Offra Seller Privacy Policy
3-7-18 Shin-Yokohama, Kohoku-ku, Yokohama, Kanagawa 222-0033, Japan
Corporate number: 8020001115655
customer@rubik.co.jp
Revised September 25, 2026. The effective date is displayed on the publication and consent screens presenting this version. Application to existing transactions follows the amendment provisions.
Offra Seller Terms of Service · Japanese Commercial Disclosure and B2B Transaction Information
1. Controller
This Policy explains the processing of personal information about Offra Sellers and their representatives.
The controller is Rubik KK (Japanese registered name: ルービック株式会社), 3-7-18 Shin-Yokohama, Kohoku-ku, Yokohama, Kanagawa 222-0033, Japan; corporate number 8020001115655. Privacy contact: customer@rubik.co.jp. In this Policy, “we” means Rubik. Although Offra is a business service, applicable personal-data laws protect information about representatives, employees, sole proprietors and other individuals.
Company representative: Naoki Fujimoto.
2. Data processed
We collect the following to the extent necessary:
- Account and business information: name, position and authority, work email, telephone number, language, legal name, company/business registration number, VAT number, business address, logo, authentication information and records of acknowledgment or acceptance of policies and terms.
- Verification information: company registration, applicable secondhand-dealer permits and supporting information, and evidence of selling authority and staff authorization, approval status, replies to additional checks, facts relevant to suspected misuse and review outcomes. We request identity documents only when necessary, through a secure method. Do not submit unnecessary sensitive information or national identifiers.
- Trading information: requests, offers, negotiation messages, photos and attachments, orders, prices, currencies and fees, acceptance timestamps, payment/refund/chargeback identifiers and status, ratings, claims and handling records.
- Payment and delivery information: Stripe connection, verification and payout status, delivery addresses and contacts, tracking numbers and delivery status, and payout and bank information made available to us. Full card numbers and security codes are processed directly on Stripe’s payment interface and are not stored by Offra. Offra may receive necessary identifiers, payment status, card brand and last four digits.
- Technical information: IP address, timestamps, access/action/error logs, session identifiers, browser and device information, and information needed for security.
Sources include you, your business administrator, counterparties, Stripe, carriers/tracking services and public official business registers. Without mandatory information, registration checks, transactions, payments or delivery may not be possible. If you provide another person’s details, including staff or a delivery contact, limit them to what is necessary and give that person this policy.
Where we obtain personal data from another source, we provide the required information to the individual under applicable law. Where GDPR Article 14 notice is required, we normally provide it within one month of obtaining the data, or by the first communication or disclosure if earlier; any exception must satisfy the statutory conditions. A user’s notice does not, by itself, discharge our own information obligations.
3. Purposes and legal bases
| Purpose | Basis where the GDPR applies |
|---|---|
| Accounts, transactions, payments, delivery and necessary service notices | Necessary contractual or pre-contractual processing where the individual is a party to the contract; for corporate staff and similar contacts, legitimate interests in communicating and conducting business transactions |
| Business and authority checks, fraud prevention, security and audits | Legitimate interests in a secure B2B service and protection of its participants; an applicable legal obligation where EU or Member State law requires the processing |
| Translation to support trading communications | Contractual performance where objectively necessary for a contract with the individual, or legitimate interests in supporting cross-border business communication; consent where separately required |
| Claims, refunds, investigations and legal claims/defence | Applicable contractual performance and legitimate interests in resolving disputes and establishing, exercising or defending rights |
| Accounting, evidence retention and authority requests | Applicable EU/Member State legal obligations; where compliance with Japanese or other law is not an Article 6(1)(c) basis, legitimate interests in lawful accounting, business operation and protection of rights |
| Optional functions or trackers requiring consent | The relevant consent; unnecessary consent is not a condition of essential service use |
Under Japanese law, these are our specified purposes of use; we separately meet consent and other requirements for disclosure, overseas transfers and other regulated processing. Where relying on legitimate interests, we assess purpose, necessity and effects on individuals’ rights. Acknowledging this policy is not blanket consent to all processing. We do not sell personal data and currently do not use it for advertising.
If special categories of personal data or data relating to criminal convictions and offences need to be processed, we also establish the additional conditions under GDPR Articles 9 and 10, Japanese law and other applicable law. Legitimate interests alone do not meet those conditions. We avoid collecting data without lawful grounds and, where appropriate, isolate or delete information received in error.
4. Recipients and processors
Offers and transaction communications are shown as necessary to the relevant buyer and participants. The applicable interface indicates the visibility of store information and ratings. Access to request information is also limited according to need before and after the transaction.
After a transaction is agreed, we share the business, contact and delivery information necessary for performance, communication, shipping, customs and claims with the relevant parties. Identity documents, authentication secrets and full card numbers are not generally disclosed to counterparties. Do not put unnecessary personal details, such as a private address, in public fields. The input interface also explains the intended audience and visibility.
We and counterparties are independent controllers to the extent each determines its own purposes, such as accounting, delivery or customer administration. Counterparties must restrict received information to the transaction and lawful obligations, without unauthorized advertising, contact-list building or unrelated reuse. If the actual arrangement involves a processor or joint controllers, we put the required agreement and notices in place.
We use or share necessary data with Stripe for payments and verification, Amazon Web Services for hosting, photo storage and email delivery, OpenAI for the translation in section 4, and carriers and tracking providers for delivery checks. Access and data are limited to their tasks. Stripe, carriers and other providers may act as independent controllers for their own legal compliance and similar purposes; their applicable privacy policies are also available.
