Policies

We collect your personal data from different sources, including information you register to our membership, you provide in Surveys and we collect from you directly (e.g. when you contact us), and information we collect about you from other sources described below, so that we can verify the data you provided with us is correct or not:

Category of the third parties who provide the other sources: private companies

Note that we may be required by law to collect certain personal data about you, or as a consequence of any contractual relationship we have with you. Failure to provide this information may prevent or delay the fulfilment of these obligations. We will inform you at the time your information is collected whether certain data is compulsory and the consequences of the failure to provide such data.

We always need a proper reason to process your data. The reason shall be either collecting personal data to perform our contract with you, complying with our legal obligations, and, where applicable, processing personal data on your consent. Below, you can find information regarding the purposes for which we process the types of personal data.

1. Provide and personalize Surveys: For market research purposes initiated by Rakuten Insight and/or Clients. We use your profile data and your usage of the service to personalize the services for you to provide you with more relevant Surveys, improve your experience by providing interactive or personalized elements, and provide you with recommendations based on your interests.
2. Collect and analyze Survey responses for insight: When you choose to participate in Surveys, which Rakuten Insight and/or Clients may initiate, we process your data to conduct, collect, and analyze your response in the Survey to find insights.
3. Granting Offers or applicable refunds: We process your data to provide you with rewards Rakuten Insight offers or refunds if applicable.
4. Communication, support, and customer services: We use your data to reply to your requests and inquiries and to notify you about changes and updates to our Services.
5. Identity authentication and account management: We process your data to either allow you to register, log in, or activate your account; verify that you are truly you when you log into our service (authentication); we record your configuration and settings to manage your accounts and for creating and updating your profile with the information you provided to us.
6. Improve and develop the services for you: We use data about your usage of the service to ensure the service meets your expectations and for service improvements, internal analytics about how our service is used, develop new services and improve the technical functionality of the service.
7. Conduct marketing/advertising activities and send commercial messages: We conduct marketing activities such as promotional campaigns and may send you related messages through different means including email. We may personalize these marketing activities that are relevant and interesting to you.
   You may opt out of receiving these from us by following the instructions provided in the email or through the settings of your account. Note that where you opt out of receiving promotional communications, we may send you transactional emails as permitted by law, such as service emails and notifications that relate to the ongoing business relationship with us.
8. Comply with legal obligations addressed to us and cooperate with regulators and law enforcement authorities: We may be required to disclose data to law enforcement bodies (such as a court or the police). In such cases, we may disclose your data to such bodies without prior consent.
9. To prevent fraud, malicious activity, and potential losses: We use data to protect our service from fraud, malicious activities, and other threats. We analyze log-in patterns to protect your account against being accessed by someone else.

You have certain rights regarding your personal data, subject to local law. These include the following rights to:

• access your personal data: you can request access the information about your personal data, such as the categories, the purposes of the processing or any other information required under the applicable law;
• rectify the information we hold about you: you can rectify inaccurate personal data concerning you;
• erase your personal data: you can ask us to erase your personal data we have collected;
• restrict our use of your personal data;
• object to our use of your personal data: you can object to certain types of our processing of your personal data depending on the circumstances, such as profiling or any other processing required under the applicable law;
• data portability: receive your personal data in a usable electronic format and transmit it to an external party;
• learn more about the sources from which we collect information, the purposes for which we collect and share information, the information we hold, and the categories of parties with whom we share your information;
• opt out of "sales":
  for California residents, opt out of certain disclosures of personal data that California law defines as “sales” even if no money is exchanged (you may exercise that right here: Do Not Sell My Personal Information);
• be free from discrimination: You can freely exercise rights without fear of being denied goods or services; and
• lodge a complaint: you can lodge a complaint to the Global Privacy Manager of Rakuten or a data protection authority in accordance with Rakuten's BCRs (https://corp.rakuten.co.jp/privacy/en/bcr.html).

If you would like to ask about or exercise such rights, please contact us in accordance with Section 9 ("Contact Us"). You may use an authorized agent to exercise your rights in accordance with the applicable law. In that case, please ensure that you give the written permission to the agent.

Once we receive the request, we will verify your identity based on your personal data that we already have and that we may additionally require from you for the verification purpose. Please note that we may also require additional information from you in order to respond your request appropriately.

