VosCMS Privacy Policy
Effective date: March 2, 2026
Effective date: March 2, 2026
Article 1 (Processing Purposes)
株式会社ザボスＥＣＯ研究所 (the "Company") processes the minimum necessary personal information from Users (Buyers and Developers) to operate the marketplace "VosCMS Marketplace" (the "Marketplace") at market.21ces.com and related ancillary services.
- Member management, login, identity verification, and abuse prevention for the Marketplace.
- Item purchase and payment processing, license issuance, and delivery (download).
- Developer review, settlement, withholding tax processing, overseas remittance, and preparation and retention of tax documents.
- Inquiries, support, reviews, dispute handling, and refund processing.
- Compliance with legal obligations (personal information protection, income tax, consumption tax, Act on Specified Commercial Transactions, etc.).
Article 2 (Items Processed)
| Category | Items | Source |
|---|---|---|
| Common (Buyers and Developers) | Email address, name, login history, IP address, browser information, cookies | Auto-collected during registration and use |
| Buyer | Purchase history, payment-method token (the Company does not store card numbers; they are transmitted directly to the payment provider), billing address (country/state/zip level) | Entered at purchase / via payment provider |
| Developer (common) | Identity-verification documents (image, date of birth), country of residence, bank account information, PayPal email, withholding-tax information | Entered at developer registration |
| Japan-resident Developer | Business number, qualified invoice issuer number (T-number), address, phone number, blue-form filing status | Entered at developer registration |
| Overseas-resident Developer | Country-of-residence tax number (optional), PayPal email (required) | Entered at developer registration |
| Delivery | Download logs for purchased Items, license-key issuance history | Auto-collected at purchase/download |
Article 3 (Retention Periods)
| Information Type | Retention Period | Legal Basis |
|---|---|---|
| Member information (Buyers and Developers) | During membership, plus 1 year after withdrawal | Consent withdrawal and support |
| Purchase and payment records | 7 years after transaction completion | Bookkeeping obligation under Japan Income Tax / Corporate Tax / Consumption Tax Acts |
| Developer settlement and withholding-tax records | 7 years after settlement | Japan Income Tax Act §216, §226 |
| Identity-verification documents | 5 years after review completion | Act on Prevention of Transfer of Criminal Proceeds; payment-provider rules |
| Access logs / login records | 6 months | Abuse prevention |
| Inquiry / support history | 3 years after intake | Dispute response and service improvement |
| Minimum post-withdrawal transaction history | 7 years (electronic records only) | Bookkeeping obligation |
Article 4 (Provision to Third Parties)
The Company does not provide personal information to third parties without the User's consent, except in the following cases:
- When required by law (court order, tax investigation, cooperation with law-enforcement, etc.).
- When necessary to protect life, body, or property and obtaining consent is difficult.
- When payment processors, overseas-remittance services, etc. handle data under an "outsourcing/processor" relationship rather than a third-party transfer (Article 5).
Article 5 (Processors)
The Company may entrust processing of personal information to the following processors, supervised under contract and law:
| Processor (typical examples) | Service | Information Provided | Country |
|---|---|---|---|
| Stripe / KOMOJU / PayPal / card networks | Payment processing | Payment information, email, billing country | US, JP, others |
| PayPal (overseas remittance) | USD payouts to Developers | Recipient name, PayPal email, payout amount | US |
| Foreign-exchange rate services (e.g., Frankfurter API) | Same-day USD rate retrieval | No personal information | EU and others |
| Hosting / CDN providers | Server and content delivery | Access logs, cookies | Mainly Japan |
| Email-delivery providers (e.g., SendGrid) | Email notifications | Email address, message content | US |
| Japan National Tax Agency (NTA) / Japanese tax advisors | Tax filings, withholding remittance | Settlement records, developer info, T-number | Japan |
Article 6 (Cross-Border Transfers)
In connection with outsourcing for payment processing, overseas remittance, email delivery, and analytics, the Company may transfer personal information to overseas processors. The Company verifies destination protection levels and applies contractual safeguards. Main destinations:
- United States: PayPal (overseas remittance), Stripe (payment processing), SendGrid (email).
- EU countries: foreign-exchange rate services.
- Other countries: regional payment gateways, recipient-country banks (for remittance).
Article 7 (Security Measures)
The Company takes the following measures to prevent leakage, loss, or alteration of personal information:
- Organizational: appointment of a privacy officer, least-privilege access, internal audit.
- Technical: HTTPS (TLS) encryption, database encryption, intrusion detection.
- Physical: server-room access control, anti-theft measures for devices.
- Payment data: card numbers are not stored on the Company's servers and are processed directly by PCI-DSS-compliant providers.
- Identity documents: minimized access rights and prompt deletion after purpose completion.
Article 8 (User Rights)
Users may exercise the following rights regarding their personal information held by the Company:
- Right to disclosure of held personal data.
- Right to correction, addition, or deletion where data is inaccurate.
- Right to suspension or erasure where data is used beyond purpose or unlawfully obtained.
- Right to suspend third-party provision where consent was not given.
- Right to withdraw consent (except processing required by law).
Requests are accepted at the contact point in Article 12 and are handled without delay following identity verification.
Article 9 (Cookies and Similar Technologies)
The Company uses cookies and similar technologies for smooth operation of the Marketplace:
- Authentication cookies — maintain login state.
- Functional cookies — remember language and display preferences.
- Analytics cookies — aggregate access statistics (statistics only; no personal identification).
- Advertising cookies — none used at this time.
Users may disable cookies in browser settings; some features may then be limited.
Article 10 (Minors)
For Users under 18, the Company in principle obtains the consent of a legal guardian before collecting personal information. Information collected without such consent will be promptly deleted upon discovery.
Article 11 (Changes)
The Company may revise this Policy in accordance with applicable laws. Changes are announced on market.21ces.com at least 7 days (or 30 days for material changes to user rights) before the effective date.
Article 12 (Contact)
Inquiries about personal-information handling and rights requests are accepted at:
- Privacy officer: 株式会社ザボスＥＣＯ研究所
- Address: 福岡県福岡市博多区古門戸町１０番５－５０１号
- Phone: (092) 282-4518
- Inquiry URL: https://market.21ces.com/contact
You may also submit complaints to Japan's Personal Information Protection Commission (https://www.ppc.go.jp/).
(The Japanese version of this Policy is the authoritative original; in case of discrepancy with another language version, the Japanese version shall prevail.)