Official Announcement on Personal Information

Established: October 30th 2025
Updated: July 31st 2026

■ Regarding Handling of Personal Information Related to TOP SIM

Brastel Co., Ltd. ("we," "our," or "the Company") has established this policy regarding the handling of personal information in connection with the TOP SIM service ("the Service").

By using the Service, including installing the application or logging into the website, you are deemed to have agreed to this policy. We recognize the importance of protecting personal information and are committed to handling the information entrusted to us in a transparent, responsible, and professional manner as described below.

1. Personal Information We Collect or Process

To provide the Service, we collect the following personal information through lawful and appropriate means. Even if certain information (such as device identifiers) cannot by itself identify a specific individual, we will treat it as personal information and manage it appropriately when it can be combined with other information to identify an individual.

Category	Main Information Collected	Purpose of Use
Customer Information (when purchasing a physical SIM)	Order ID, email address, last name, first name (optional), address, telephone number (optional)	Processing applications, identity verification, order management, product delivery, important service notifications, and customer support
Account Information	Username, password, authentication information, account settings	Creating and maintaining accounts, user authentication, preventing unauthorized access, and saving user preferences
Order & Transaction Information	Products viewed, shopping cart contents, wishlist information, purchased products, purchase quantities, order history, purchase	Order processing, inventory and shipping management, returns and exchanges, transaction records, and service improvement
Payment Management Information	Selected payment method, purchase amount, payment date and time, payment status, transaction ID, etc.	Payment confirmation, matching payments with orders, and accounting processing
Device & Usage Information	IP address, device, browser and network information, cookies, device identifiers, and similar identifiers (for details, please refer to the Application Privacy Policy)	Providing the website, optimizing content display, access analysis, troubleshooting, security, fraud detection, and service improvement
Marketing Information	Purchase history, browsing history, communication preferences, campaign participation information	Providing information about products and services within the scope permitted by your consent or applicable laws, measuring advertising effectiveness, and delivering personalized content

2. Relationship with External Service Providers

2.1 Relationship with Shopify and Provision to Third Parties Located Outside Japan

This Service uses Shopify, a globally recognized e-commerce platform. As a result, your personal information is handled as described below. We entrust the processing of your personal information to Shopify. Under our supervision, Shopify manages such information as our data processor.

Shopify collects and processes information relating to your access to and use of this Service for purposes including providing and improving the e-commerce platform, ensuring security, preventing fraud, conducting analytics, and other related purposes. Information you enter into this Service may, in accordance with our Terms and Conditions and our agreement with Shopify, be transmitted and processed through Shopify's systems by Shopify and its affiliates and subcontractors for the purpose of providing and improving the Service.

In addition, when we use Shopify's network features, personalization services, advertising support, or other enhanced features, Shopify may combine and process information obtained through your interactions with our store, other merchants, and Shopify services. For processing carried out for Shopify's own purposes, Shopify is responsible in accordance with its Privacy Policy and will respond to requests from individuals exercising their privacy rights.

For more information on how Shopify handles personal information, please refer to: Shopify Consumer Privacy Policy

Shopify is a global company headquartered in Canada. As a result, your personal information may be stored and processed by Shopify, its affiliates, or its subcontractors located in Canada, the United States, or other countries outside Japan. The countries or regions to which personal information is transferred may change depending on Shopify's service configuration, data hosting arrangements, and subcontracting relationships.

When providing personal data to, or entrusting its processing to, business operators located outside Japan, we will take the measures required under applicable personal information protection laws, including obtaining the individual's consent where required, confirming that appropriate safeguards are maintained through contractual arrangements or other measures, and continuously monitoring compliance. Upon request from the individual, we will provide information, in accordance with applicable laws, regarding the data recipient's data protection framework and the safeguards implemented by us.

For more information regarding Shopify's international data transfers, please refer to: Shopify – International Transfers of Personal Data

Provision to Third Parties Located in Foreign Countries (Canada, United States, etc.)

