Chapter 2 Handling of personal data of EEA and UK residents by OCS

1.   Introduction

This Chapter 2 provides additional information about the handling of personal data of customers and other individuals in the European Economic Area ("EEA") and/or the United Kingdom ("UK") in accordance with EU General Data Protection Regulation 2016/679

("GDPR") and the UK Data Protection Act 2018 ("DPA 2018") and other national and international data protection and privacy laws

(together, "Data Protection Laws").

Please note that the UK's laws are similar to those in the EEA, and customers from both jurisdictions have very similar rights. Accordingly, references to the GDPR in this Chapter should also be read as references to corresponding UK law.

The consent shall be given or authorized by the holder of parental responsibility in the event that a customer under the age of 16 uses OCS's service. The data subject's consent to this Privacy Policy must be obtained in the event that a person such as family member applies for OCS's service on behalf of the data subject.

In the event that any provisions of this Chapter 2 contradict those of Chapter 1, the provisions of this Chapter 2 shall prevail.

 

2. The controller of personal data

The controller of your personal data is the OCS.

OCS protects personal data which is collected and used by controllers (who make decisions about how and why your personal data is used) and processors (who act on the controller's written instructions) on the basis of Data Protection Laws.

 

3.   Our legal basis for processing personal data

OCS protects your personal data by ensuring that it can only be used to the extent necessary for specific purposes (as set out in Part 3 of

Chapter 1 of this Privacy Policy) and by requiring that there is a legal basis for each processing activity on the basis of Data Protection

Laws.

OCS may process customer personal data on one or more of the following legal basis:

(a)  When your consent is obtained to the processing (Article 6(1)(a) GDPR)
Consent will usually only be relied upon for promotional and marketing related processing, or in some cases, in relation to sensitive personal data.

(b)  When processing is necessary in order to perform or take steps to enter into a contract (Article 6(1)(b) GDPR)

This is typically why we process customer information which is essential to providing our services, including a customer's identity, contact, payment, travel information etc.

(c)  OCS needs to process the information to comply with a legal obligation (Article 6(1)(c))

This includes the requirement to share personal data with customs and immigration authorities or law enforcement, as well OCS's legal obligations towards its staff and customers.

(d)  The information is required to protect your, or a third party's, vital interests (Article 6(1)(d)), for example in the event of a medical emergency.

(e)  It is in OCS's or a third party's legitimate interests to process the personal data, and these interests are not overridden by your rights under Data Protection Laws (Article 6(1)(f) GDPR).

This includes the use of personal data necessary to operate OCS's business and also to maintain, develop and improve its goods and services, and to provide the best experience to customers.

4. Request for processing of personal data

(1) Data Protection Laws provide you with the following legal rights:

1) Request for access : You can request copies of your personal data and details of how we process it.

2) Request for rectification: Rectifications to personal data will be undertaken wherever possible after due review of the request.

3) Request for erasure: You may request that we erase all or part of the personal data we hold about you. We will consider your request and, where the data is no longer required or the law does not permit us to continue to retain it, we will erase it.

4) Request for data portability: You can request a copy of your personal data in a structured, common, machine-readable format. This only applies to personal data which we obtain from you and process on the basis of your consent or in order to perform a contract, and which is processed by automated means.

5) Objecting: You can object to processing which is carried out on the basis of our or a third party's legitimate interests or for the purpose of direct marketing. We will stop processing your information unless we have a strong reason to continue which overrides your objection. If your objection is to direct marketing, we will always stop.

6) Restrictions: You can restrict how we process your personal data in certain circumstances. Where this applies, any processing of your personal data (other than storing it) will only be lawful with your consent or where required for legal claims, protecting certain rights or important public interest reasons.

7) Withdrawal of consent: If we are relying on consent to process your personal data, you have the right to withdraw that consent at any time.

Please note, the rights set out above are not absolute and do not apply in every situation. There are also legal exemptions which apply in some situations and mean a request may be refused. Of course, if a request is refused, we will inform you of the reasons for this when we respond.

Records of requests made to us will be retained so that we can ensure we have complied with our legal obligations.

