Privacy Policy
Privacy Policy
RealReal Inc. (the "RR") has established the following privacy policy (the "Policy") regarding the handling of Personal Information, of users (the "User") of the service provided by RR (the "Service"). The terms of "Personal Information," "Personal Data" and "Retained Personal Data" in the Policy are to be interpreted in accordance with the definitions of the Act on the Protection of Personal Information.
[Indication of the enterprise handling Personal Information]
Name: RealReal Inc.
Address: 6th Floor, Daiwa Sasazuka Building, 1-64-8 Sasazuka, Shibuya-ku, Tokyo, Japan
Representative Director: Kori Cameron Oai
Article 1 Manner of Obtaining Personal Information
RR will obtain Personal Information after publicly announcing or notifying the purpose of use (including the announcement made pursuant to the Policy) and by lawful and fair means in accordance with the following manner. RR will not use Personal Information for any other purpose other than the purpose of use, and after the purpose of use has been achieved, RR will delete, destroy, or anonymize in an irreversible manner (the “deletion”).
-
Information provided by the User for the purpose of using the Service or through the use of the Service;
-
Information provided by other services when the User permits linkage with such other services in the use of the Service;
-
Information that RR obtains independently through the use of the Service by the User; and
-
Information obtained based on the User's individual consent when the User uses the Service.
Article 2 Purpose of Use
RR shall use Personal Information obtained from the User for the following purposes:
-
To provide, maintain, protect and improve the Service, including the acceptance of registration for the Service, identity verification, user authentication, recording of user settings and calculation of payment for the charges;
-
To provide information about the Service or a questionnaire regarding the Service, and to send the reward;
-
To measure the User's traffic and behavior;
-
To research, development and improve RR’s services;
-
To manage the functions of the Service, delivery of goods, the related after-sales services, payment of services and sales information that are provided in the Services;
-
To distribute advertisements on and provide information on goods, services and campaigns by invitations, emails and other means;
-
To provide information on the Service and to respond to inquiries and other matters; and
-
To notify changes of Policy.
Article 3 Security Control Measures
RR endeavors to keep Personal Data of the User accurate and up-to-date and takes necessary and appropriate security control measures to protect them from unauthorized access, alteration, leakage, loss or damage. For details on Security Control Measures, please contact the inquiry desk described in Article 10.
Article 4 Provision to Third Party
-
RR will not provide Personal Data to a third party (including those located outside Japan) without the prior consent of the User, provided, however, that this does not apply to the provision to a third party (including those located outside Japan) when the following needs occur
(1)Where RR outsources all or part of the handling of Personal Data within the scope necessary to achieve the purpose of use;
(2)Where Personal Data is provided as a result of succession of business due to merger or other similar event;
(3)Where it is necessary to cooperate with a national government organ, local government or person entrusted thereby in performing services prescribed by laws and regulations, and the obtainment of the User's consent is likely to interfere with the performance of those services; and
(4)Where other cases are permitted by the Act on the Protection of Personal Information (“APPI”) or other laws and regulations.
2. Notwithstanding the provisions of the preceding paragraph, in order to provide the Service and improve customer value, RR may provide User Information to business partners, subcontractors, advertising partners, data analysis companies, service providers, and other related business operators.
Article 5 Outsourcing
RR may outsource to a third party to provide the Service and provide some or all of Personal Data that RR holds. In this case, RR will properly manage and supervise the outsourcer to take appropriate security control measures for Personal Data.
Article 6 External Transmission of Personal Information
RR uses services provided by external enterprises for the purpose of analyzing the usage of the Service by the User and linking with external services. For such occasions, the User's Personal Information may be transmitted to the external enterprises ("External Transmission."). The Personal Information falling within scope of External Transmission is subject to the privacy policies of the external enterprises. For details on External Transmission, see External Transmission of Personal Information.
Article 7 Use of Cookies
RR may use cookies (*) and similar web tracking technologies (web beacons, pixels, etc.) for the following purposes. The change of browser settings and other like can control the cookie function, however, note that this may impair the overall convenience of the User.
-
To use information about the User's usage of services in order to make improvement of services and post information that is appropriate for the customer.
