Privacy Policy

At pafin Inc. ("us", "we", "our" or the "Company") we value your privacy and the importance of safeguarding your data. This Privacy Policy (the "Policy") describes our privacy practices for the activities set out below. As per your rights, we inform you how we collect, store, access, and otherwise process information relating to individuals. In this Policy, personal data ("Personal Data") refers to any information that on its own, or in combination with other available information, can identify an individual.

This policy applies to the pafin Inc. websites, domains, applications, services, and products (collectively, the "Services"). This Policy does not apply to third-party applications, websites, products, services or platforms that may be accessed through links we provide (i.e., links not operated by pafin Inc.). These sites are owned and operated independently from us, and they have their own separate privacy and data collection practices. Any Personal Data that you provide to these websites will be governed by the third-party's own privacy policy. We cannot accept liability for the actions or policies of these independent sites, and we are not responsible for the content or privacy practices of such sites.

Article 1 (What personal data we collect)

The information we collect in the Service includes the following:

1. Information input by the customer upon registering the Account (email address, user name, etc.);
2. Information input, data uploaded, and information acquired via API or other means by the customer during use of the Service (e.g., cryptocurrency transaction history);
3. Information related to cookies, IP address, or the use of Google Analytics™; and
4. Other information provided by the customer in the course of using the Service.

Article 2 (How we collect your personal data)

We collect Personal Data from the following sources:

From You:

You may give us your Account Information, Payment Information, Financial Information, Demographic Data, Purchase Information, Content, Feedback, Product Information, by filling in forms, using our products or services, entering information online or by corresponding with us by post, phone, email or otherwise. This includes Personal Data you provide, for example, when you:

• Create an account through the Service;
• Use the Service;
• Create content via the Service;
• Express interest in the Services;
• Downloading software and/or our mobile application;
• Subscribe to our newsletters;
• Respond to voluntary market surveys;
• Contact us with an inquiry or to report a problem (by phone, email, social media, or messaging service).

From automated technologies or interactions:

As you interact with our website, we may automatically collect the following types of data (all as described above): Device Data about your equipment, Usage Data about your browsing actions and patterns, and Contact Data where tasks carried out via our website remain uncompleted, such as incomplete orders or abandoned baskets. We collect this data by using cookies, server logs and other similar technologies. Please see our Cookie section below for further details.

From third parties:

We may receive Personal Data about you from various third parties, including:

• Device and Usage Data from third parties, including analytics providers such as Google;
• Content from communication services, including email providers and social networks, when you give us permission to access your data on such third-party services or networks;
• Account Information and Payment Data from third parties, including organizations (such as law enforcement agencies), associations and groups, who share data for the purposes of fraud prevention and detection and credit risk reduction; and
• Account Information, Payment Data, and Financial Data from providers of technical, payment and delivery services.

If you provide us, or our service providers, with any Personal Data relating to other individuals, you represent that you have the authority to do so and acknowledge that it will be used in accordance with this Policy. If you believe that your Personal Data has been provided to us improperly, or to otherwise exercise your rights relating to your Personal Data, please contact us by using the information set out in the "Contact us" section below.

Article 3 (Device and usage data)

When you visit a pafin Inc. website, we automatically collect and store information about your visit using browser cookies (files which are sent by us to your computer), or similar technology. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. The Help Feature on most browsers will provide information on how to accept cookies, disable cookies or to notify you when receiving a new cookie. If you do not accept cookies, you may not be able to use some features of our Service and we recommend that you leave them turned on.

We also process information when you use our services and products. This information may include:

• Device ID
• Login information
• IP address
• Timestamp
• Authentication records
• Location information
• Individual products you view
• Web terms or searches that led you to the site
• Time zone
• Other operational data

Article 4 (Data we collect from third parties)

We may receive your Personal Data from third parties such as companies subscribing to our Services, partners and other sources. This Personal Data is not collected by us but by a third party and is subject to the relevant third party's own separate privacy and data collection policies. We do not have any control or input on how your Personal Data is handled by third parties. As always, you have the right to review and rectify this information. If you have any questions, you should first contact the relevant third party for further information about your Personal Data. Where that third party is unresponsive to your rights, you may contact our Data Protection Officer. (contact details below).

Our Services may contain links to other websites, applications and services maintained by third parties. The information practices of such other services, or of social media networks that host our branded social media pages, are governed by third parties' privacy statements, which you should review to better understand those third parties' privacy practices.