(2) Method for submitting a request

You can exercise your rights free of charge (except in the case of unreasonable, excessive or repeated requests in which case we may charge a fee or refuse the request). The method for submitting a request and contact information are as follows.

Please send the required documents by postal mail to the address below.

(Mailing address)
Overseas Courier Service (Deutschland) GmbH
Fasanenweg 7D, 65451 Kelsterbach, Germany

 

(3) Required documents

written application

Disclosure Request Form (for EEA/UK residents

Customer requests for disclosure, etc., may not be acknowledged if any of the required information is missing.
 

(4) Responding to a request

We will respond without undue delay and usually within one month. We may, in some cases, ask for identification or (if you are making the request on behalf of a third party) proof of your authority to submit a request. If your request is particularly complex or you have made a number of requests, it may take longer to provide a detailed response. Please also bear in mind that there are exceptions to the rights above and some situations where they do not apply.

If you are not satisfied with our response to a data protection request or if you think your personal data has been mishandled, then you have the right to complain to a supervisory authority. Please see Part 9 of this Chapter 2 ("Lodging a complaint with an authority") for further details.

 

5. Data sharing which is necessary to provide goods or services

OCS's goods and services are provided with the assistance of other companies and organizations and often OCS will need to share personal data with third parties in order to run its business. These third parties include:

 

(a) Other companies in the ANA Group
(b) Organizations with which OCS is legally required to share personal data

including: government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organization, etc.

(c) Service providers

Including: subcontractor for collection and delivery, cargo handling, various service providers, providers with whom we have a marketing partnership, etc.

Where OCS instructs companies, contractors or service providers to process data on its behalf, then it will ensure that it does so pursuant to a contract which meets the requirements of applicable Data Protection Laws.

 

6. Marketing communications

OCS sends out marketing communications from time to time to notify interested persons of news and provide details of goods and services which may be of interest to them. OCS will only do this if the recipient has consented to receive marketing or if they are an

existing customer who purchased goods or services from OCS and were given the opportunity to opt-out from marketing at the time

but chose not to do so.

 

7. Where your personal data is stored and transferred

OCS is located in Japan and many of the service providers and other organizations with whom we share your personal data will be located in jurisdictions outside the EEA and UK. It should be noted that Japan has been recognized by the European Commission as providing

adequate protection for personal data.

When transferring personal data to third parties OCS will ensure that it complies with the requirements of Data Protection Laws, including the onward transfer requirements of the EU-Japan adequacy decision and related Japanese laws. However, you should be aware that recipients outside the EEA and UK may be subject to national laws which do not necessarily provide equivalent protection for your personal data. If you would like more information regarding where your personal data is stored and transferred, please contact OCS using the details set out in Part 12 of this Chapter 1 ("Submission of a request for disclosure, etc.").

8. Retention of personal data

OCS retains customers' personal data until the purpose of use is achieved. Particularly, OCS has set the retention period for personal data as follows.

(1) Personal data of customers using international transportation service

Until completion of carriage and related services as defined in the International conditions of carriage.

 

(2) Other personal data

Required period for the purpose which customers have consented. 

 

9. Lodging a complaint with an authority

Customers have the right to lodge a complaint on the processing of their personal data with the data protection authority having jurisdiction over their residence.

(1) EEA residents: Please contact your national supervisory authority, details of which can be found on the European Data Protection Board's website (Our Members | European Data Protection Board）

(2) UK residents: Please contact the Information Commissioner's Office

10. The contact information of the controller and OCS's Data Protection Officer

Overseas Courier Service (Deutschland) GmbH
Fasanenweg 7D, 65451 Kelsterbach, Germany

 

 

Chapter 3 Handling of personal information of China residents by OCS

 

Besides Chapter 1, Chapter 3 also applies to the handling of personal information of persons residing in the People's Republic of China (hereinafter, "China") based on China's Personal Information Protection Law and related regulations (hereinafter, “PIPL etc.”). In the event that any provisions of this chapter contradict those of chapter 1, the provisions of this chapter shall prevail.