(*)Cookies are small text files saved on the User's computer when visiting websites. These text files store information that can be read by site operators when the User revisits the websites at a later date.
Article 8 Disclosure of Personal Data
RR will, upon a User's request of disclosure of Personal Data pursuant to the provisions of the APPI, confirm that the request is made by the User in person and disclose the data to the User without delay (If the Personal Data does not exist, that effect will be informed to the User.). Provided, however, that this shall not apply to cases where RR is not obliged to disclose the data pursuant to the APPI or other laws and regulations, the User fails to cooperate in any necessary investigations, or it cannot be confirmed that the request is made by the User in person. Note that disclosure of Personal Data requires a fee (1,000 yen per request).
Article 9 Correction and Cease of Use of Personal Data
-
RR will, upon a User's request of correction, addition or deletion of Personal Data pursuant to the provisions of the APPI on the grounds that such Personal Data is not true (the "Corrections") confirm that the request is made by the User in person and conduct necessary investigations without delay, make Corrections of contents of Personal Information based on the results, and inform the User to that effect.
-
RR will, upon a User's request to cease the use of Personal Data pursuant to the provisions of the APPI on the grounds that such data has been handled beyond the scope of the purpose of use publicly announced in advance or that such data has been obtained by deception or other wrongful means, confirm that the request is made by the User in person and conduct necessary investigations without delay, cease the use of Personal Information based on the results, and inform the User to that effect.
-
RR will, upon a User's request to erase Personal Data of the User and upon RR's determination of necessity to comply with the request, confirm that the request is made by the User in person and erase the Personal Data, and inform the User to that effect.
-
RR will, if the determination not to conduct Corrections, the cease of use or the deletion of Personal Data is made as a result of investigations and determinations set forth in Paragraph 1 through Paragraph 3, inform the User to that effect.
-
Notwithstanding the provisions of Paragraph 1 through Paragraph 3, if RR is not obliged to make Corrections or the cease of use pursuant to the APPI or other laws and regulations, if the User fails to cooperate in necessary investigations or if RR is unable to confirm that the request is made by the User in person, RR shall not conduct Corrections and the cease of use of Personal Data.
Article 10 Contact for Inquiries
If you have any comments, questions, complaints or other inquires about the handling of User Information, contact the following:
Real Real Inc.
Person in charge: Information Security Department
Address: 6th Floor, Daiwa Sasazuka Building, 1-64-8 Sasazuka, Shibuya-ku, Tokyo
Contact: please contact this form realrealproject@gmail.com
Article 11 Procedure for Changing Privacy Policy
RR will change the Policy as necessary. However, in the case of a change to the Policy that requires the consent of Users under laws, the changed Policy will be applied only to the User who has consented to the change in the manner prescribed by RR. In the event of any changes to the Policy, RR will announce the time of implementation and the contents of the changed Policy on its website or by any other appropriate means or inform the User thereof.
Established on November 30, 2025
Privacy Policy for EU/EEA/CA
RR Inc. (hereinafter referred to as "RR", "we" or "us") processes the personal data of users to whom the regulations apply (hereinafter referred to as a ”User", "you" or "your") in accordance with the applicable European Union and European Union Member State’s regulations on data protection, in particular, the General Data Protection Regulation 2016/679 (hereinafter referred to as the "GDPR"), and with the applicable California State’s regulations on data protection including the California Privacy Rights Act of 2020 (“CPRA”). This privacy policy (hereinafter referred to as “Policy”) explains how RR, as the data controller, processes the User’s personal data when the User uses our service (hereinafter referred to as “Service”).
Section 1 (Legal Bases for processing/categories of personal data subject to Processing)
1. RR processes the categories of the User’s personal data as described in appendix based on the legal bases provided for in Articles 6 and 7 of the GDPR. RR will obtain and process the User’s personal data, as listed in appendix for the purpose and bases described in appendix.
2. When the personal data is processed on the basis of the User’s consent, you have the right to withdraw your consent at any time by notifying RR. However, the User’s withdrawal of consent will not affect the legality of processing conducted based on the User’s consent before such withdrawal.
3. RR neither obtains nor processes any of the User’s personal data which is sensitive in nature, including religious beliefs and health status.