Personal Data in the Service

We collect and use your Personal Data with your consent to provide, maintain, and develop our services and understand how to improve them. These purposes include:

• to provide, maintain, improve and develop the Services
• to inform you about the Service and various campaigns;
• to perform marketing, surveys, and analysis for improving or enhancing the quality of the Services (In order to measure the effectiveness of advertisement of the Services, we may collect data on ads clicked prior to accessing the Service (such as the click date and referring site) via third party tools, and compare such data with registered information);
• to provide maintenance and support;
• to establish a safe and secure environment;
• to investigate and prevent security incidents, such as breaches, attacks and hacks
• to respond to acts in violation of our terms, this Policy, or other applicable policies (collectively, the "Rules");
• to notify changes to the Rules relating to our Service;
• to use information which is necessary to provide the Services to the user such as contents of inquiries, information regarding billing, usage status and contact details;
• to send you newsletters and other marketing communications about current and future products, programs, services, events, competitions, surveys, and promotions held by us or hosted on our behalf;
• to communicate in emergencies; and
• for other purposes associated with the foregoing purposes of use.

Where we process your Personal Data to provide a product or service, we do so because it is necessary to perform contractual obligations. All of the above processing is necessary in our legitimate interests to provide the Service and to maintain our relationship with you and to protect our business for example against fraud. Consent will be required to initiate services with you. New consent will be required if any changes are made to the type of data collected. Within our contract, if you fail to provide consent, some services may not be available to you.

Personal Data of shareholders

• to exercise rights and perform obligations under laws and regulations;
• to provide various facilities to shareholders (e.g. shareholder special benefit plan);
• to perform various shareholder strategies (e.g. surveys); and
• to manage shareholder records as required by law.

Personal Data of officers and employees of business partners and other companies

• to make various communications and engage in negotiations required for business; and
• to manage business partner information, and process payments and receivables.

Personal Data entrusted from business partners:

• to perform service agreements.

Personal Data of job applicants, employees and retirees:

• to provide information to and contact job applicants (including internships) regarding their hiring status;
• to manage recruitment process internally;
• to manage employment and personnel matters; and
• to provide information and maintain communication with retirees.

Article 6 (Amendment to purpose of collection and use of personal data)

We may amend to the purpose of use of Personal Data to the extent that is reasonably considered that the purpose of use after the change is duly related to that before the change, and in such case the Company will notify or publicly announce such amendment.

Article 7 (Restriction on use of personal data)

Excluding the following cases, we may not handle Personal Data beyond the scope required for achieving the purpose of use without obtaining the user's consent in advance; save for cases that are permitted under the Personal Information Protection Act in Japan and other applicable laws:

1. cases in which the handling of Personal Data is based on laws and regulations;
2. cases in which the handling of Personal Data is necessary for the protection of the life, body, or property of an individual and in which it is difficult to obtain the consent of the person;
3. cases in which the handling of Personal Data is especially necessary for improving public health or promoting the sound growth of children and in which it is difficult to obtain the consent of the person; and
4. cases in which the handling of Personal Data is necessary for cooperating with a state organ, a local government, or an individual or a business operator entrusted by either of the former two in executing the affairs prescribed by laws and regulations and in which obtaining the consent of the person is likely to impede the execution of the affairs concerned.

Article 8 (International data transfer and storage)

Where possible, we store and process data on servers within the general geographical region where you reside (please note that this may not be within the country in which you reside). Your Personal Data may also be transferred to, and maintained on, servers residing outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. We will take appropriate steps to ensure that your Personal Data is treated securely and in accordance with this Policy as well as applicable data protection law.

Article 9 (Sharing and disclosure)

We also use Google Analytics to help us understand how our customers use our site. The data collected through Google Analytics is gathered anonymously and does not identify individuals. These data are managed in accordance with Google's privacy policies and other terms (https://policies.google.com/technologies/partner-sites?hl=en). You can opt out of Google Analytics here: https://tools.google.com/dlpage/gaoptout?hl=en

We may also use your Personal Data to provide you with targeted marketing through advertisements or communications, such as newsletters.

We do not disclose your Personal Data to third parties without your prior consent, except where such disclosure is permitted under applicable law or as otherwise described in this Policy or explicitly indicated at the time of collection. However, the following cases are not considered as disclosure to third parties under the above clause:

1. When we outsource all or part of handling of Personal Data to the extent necessary to achieve the stated purpose of use;
2. When Personal Data is provided in connection with the succession of business due to a merger or other reason; or
3. When Personal Data is jointly used in accordance with the provisions of the Protection of Personal Information Protection Act in Japan.

Article 10 (Legal requirement)

We may use or disclose your Personal Data in order to comply with a legal obligation, in connection with a request from a public or government authority, or in connection with court or tribunal proceedings, to prevent loss of life or injury, or to protect our rights or property. Where possible and practical to do so, we will tell you in advance of such disclosure.

Article 11 (Service providers and other third parties)

We may use a third party service provider, independent contractors, agencies, or consultants to deliver and help us improve our Services. We may share your Personal Data with marketing agencies, database service providers, backup and disaster recovery service providers, email service providers and others but only to maintain and improve our Services. For further information on the recipients of your Personal Data, please contact us by using the information in the "Contacting us" section below.