 

1.   Introduction

A guardian's consent or permission must be obtained in the event that a customer under the age of 18 uses OCS's service and consents to this Privacy Policy. In the event that a person such as a family member applies for OCS's service on behalf of the data subject, the consent of the data subject (when he/she is under the age of 14, his/her guardian) to this Privacy Policy must be obtained.

 

2. Collection of sensitive personal information

OCS may handle personal information such as your personal details that may be classified as sensitive personal information under the PIPL, etc. for the purpose of use. Since sensitive personal information can negatively affect the interests of customers if it is leaked or used unlawfully (for example, it is likely that individual dignity will be damaged or that personal safety and asset security will be put at risk), OCS will carefully manage such information and handle it in a lawful manner.

 

3. Retention period for personal information

OCS will retain the customer's personal information until the purpose of use is achieved. In particular, OCS sets the retention period for personal information as follows.

 

(1) Personal data of customers using international transportation service

Until completion of carriage and related services as defined in the International conditions of carriage.

(2) Other personal data

Shortest period for the purpose which customers have consented.

 

4.Technology and measure to protect customers' personal information

1. OCS takes security measures to protect customers' personal information from leakage, alteration or loss. Specifically, OCS takes

the following measures to protect customers' personal information.

 

・OCS establishes and implements an internal management system and operational rules relating to the protection of personal information.

・OCS conducts classification management for personal information.

・OCS develops website with https and sets SSL encryption to secure important customers' data (credit card information, etc.) communication between the customers' web browser and the server.

・OCS uses encryption technology for protecting personal information.

・OCS allocates access rights reasonably and controls access, so that access by unauthorized persons to personal information will be prevented.

・In order to raise employee awareness of the importance of protecting personal information, OCS provides education and training on security and privacy protection.

・OCS establishes emergency responses for personal information incidents and prepares for their implementation.

 

2.      OCS will take all reasonable and practicable steps to ensure that no irrelevant personal information is collected. OCS will only retain customers' personal information for the shortest period of time required to achieve the purposes stated in this Privacy Policy, unless an extension of the retention period is permitted by law.

3.      In the event of a personal information incident, OCS will promptly inform customers of the relevant circumstances of the incident in accordance with the requirements of PIPL, etc. and report to the regulatory authorities.

 

5. Request about handling of Personal Information

In the event that OCS receives a request regarding the personal information it holds of a customer who is a resident of China, the request will be handled in a reasonable timeframe and scope in accordance with PIPL, etc. and Chapter 1 "Article 11 Request about handling of Personal Information". In responding to the request, OCS may confirm that it was submitted by the customer himself/herself.

 

1. Request for withdrawal of consent

If the handling of the customer's personal information is based on his/her consent, the customer has the right to withdraw such consent. Personal information items designated by the customer will be deleted in accordance with the customer's request, wherever possible and appropriate. However, please note that such deletion may prevent customers from being provided with services that they had utilized, or may impede the provision of services in accordance with their wishes.

2. Requests for interpretation/explanation of Privacy Policy

Customers have the right to ask for the interpretation/explanation of this Privacy Policy.

3. Methods for submission of a request

Customers may submit a request by following methods.

1) Submission of a request

(by post)
Please send the required documents by postal mail to the address below.

(Mailing address)

Overseas Courier Service (Deutschland) GmbH
Fasanenweg 7D, 65451 Kelsterbach, Germany

 

2) Required documents

Written application

Request for Disclosure Form <for Chinese residents>

Documents required for confirmation of identification of individual, etc.

<For individuals>
① A Copy of one of the followings: Official ID Card with a photo, such as Driver's License, Passport, etc.

<For representatives>

In addition to "<For individuals>," the following documents described in ① and ② below are required.

1        Power of Attorney (legal representatives must provide a certifying document)

2        Documents to identify the representative (A Copy of one of the followings: Official ID Card with a photo, such as Driver's License, Passport, etc.)

 

3) Contact Desk

Germany : +49-(0)617-705-6920

 

 

6. Provision to third parties and transfer outside China

When OCS provides personal information of customers to third parties (including the cases of provision due to shared use and business entrustment that involves the transfer of such information outside China), it will do so in accordance with PIPL, etc.

