In accordance with Article 30 of the Personal Information Protection Act, Korilaboots establishes and discloses the following personal information processing policy to protect the personal information of information subjects and to promptly and smoothly handle grievances related thereto.


Article1(Purpose of Processing Personal Information)

Korilla Boots (hereinafter referred to as the “Company”)processes personal information for the following purposes. The personal information processed will not be used for any purpose other than the following purposes, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Sign up and manage homepage members

Personal information is processed for the purpose of confirming the intention to join the membership, identifying and authenticating the person in accordance with the provision of membership services, maintaining and managing membership, preventing unauthorized use of services, providing various notices and notifications, and handling grievances.

2. Providing goods or services

We process personal information for the purpose of delivering goods, providing services, sending contracts and invoices, providing content, providing customized services, identification, age verification, payment and settlement, and debt collection.

3. Grievances

Personal information is processed for the purpose of identifying the identity of the complainant, verifying the complaint, contacting and notifying the complainant for fact-finding, and notifying the result of processing.


Article 2(Processing and Retention Period of Personal Information)

① The Company shall process and retain personal information within the period of retention and use of personal information in accordance with the laws and regulations or the period of retention and use of personal information agreed upon when collecting personal information from the information subject.

② The processing and retention period of each personal information is as follows.

1. Homepage membership registration and management: until withdrawal from the business/organization website

However, if any of the following reasons apply, you may be able to use the

1) In the case of an ongoing investigation or investigation for violation of relevant laws and regulations, etc.

2) If a debt or debt relationship remains due to the use of the website, until the debt or debt relationship is settled.

2. Provision of goods or services: until the completion of the supply of goods and services and payment and settlement of fees

However, if any of the following circumstances apply, you may be able to use the

1) Records of transactions such as display, advertisement, contract contents and performance in accordance with the Act on Consumer Protection in Electronic Commerce, etc.

– Records on display and advertising: 6 months

– Records of contract or subscription withdrawal, payment, supply of goods, etc.: 5 years

– Records of consumer complaints or dispute handling: 3 years

2) Retention of communication factual verification data in accordance with the Protection of Communications Secrets Act

– Subscriber telecommunication date, start and end time, other subscriber number, usage level, sending base station location tracking data: 1 year

– Computer communication, Internet log data, access point tracking data: 3 months


Article3(Provision ofpersonal informationto third parties)

① The Company processes the personal information of the information subject only within the scope specified in Article 1 (Purpose of Processing Personal Information), and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as the consent of the information subject or special provisions of the law.

② The Company does not provide your personal information to third parties.
However, if otherwise provided by law, it may be provided in accordance with relevant laws and regulations upon request by investigative agencies and related organizations.


Article4(Consignment ofPersonal Information Processing)

① The Company entrusts personal information processing as follows to ensure smooth personal information processing.

1. Payment processing and financial transactions
– The entrusted party (trustee): TOSPAYMENTS Co.
– Contents of entrusted business: Payment authorization and processing, payment history verification

2. Product delivery and logistics management
– Consignee (consignee): CJ Logistics, Rosen Courier, Post Office Courier, and other affiliated courier companies
– Contents of entrusted business: delivery of goods, return/exchange processing, delivery tracking

3. Provision of notification service
– The entrusted person (trustee): Kakao
– Contents of the entrusted work: Sending notification talk messages such as order confirmation, payment completion, delivery status information, etc.

② When entering into an outsourcing contract, the Company specifies in documents such as contracts the prohibition of processing personal information other than for the purpose of performing outsourced tasks, technical and administrative protection measures, restrictions on re-consignment, management and supervision of the outsourcer, and liability for damages in accordance with Article 26 of the Personal Information Protection Act, and supervises whether the outsourcer handles personal information safely.

③ If the contents of the consignment or the trustee change, we will disclose it through this privacy policy without delay.


Article 5(Rights, dutiesand exercise methods ofinformation subjects and legal representatives)

The customer (information subject) may request the Company to view, correct, delete, or suspend the processing of his/her personal information at any time. The Company will take prompt action in accordance with relevant laws and regulations after receiving such a request.

② Pursuant to Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, the customer may request the exercise of rights related to personal information in writing, by e-mail, or by facsimile transmission (FAX). The Company will process the request without delay after confirming it, and additional verification procedures may be required depending on the request.

③ If it is difficult for you to exercise your rights directly, you may also make a request for personal information through your legal representative or authorized representative. In this case, you must submit a **Power of Attorney (form in Appendix No. 11)** as stipulated in the Notification on the Method of Handling Personal Information (No. 2020-7) and provide proof that you are a legitimate representative.

④ Pursuant to Articles 35(4) and 37(2) of the Personal Information Protection Act, we may limit some requests to access and stop processing personal information. For example, a request may be denied if the requested information is legally required to be kept, or if it is likely to infringe on the rights and interests of others.

⑤ If the correction and deletion of personal information you request is subject to collection under other laws, we may not be able to delete it immediately because we must keep the information for the period required by those laws.