Article 12 (Cookies)

A cookie is a small file with information that your browser stores on your device. Information in this file is typically shared with the owner of the site in addition to potential partners and third parties to that business. The collection of this information may be used in the function of the site and/or to improve your experience.

For details, please see our Cookie Policy

How we use cookies

To give you the best experience possible, we use the following types of cookies:

• Strictly Necessary. As a web application, we require certain necessary cookies to run our service.
• Preference.
  • We use preference cookies to help us remember the way you like to use our service.
  • Some cookies are used to personalize content and present you with a tailored experience. For example, location could be used to give you services and offers in your area.
• Analytics. We collect analytics about the types of people who visit our site to improve our service and product.
• Marketing. We share cookies with third party advertisers and/or partners to help provide you with a personalized marketing experience.

We also allow third party partners to put their own cookies on our website.

Article 13 (Proper acquisition of personal data)

We acquire Personal Data through fair and appropriate means and do not collect such data through deception or any other wrongful means.

Article 14 (Safety control of personal data)

We have appropriate organizational safeguards and security measures in place to protect your Personal Data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed.

To ensure the secure handling of Personal Data and prevent risks such as loss, destruction, falsification, or leakage, we exercise necessary and appropriate supervision over our employees. When all or part of the handling of Personal Data is outsourced, we also supervise the subcontractors to ensure that they implement necessary and appropriate security control measures.

Our security management measures for retained Personal Data include: the establishment of internal rules, development of organizational structures, maintenance of Personal Data handling ledgers, regular inspections and audits, employee training, prevention of unauthorized access, and assessment of external environments.

For more details regarding the specific security management measures we take, please contact the inquiry desk specified in Article 18. We will respond without delay.

If You Reside Outside of Japan

• Right to Access (Personal Information Protection and Electronic Documents Act (PIPEDA – Canada), General Data Protection Regulation (GDPR – EU), California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA – California), Colorado Privacy Act (CPA), Virginia Consumer Data Protection Act (VCDPA), Connecticut Data Privacy Act (CTDPA), Utah Consumer Privacy Act (UCPA))
  • You have the right to learn whether we are processing your Personal Data and to request a copy of the Personal Data we are processing about you.
• Right to Rectification (PIPEDA, GDPR, CPRA, CPA, VCDPA, CTDPA)
  • You have the right to have incomplete or inaccurate Personal Data that we process about you rectified.
• Right to be Forgotten (right to erasure) (GDPR, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA)
  • You have the right to request that we delete Personal Data that we process about you, unless we need to retain such data in order to comply with a legal obligation or to establish, exercise or defend legal claims.
• Right to Restriction of Processing (GDPR)
  • You have the right to restrict our processing of your Personal Data under certain circumstances. In this case, we will not process your Data for any purpose other than storing it.
• Right to Portability (PIPEDA, GDPR)
  • You have the right to obtain Personal Data we hold about you, in a structured, electronic format, and to transmit such Personal Data to another data controller, where this is (a) Personal Data which you have provided to us, and (b) if we are processing that data on the basis of your consent or to perform a contract with you or the third party that subscribes to services.
• Right to Opt Out (CPRA, CPA, VCDPA, CTDPA, UCPA)
  • You have the right to opt out of the processing of your Personal Data for purposes of: (1) Targeted advertising; (2) The sale of Personal Data; and/or (3) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. Under CPRA, you have the right to opt out of the sharing of your Personal Data to third parties and our use and disclosure of your Sensitive Personal Data to uses necessary to provide the products and services reasonably expected by you.
• Right to Objection (GDPR)
  • Where the legal justification for our processing of your Personal Data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for processing which override your interests and rights, or if we need to continue to process the Personal Data for the establishment, exercise or defense of a legal claim.
• Nondiscrimination and nonretaliation (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA)
  • You have the right not to be denied service or have an altered experience for exercising your rights.
• File an Appeal (CPA, VCDPA, CTDPA)

  You have the right to file an appeal based on our response to you exercising any of these rights. In the event you disagree with how we resolved the appeal, you have the right to contact the attorney general in state or jurisdiction:

• File a Complaint (GDPR)
  • You have the right to bring a claim before their competent data protection authority.
  • If you are based in the EEA, please visit this website (https://edpb.europa.eu/about-edpb/about-edpb/members_en) for a list of local data protection authorities.

Withdrawing Consent

If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time, free of charge, such as where you wish to opt out from marketing messages that you receive from us. If you wish to withdraw your consent, please contact us using the information found at the bottom of this page.

How to Exercise Your Rights

You can make a request to exercise any of these rights in relation to your Personal Data by sending the request to our privacy team by using the form below.

