This Privacy Policy describes our collection, use, and disclosure of personal data. This Privacy Policy applies to Sanrio Company, Ltd. (“SANRIO,” “we,” “our,” or “us”). Our “services” in this Privacy Policy include our customer-facing websites, apps, and other products. This Privacy Policy applies to our services that display or reference this Privacy Policy, but does not apply to services that display or reference a different one.
In some cases, we process personal data of consumers or end users on behalf of our business customers. In such cases, we act as a “Service Provider,” “Contractor,” or “Processor” (as defined by applicable laws) for those organizations, but we do not control, and are not responsible for, their privacy practices.
We do not knowingly collect personal data from children under the age defined by applicable laws (such as under 13 in the United States or under 16 in certain European countries) without having obtained prior parental consent.
The personal data we collect depends on how you interact with us, the services you use, and the choices you make. We collect information about you from different sources and in various ways when you use our services, including information you provide directly, information collected automatically, information from third-party data sources, and data we infer or generate from other data.
When you are asked to provide personal data, you may decline. In addition, you may use web browser or operating system controls to prevent certain types of automatic data collection. However, if you choose not to provide or allow information that is necessary for certain services or features, those services or features may not be available or fully functional.
We may ask you to provide us with your personal data by operating your device and entering information or via a document or other media. The foregoing personal data includes, for example:
We collect information related to your activities when using our services and information related to your devices and how you use them. The foregoing personal data includes, for example:
We infer new information from other data we collect, by using automated means to generate information about your likely preferences or other characteristics (“Inferences”). The foregoing personal data includes, for example:
We may collect personal data from third parties, including our Partners. The foregoing personal data includes, for example:
We use the personal data we collect for purposes described in this Privacy Policy or as otherwise disclosed to you. For example, we use personal data for the following purposes:
| Purpose | Example | Personal Data Categories |
|---|---|---|
| Provision and Maintenance of Services |
|
|
| Development and Improvement of Services. |
|
|
| Security and Prevention of Unauthorized Use |
|
|
| Provision of Services Optimized for You |
|
|
We process your personal data based on the following legal grounds as permitted by applicable laws, including the General Data Protection Regulation (GDPR). The table below outlines the specific lawful bases for each of our processing purposes.
| Purpose | Lawful basis |
|---|---|
| Provision and maintenance of services. |
|
| Development and improvement of services. |
|
| Security and prevention of unauthorized use. |
|
| Provision of Services optimized for you. |
|
We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. In doing so, we take into account current technology, implementation costs, and the nature, scope, and purposes of processing, as well as the potential risks to the rights and freedoms of individuals.
The following department is responsible for the management of your personal information. Depending on your jurisdiction and applicable laws, this department serves as our Data Protection Officer, Privacy Officer, or a similar function. Responsible Department: DX Department, Sanrio Company, Ltd.
We and our data processors may transfer, store, or process your personal data in countries or regions outside of your location. In such cases, we ensure that appropriate safeguards are in place to provide an adequate level of data protection as required by applicable laws. Such safeguards include the use of Standard Contractual Clauses (SCCs) approved by the European Commission or other relevant authorities to ensure the security and confidentiality of your personal data. For more information regarding these safeguards and the specific locations where your data is processed, please contact us.
We may outsource the handling of all or part of the personal data we collect to processors or service providers (including contractors, where applicable). In such cases, we will enter into a written agreement in advance with the processor to ensure data protection in accordance with this Privacy Policy. We will also provide necessary and appropriate supervision to ensure that the processor manages the information appropriately and safely.
The details of our main outsourcing partner and delegated tasks are as follows:
・Processor Name: Pole To Win Co., Ltd.
Delegated Tasks: Customer support services for our game titles (including handling user inquiries, multilingual support, bug investigation and escalation, and assistance with FAQ creation)
In addition to the data processors and service providers mentioned above, we disclose personal data to certain third parties as required for our business operations or as permitted by law. This may include "sharing" or "selling" (as defined under certain privacy laws) for advertising purposes. For more details on these disclosures, please refer to the table below.
| Categories of Third Parties |
Categories of Personal Data |
Examples of Situations |
|---|---|---|
| Marketing and advertising partners |
|
|
| Governmental and law enforcement agencies |
|
|
| Other Third Parties |
|
|
Public information may be viewed, copied, stored, or disseminated by third parties. Given the nature of digital environments, such information may be accessed by unintended third parties. When setting your profile or posting on our services, please be mindful of the content and scope of your disclosure. We may provide public information about you to third parties, which may then be posted on their own services. We confirm that such third parties comply with applicable data protection laws and regulations.
