Article 1 Consent to Collection of Personal Information and Collection Method

WIN&WIN CO., LTD. (“Website”) shall establish a procedure for allowing customers to click the button “Agree” to the terms of use, collection of personal information, and details of personal information used. Customers shall be deemed to have agreed to the collection and use of their personal information by clicking the “Agree” button.

Article 2 Personal Information Items Collected and Purpose of Using Personal Information

“Personal Information” means information on living persons and refers to their names, e-mail addresses, or any other information that identifies such persons.

The Website has the following purposes for collecting and using customers’ personal information:

1. Personal information of general members

• Time of collection: Signing up for membership

• Mandatory collection items: ID, Password, Name, E-mail address

• Optional collection items: Profile image, Date of birth, Telephone/Mobile number, Address

• Purpose of using personal information: Membership management, customer consulting, and delivery of notices

• Retention period: Immediately deleted upon withdrawal of membership (However, records of members with purchase history are retained for five (5) years in accordance with relevant statutes)

2. Order information (including members and non-members)

• Time of collection: Upon placing orders

• Mandatory collection items: Orderer information (Name, Address, Telephone, E-mail), Recipient information (Name, Address, Telephone), Payment approval information

• Optional collection items: Delivery messages

• Purpose of using personal information: Payment, delivery of products, and order tracking

• Retention period: Retained for five (5) years

Article 3 Collection of Personal Information via Cookies

The Website uses cookies to provide personalized services.

1. Purposes of using cookies: Analyzing access frequency, identifying user tastes/interests, and providing target marketing and tailor-made services.

2. Rejection of cookies: Customers may refuse to store cookies by changing settings on their web browser (Internet Explorer, Chrome, etc.). However, some services may be restricted.

Article 4 Periods of Retaining and Using Personal Information and Destruction of Personal Information

1. Statutory Retention Periods:

• Records on contracts or withdrawal of offers: 5 years

• Records on payments and the supply of goods: 5 years

• Records on the resolution of customers’ complaints or disputes: 3 years

• Log-in records (Protection of Communication Secrets Act): 3 months

2. Destruction Methods: Electronic files are permanently deleted using technical methods, and paper documents are shredded or incinerated.

3. Dormant Accounts: Members who have not used services for 12 months will be notified, and their information will be separately managed or destroyed.

Article 5 Provision of Personal Information for Third Parties

The Website does not provide personal information to third parties without consent, except as required by investigative institutions under relevant statutes or for anonymous statistical/academic research.

Article 6 Outsourcing of Personal Information Processing

The Website outsources processing for efficiency and better service:

• Delivery of ordered products: Authorized local/international courier services (e.g., DHL, FedEx, CJ Logistics)

• Computer systems/Hosting: Professional hosting service providers

• Delivery tracking: Goodsflow Inc.

• Payment and escrow: Authorized Payment Gateway (PG) companies

• Self-authentication: Dream Security Inc.

Article 7 Access and Modification of Personal Information

Customers may access or modify their personal information at any time via the "Edit Profile" menu or by contacting the Chief Privacy Officer.

Article 8 Withdrawal of Consent

Customers may withdraw their consent to the collection and use of personal information at any time by applying for "Membership Withdrawal."

Article 9 Measures for Ensuring the Security of Personal Information

The Website takes technological/administrative measures such as encryption of passwords/personal data and installation of security programs to prevent hacking and data leakage.

Article 10 Protection of Personal Information of Children

The Website does not allow children under 14 years of age to apply for membership to ensure their protection in online environments.

Article 11 Chief Privacy Officer

The Website has appointed the following officer to handle inquiries and complaints regarding personal information.

▶ Chief Privacy Officer

• Name: Customer Service Department

• Title: Personal Information Manager

• Contact: [Enter Company Phone Number or E-mail]

Article 12 Modification of the Guideline on Personal Information Processing

This guideline shall take effect on March 26, 2026. Any changes will be announced via notices at least seven (7) days prior to the effective date.