For your own privacy and security, at our discretion, we may require you to prove your identity before providing the requested information.

Disclosure of Personal Data

1. If we receive a request to disclose or notify the purpose of use of personal data, we will promptly respond after we confirm that the request was made by the individual themselves, their authorized agent, or their legal representative (collectively, the "Person, etc."). However, this shall not apply if we are not legally obligated to disclose or notify such information under the Personal Information Protection Act in Japan or other applicable laws. Furthermore, if any of the following circumstances apply, we may decide not to disclose all or a part of the requested information. In such case, we shall promptly notify the Person, etc. of such decision:
   1. Where disclosure is likely to harm the life, body, property, or other rights or interests of the person or a third party;
   2. Where disclosure is likely to seriously impede the proper execution of our business; or
   3. Where disclosure would violate other applicable laws or regulations.
2. Notwithstanding the above, as a general rule, we do not disclose non-personal information such as history information and characteristic information.

Correction of Personal Data

If you request that we correct, add to, or delete (collectively, the "Correction") your Personal Data pursuant to the provisions of the Personal Information Protection Act in Japan on grounds that Personal Data is contrary to facts, we would promptly conduct necessary investigation after we confirm that the request was made by the Person, etc. to the extent required for achieving the purpose of use, and perform the Correction of the subject matter of Personal Data based on the investigation results, and notify the customer to such effect (if we decide not to perform the Correction, we shall notify the customer to such effect); provided, however, that this shall exclude cases where we are not obligated to perform the Correction under the Personal Information Protection Act in Japan or other applicable laws.

Suspension of Use of Personal Data

If you request that we suspend the use or delete (collectively, the "Suspension of Use") your Personal Data pursuant to the provisions of the Personal Information Protection Act in Japan on grounds that Personal Data is being handled beyond the scope of purpose of use or was acquired by wrongful means, we would promptly conduct necessary investigation and perform the Suspension of Use of Personal Data based on the investigation results after we confirm that such request was made by the Person, etc., and notify the Person, etc. to such effect; provided, however, that this shall exclude cases where we are not obligated to perform the Suspension of Use under the Personal Information Protection Act in Japan or other applicable laws.

Procedures for Requesting Disclosure, etc.

Procedures for requesting notification of the purpose of use, disclosure, correction, suspension of use, etc. of retained personal data (collectively, "Disclosure, etc.") are as follows. Personal Data collected through these procedures will be used only for responding to the request and for record retention purposes.

1. Eligible Requestors

   Requests for Disclosure, etc. may be submitted by:

   • the individual themselves;
   • the statutory agent of the individual, if the individual is a minor or an adult ward;
   • an agent authorized by the individual to act on their behalf for such request.
2. Documents required for submission

   When the request is made by the individual:

   • Our designated request form for Disclosure, etc.
   • Identification document (one of the following documents: "passport, driver's license, certificate of alien registration, special permanent resident certificate, student ID card, insurance card of health insurance, national health insurance or mariners insurance, company ID card or certificate of qualification with photo issued by a public institution")

   When the request is made by an agent:

   • Our designated request form for Disclosure, etc.
   • Identification document for both the individual and the agent)
   • Our prescribed power of attorney form
3. Submission Method

   Please submit your request to the contact point indicated in Article 18.

4. Fees

   If you request disclosure of Personal Data or the notification of its purpose of use, we charge a fee of 1,000 yen (excluding tax) per request. Payment can be made by way of bank transfer, or enclosing stamps or a postal money order via mail.

5. Response Method and Timing

   Once we verify that the requested personal data pertains to the individual, we will respond in writing within a reasonable period, except in the following cases. If we are unable to respond, we will notify you along with the reason. We may not respond to the request for Disclosure, etc. in the following cases:

   • Where the purpose of use of the retained personal data capable of identifying the individual is obvious;
   • Where disclosure may harm or impair the life, body, property or other rights and interests of a third party;
   • Where disclosure may infringe upon the rights or interests of Personal Data handling business operator; or
   • Where responding to the request may hinder the performance of duties prescribed by laws or regulations.

Article 16 (Retention & deletion)

We will only retain your Personal Data for as long as necessary for the purpose for which that data was collected and to the extent required by applicable law. When we no longer need Personal Data, we will remove it from our systems and/or take steps to anonymize it.

Article 17 (Continuous improvement)

We regularly review how we handle Personal Data and strive for continuous improvement, and we may revise this Policy as necessary.

Article 18 (Contact information)

If you have any questions about this Policy, please contact us using the information below.

pafin Inc.
Email address: contact@pafin.com
Write to us at:
Data Privacy Officer of pafin Inc.
Kojimachi 3-2-4, 102-0083, Tokyo, Chiyoda
Representative Director:
Amin Azmoudeh
Gaku Saito