Privacy Policy

TCGTwo Privacy Policy

ORIPAS Platform

Effective Date: March 24, 2026

Last Updated: March 24, 2026

1. Introduction

TCGTwo, LLC ("TCGTwo," "we," "us," or "our") provides services named "ORIPAS" (the "Services") in which you can play a mystery pack game and may obtain trading cards or other products ("Trading Card(s)") as a result thereof. We comply with applicable data protection laws and properly handle your personal information collected with regard to your use of the Services pursuant to this Privacy Policy.

This Privacy Policy is designed to comply with applicable data protection laws across the jurisdictions in which we operate, including but not limited to: Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486) ("PDPO"); Macau's Personal Data Protection Act (Law No. 8/2005); the People's Republic of China's Personal Information Protection Law ("PIPL"); Taiwan's Personal Data Protection Act ("PDPA"); Singapore's Personal Data Protection Act 2012 ("SG PDPA"); and Japan's Act on the Protection of Personal Information ("APPI").

By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with the practices described herein, please discontinue use of the Services.

2. Personal Information We Collect

We collect the following categories of your personal information:

(1) Information with regard to your use of the Services: Email address, username, password and other information you are required to provide upon user registration; information necessary for the shipping of Trading Cards, such as name, address and phone number; settings and preferences of the Services; trading history and gaming records, such as records of purchase and use of Points, the mystery packs you played and results thereof, your membership rank, and shipping of Trading Cards; and your interests and preferences inferred from other information.

(2) Personal information automatically collected from your device: Technical information such as types and versions of OS or language settings; internet protocol address and approximate geolocation information based thereon; log information including access times; and identifiers such as device IDs.

(3) Payment Information: Credit card or debit card details, billing address, and transaction records, processed through our third-party payment processors. We do not store your full payment card details on our servers.

(4) Others: We collect other personal information that you voluntarily provide to us, such as content of inquiries you make.

Sensitive Personal Information: We do not collect, use or disclose any sensitive personal information, such as information revealing your racial or ethnic origin, religious or philosophical beliefs, precise geolocation, or credit card number in combination with password, in relation to the Services.

3. Purposes of the Collection and Processing of Personal Information

We will collect and process your personal information for the following purposes:

(1) To provide you with the Services, such as: enabling you to use the Services; customizing contents or making recommendations based on your registered information and behavioral information; delivering Trading Cards to you; managing your settings and preferences and providing notices on necessary matters; answering your inquiries; and ensuring security, including SMS verification for the shipping of Trading Cards.

(2) To improve the quality of the Services and users' satisfaction.

(3) To provide you with targeted advertising based on your personal information such as your activity on our websites and applications.

(4) To comply with applicable laws, regulations, and legal processes.

(5) To send you marketing and promotional communications, subject to your consent where required by law. You may opt out of marketing communications at any time.

In principle, we will collect and process your personal information within the scope of the purposes set forth above, and when we use your personal information outside the scope of those purposes, we will obtain your prior consent unless otherwise permitted by applicable law.

4. Legal Bases for Processing

Depending on the jurisdiction that applies to you, we process your personal information on one or more of the following legal bases:

(a) Consent: Where you have given clear consent for us to process your personal information for a specific purpose.

(b) Contractual Necessity: Where processing is necessary to perform or enter into a contract with you.

(d) Legitimate Interests: Where processing is necessary for our legitimate interests, provided these interests are not overridden by your rights.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect usage and analytics data. For details, please see our separate Cookie Policy.

6. Disclosure of Personal Information

We may disclose your personal information to our service providers who process your personal information on our behalf for the purposes described in Section 3.

However, we will not sell personal information or share it for cross-context behavioral advertising. We have not sold, or shared for cross-context behavioral advertising, any personal information in the preceding twelve (12) months.

We may also disclose your personal information as required or permitted by law, or in the event of a sale, merger, reorganization or other restructuring.