7. Change of purposes of use of personal data

In the case of a change to the purposes of use of personal information, OCS will announce the revised Privacy Policy in advance on OCS website  (www.ocs.co.jp) and OCS will use personal information in accordance with the new purposes of use of personal information after obtaining consent from customers.

 

8. Basic information of Controller of personal information

Overseas Courier Service (Deutschland) GmbH
Fasanenweg 7D, 65451 Kelsterbach, Germany

 

 

 

Chapter 4: Handling of personal information of California residents by OCS

Last updated on July 1, 2025

Besides Chapter 1, Chapter 4 also shall be applied to the handling of personal information of persons residing in California, United States of America based on the California Consumer Privacy Act of 2018 as amended under the California Privacy Rights Act of 2020 (hereinafter "CCPA"). In the event that any provisions of this chapter contradict those of chapter 1, the provisions of this chapter shall prevail.

The terms used in this chapter are based on the definitions provided in CCPA. For example, the term "sale" means OCS's selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information to a third party for monetary or other valuable consideration. The term "sharing" means OCS's sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration. However, if OCS concludes an appropriate agreement concerning the handling of personal information with a third party, the activities mentioned above are not regarded as "sale" from the perspective of CCPA.

 

1. Acquisition and use of personal information

Personal information collected by OCS in the preceding 12 months or likely to be collected in the future is classified as defined in the following table. OCS uses such information for the purposes set forth in Chapter 1, Article 3 (Purpose of using personal information). It will acquire such personal information directly from customers.

 

Type of personal information collected	Examples of personal information
Identifiers (name or symbol, etc. used to uniquely identify a particular subject)	The customer's name, address, telephone number, fax number, mailing address, email address, passport information, personal online ID, ANA Mileage Club customer number (10 digits), etc.
Commercial information	Usage record of international transportation service, purchases of publications and daily necessities, etc., and information in detail of enquiries, requests and complaints contained in correspondence with customers, etc.
Internet or other electronic network activity information	Information such as that on how customers use the OCS website, including cookies, advertising identifiers (IDFA/GAID), location information, unique device identifiers, IP address, details on OS and browser type, etc., and website activity logs
Professional or employment-related information	Employment information (company name, division/department the customer belongs to, title, address, telephone number, fax number) and related information

 

2. The disclosure of personal information

(1) Sale of personal information

OCS will not sell customers' personal information (including personal information concerning minors) to any third parties, and has not sold the same in the past 12 months.

(2) The sharing of personal information

The types of personal information that OCS may share with third parties in the future, and the types of personal information that OCS has shared with third parties in the past 12 months and the types of third parties with whom OCS has shared personal information during the said period are shown below. OCS shares such personal information with third parties in order to conduct marketing activities (including personalized advertisements), such as provision of information on events and campaigns. OCS will not share the personal information of a customer with a third party if OCS has actual knowledge that the customer is a minor.

 

Type of personal information shared	Example of personal information	Type of third party OCS shared personal information with in the past 12 months
Internet or other electronic network activity information	Information such as how customers use the OCS website and mobile application, including details on cookies, advertising identifiers (IDFA/GAID), location information, unique device identifiers, IP address, details on OS and browser type, etc., and website activity logs	Ad network

 

(3) Disclosure of personal information for business purposes

The types of customers' personal information that OCS has disclosed in the past 12 months for business purposes and the types of third parties to which such personal information has been disclosed are shown below. OCS discloses these types of personal information to third parties for the purposes specified in Chapter 1. ("3. Purpose of using personal information" and "7. Data sharing")

 

