Privacy Policy
Last updated: August 10, 2026
TO Education Co., Ltd. ("we," "us," or "the Company") processes personal data collected through the Todoh (莵道) website, online store, and any other services we provide, in accordance with applicable data protection law, in particular the EU General Data Protection Regulation ("GDPR").
1. Data Controller
The data controller for your personal data is:
Company name: TO Education Co., Ltd.
Address: 44 Todo Tanisagari, Uji, Kyoto 611-0013, Japan
Email: contact@to-education.com
Website: Pending
If we are required to appoint a representative in the EU under Article 27 of the GDPR, that representative's details will be listed here.
EU Representative: Pending
2. Data Protection Officer (DPO)
If we are required — under the GDPR or other applicable law — to appoint a Data Protection Officer, or if we appoint one voluntarily, their contact details will be listed here.
DPO: Not yet appointed
Contact: Pending
3. Personal data we process, purposes, and legal basis
Depending on how you use our services, we may process the following categories of personal data.
Purchases and shipping
Data collected: name, email address, phone number, billing address, shipping address, order details, purchase history, and other information necessary to process your order.
Purpose: accepting orders, processing payment, shipping products, handling returns and refunds, order-related communication, and customer support.
Legal basis: performance of a contract with you, or steps taken prior to entering into a contract.
Payment
Payments are processed through Pending.
We may receive transaction data necessary to confirm payment, but as a general rule we do not hold the full card details processed directly by our payment provider.
Purpose: processing payment, preventing fraud, and handling refunds.
Legal basis: performance of a contract, legal obligation, and our legitimate interests.
Inquiries
Data collected: name, email address, company name, the content of your inquiry, and any other information you choose to provide.
Purpose: responding to inquiries, business discussions, and after-sales support.
Legal basis: steps taken prior to entering into a contract, or our legitimate interests.
Newsletter and marketing
Data collected: email address, communication preferences, and a record of your marketing consent.
Purpose: sending you news about products, events, and our brand story.
Legal basis: your consent. You may unsubscribe or withdraw your consent at any time.
Website usage information
Data collected: IP address, device information, browser information, cookie identifiers, pages viewed, access times, referral source, and other usage data.
Purpose: operating the site, maintaining security, investigating faults, and — where you have given consent — analytics and service improvement.
Legal basis: our legitimate interests, or, where required, your consent.
The GDPR requires us to identify an appropriate legal basis — consent, contract performance, legal obligation, or legitimate interest — for each processing activity.
4. Recipients of personal data
Where necessary to provide our services, we may share personal data with the following third parties or service providers.
- E-commerce platform providers
- Payment service providers
- Logistics and warehousing providers
- Delivery and shipping providers
- Cloud and hosting providers
- Email delivery providers
- Analytics and other IT service providers
- Accountants, lawyers, and other professional advisors
- Public authorities, where required by law
When selecting service providers, we put in place the contracts and security measures necessary to protect your personal data appropriately.
5. Transfers of personal data outside the EU/EEA
We, or our service providers, may process personal data outside the EU/EEA.
Where this occurs, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses (SCCs), or another transfer mechanism recognized under the GDPR.
Japan currently benefits from an adequacy decision by the European Commission.
6. Your rights
Depending on the applicable data protection law, you may have the following rights.
- Access to your personal data
- Correction of inaccurate personal data
- Deletion of your personal data
- Restriction of processing
- Objection to processing
- Data portability
- Withdrawal of consent
- The right to lodge a complaint with your competent data protection authority
To exercise any of these rights, please contact us at contact@to-education.com.
Under the GDPR, we are generally required to respond to such requests within one month.
7. How long we keep personal data
We do not keep personal data for longer than necessary to fulfil the purpose for which it was collected.
The exact retention period depends on our contractual relationship with you, tax and accounting obligations, potential disputes, and security requirements. For example:
Order and transaction records: Pending
Customer support records: Pending
Newsletter data: Until you withdraw consent or unsubscribe
Cookie and analytics data: Pending
After the retention period ends, we delete or anonymize the data, unless a longer retention period is required by law or another legitimate reason.
8. How we protect personal data
We implement technical and organizational security measures appropriate to the processing and its risks, to protect personal data against unauthorized access, loss, destruction, alteration, and disclosure.
9. Changes to this policy
We may update this Privacy Policy to reflect changes to our services, how we handle personal data, or applicable law.
If we make a material change, we will notify you on the website or through another appropriate means where necessary.
The "Last updated" date at the top of this page always reflects the latest version.
10. Cookies and similar technologies
Our website may use cookies and similar technologies. We classify cookies into the following categories.
Strictly necessary cookies
Cookies required for core functions of the website, such as the online store, shopping cart, and security.
Analytics cookies
Cookies used to analyze how the site is used and to improve our services.
Marketing cookies
Cookies used for advertising measurement, retargeting, and other marketing purposes.
Where consent is legally required for a given cookie, we do not use it until you consent. You can decline or withdraw consent at any time through our cookie banner or cookie settings.
Details of the specific cookies we use, their providers, purposes, and retention periods will be published separately in our Cookie Policy.