We require all third-party recipients to maintain appropriate security measures and to process your personal information only for the purposes for which it was disclosed.

7. International Transfer of Personal Information

In principle, your personal information is stored on servers located in Tokyo, Japan, operated by Amazon Web Services (AWS). Your personal information may be transferred to and stored in countries/regions outside Japan to the extent necessary for the purposes specified in Section 3.

For users in Mainland China: Pursuant to the PIPL, we will obtain your separate and explicit consent before transferring your personal information outside of Mainland China, where required. We have implemented appropriate safeguards, including contractual measures. We will provide you with the name, contact method, handling purpose, handling methods, and categories of personal information of the overseas recipient, and the means by which you may exercise your rights.

For users in other jurisdictions: We will take adequate measures to protect your personal information and ensure compliance with applicable laws.

8. Data Retention

We retain your personal information to the extent reasonably necessary to achieve the purposes stated in Section 3. Once you delete your account, we will delete your account registration information including shipping address.

Analytics data is retained in anonymized or aggregated form. When personal information is no longer required, we will securely delete or anonymize it.

9. Security

We implement reasonable security procedures including encryption, access controls, regular assessments, and employee training.

Where we delegate processing to service providers, we ensure they are contractually obligated to implement reasonable security procedures.

No method of transmission over the internet is completely secure. We cannot guarantee absolute security.

10. Your Rights

You may have certain rights under applicable data protection laws, including:

(a) Right to Know what personal information we have collected about you.

(b) Right to Correct inaccurate personal information.

(d) Right to Restrict or Object to Processing in certain circumstances.

(e) Right to Withdraw Consent at any time without affecting prior processing.

(f) Right to Data Portability in a structured, machine-readable format.

(g) Right Not to Receive Discriminatory Treatment for exercising your privacy rights.

(h) Right to Lodge a Complaint with the relevant data protection authority.

To exercise any rights, please contact us at support@tcgtwo.com. We will verify your identity and respond within the timeframe required by applicable law.

11. Personal Information of Minors

The Services are restricted to users 18 years of age or older. We do not knowingly collect personal information from minors under 18. If we discover such information, we will delete it as soon as possible. Contact support@tcgtwo.com if you become aware a minor has provided us with personal information.

12. Jurisdiction-Specific Provisions

Hong Kong: In accordance with the PDPO, we collect personal information lawfully and fairly for purposes directly related to our business. Data collected is adequate but not excessive. You have the right to access and correct your personal information. We will not use it for direct marketing without your consent.

Macau: In accordance with Law No. 8/2005, we process your personal information lawfully and in good faith. You have the right to access, correct, and oppose processing.

Mainland China: In accordance with the PIPL, we will obtain consent before collecting and processing. For cross-border transfers, we will obtain separate consent and conduct a Personal Information Protection Impact Assessment. You have the right to access, correct, delete, port your information, and withdraw consent.

Taiwan: In accordance with the PDPA, we collect and process within the necessary scope of specific purposes. You have the right to access, correct, supplement, discontinue collection/processing/use, and delete.

Singapore: In accordance with the SG PDPA, we will notify you of purposes. We have appointed a Data Protection Officer contactable at support@tcgtwo.com.

Japan: In accordance with the APPI, we will specify and publicly announce purposes of use. You have the right to request disclosure, correction, cessation of use, and deletion. We will provide information about data protection systems of destination countries.

13. Language

13.1 This Privacy Policy is provided in English, Traditional Chinese, and Simplified Chinese. In the event of any inconsistency or discrepancy between the English version and any translated version, the English version shall prevail and govern.

14. Modification to Privacy Policy

We will review this Privacy Policy as necessary. When we make important changes, we will notify you in the Services. If required under applicable law, we will obtain your prior consent before implementing changes.

15. Contact Information

If you have any questions, comments or requests regarding this Privacy Policy, please contact us at:

TCGTwo, LLC

Email: support@tcgtwo.com

You can also contact us via the "Contact Us" form on the Services.