Type of personal information disclosed	Example of personal information	Types of third parties to which the personal information has been disclosed in the past 12 months
Identifiers (name or symbol, etc. used to uniquely identify a particular subject)	The customer's name, address, telephone number, fax number, mailing address, email address, passport information, personal online ID, ANA Mileage Club customer number (10 digits), etc.	Other companies in the ANA Group,  subcontractor for collection & delivery and   cargo handling, various service providers, , government organizations, regulatory and law enforcement authorities, judicial, customs and authorities, third-party organization, etc.
Commercial information	Usage record of international transportation service, purchases of publications and daily necessities, etc., and information contained in correspondence with the customer. The details of enquiries, requests and complaints contained in correspondence with customers, etc.	Other companies in the ANA Group,  subcontractor for collection ＆ delivery and cargo handling, various service providers, , government organizations, regulatory and law enforcement authorities, judicial, customs and authorities, third-party organization, etc.
Internet or other electronic network activity information	Information such as that on how customers use the OCS website, including details on cookies, advertising identifiers (IDFA/GAID), location information, unique device identifiers, IP address, details on OS and browser type, etc., and website activity logs	Other companies in the ANA Group, various service providers, government organizations, regulatory and law enforcement authorities, judicial, customs authorities, third-party organization, etc.
Professional or employment-related information	Employment information (company name, division/department the customer belongs to, title, address, telephone number, fax number) and related information	Other companies in the ANA Group, various service providers, government organizations, regulatory and law enforcement authorities, judicial, customs authorities, third-party organization, etc.

 

3. Sensitive personal information

OCS does not use or disclose sensitive personal information of customers for any purpose other than certain purposes permitted under the CCPA. OCS does not collect or process sensitive personal information of customers for the purpose of inferring characteristics about customers.

 

4.   Retention of personal information

OCS retains customersʼ personal information until the purpose of use is achieved. The period of retention shall be the period necessary

for the purpose of use agreed to by the customer, and shall be determined according to the nature of the information and the purpose of

retention, taking into consideration our business needs, and other factors.

 

5.  Request about handling of personal information

Customers living in California have the following rights concerning their personal information:

 

(1)  Right to access

Customers have the right to make a request to OCS for the disclosure of the following information regarding their personal information collected/used/disclosed by OCS within the 12 months before the date of request (hereinafter "Right to access"), up to twice in 12 months.

・Type of the customer's personal information collected by OCS

・Source of the collection of such personal information

・Business or commercial purposes for the collection of such personal information

・Type of third party with which such personal information has been shared

・The customer's specific personal information collected by OCS

　　　・Type of the customer's personal information disclosed by OCS for a business purpose

             ・Type of third parties to which each type of such personal information has been disclosed

 

(2)  Right to delete

Customers have the right to make a request to OCS for the deletion of their certain personal information collected by OCS  (hereinafter "Right to delete").

(3)  Right to correct

Customers have the right to request OCS to correct incorrect personal information held by OCS (hereinafter the "Right to correct").

 

(4)  Right to opt-out of sharing

Customers have the right to direct OCS to stop sharing their personal information with a third party (hereinafter the "Right to opt-out of sharing").

When, among the rights set out above, exercising the right to access, the right to delete, the right to opt-out of sharing, please contact us using any of the following methods below. Once OCS receives such a request, it will be handled according to the related laws and regulations within a reasonable timeframe and manner, after confirming, through the procedures for individual identification described below, that the request was submitted by the customer himself/herself.

1)    Submission of a request

Overseas Courier Service (Deutschland) GmbH
Fasanenweg 7D, 65451 Kelsterbach, Germany

Germany : +49-(0)617-705-6920

2)    Procedures for individual identification

<For individuals>

Upon receiving a request for the exercise of the right to access, the right to delete, the right to correct and the right to opt-out of sharing,  OCS will ask the customer to submit information sufficient to confirm that such request was submitted by such customer himself/herself, such as his/her name and email address, and compare the submitted information with the information held by OCS.

 

<For representatives>

In addition to the information required for the identification of individual in "<For individuals>," the customer needs to submit a certificate signed by him/her certifying that the representative is authorized to exercise rights on his/her behalf. In addition, OCS may ask the customer to directly contact OCS to confirm that he/she has granted the representative authority to exercise the right to access, the right to delete, the right to correct or the right to opt-out of sharing.

 

 

 

 

Chapter 5: Handling of personal data of Thailand residents by OCS

1.   Introduction.

This Chapter 5 provides additional information about the collection, use, or disclosure ("processing") of personal data of customers and

other individuals in the Kingdom of Thailand ("Thailand") in accordance with the Personal Data Protection Act of Thailand B.E. 2562

(A.D. 2019) ("PDPA").