In the event of a business transaction such as an acquisition, merger, or change of entity, personal data may be transferred to a successor of the business to the extent permitted by Applicable Laws.
We retain personal data for as long as necessary to fulfill the purposes of use described in this Privacy Policy, unless a longer retention period is required or permitted by Applicable Laws. When your account is deleted, we will delete or anonymize your personal data after a given period of time necessary for the following purposes:
Where self-service features are available, you may access, modify, or delete certain personal data at any time through the app or website via: Settings > Account Information. You may also withdraw your consent for the collection and use of personal data at any time. For example, where available, you can opt-out of certain data collection through your device or app settings, or withdraw your consent entirely by deleting your account via: Settings > Account Information > Delete Account.
To the extent permitted by applicable law, you may have the following rights with respect to your personal data. To exercise any of these rights, please contact us at the contact information below.
You generally do not need to pay a fee to exercise your rights. Where required by applicable law, we will respond to your request within the period required by applicable law.
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details provided in this Privacy Policy. You also have the right to lodge a complaint with a supervisory authority in your country or region. However, we encourage you to first contact us with any questions or concerns so that we may address them directly.
As required or permitted under applicable law, we will take steps to verify your identity before acting on your request to exercise your rights. We may require you to provide additional information as proof of identity to process such requests. We may limit our response to your exercise of rights as permitted under applicable law. When you submit a request, we will use the information you provide solely to process your request and to maintain a record of our response, in accordance with applicable law.
Under applicable law, you may designate an authorized agent to make a request on your behalf. To do so, you must provide the agent with written permission. We will require the agent to provide proof of such authorization and, to the extent permitted by law, we may still require you to verify your own identity directly with us to ensure the security of your personal data. If you are an authorized agent submitting a request on behalf of a consumer, please contact us at the contact information provided below.
We use cookies, web beacons, and other similar technologies provided by the following third-party services to understand usage status, manage operations, and improve our services, as well as to deliver personalized advertisements. Through these tools, information such as your device identifiers (e.g., IDFA/AAID), IP address, and service usage logs may be transmitted to the providers listed below. For more information on how these third parties handle your data and how to opt-out, please refer to their respective privacy policies.
This section applies solely to residents of the State of California.
In the preceding 12 months, we have collected the categories of personal information listed in “PERSONAL DATA WE COLLECT” Section. We have disclosed these categories for business purposes to the third parties identified in the " DISCLOSURE OF PERSONAL DATA" section. Furthermore, as defined under California law, we may have "shared" or "sold" identifiers and internet activity information with advertising partners for the purpose of cross-context behavioral advertising during this period.
We do not use or disclose "sensitive personal information" (as defined under California law) for purposes other than those permitted by the CCPA/CPRA, such as to perform the services reasonably expected by an average consumer. Therefore, we do not provide a "Limit the Use of My Sensitive Personal Information" option.
You have the right to direct us not to "sell" or "share" your personal information for cross-context behavioral advertising. You can exercise this right by contacting us at the address provided in "HOW TO CONTACT US".
If you have any comments, questions, requests, complaints, or other inquiries regarding our handling of personal data, please contact us at:
Data Controller: Sanrio Company, Ltd.
Address: Gate City Ohsaki, 1-11-1 Osaki, Shinagawa-ku, Tokyo, Japan
Email:
(General Inquiries) sanrio-kojinhogo@sanrio.co.jp
(GDPR) overseas@sanrio.co.jp
(CCPA) customercare@sanrio.com
We will update this Privacy Policy as necessary to reflect changes in our services, how we use personal data, or Applicable Laws. When we post changes to the policy, we will revise the "Last Updated" date at the top of the document. If we make material changes to the policy, we will provide notice or obtain consent regarding such changes as required by law.
September 9, 2026