As a result of using Shopify, your personal information may be transferred to, stored, and processed on Shopify's servers located in Canada, the United States, and other countries.

• For information regarding personal information protection systems in foreign countries, please refer to the survey published by Japan's Personal Information Protection Commission: Survey on Personal Information Protection Systems in Foreign Countries

2.2 Entrustment to Telecommunications Service Providers

In order to provide this Service (including activation of telecommunications services and network maintenance and management), we may entrust all or part of the processing of non-personally identifiable device information and similar information to telecommunications service providers with whom we have entered into contracts.

3. Handling of Credit Card Information

When you use a credit card to pay for this Service, your credit card number, expiration date, and security code are collected and processed directly by the credit card payment service provider through its payment processing system. We do not collect, store, or access this card information.

4. Contact Information

If you have any complaints, inquiries, requests for consultation, or wish to exercise your rights regarding the handling of personal information in connection with the Service, please contact:

Personal Information Protection Administrator

• Address: 2-6-2 Yokoami, Sumida-ku, Tokyo 130-0015, Japan
• Email: privacy@brastel.co.jp

■ Regarding the Personal Data Held by the Company

1. Name and address of the personal information handling business operator and the name of the CEO

   Name: Brastel Co., Ltd.
   Address: 2-6-2 Yokoami, Sumida-ku, Tokyo 130-0015, Japan
   CEOs: Junji Tanabe, Kendi Kawai (Adopting a multiple representative system)

2. Title, department, and contact information of the personal information protection manager

   General Management Director, Jun Aki (Contact information can be found below under "Personal Information Complaints and Consultation Desk")

3. Purpose of use for all retained personal data

   Category	Purpose of Use
   Customer’s personal information	To implement and properly manage the contents of the contract To support customers To manage usage history To provide guidance information about the Company’s services To respond to customers' inquiries For surveys, contests, campaigns, and other marketing research
   Personal information of individuals who have contacted the Company	To improve our customer service To accurately understand and address inquiries and communications

4. Contact point for complaints regarding the handling of retained personal data

   "Personal Information Complaints and Consultation Desk" (listed at the end).

5. Name of the Accredited Personal Information Protection Organization and Contact for Complaint Resolution

   Name of an authorized personal information protection organization:
   Japan Institute for Promotion of Digital Economy and Community (JIPDEC)

   Contact point for resolution of complaints:
   Accredited Personal Information Protection Organization Administrative Office
   Address: 1-9-9 Roppongi, Minato-ku, Tokyo 106-0032, inside Roppongi First Building
   Phone number 03-5860-7565 / 0120-700-779

6. Procedures for responding to requests for disclosure

   For requests from individuals or their representatives regarding the notification of usage purposes, disclosure, correction, addition, or deletion of contents (see N.B.), suspension of use, erasure, and suspension of provision to third parties of personal information or records of third-party provision held by the Company (hereinafter referred to as "requests for disclosure, etc."), please contact the "Personal Information Inquiry Desk" listed below.

   N.B. Regarding deletion, the Company may retain personal data for a certain period in accordance with security, fraud prevention, and legal requirements (e.g., 7 years under the Act on Prevention of Transfer of Criminal Proceeds, 3 years under the Act on Prevention of Illegal Use of Mobile Phones). In such cases, we will implement measures to ensure safety, such as masking the data as much as possible.

   1. Contact point for requests for disclosure

      "Personal Information Complaints and Consultation Desk" (listed at the end)

      N.B. If you wish to receive disclosure through electronic procedures, please indicate so. We will respond to your request accordingly.

   2. Forms and methods for requests for disclosure

      Please send the following to our "Personal Information Complaints and Consultation Desk" by mail or courier. We will respond promptly and without delay. Requests for disclosure, etc., by means other than mail or courier (such as in-person visits, email, fax, etc.) will not be accepted.

      1. The company's designated "Request for Disclosure Application Form"

         If you do not have this form, please contact us. We will send it to you.

