PRIVACY
About This Policy
BSHOP INC. (“we”, “our”) operates the Gymphlex online store and related services (the “Website”). This policy explains how we collect, use, share and protect the personal information of people who use the Website.
Under the GDPR and UK GDPR, BSHOP INC. is the data controller. For U.S. residents, we also comply with the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and other U.S. state privacy laws, to the extent they apply (together, “Applicable Data Protection Laws”).
Information We Collect
- Information you provide: name, address, phone number, email address, order details, payment-related information (full card numbers are processed directly by our payment providers), and anything else you submit when you order, create an account, subscribe to emails or contact us.
- Information collected automatically: IP address, device identifiers, browser type, access times, pages viewed and interaction logs, including through cookies and similar technologies (see “Cookies and Similar Technologies”).
- Information from service providers: data we receive from our store platform, payment, logistics, order management, advertising and analytics providers.
How We Use Information and Legal Bases
We use personal information only for the purposes below. For individuals in the EEA and UK, the legal basis for each purpose is also shown.
Purpose / Legal basis (EEA and UK)
・Process and deliver orders; handle payments, returns and customer support / Performance of a contract
・Operate, secure and improve the Website; remember your preferences; prevent fraud / Legitimate interests
・Analytics and advertising cookies, including delivering and measuring ads; marketing emails / Consent (you can withdraw it at any time)
・Comply with tax, accounting and other legal obligations; respond to lawful requests from authorities / Legal obligation
Our legitimate interests are running, securing and improving the Website and preventing fraud. In rare cases we may also process information to protect someone’s vital interests. We do not use personal information for incompatible purposes without obtaining additional consent where required. If you do not provide the information needed to process an order (such as your name and delivery address), we cannot fulfill it. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
Cookies and Similar Technologies
We use cookies and similar technologies (such as pixels) for three purposes:
- Essential: needed for the Website to work, such as the shopping cart, checkout, security and your language or region settings. These are always on.
- Analytics: to understand how the Website is used and to fix problems.
- Advertising: to deliver and measure online ads, including cross-context behavioral advertising. Our advertising partners may set their own cookies.
If you are in the EEA or UK, we place analytics and advertising cookies only after you consent. You can accept or reject them in the privacy settings pop-up on our home page, and you can change or withdraw your choice at any time through the Website’s privacy settings. You can also block or delete cookies in your browser settings, but some features may not work. The cookies we use, including their providers, purposes and durations, are listed in the privacy settings.
Sharing Personal Information
We do not sell personal information in exchange for money. We share it only as needed with:
- Service providers acting on our behalf: our store platform (e.g., Shopify), payment processors, logistics and fulfillment partners (including our warehouse operator, NEOlogi), delivery companies, and advertising and analytics providers (subject to your choices below). They process information only on our instructions and under confidentiality and security obligations.
- Public authorities, when required by law or a lawful request.
- Successors, if we are involved in a merger, acquisition or sale of business. In that case, the protections in this policy continue to apply.
International Transfers
Your information may be transferred to and processed in Japan and other countries where we or our service providers operate, which may have different data protection laws from your country. For transfers from the EEA or UK, we rely on adequacy decisions, Standard Contractual Clauses (or the UK International Data Transfer Addendum) and other appropriate safeguards. You can request information about these safeguards by contacting us.
Retention and Security
We keep personal information only as long as needed for the purposes above, to meet legal obligations, resolve disputes and enforce our agreements. We then securely delete or anonymize it. If processing is based on consent, we stop when you withdraw it, unless we must keep the data by law or for legal claims.
We use appropriate technical and organizational measures (such as access controls and encryption) to protect personal information, and we require our service providers to do the same. If a security incident occurs, we will respond promptly and take the steps required by law.
Your Rights and Choices (EEA, UK and U.S.)
All customers.
You may request access to, correction of, deletion of, or suspension of use of your personal information. We may keep certain information where the law requires it or to protect our legal rights.
Sale, sharing and opt-out.
If you are a California resident, our use of certain advertising and analytics technologies may count as a “sale” or “sharing” of personal information for cross-context behavioral advertising under the CCPA. You can opt out at any time by selecting “Reject” in the privacy settings pop-up on our home page, and we will not discriminate against you for doing so. Your choice applies to the browser and device you use, so you must set it again if you clear cookies or switch devices. If you turn on an opt-out preference signal such as Global Privacy Control (GPC), we treat it as an opt-out request for that browser.
Categories of personal information (California).
In the past 12 months we collected the following categories for the purposes described above: identifiers (such as name, address, email, phone number and IP address); commercial information (such as order history); internet or network activity (such as pages viewed and interaction logs); and approximate location derived from your IP address. We disclosed these categories to the service providers listed in “Sharing Personal Information” for business purposes, and identifiers and internet activity to advertising partners unless you have opted out. We use sensitive personal information (such as account log-in details and payment information) only as needed to provide the Website and process orders. We keep each category for the period described in “Retention and Security.”
EEA and UK residents.
Under the GDPR and UK GDPR you also have the right to: be informed; access; rectification; erasure; restriction of processing; object to processing based on legitimate interests and, at any time, to direct marketing; data portability; not be subject to decisions based solely on automated processing that significantly affect you; withdraw consent at any time; and lodge a complaint with a supervisory authority.
U.S. residents.
Depending on your state, you may have the right to: know and access the personal information we collect, use and disclose; correct it; delete it; opt out of its sale or sharing and of targeted advertising; limit the use of sensitive personal information (where applicable); receive it in a portable format; appeal our decision on a request (where your state allows); and not be discriminated against for exercising these rights. An authorized agent may submit a request for you, and we may ask for proof of authorization.
Children.
The Website is not directed to children, and we do not knowingly collect personal information from children under 16. We do not knowingly sell or share the personal information of consumers under 16.
How to exercise your rights.
Email info@gymphlex.com. We will verify your identity and respond within one month (EEA and UK, extendable as permitted by law) or within the period required by law (U.S., generally 45 days).
Accessibility (European Accessibility Act)
We aim to make the Website accessible to people with disabilities, in line with the European Accessibility Act (Directive (EU) 2019/882) and the national laws implementing it. We aim to conform to WCAG 2.1 Level AA [and EN 301 549]. Current status: [partially conformant].
If you have difficulty using any part of the Website or need information in another format, email info@gymphlex.com. We aim to respond within [7] business days. If you are not satisfied with our response, you may contact the market surveillance authority in your EU Member State. Last assessed: [2026.11.2].
Contact
BSHOP INC. – Gymphlex Official Site Customer Center
Address: 9th Floor, Kobe Asahi Building, 59 Naniwacho, Chuo-ku, Kobe City, Hyogo Prefecture 650-0035, Japan
Email: info@gymphlex.com
If you are in the EEA, UK or U.S. and wish to exercise your rights, please include enough information for us to verify your identity and process your request.
Updates to This Policy
We may update this policy to reflect changes in our practices, services or legal requirements. The updated version will be posted on the Website with a revised date, and we will give reasonable notice of material changes.
Last updated: November 2026.