Rakuten ID Privacy Policy

We collect personal data in different ways when you sign up for, or use your Rakuten ID. You first sign up for a Rakuten ID via any of the services, which make use of the Rakuten ID. If you use the same Rakuten ID to log in to another service, we share your data with that new service. Each service may use different kinds of personal data which are only stored with each service. For details, please refer to each service’s privacy policy. The following is a list of examples of data that is stored in the ID system and shared among participating services:

Information that you directly provide to us:

• Identifiers, such as
  • Personal details (e.g. name, date of birth);
  • Contact details (e.g. phone number, email address, postal address or mobile number);
  • Account login details, such as your username and password;
• Financial information, such as
  • Bank details or credit card numbers;
  • Rakuten points, if your Rakuten ID service participates in the Rakuten points program.

Information we collect automatically, for example via cookies:

• Identifiers for devices you have used to access our services, including the IP address and MAC identifiers;
• Geolocation data, such as your IP address;
• Internet or other electronic network activity information, such as information about your login sessions.

• We need to verify you are truly you, when you log into one of our services (authentication);
• Sending you service messages;
• Creating your profile. You can add information voluntarily to create a better user profile;
• Some services need financial information, like your credit card number. Your credit card number can be stored centrally with your profile. This is for your convenience. You can access it easily from any service when making a payment. You do not need to store it in your account, and you can also delete it anytime from your account page;
• We use data about your usage of the service for
  • Service improvements;
  • Internal Analytics about how our services are used;
  • Improving the technical functionality of the service.
• We send you marketing messages if you agree to it.
• To use Rakuten points. Points are tied to your account and the currency of the service you are using. You can collect and use points on services that are part of the points program and use the same currency. We also analyze how points are used across different services.
• You can use your Rakuten ID to log-in to selected partner sites. These partners do not belong to the Rakuten group. However, you can use your Rakuten ID to log in to their services.
• We need some data to reply to your requests.
• We may be required by law to disclose data to law enforcement bodies (such as a court or the police).
• We use data to protect our services from fraud and other threats. For example, we try to analyze log-in patterns to protect our users’ accounts against being accessed by someone else.

We share your data with:

• Other Rakuten services that use Rakuten ID; in case that you log in to any service with the same Rakuten ID;
• Rakuten Group, Inc. (Japan), our parent company; which is providing the technology behind Rakuten ID; for example for security and compliance purposes, as well as for service improvements;
• Our service providers and business partners; who help us make Rakuten ID possible (they are data processors).
• Business partners that have implemented Rakuten ID as a log-in function to their site, but do not belong to the Rakuten group. If you chose to use your Rakuten ID on any other service, you will be told which data is shared with this service the first time you log-in. Rakuten does not have any control over how these partners use your data after you have logged in.

The rights and choices about your data are different depending your location. For example, in Europe and California, this includes the right to request:

• Access to your data; if you want to know what data we have about you; or
• Get a copy of your data in a machine-readable format (right to data portability);
• Correct any information that is wrong;
• Delete your data;
• Restrict usage to the bare minimum (for example, if you ask us to delete, but we still need to keep your order history for legal reasons, like tax audits of our business);
• Object to specific uses (like you can opt-out of marketing e-mails);
• Ask us where we got certain data about you, how we use it and with whom we share it;
• Very specifically for California residents, there is a right to request that we ‘Do-Not-Sell’ your data. This ‘sale’ includes many different kinds of data sharing, even if it is not for money. Please rest assured that we do not sell any of your data in this sense.

You can always ask us to exercise these rights without having to be afraid of discrimination. Also, you can file a complaint with your data protection authority, if you think we mishandled your data.
If you want to request any of this from us, please just get in touch with any Rakuten service where you have used your Rakuten ID before. Please be careful, because if you delete your Rakuten ID account, you will lose access to all the services you have used it on before.

We are a global business. That means your data will be shared to other group companies around the world. Also, we use service providers in different countries. Data may be sent to them as well. Rest assured that we have taken steps to keep your data safe. Inside the Rakuten Group, we have BCR (Binding Corporate Rules) that show our strong conviction to privacy. You can find them here: https://global.rakuten.com/corp/privacy/bcr/. And for our service providers, we are always watching out to ensure they are trustworthy and we have strict contracts in place.

We always need a proper reason to process your data. Under European law that is called a legal basis. Our legal basis will be one of the following:

• We have a contract with you to provide a service that you asked us to provide;
• For certain analytics, our loyalty program, security and compliance with different rules around the world, we rely on what is called legitimate interest. That means first that we have a valid interest to do what we are doing with your data (like checking that our systems are safe or creating statistics about how many users we have). Second, we have to make sure that your interests do not override ours. For that we have to balance our and your interest and make sure everything is in order.
• Sometimes we are required by law to process data. For example, we need to create reports for tax purposes.
• Sometimes we ask for your consent. For example, for marketing mails. You can always withdraw your consent easily.

We have strict security measures in place to ensure that your account and your data is safe with us. Some of these are technical, like password rules and monitoring of log-in patterns. Others are organizational, like having proper processes and access rules in place. We make sure to always keep up with the latest developments.

As long as you have your account, we keep your data. When you delete your account, we will retain data only if we are required to do so by law. Or in case we still need it for the defense in court proceedings.

For any questions or concerns, or if you want to make use of your rights, feel free to reach out anytime to:

• Any service you have used your Rakuten ID account on;
• rakuten-privacy@mail.rakuten.com

Our data protection officer can be contacted with this e-mail address. If you have any complaint, we hope we can work with you to achieve a good solution. If we are not able to, you can contact your local data protection authority. Additionally, you can contact the data protection authority of Luxembourg here: https://cnpd.public.lu/en.html.

We may update this privacy policy from time to time. If we make changes, we will notify you via e-mail. If there is going to be a substantial change, we will give you enough time in advance, so that you can consider to for example delete your ID.

Last updated: Dec 26, 2019