Open Bridge Solutions Sdn. Bhd., a company incorporated in Malaysia (the "Operator"), and TRIPLEX LLC, a company incorporated in Japan (the "Seller of Record"; together with the Operator, "we" or "us"), set out this Privacy Policy to explain how personal data is handled on the online marketplace "Open Bridge Market" (the "Service"). The Operator handles personal data to operate the Service, and the Seller of Record handles personal data to sell products and process payments.

1. Information We Collect

1. Registration data: username, email address, password (stored hashed), and, if you provide them, your name, country, and phone number
2. Seller registration and profile data: name or business name, username, email address, occupation, qualifications, track record, and other profile information the Seller registers or publishes
3. Transaction data: purchase history, order number, amount, currency, refund history, and payment history to Sellers
4. Payment data: card details are collected directly by Stripe and are not stored on our servers. We receive limited information from Stripe, such as card brand, last four digits, country, and payment result.
5. Seller identity verification data: identity documents, date of birth, address, bank account details, etc. are collected directly by Stripe during Stripe Connect onboarding. We receive from Stripe the verification status and the information needed to pay Sellers.
6. Usage logs: access logs, IP address, cookies, etc. (see our Cookie Policy)
7. The content of your inquiries

2. Purposes of Use

1. To provide, operate, maintain, and improve the Service
2. To facilitate transactions between Users and Sellers (purchases, payments, delivery of products, etc.)
3. To authenticate accounts
4. To respond to inquiries and provide customer support
5. To address violations of the Terms of Service and prevent fraudulent use
6. To comply with applicable laws
7. For the Seller of Record to enter into and perform Purchase Contracts, process payments and refunds, pay Sellers, and handle accounting and tax matters

3. Disclosure to Third Parties and Service Providers

We do not provide personal data to third parties except in the following cases:

1. With the individual's consent
2. Between the Operator and the Seller of Record, to the extent necessary to operate the Service and to sell products, process payments and refunds, and pay Sellers (excluding passwords)
3. To Stripe, as necessary for payment processing and for Seller identity verification and payouts. Seller data is handled under the Stripe Connected Account Agreement and Stripe's Privacy Policy.
4. To service providers such as our hosting provider (World Host Group) and our security/CDN provider (Cloudflare), to the extent necessary to operate the Service
5. Where required by law

4. Cookies

For information on our use of cookies and similar technologies, please see our separate Cookie Policy.

5. Data Retention

We keep personal data for as long as necessary for the purposes for which it was collected. After an account is deleted, we will endeavor to delete or anonymize the relevant data within a reasonable period, except where we must keep it by law (for example, accounting and tax records).

6. Security Measures

Our measures include appointing a person responsible for personal data, managing access rights, encrypting communications (TLS), hashing passwords, protection by Cloudflare (DDoS mitigation and a web application firewall), and supervising staff and service providers. When handling personal data in Malaysia, we apply security measures based on an understanding of that country's legal system.

7. Your Rights

Under applicable laws (including Japan's Act on the Protection of Personal Information and Malaysia's Personal Data Protection Act (PDPA)), Users and Sellers may request access to, correction of, addition to, deletion of, or the cessation of use of their personal data held by us. Please make requests through the contact point in Section 11.

8. Minors

The Service is intended for adults (or those who have reached the age of contractual capacity in their country or region of residence). Minors must obtain consent from a parent or guardian before using the Service.

9. International Data Transfers

1. The Operator is located in Malaysia and the Seller of Record is located in Japan. To provide the Service, personal data is transferred between Japan and Malaysia. Personal data may also be processed on servers in the United States, the United Kingdom, and other countries by Stripe, World Host Group, and Cloudflare.
2. By agreeing to this Policy when registering, Users and Sellers consent to the transfer of their personal data from Japan to other countries, including Malaysia. Information on the data protection systems of the destination countries:
3. Malaysia: the Personal Data Protection Act 2010 (as amended in 2024) applies. It gives individuals rights of access and correction, and requires notification of data breaches to the authority and the appointment of a data protection officer.
4. United States: there is no comprehensive federal data protection law; personal data is protected by sector-specific federal laws and state laws (such as the California Consumer Privacy Act).
5. United Kingdom: the UK GDPR and the Data Protection Act 2018 apply, and Japan's Personal Information Protection Commission recognizes the UK as providing a level of protection equivalent to Japan's.
6. The Operator and the Seller of Record have agreed on security measures, a prohibition on use for other purposes, and restrictions on onward transfers, and apply protections equivalent to Japan's Act on the Protection of Personal Information and Malaysia's PDPA.

10. Changes to This Policy

We may amend this Policy as we consider necessary by posting it on the Service. We will give advance notice of material changes where practicable.

11. Contact

Please use the inquiry form on the Service or email [email protected] for questions or requests regarding personal data (shared contact point for both companies).

• Operator: Open Bridge Solutions Sdn. Bhd. / Representative: Toyoshi Nagata / A-3-41, Plaza Medan Putra, Jalan Medan Putra 6, 52200 Kepong, Kuala Lumpur, Malaysia
• Seller of Record: TRIPLEX LLC / Representative Member: Toyoshi Nagata / 4-1-4 Shimoigusa, Suginami-ku, Tokyo 167-0022, Japan

Effective date: 15 October 2026