If consent is required for processing of personal data relevant to the use of OCS's services of data subjects who are minors, quasi-incompetents or incompetents under the law of Thailand and cannot lawfully give consent by themselves, consent of the holder of parental responsibility over the child, their curators or custodians (as the case may be) shall also be obtained. If data subjects are under the age of 10, only consent of the holder of parental responsibility shall be obtained.

If OCS is not aware that the data subjects are minors, quasi-incompetent persons or incompetent persons prior to the collection of their personal data, upon learning that we have collected personal data of minors without the consent of the holder of parental responsibility over the child (when it is required and the minors cannot lawfully give consent by themselves), or from quasi-incompetent persons and incompetent persons without the consent of their legal curator and custodian, we will delete the personal data at the earliest convenience unless we can rely on other legal grounds apart from consent for such processing.

The data subject's consent to this Privacy Policy must be obtained in the event that a person such as family member or an agent authorized to act on its behalf applies for OCS's service on behalf of the data subject.

In the event that any provisions of this Chapter 5 contradict those of Chapter 1, the provisions of this Chapter 5 shall prevail.

 

2. The controller of personal data

The controller of your personal data is OCS.
OCS protects personal data which is collected and used by controllers (who make decisions about how and why your personal data is used) and processors (who act on the controller's written instructions) on the basis of the PDPA.

3. Our legal basis for processing personal data

OCS protects your personal data by ensuring that it can only be used to the extent necessary for specific purposes (as set out in Part 3 of Chapter 1 of this Privacy Policy) and by requiring that there is a legal basis for each processing activity on the basis of the PDPA.

OCS may process customer personal data on one or more of the following legal basis:

 

(a)  When your consent is obtained to the processing (Article 19 PDPA)

Consent will usually only be relied upon for promotional and marketing related processing, or in some cases, in relation to sensitive personal data.

(b)  When processing is necessary in order to perform or take steps to enter into a contract (Article 24(3) PDPA).

This is typically why we process customer information which is essential to providing our services, including a customer’s identity, contact, payment and travel details, etc.

 

(c)  OCS needs to process the information to comply with a legal obligation (Article 24(6) PDPA).

This includes the requirement to share personal data with customs and immigration authorities or law enforcement, as well OCS's legal obligations towards its staff and customers.

 

(d)  The information is required to protect your, or a third party’s, vital interests (Article 24(2) PDPA), for example in the event of a medical emergency.

 

(e)  It is in OCS's or a third party's legitimate interests to process the personal data, and these interests are not overridden by your fundamental rights regarding your personal data under the law (Article 24(5) PDPA).

This includes the use of personal data necessary to operate OCS's business and also to maintain, develop and improve its goods and services, and to provide customers with the best possible experience to the extent permissible under the PDPA.

 

4. Request for processing of personal data

(1) The PDPA provides you with the following legal rights:

1) Request for disclosure

You can request copies of your personal data and details of how we process it.

2) Requests for correction or updating

     Corrections or updates to personal data will be undertaken wherever possible after due review of the request.

            3)Request for erasure

                    You may request that we erase, destroy or anonymize all or part of the personal data we hold about you. We will consider your        

                    request and, where the information is no longer required or the law does not permit us to continue to retain it, we will delete it.

       4) Transferring your personal data

       You can request a copy of your personal data in a structured, common, machine-readable format. This only applies to personal  

       data which we obtain from you and process on the basis of your consent or in order to perform a contract, and which is

       processed by automated means.

5) Objecting to processing

       You can object to processing which is carried out on the basis of our or a third party's legitimate interests or for the purpose of 

       direct marketing. We will stop processing your information unless we have a legitimate reason to continue which overrides your 

       objection. If your objection is to direct marketing, we will always stop.

       6) Restricting how your personal data is processed

                   You can limit how we process your personal data in certain circumstances. Where this applies, any processing of your personal

       data (other than storing it) will only be lawful with your consent or where required for legal claims, protecting certain rights or

                   important public interest reasons.

