Privacy Policy

Controller Hilltop Management Co., Ltd.
Representative: Akira Otani
Kojima Building 401, 3-20-8 Ueno, Taito-ku, Tokyo 110-0005, Japan
Phone: +81-3-3836-9830
Contact: Inquiry form / Email: ueno＠sishobako.jp
Information we collect
[When you apply for membership]
Name; date of birth; address (country, postal code, address); phone number; email address; occupation; purpose of using the mailbox; images of your identity documents, and the type, number, date of issue and expiry date shown on them
[When you request a quote or contact us]
Email address; the plan you selected; the content of your inquiry
[Automatically, when you use our services]
IP address; date and time of access; browser type; cookies
We use this information to prevent fraud and to operate our services. Except for inquiry records and login times, we do not keep it linked to you as an individual.
Purposes and legal bases
  • Providing our private mailbox service (receiving, storing, forwarding and scanning your mail and parcels) — to perform our contract with you
  • Verifying your identity and keeping records of it, as required by Japanese law (the Act on Prevention of Transfer of Criminal Proceeds) — to perform our contract with you, and for our legitimate interest in complying with the law
  • Billing and payment — to perform our contract with you
  • Contacting you — to perform our contract with you
  • Preventing fraudulent use (other than reCAPTCHA) — for our legitimate interest in keeping our service secure
  • Preventing fraudulent submissions with reCAPTCHA — based on your consent
Why we need your information Identity information is required by Japanese law for a private mailbox contract. If you do not provide it, we cannot enter into a contract with you. We ask for other information only as far as necessary to provide our services.
Disclosure to third parties We do not disclose your personal information to third parties without your consent, except in the following cases:
  • To carriers, the recipient's name, address and phone number, to forward your parcels
  • To payment providers (PayPal), the information needed to process payments
  • To Google (reCAPTCHA), to prevent fraudulent submissions (only when you have consented)
  • To public authorities, when disclosure is required by law
International transfers We are a business based in Japan, and your information is stored on servers located in Japan. Transfers from the European Union (EU) and the European Economic Area (EEA) to Japan are made on the basis of the European Commission's adequacy decision for Japan.
Your information may also be transferred to the United States when we use the following services. These transfers are made under safeguards recognized by EU law that each company has adopted.
  • Google (reCAPTCHA)
  • PayPal (payments)
About reCAPTCHA Our application form may use Google reCAPTCHA to prevent automated fraudulent submissions. When it is used, your IP address, browser information and interaction data are sent to Google, and Google's Privacy Policy and Terms of Service apply. You can still apply if you do not consent to reCAPTCHA.
Cookies We use cookies to keep you logged in and for reCAPTCHA as described above. We do not use cookies to track you for advertising.
Retention Identity verification records are kept for 7 years from your last use of our services (the end of your contract).
Accounting records are kept for the period required by law.
Other information is kept for as long as necessary for the purposes above, and then deleted.
Your rights You may ask us to:
  • give you access to your personal information — you can view your registered details on the member site at any time
  • correct it (change your registered details) — you can change your address after identity verification. Your name and date of birth are registered as confirmed by your identity documents and cannot be changed
  • delete it — while your contract is active, we cannot delete information needed to provide our services
  • restrict or stop its use (restriction and objection) — we cannot stop using information needed for your contract, so in that case we will end our services to you
  • provide it to you so that you can move it to another service (data portability) — we will give you your registered details in a commonly used file format
  • withdraw your consent where we rely on consent (this does not affect use before the withdrawal)
We will respond in accordance with the law. However, identity verification records that we are required by law to keep cannot be deleted during the retention period.
How to ask: Inquiry form
Complaints If you live in the EU or EEA, you have the right to lodge a complaint with the data protection supervisory authority in your country.
Automated decisions We do not make decisions that have legal effects on you based solely on automated processing.
Security Images of identity documents and similar files are stored where they cannot be accessed directly from outside, and are shown only through tokens that expire.
Changes to this policy If we change this policy, we will post the new version on this page.
Effective date 30 Sep 2026