      2. Identification documents

         1. In case of a request by the individual

            A copy of the individual's official identification

         2. In case of a request by a representative

            All relevant documents from the following list:

            1. Documents confirming the authority of the representative:

               1. Legal representative:

                  Family register or other document proving legal authority.

               2. Voluntary representative (all of the following):

                  • Our company-designated power of attorney (If you do not have our designated power of attorney, please contact us. We will promptly mail it to you.) N.B. The power of attorney must be stamped with the individual's registered seal.
                  • Certificate of seal registration for the individual.

            2. Identification documents of the representative:

               A copy of the representative's official identification.

            3. Identification documents of the individual:

               A copy of the individual's official identification.

               N.B. Official identification documents:

               1. One of the following:

                  Driver's license, driving history certificate, passport, My Number card (the front side showing name and photo only), residence card (zairyu card), special permanent resident certificate.

               2. Two or more of the following:

                  Public health insurance card, copy of the resident record, certificate of items stated in a resident register, pension handbook, insurance card for medical care for the elderly, certificate of membership in national or local public service employee mutual aid associations, membership card for private school faculty mutual aid system, child-rearing allowance certificate, special child-rearing allowance certificate.

                  N.B. The identification documents you provide will be used as follows. Please submit your request for disclosure, etc., only if you agree to the terms.

                  • The personal information will be used to respond to requests for disclosure, etc., made by the individual.
                  • Please redact any sensitive personal information not necessary for identification to make it unreadable.
                  • Except as required by law, we will not provide personal information to third parties without the individual's consent. Additionally, we do not plan to outsource the handling of this personal information.
                  • If we cannot verify your identity through the identification documents, we may not be able to respond to your request for disclosure, etc.
                  • For more information on our company's handling of personal information, please visit our website.

   3. Fee

      For "Notification of Purpose of Use" or "Disclosure," a fee of 1,000 yen per request will be charged. Please enclose a postal money order for 1,000 yen with the above documents.

      If the fee is not enclosed, we will notify you, but if the payment is not made within the specified period, we will consider the request for disclosure, etc., as not having been made. Please note that the documents you submit will not be returned.

      ＜Personal Information Complaints and Consultation Desk＞

      Brastel Co., Ltd. Personal Information Inquiry Desk:
      2-6-2 Yokoami, Sumida-ku, Tokyo 130-0015
      e-mail: privacy@brastel.co.jp (open hours 10:00-17:00*)
      * Response to inquiries received on Saturdays, Sundays, national holidays, and during New Year's and Golden Week holidays will be on the following business day.

7. Measures taken for the security management of retained personal data

   1. Basic policy

      To ensure the proper handling of personal data, our company complies with the Personal Information Protection Law and related laws, regulations, and guidelines. Additionally, we adhere to the following guidelines related to our services:

      The Telecommunications Business Act concerning the confidentiality of communications and the "Guidelines on the Protection of Personal Information in the Telecommunications Business".

      The "Guidelines on the Protection of Personal Information in the Financial Sector".

      The "Practical Guidance on Security Management Measures in the Financial Sector".

   2. Development of regulations related to the handling of personal data

      We have established regulations for handling personal data at each stage, including acquisition, use, storage, provision, deletion, and disposal. These regulations outline the methods of handling, the responsible persons, the in-charge persons, and their duties.

   3. Organizational security management measures

      We have appointed a person responsible for the handling of personal data, clarified the scope of personal data handled by employees, and established a reporting and communication system to notify the responsible person in case of any facts or signs of violations of laws or handling regulations.

      We also conduct regular self-inspections and audits conducted by other departments or external parties to review the handling of personal data.

   4. Human security management measures

      We provide regular training to employees on the precautions related to handling personal data.

      We have also signed confidentiality agreements with employees concerning personal data.

   5. Physical Security Management Measures

      In areas where personal data is handled, we manage the entry and exit of employees and the devices they bring in, and we take measures to prevent unauthorized persons from viewing personal data.