We encourage you to contact us to update or correct your information if it changes or if the personal data we hold about you is inaccurate.

Please also note that your rights are not absolute, and there are some grounds where we may decline your request as permitted under the applicable law.

We may disclose your personal data for business purposes to the following parties:

• Service providers and business partners. We may share your personal data with our service providers and business partners that perform marketing services and other business operations for us. For example, we may partner with other companies to process secure payments, fulfil orders, send newsletters and marketing emails, support email and messaging services.
• Affiliates. We may share your personal data with our affiliates and group companies that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal data uses it in a manner that is consistent with this Policy. In addition, in cases where it is necessary to prevent and mitigate fraudulent or illegal activities or to protect life, body or property, we may share your personal data with our affiliates and group companies.
• Law enforcement agencies, courts, regulators and government authorities. We may share your personal data with these parties where we believe this is necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party.
• Clients. We may share your personal data with any third party that purchases, or to which we transfer, all or substantially all of our assets and business. Should such a sale or transfer occur, we will use reasonable efforts to try to ensure that the entity to which we transfer your personal data uses it in a manner that is consistent with this privacy notice.

The following categories of your personal data we collected from you may be shared with these parties:

• Identifiers
• Protected characteristics
• Financial, medical, or health information
• Audio, electronic, visual, thermal, olfactory, or similar information
• Internet or other electronic network activity information
• Employment Information
• Education Information

California law requires that we describe certain disclosures of personal data that involve monetary or other consideration. California law treats such disclosures as "sales", even if no money is exchanged. Such sales include our sharing of personal data with:

• Clients
• Rakuten Group companies including our affiliates

The following categories of your personal data may be disclosed to these parties:

• Identifiers
• Protected characteristics
• Financial, medical, or health information
• Audio, electronic, visual, thermal, olfactory, or similar information
• Internet or other electronic network activity information
• Employment Information
• Education Information

Because we operate as part of a global business, the recipients referred to above may be located outside the jurisdiction in which you are located (or in which we provide the services). See the section on "International Data Transfers" below for more information.

We do not "sell" your personal data of minors under 16 years of age without affirmative authorization.

We implement technical and organizational measures to ensure a level of security appropriate to the risk to the personal data we process. These measures are aimed at ensuring the on-going integrity and confidentiality of personal data. We evaluate these measures on a regular basis to ensure the security of the processing.

We will keep your personal data for as long as we have a relationship with you and/or your personal data is necessary for the purposes for which it is collected and further processed.

We retain statistical and anonymous information about you to help improve our service.
We will only retain your personal data beyond the terms above if we are required to do so to comply with the law, or if there are outstanding claims or complaints that will reasonably require your personal data to be retained.

Your personal data may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for personal data.

We have put in place appropriate safeguards (such as contractual commitments) in accordance with applicable legal requirements to ensure that your data is adequately protected. For more information on the appropriate safeguards in place, please contact us at the details below.

As part of the Rakuten Group, Rakuten Insight relies on the Rakuten Group Binding Corporate Rules to legitimize international data transfers within the Group. The Rakuten Group Binding Corporate Rules can be found at https://corp.rakuten.co.jp/privacy/en/bcr.html.

Our services embed links directing to other websites, especially when connecting to a Client’s survey system for Users to answer a survey on it. Rakuten Insight is not responsible for privacy practices of such other websites. Rakuten Insight encourages the User to be aware when the User is leaving our services, and to read the privacy statements of each website that collects personal data. This Policy applies solely to the processing activities collected and controlled by Rakuten Insight.

Rakuten Insight is the controller responsible for the personal data you provided us as our member database.

If you would like to discuss or exercise your rights granted by the applicable laws, please contact us through the following inquiry methods below. For example, the rights may include the right to opt out of "sales", which is granted to California residents. For more description of your rights and the procedures, please see Section 3 ("YOUR RIGHTS OVER YOUR PERSONAL DATA").

• Inquiry form
• Email: rig-DoNotSellMyPI@mail.rakuten.com

We may modify or update this privacy notice from time to time.

If we change this privacy notice, we will notify you of the changes. Where changes to this privacy notice will have a fundamental impact on the nature of the processing or otherwise have a substantial impact on you, we will give you sufficient advance notice so that you have the opportunity to exercise your rights (e.g. to object to the processing).