Supplement for Japan

Last Updated: February 27, 2026

If you are located in Japan, this supplement contains additional information which we are required to provide to you.

1. The Controller of your personal information

In this supplement, the LEGO Group shall refer to LEGO System A/S, LEGO Japan Co., Ltd. and LEGO BrickLink, Inc.

LEGO System A/S is the controller of your personal information as described in Section 1 of this Policy.

If you have a contract directly with LEGO Japan Co., Ltd. (e.g., by making a purchase on lego.com/ja-jp/), LEGO Japan Co., Ltd. is the controller, solely in relation to that contract.

If you have a contract directly with LEGO BrickLink, Inc. (e.g., by making a purchase, or participating as a seller, on the BrickLink marketplace), BrickLink, Inc. is the controller, solely in relation to that contract.

If you visit one of our LEGO Discovery Centers and LEGOLAND Discovery Centers in Japan, LEGOLAND Japan is the controller in relation to the following processing activities but only insofar as it relates to LEGO Discovery Centers and LEGOLAND Discovery Centers:

  • Order fulfillment
  • Customer support
  • Digital Marketing communications (e.g., email, SMS, push messages in app messages or similar direct electronic marketing)
  • Printed marketing including catalogs and newsletters and other print marketing
  • Video monitoring and collection of images (in stores and other relevant LEGO Group locations)
  • Business partners and commercial relations
  • Interacting with LEGO Discovery Centers and LEGOLAND Discovery Centers

2. Shared use of personal information with LEGO Group companies

LEGO Group companies will share your personal information for the purposes set out in this Policy.

The types of personal information that are subject to joint use and the purposes of use are described in Section 2 "Personal data" of this Policy, "What personal data does the LEGO Group collect?" An example of a LEGO Group company can be found at (https://www.lego.com/en-sg/aboutus/lego-group/contact/locations). Our senior management (https://www.lego.com/en-sg/aboutus/lego-group/management/) is ultimately responsible for the personal data that is jointly used. If you have any questions about joint use, please contact our Privacy Officer (([email protected])).

3. Outsourcing of Personal Information Processing

The LEGO Group is compliant with the Act on the Protection of Personal Information (hereinafter referred to as the "Personal Information Protection Act") of Japan. The LEGO Group may entrust the processing of your personal information to a subcontractor (including domestic and overseas outsourcing companies). Where the LEGO Group entrusts your personal information to a subcontractor (including domestic and overseas subcontractors), the LEGO Group will conclude appropriate data processing agreements with and will appropriately supervise each subcontractor to ensure compliance with the Personal Information Protection Act.

4. Your Privacy Rights

  • Right to access your personal information. You have the right to view the personal information we hold about you and records of its transfer. In many cases, we provide this information to you in our online services. However, your access rights may be limited by law, the privacy of others, the LEGO Group's trade practices and know-how, business confidentiality and internal evaluation.
  • Right to request correction, addition and deletion of inaccurate or incomplete data. If the personal information we hold about you is inaccurate or incomplete, you have the right to request correction, addition and deletion of your personal information to the extent permitted by law.
  • Right to request deletion and suspension of processing of personal information. If any of the following apply, you have the right to request that your personal information be erased or that the processing of your personal information be stopped:
  • When your personal information is used beyond the scope necessary to achieve the purpose for which it was originally collected.
  • When the product is processed or obtained using fraudulent measures or in violation of the Personal Information Protection Act.
  • When our use of your personal information triggers illegal acts.
  • When the personal information is no longer necessary in light of the purpose for which it was originally collected.
  • When a situation such as a leak, loss, damage or other situation concerning the security of your personal data that is specified under the Personal Information Protection Act has occurred.
  • When our use of your personal data is likely to harm your rights and legitimate interests.

However, we may be permitted by applicable law to retain some of your personal information to meet our business needs.

  • Right to request suspension of provision of personal information to third parties. When your personal information is provided to a third party in violation of the Personal Information Protection Act, or when the provision to a third party may harm your rights or legitimate interests, you have the right to request that the provision of personal information to a third party be stopped.
  • Other Rights/Inquiries. If you have any objections to how we process your personal information, have questions about this Policy, our use of your personal information or the data protection measures we implement, or would like to learn more about how you can exercise your privacy rights as described above. Please contact us at the email address listed in this policy.

You may request that we disclose the following information (however, the LEGO Group may refuse such requests to the extent permitted by applicable law):

  • Data Security Measures We Implement
  • If we share your personal information with foreign companies, including LEGO Group companies overseas, or on a outsourcing basis) (i) Adequate data security measures by the data recipient (hereinafter referred to as the "Measures"). (ii) the measures and frequency of audits of the implementation of the Measures by the Data Recipient, (iii) the name of the country of the recipient of the data and the laws and regulations in such country that may interfere with the implementation of the Measures, and (iv) other obstacles that may interfere with the implementation of the Measures; and the measures taken by the LEGO Group to resolve such failures.

5. Basis for processing personal information

According to the provisions of the Personal Information Protection Act, there is usually no legal basis required for processing personal information.

However, when conducting direct marketing, we will ask you to provide explicit consent through your opt-in.

6. Sharing information with other companies

If LEGO Japan transfers your personal information to foreign tax, customs, regulatory and other public authorities, we will do so in accordance with the provisions of the Personal Information Protection Act.

We will disclose personal information to third parties if we believe it is necessary or appropriate for any of the following purposes:
  (a) to comply with applicable laws (including laws outside of Japan)
  (b) to respond to requests from public and government authorities (including public institutions outside Japan)
  (c) to cooperate with law enforcement;
  (d) to protect the rights, privacy, safety and property of us, our affiliates, you and others.

If required, we will ask for your consent to such data transfer as necessary or carry out the data transfer in accordance with the provisions of the Personal Information Protection Act.

If we determine that it is necessary to transfer your personal information to a third party and we are required to obtain your consent under the Personal Information Protection Act, we will separately request your consent for such data transfer.

7. Transfer of information outside Japan

As the LEGO Group is a global company, we may disclose certain personal information outside of Japan. If we transfer your personal information to a country which has not been prescribed by the Personal Information Protection Commission as a foreign country that has established a personal information protection system recognized to have equivalent standards to that in Japan, we will ensure (by way of Binding Corporate Rules or appropriate data processing agreements) that the recipient nonetheless adopts measures to ensure that personal information is protected to a standard equivalent to that under the Personal Information Protection Act.

If it is not possible to secure an equivalent level of protection, the LEGO Group will separately obtain your consent.