      We implement measures to prevent the theft or loss of devices, electronic media, and documents that handle personal data. Additionally, when carrying such devices or media within the business premises, we ensure that personal data is not easily disclosed.

   6. Technical security management measures

      We implement access controls to limit the scope of personal data databases handled by responsible personnel.

      We have also introduced mechanisms to protect information systems that handle personal data from unauthorized access or malicious software from external sources.

   7. Management of external environments

      Our company prioritizes the protection of personal information entrusted to us by our customers. We provide only the essential personal information necessary for service execution to carefully selected and trustworthy contractors.

      For details, please refer to:
      Section 2.1: Relationship with Shopify and Provision to Third Parties Located Outside Japan

      
      

      Important Notes

      • Our company is not responsible for the loss or non-delivery of documents sent by mail or courier due to accidents.
      • Please fill in all required fields. Incomplete documents may be returned.
      • We may not be able to respond to requests for disclosure, etc., in cases that fall under exceptions to the Personal Information Protection Law.
      • Depending on the content, it may take some time to process your request.
      • Personal information collected in connection with requests for disclosure, etc., will be handled only to the extent necessary to respond to the requests. Submitted documents will be properly disposed of by our company.
      • As a result of "correction, etc." or "suspension of use, etc.", it may no longer be possible to use the relevant services. Please understand this in advance.

      N.B. "Retained personal data" refers to personal information that is systematically structured to be easily searchable using electronic computers, or a collection of information that is organized and classified according to certain rules, making it easy to retrieve specific personal information by adding indexes, symbols, etc. This includes personal information over which our company has the authority to respond to requests for disclosure, correction, addition, deletion, suspension of use, erasure, and suspension of provision to third parties made by the individual. For more details, please contact the "Personal Information Complaints and Consultation Desk."

8. Voluntary Provision of Personal Information by customers and the consequences that may arise if not provided

   Providing personal information to our company is voluntary. However, if the provided information is insufficient, you may not be able to use our services (including responding to inquiries).

---

Privacy Policy

Established: June 1st 2017
Brastel Co., Ltd.
CEO Kendi Kawai

Brastel Co., Ltd. (Hereinafter, the“Company”) will comply with laws and regulations concerning the protection of personal rights and personal information with full awareness of the social mission regarding the protection of all collected personal information. Furthermore, The Company has established a personal information protection management system to embody the policies stated below, constantly recognizing the latest IT technology trends, changes in social demands, and changes in the business environment, declaring to strive for continuous improvement.

1. The personal information will be obtained, used, and/or provided only within the scope necessary for the Company's legitimate business execution in the telecommunication service business and remittance service business, as well as employee hiring and personnel management. It will not be used beyond the specified scope (non-purpose use), and the Company will also take measures to prevent non-purpose use.
2. The Company will comply with the laws related to personal information protection, guidelines established by the national government, and other norms.
3. The company will promptly and sincerely respond to complaints and consultations concerning the handling of personal information and take measures appropriately.
4. In response to any environmental change, the Company will continuously review and improve the personal information protection management system promptly and appropriately.
5. The Company will continuously improve the personal information security system by assigning management resources consistent with the actual situation of the business to attain rational safety measures to prevent risks such as leakage, loss, and damage of personal information. Also, in an emergency, the Company will take corrective action promptly.

This policy will be distributed to all employees for dissemination and will be available on the Company’s website, in pamphlets, and in other media for anyone to access at any time.

【Contact Information Desk】

For inquiries regarding our personal information protection policy, please contact the Personal Information Inquiry Desk:

Brastel Co., Ltd. Personal Information Inquiry Desk:
2-6-2 Yokoami, Sumida-ku, Tokyo 130-0015
e-mail: privacy@brastel.co.jp
(open hours 10:00-17:00*)

*Response to the inquiries received on Saturdays, Sundays, national holidays, and during New Year's and Golden Week holidays, will be on the following business day.