4. RR does not conduct or make any solely data-based, automated decision-making that may effect the User.
5. RR will notify the User separately if the provision of the User’s personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as the possible consequences of failure to provide such data.
Section 2 (Retention Period for Personal Data)
RR will retain the User’s personal data for as long as necessary to fulfill the aforementioned purposes (prescribed in Section 1 of this Policy) for obtaining and processing the User’s personal data. Specific retention periods are decided based on the following considerations: (i) the purpose for obtaining and processing the personal data; (ii) the nature of the personal data; and (iii) the necessity of retaining the personal data for legal or business reasons.
Section 3 (User’s Right)
1. The User has the following rights regarding the personal data obtained and processed by RR.
i. Obtaining information regarding the processing of data: The User has the right to obtain from RR all the requisite information regarding RR’s data processing activities that concern the User (Article 13 and Article 14 of the GDPR).
ii. Access to personal data: The User has the right to obtain from RR confirmation as to whether personal data concerning the User is being processed, and, if so, then access to the personal data and certain related information (Article 15 of the GDPR).
iii. Rectification or erasure of personal data: The User has the right to have RR rectify inaccurate personal data concerning the User without undue delay and the right to have RR complete any incomplete personal data (Article 16 of the GDPR). Also, if certain conditions are satisfied, the User will have the right to have RR delete personal data concerning the User without undue delay (Article 17 of the GDPR).
iv. Restriction on processing of personal data: If certain conditions are satisfied, the User will have the right to have RR restrict the processing of personal data concerning the User (Article 18 of the GDPR).
v. Objection to the processing of personal data: If certain conditions are satisfied, the User will have the right to object to the processing of personal data concerning the User (Article 21 of the GDPR).
vi. Data portability of personal data: If certain conditions are satisfied, the User will have the right to receive personal data concerning the User in a structured, commonly used, and machine-readable format and the right to transfer those data to another controller without hindrance from RR (Article 20 of the GDPR).
vii. Not to be subject to automated decision-making: If certain conditions are satisfied, the User will have the right not to be subject to solely data-based, automated decision-making (including profiling) that may produce any legal or similar material effect on the User (Article 22 of the GDPR).
2. If the User intends to exercise any of the aforementioned rights, please inquire using the contact details at the end of the Policy. RR will provide information on action taken on an aforementioned request within one month of receipt of the request (which may be extended by two further months where necessary) or inform the reasons for not acting within one month of receipt of the request.
3. The User can lodge a complaint concerning RR’s processing of the User’s personal data with the Data Protection Supervisory Authority of the Member State of the User’s habitual residence, place of work or place of the alleged infringement.
Section 4 (Amendment of Policy)
RR may amend this Policy from time to time and will contact the User through this website or if necessary, by e-mail, when we make any substantive or material amendments.
Section 5 (Inquiry)
For any questions, complaints, or other inquiries regarding the handling of your personal data, please contact the data controller or representative set out below:
Data Controller
The reception time shall be from 10:00 a.m. to 5:00 p.m. Japan time on weekdays.
[Address; post code]
RR Inc.
#6 Daiwa Sasazuka Building,
1-64-8 Sasazuka,
Shibuya, Tokyo
151-0073, Japan
[Communication form]
Community team
Section 6 (Disclosures Specific to California Residents)
California law requires that we make certain disclosures about your data. The following disclosures are made pursuant to CPRA.
1. Your Rights
In addition to the rights listed in Section 4, the user has the following rights.
i.The right to correct inaccurate personal information
ii. The right to opt-out of the sale or sharing of their personal information
iii. The right to limit the use or disclosure of sensitive personal information
iv.The right not to receive discriminatory treatment
2. Exercising Your Rights
If you wish to exercise ⅱ or ⅲ any of the above rights, please contact us using the contact information provided above.
Before completing your request, we may need to verify your identity. We will send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity.
3. Collection and Use of Personal Data
In the preceding 12 months, we have collected the following categories of Personal Data: Identifiers, user profile information, user content, usage data, transaction data, device data. To learn more about the specific information we collect, the sources and purposes of such collection, please see Section1 (“Legal Bases for processing/categories of personal data subject to Processing”).
