personal Information to specified purposes.

5. Sale or Sharing of Personal Information

Identifiers
We collect identifiers such as your name, address, shipping address, telephone number, IP address, email address, online ID, order number, and other similar information. In the past 12 months, we have disclosed this category of personal information to Japan Bio Products Co., Ltd. and our service providers.

Personal Information Described in the California Customer Records Act (CCRA)
We collect personal information described in the California Customer Records Act (CCRA), including all categories of personal information listed in Cal. Civ. Code Sec. 1798.80(e). This may include payment information such as credit card numbers, debit card numbers, your name, signature, telephone number, bank account information, and other similar information. In the past 12 months, we have disclosed this category of personal information to Japan Bio Products Co., Ltd. and our service providers.

Commercial Information
We collect commercial information such as your purchase history, search history, order number, other purchasing trends relating to our products, and other similar information. In the past 12 months, we have disclosed this category of personal information to Japan Bio Products Co., Ltd. and our service providers.

Internet or Other Electronic Network Activity Information
We collect Internet or other electronic network activity information, including information collected through cookies, such as usage history and information exchanged between your browser and the server, as well as activity logs reflecting your use of our website, such as access status, traffic, routing information, and other similar information. In the past 12 months, we have disclosed this category of personal information to Japan Bio Products Co., Ltd. and our service providers.

6. Rights of California Residents

California residents have specific rights under applicable law. These rights may include the right to request disclosure of categories and specific pieces of Personal Information collected, the right to request deletion of Personal Information, the right to request correction of inaccurate Personal Information, and the right to opt out of the sale or sharing of Personal Information where applicable. California residents may also have the right to limit the use of sensitive Personal Information where such information is collected. To exercise this right, please use the "Do Not Sell or Share My Personal Information link provided on our website, or contact us using the contact details set forth in this Privacy Policy.

7. Right to Non Discrimination

The Company will not discriminate against any user for exercising their privacy rights under applicable law. This means that the Company will not deny goods or services, charge different prices, or provide a different level of service solely because a user has exercised their rights.

8. Exercising California Rights

California residents may exercise their rights by contacting the Company using the contact information provided in this Privacy Policy. The Company may need to verify the identity of the requester before processing the request to ensure the security of Personal Information.

9. Retention of Personal Information under California Law

The Company retains Personal Information for as long as reasonably necessary to achieve the purposes for which it was collected, considering legal obligations, operational needs, and risk considerations. The retention period may vary depending on the nature and sensitivity of the information.