⑥ The Company will take action on your request to access, correct, delete, or suspend the processing of your personal information after verifying whether you are the person or your authorized representative. For this purpose, we may request identification, or in the case of a representative, a power of attorney and supporting documents.

第6條(Items of Personal Information Processed)

We collect and process the following items of personal information to provide our services and comply with our legal obligations.

1. Sign up and manage your membership on our website
We collect the minimum information necessary for you to sign up as a member and use the Services.

-Required: full name, date of birth, username, password, address, phone number, email address

2. provide goods or services
collects personal information in the course of a customer’s purchase of goods or use of services to facilitate payment and delivery processing.

-Required: full name, username, password, address, phone number, email address, payment information (credit card number, bank account information)

3. handling customer consultation and inquiries
When you make an inquiry or request for consultation, we collect personal information to facilitate the process.

-Required: Full name, contact information (phone number or email), and the nature of your inquiry to
-Optional: Order history (for inquiries related to orders)

4. Provide Kakao Notification Service
We collect the necessary information to send you notifications about your order and delivery via Kakao Notification Talk.

-Required: name, phone number, order history

5. Information automatically generated and collected in the process of using Internet services
The Company may collect information automatically generated in the process of using the Website and mobile services.

Collected items: IP address, cookies, MAC address, service usage history, visit history


Article7(Destruction of Personal Information)

① The Company will destroy personal information without delay when the retention period for personal information has expired or when the purpose of processing has been fulfilled and the personal information is no longer needed.

② However, if the Company is required to retain personal information for a certain period of time as prescribed by law, even if the period of retention of personal information agreed to by the customer has elapsed or the purpose of processing has been fulfilled, the Company shall transfer the information to a separate database (DB) or separate the storage location and keep it safe.

• Legal basis: Act on Consumer Protection in Electronic Commerce, etc., National Taxation Act, Commercial Code, etc.
• What personal information we keep: account information, transaction history, and payment history

③ The procedures and methods for destroying personal information are as follows.

1. Destruction Procedures

The Company will select the personal information for destruction and destroy the personal information with the approval of the Company’s Privacy Officer.

2. Destruction methods

The Company destroys personal information recorded and stored in the form of electronic files so that the records cannot be reproduced, and destroys personal information recorded and stored in paper documents by shredding or incineration.


Article8(Measures to secure the safety of personal information)

The Company takes the following measures to ensure the safety of personal information.

1. Administrative measures: establishment and implementation of internal management plans, regular employee training, etc.
2. Technical measures: management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, and installation of security programs
3. Physical measures: Access control to computer labs, archives, etc.

Article9(Installation, Operation, and Rejection ofAutomatic Personal Information Collection Devices)

①The Company uses ‘cookies’ to store and retrieve usage information from time to time to provide individualized customized services to users.

Cookies are small amounts of information sent to the user’s computer browser by the server (http) used to operate the website and are stored on the hard disk of the user’s PC computer.

A. Purpose of use of cookies: Cookies are used to provide optimized information to users by identifying the type of visit and use of each service and website visited by users, popular search terms, secure connection, etc.

I. Installation, operation and rejection of cookies: You can reject the storage of cookies through the tools at the top of your web browser>Internet Options>Privacy menu option setting.

D. If you refuse to save cookies, you may experience difficulties in using our personalized services.


第10條(Privacy Officer)

① The Company is responsible for the overall handling of personal information, and designates a person in charge of personal information protection as follows to handle complaints and damage relief from information subjects related to the handling of personal information.

Privacy Officer

Full Name: Ascension

Job Title: Acting

Contact: 010-5596-9027

② The information subject may inquire about all personal information protection-related inquiries, complaints, damage relief, etc. arising from the use of the Company’s services (or business) to the person in charge of personal information protection and the department in charge. The Company will respond to and handle inquiries from the information subject without delay.


第11條(Remedies for Infringement of Rights)

The information subject may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center of the Korea Internet & Security Agency to receive relief from personal information infringement. For other reports and consultations on personal information infringement, please contact the following organizations.

1. Personal Information Dispute Mediation Committee: (without area code) 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Report Center: (without area code) 118 (privacy.kisa.or.kr)
3. General Prosecutor’s Office: 1301 (without area code) (www.spo.go.kr)
4. National Police Agency: 182 (without area code) (cyberbureau.police.go.kr)

“A person whose rights or interests have been infringed by an action or omission taken by the head of a public institution in response to a request pursuant to the provisions of Articles 35 (Access to Personal Information), 36 (Correction and Deletion of Personal Information), and 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may file an administrative appeal in accordance with the Administrative Appeals Act.

For more information about administrative appeals, please visit the website of the Central Administrative Appeals Commission (www.simpan.go.kr).

第12條(Duty of Notice)

If we modify our Privacy Policy due to changes in law, policy, or security technology, we will provide notice of the changes at least seven (7) days beforethey become effective. However, if we make any material changes, we will provide a clearer notice in advance.

Butchick

①Date of announcement: February 17, 2025

Implementation date: February 17, 2025