4. Sale or Sharing of Personal Data
In the preceding 12 months, we have sold or shared the following categories of Personal Data: Nothing.
5. Disclosure of Personal Data for a Business Purpose
In the preceding 12 months, we have disclosed for a business purpose the following categories of Personal Data: Nothing.
6. The categories of other entities which we disclose Personal Data
We disclose your Personal Data to entities who provide monitoring services, e-mail sending services, shipping services, and payment services.
Also, we disclose your Personal Information to third parties in order to provide the following functions of our services:
Searching other users.
7. Sensitive Data
We also do not use sensitive personal information for purposes other than those specified in Section 7027(m) of the California Consumer Privacy Regulations promulgated by the California Privacy Protection Agency. Therefore, we do not offer you the option to opt out or to limit the use of your sensitive personal information.
8. The personal information of minors under 16 years of age
We do not sell or share the personal information of known minors under 16 years of age.
9. Authorized Agents
If you authorize another person to submit a request to know, correct, or delete on your behalf, we may ask you to verify your identity or to confirm that you authorized another person to make such request on your behalf. Separately, such other person may have to submit proof that they are authorized to make a request on your behalf.
Last Modified：30/11/2025
[Appendix]
(i) List of the User's personal data collected by RR:
Data collected when the User uses the Service:
①User profile information
We collect user information.
This includes your name, email, phone number and address.
②Usage Data
We collect data about your activity.
This includes the features or pages viewed, browser type, and other system activity.
③Transaction Data
We collect payment transaction data related to the use of the Service (such as the type of service purchased, user's address, payment date, amount charged, and payment method).
④Device Data
We collect data about the devices used to access the Service, including the hardware models, device IP address or other unique device identifiers, operating systems and versions, software, preferred languages, advertising identifiers, device motion data, and mobile network data.
(ii) Purposes and bases of use of the User’s personal data
Performance of a Contract / Entry into a Contract（Article 6- 1 - (b) GDPR）
We process the following categories of your personal data for the following purposes as it is necessary to do so to perform contractual obligations in providing the Service to you.
Legitimate Interests（Article 6 -1 - (f) GDPR）
We process the following categories of your personal data for the following purposes as it is necessary to do so to pursue our legitimate interests.
Legal Basis
Categories
Purposes of use
Performance of a Contract / Entry into a Contract
Personal data described the above item ① and ③
To provide the Service:
We process your personal data to provide you with the Service.
For example, we collect your name, email address, and other information to deliver the Merchandise.
Performance of a Contract / Entry into a Contract
Personal data described in the above items ①
To communicate with you:
We process your personal data to communicate with you.
For example, we respond to inquiries from you, or we may send you a notification about the Service by using the contact information provided by you such as your email address. In addition, if you contact us, we will keep a record of your request to help solve any issues you might be facing.
Legitimate Interests
Personal data described in the above items ①,②, ③ and ④
To measure and analyze the performance of the Service:
We process your personal data for analyzing and measuring how the Service is used.
For example, we measure and analyze your visits to and activity on the Service for optimizing the performance of the Service.
Legitimate Interests
Personal data described in the above items ①, ②,③ and ④
To maintain and improve the Service:
We process your personal data for maintaining or improving the Services.
For example, we collect and use information regarding trouble being informed by you for tracking system failure and troubleshooting, or we collect and use your usage activity on the Service for improving the functions of the Service or develop more convenient for users of the Service.
Legitimate Interests
Personal data described in the above items ①, ②,③ and ④
To develop new products or services:
We process your data for developing new products or services. For example, for developing new products or services, we collect and utilize information on how you use the Service, your inquiries or questionnaire results.
Legitimate Interests
Personal data described in the above item ①
Direct marketing:
We process your contact information to send you information about the Service and invitations to events as a form of direct marketing.
Legitimate Interests
Personal data described in the above items ① ,②,③, ④, ⑤and ⑥
To protect us, the User, and the public:
We may process your personal data to protect us, the User or other users, or the public interest.
For example, we use your account ID and password for detecting and preventing unauthorized use of your account, fraud, abuse, or security risks. We may also use your personal data to investigate or address claims or disputes relating to the Service.