 7) The right to withdraw consent

       If we are relying on consent to process your personal data, you have the right to withdraw that consent at any time. However, the

       withdrawal of consent shall not affect the processing of your personal data that you have already given consent legally before it

       is withdrawn.

 

Please note, the rights set out above are not absolute and do not apply in every situation. There are also legal exemptions which apply in some situations and mean a request may be refused. Of course, if a request is refused, we will inform you of the reasons for this when we respond.

Records of requests made to us will be retained so that we can ensure we have complied with our legal obligations.

 

(2) Method for submitting a request

You can exercise your rights free of charge (except in the case where expenses may be chargeable under the PDPA). The method for submitting a request and contact information are as follows.

Please send the required documents by postal mail to the address below.

(Mailing address)

Overseas Courier Service (Deutschland) GmbH
Fasanenweg 7D, 65451 Kelsterbach, Germany

 

(3) Responding to a request

Written application

Request for Disclosure Form <for Thai residents>

Customer requests for disclosure, etc., may not be acknowledged if any of the required information is missing.

 

(4)Responding to a request

We will respond without undue delay and usually within thirty (30) days. We may, in some cases, ask for identification or (if you are making the request on behalf of a third party) proof of your authority to submit a request. If your request is particularly complex or you have made a number of requests, it may take longer to provide a detailed response. Please also bear in mind that there are exceptions to the rights above and some situations where they do not apply.

If you are not satisfied with our response to a data protection request or if you think your personal data has not been processed appropriately, then you have the right to file a complaint with the Personal Data Protection Committee of Thailand. Please see Part 9 of this Chapter 5 ("Lodging a complaint with an authority") for further details.

 

5. Data sharing which is necessary to provide goods or services

OCS's goods and services are provided with the assistance of other companies and organizations and often OCS will need to share personal data with third parties in order to run its business. These third parties include:

 

(a) Other companies in the ANA Group

(b) Organizations with which OCS is legally required to share personal data

including: government organizations, regulatory and law enforcement authorities, judicial, customs and immigration authorities, third-party organizations, etc.

(c) Service providers

              including: subcontractor for collection & delivery, cargo handling, various service providers, providers with whom we

  have a marketing partnership, etc.

 

Where OCS instructs companies, contractors or service providers to process data on its behalf, then it will ensure that it does so pursuant to a contract which meets the requirements of PDPA.

 

6.   Marketing communications

OCS sends out marketing communications from time to time to notify interested persons of news and provide details of goods and services which may be of interest to them. OCS will only do this if the recipient has consented to receive marketing communications.

 

7.   Where your personal data is stored and transferred

OCS is located in Japan and many of the service providers and other organizations with whom we share your personal data will be located in jurisdictions outside Thailand. When transferring personal data to third parties, OCS will ensure that it complies with the requirements of the PDPA and related Japanese laws.

However, you should be aware that recipients outside Thailand may be subject to national laws which do not necessarily provide

equivalent protection for your personal data. If you would like more information regarding where your personal data is stored and

transferred please contact OCS using the details set out in Part 12 of this Chapter 1 ("Submission of a request for disclosure, etc.").

 

8. Retention of personal data.

OCS retains customers' personal data until the purpose of use is achieved. Particularly, OCS has set the retention period for personal data as follows. For most other personal data, the appropriate retention period will be determined based on the nature of the information and the purpose for having it by reference to legal and accounting requirements and our business needs.

(1)  Personal data of customers using international transportation service.

Until completion of carriage and related services as stipulated in the International conditions of carriage.

(2)  Other personal data.

Required period for the purpose which customers have consented.

Please note that OCS may retain your personal data for a longer period than mentioned above if it is for the purposes of the establishment, compliance, or exercise of legal claims, the defense of legal claims, or the purpose for compliance with the law.

 

9. Lodging a complaint with an authority

Customers have the right to lodge a complaint on the processing of their personal data with the Personal Data Protection Committee of Thailand.