We use required data-protection contracts and appropriate safeguards and oversight. Where necessary under law, a lawful court or authority request, or for the protection of rights, we may provide limited information to legal and accounting advisers and other appropriate recipients.
Text is sent to OpenAI to translate requests, offers and transaction messages. Do not include contact details, identity documents, payment details or other information unnecessary for translation in the text. If translation is not desired, contact customer@rubik.co.jp before entering it. We explain the scope and timing of any available suspension and alternatives using the original text. We do not guarantee retrospective recovery of lawful prior disclosures or control over translation services used independently by a counterparty.
Even where automated processing supports review, individuals may contact us to request human reconsideration, explain their circumstances and object to significant registration refusals, account restrictions or decisions concerning funds. Before using a solely automated decision producing legal or similarly significant effects, we establish the required legal basis, information and safeguards.
5. Transfers outside the European Union
As the service connects EU/EEA and Japanese businesses, necessary transaction data is provided to us and counterparties in Japan. The European Commission’s adequacy decision for Japan applies only to transfers within its scope. We follow the Japanese Supplementary Rules for covered EU-origin data.
For transfers or onward transfers to the United States or elsewhere, we verify the applicable adequacy decision, appropriate standard contractual clauses or another lawful mechanism for each flow, and undertake required assessments and supplementary measures. We also meet applicable Japanese requirements concerning consent, equivalent safeguards and information.
You may request the destination countries, a description of safeguards or a copy of applicable guarantees through our privacy contact. Necessary redactions may protect trade secrets or other people’s information.
6. Retention
We retain data only as necessary, then delete it or make it non-identifiable. These are normal maximum periods; information no longer needed is removed sooner.
| Category | Period and starting point |
|---|---|
| Active account | As necessary for use and communication; outdated staff details are updated or removed |
| Ordinary profile after closure | Up to three years after closure, limited to details needed for abuse prevention, support or similar justified purposes |
| Copies of identity documents used for checks | Up to 90 days after verification is completed or refusal becomes final; only specifically necessary legal or unresolved-fraud evidence may be retained separately |
| Contract, payment, delivery and acceptance evidence | Normally five years after the transaction or relationship ends; statutory accounting or other records follow their applicable period |
| Invoices and accounting records | Usually seven years under the relevant law, and ten years for covered company books or applicable tax records; only necessary records, from the legally prescribed starting point |
| Claims, refunds and disputes | Normally five years after resolution; unnecessary attachments are removed earlier |
| Technical and security logs | Up to 12 months after creation; selected incident evidence is separated and follows the related case’s period |
| Temporary translation data | Only as needed for processing; the provider’s contractual retention period and applicable conditions can be requested from our contact |
For specific proceedings, statutory retention duties or authority orders, we preserve only relevant data as necessary with restricted access. This does not justify indefinite retention of whole accounts. Deletion from backups follows the normal replacement cycle; deletion instructions are reapplied if data is restored.
7. Your rights
Subject to applicable law and its conditions, you may request notice of purposes, access/disclosure, rectification, erasure or cessation of use, cessation of third-party disclosure, restriction, objection and portability. GDPR portability requires, among other conditions, automated processing based on consent or a contract with the individual. Objections to legitimate-interest processing are assessed in light of individual circumstances. We may retain information necessary for statutory records or establishing or defending rights, and explain the reason.
You may withdraw consent at any time for consent-based processing, without affecting prior lawful processing. Contact customer@rubik.co.jp. We use necessary and proportionate identity checks and normally respond without charge. Any exceptional fee or refusal must have an applicable legal basis and explanation.
We normally respond to GDPR requests within one month. Where law permits because of complexity or volume, we may extend by up to two further months and explain the extension within the first month. We also handle Japanese-law requests without undue delay.
Contacting us is not a prerequisite to a regulatory complaint. Where the GDPR applies, you may complain to the supervisory authority of your habitual residence, workplace or the place of the alleged infringement. In France this includes the CNIL (https://www.cnil.fr/); in Japan, the Personal Information Protection Commission (https://www.ppc.go.jp/).
8. Cookies
Cookies and other terminal-storage technologies are used for login, security, language settings and payment functions requested by the user. An exemption from consent is relied on only for purposes strictly necessary under applicable law. Advertising, unnecessary analytics and other processing requiring prior consent do not start without valid consent. Confirmation of this Policy is distinct from optional consent; we explain how optional consent can be refused or withdrawn. Disabling cookies in the browser may prevent login or other functions.
9. Security
We use risk-appropriate technical and organizational measures, including encrypted communications, secure password hashing, access controls, administrator two-factor authentication and audit logs. We do not promise absolute security or immutability. Only authorized staff and providers receive access appropriate to their tasks.
If a personal-data incident occurs, we investigate, mitigate harm and document it, and notify authorities and affected individuals where required within applicable legal deadlines.
10. Changes
We show the version and effective date of revisions, and notify affected individuals in advance of material changes by email or another appropriate channel. New purposes or processing requiring further information or consent begin only after those requirements are met. Contractual governing-law or language-priority provisions do not limit mandatory data-protection rights relating to this policy.
The Japanese, English and French versions establish the same substantive terms. If an interpretative discrepancy remains, Japanese is the reference version. Its priority alone does not override mandatory law, expressly agreed individual conditions or the counterparty's legally protected rights or reasonable reliance arising from statements expressly made in another language.