10. The contact information of the controller and OCS's Data Protection Officer

Overseas Courier Service (Deutschland) GmbH
Fasanenweg 7D, 65451 Kelsterbach, Germany

 

 

Handling of information on the website

 

This section sets out the OCS website's handling of personal data and other information. For information on the handling of personal data

by OCS as a whole, please refer to the OCS Privacy Policy.

 

1.   Introduction

OCS handles information on this website (hereinafter referred to as ‘this website’) in accordance with the ‘OCS Privacy Policy’ as

follows, and strives to operate and manage this website so that customers can use it with peace of mind.

Customers who use this website are deemed to have fully understood and agreed to the following terms and conditions.

 

Scope of application

This Privacy Policy applies when you use our website (ocs.co.jp domain) and does not apply to websites operated by other companies. Our website provides links to other websites in order to provide useful information and services to our customers. The Privacy Policy does not apply to linked sites. We recommend that you check the privacy protection statements of each site when you access them.

 

2. Security

Security technology that protects personal information

When customers provide us with personal information, we encrypt that information using SSL (secure sockets layer) encryption technology or equivalent security technology to prevent unauthorized access by third parties during transmission. In addition, we strive to ensure the security of our customers' personal information by implementing reasonable security measures such as firewalls and anti-virus software to prevent the leakage, misuse, or alteration of personal information due to unauthorized access by third parties.

 

How SSL (secure sockets layer) works

With SSL, before customers send personal information, we conduct electronic security exchanges (digital authentication and digital signatures) with them to mutually authenticate each other before transmitting data. The exchanges between us and our customers are scrambled with random numbers, preventing misdelivery to third parties who attempt to steal data by impersonating our customers.

Furthermore, information transmitted via SSL is encrypted using a combination of two encryption methods: public key cryptography (RSA) and common key cryptography (secret key cryptography). To decrypt this information, an electronic ‘key’ is required. Even if the information is intercepted by a third party, it is impossible to decrypt the encrypted information without the correct key. While the number of keys is finite, attempting to systematically try all possible keys to find the correct one would require an extremely long time, even when using a computer for computational processing. Therefore, it is extremely difficult for a third party to decrypt the information.

 

3. Collection of browsing information

About browsing our site

When you view our website, we collect the following information in order to provide you with a comfortable service experience.

1. Use of cookies*1

We collect cookies for the purpose of providing the following information.

・    Login information for web services provided by OCS

●        Information on personalized pages for customers

●        Registration information for various campaigns, etc.

●        Browsing history information (using web beacons*2)

Customers can refuse to accept cookies at any time by changing the settings of their Internet browser software. We recommend that you set your browser to allow cookies only from websites you trust. However, please note that without cookies, response speeds may be significantly reduced.

 

2. Use of IP addresses*3

We collect IP addresses for the purpose of providing information tailored to the customer's region. When a customer views our website, we identify the region from which they are accessing based on their IP address, but we do not identify the customer.

 

About email distribution

In the course of sending emails to you, we may obtain the following information

●        HTML email open or preview status (using web beacons*2)

●        Information on access to our website via email (HTML email and text email)

*1 What is a cookie?

　　　　　   1.  Cookies are a feature that stores information about users' use of this website on their computers. Information collected through cookies does not include any personally identifiable information such as email addresses or names.

 

                         2.  Our company may provide information collected through cookies to third parties to the extent necessary to achieve the

purposes listed in ‘1. Use of Cookies *1’ of this Privacy Policy.

 

3. Users may choose whether or not to use cookies for each purpose, and shall set their preferences in accordance with the

settings of the web browser they use. If users use this website with cookies enabled, they shall be deemed to have   consented to our use of information regarding their use of this website.

*We recommend that you accept cookies in order to make full use of the features of this website.

 

*2 What is a web beacon?

A web beacon is a mechanism for collecting information about page views by embedding a small, invisible image (a 1×1 pixel GIF image) in a web page or HTML-formatted email. This allows us to accumulate information about your web page views and email openings/previews.

 

*3 What is an IP address?

It is a number automatically assigned to your computer when you view various websites. Web servers (computers that provide homepages) automatically recognize your computer from its IP address and communicate with it.