Wishtrade B2B Web Catalog Privacy Policy

This English translation is provided for reference only and is not legally binding. Only the Korean version of this Policy is legally binding.

Wishcompany Co., Ltd. (the “Company”) complies with the Personal Information Protection Act and other applicable laws and regulations to protect personal information and manages personal information securely. In accordance with Article 30 of the Personal Information Protection Act, the Company establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for processing and protecting their personal information and to handle related complaints promptly and smoothly.

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. Personal information is not used for any purpose other than those listed below, and where the purpose of use changes, the Company will take necessary measures, including obtaining separate consent as required by applicable law.

1. 1.Membership Registration and Management: Verifying membership eligibility (business status), identity confirmation, member identification and authentication, maintaining and managing membership status, sanctions against members who violate laws or the Terms and Conditions, and provision of notices and notifications.
2. 2.Order Processing and Contract Performance: Receiving and confirming orders, forming and performing contracts, supplying and shipping Goods, invoicing and payment settlement, processing returns and exchanges.
3. 3.Service-Related Consultation: Handling customer inquiries and complaints.
4. 4.Marketing and Sales Activities: Sending marketing information regarding new products, promotions, and events; providing information about new services; contacting prospective business partners for business development and sales activities; providing personalized information — such as restock or discount notifications — based on behavioral data generated while using the Service, including items added to shopping carts and viewed products; and statistical analysis for understanding market trends — personal information is processed for these purposes only where the data subject's separate consent has been obtained.
5. 5.Service/Site Operation and Improvement: Analyzing service usage records, monitoring access frequency, correcting service errors, and preventing fraudulent use.

Article 2 (Items of Personal Information Processed)

1. 1.Personal Information Processed Without the Data Subject’s Consent

   The Company processes the following items of personal information without the data subject’s consent pursuant to Article 15(1)4 and Article 15(1)6 of the Personal Information Protection Act.

   Membership Registration and Management:

   Classification	Category	Items
   Required	Company/business	Trade name and company name; business registration number; VAT number (if any); business commencement date (year, month and day); address; business type; country; sales currency; sign-up source; name of representative; representative’s date of birth (for sole proprietors); business registration certificate.
   	Contract person	Name; job title; telephone number; email address (user ID).
   Optional	Website URL; sales volume; end sales channels; information on brands handled.

   Order Processing and Contract Performance: Shipping address; recipient information (contact person’s name and contact information); payment-related information (name of remitter).

   Product Delivery: Trade name; shipping address; recipient information (name and contact information).

   Service-Related Consultation: Trade name; name of representative; name of contact person; contact person’s email address; contact person’s telephone number.

   Prevention of Fraudulent Use: User ID, name, email address and contact information associated with detected fraudulent activity; records of fraudulent activity; CI (connecting information).

   Service/Site Operation and Improvement: Service usage records; visit history; access IP address; cookies; browser type; mobile device information (app version, operating system type and device identifier); session identifiers; referral source information; and content viewing, search and click history.

2. 2.Personal Information Processed with the Data Subject’s Consent

   The Company processes the following personal information with the data subject’s consent pursuant to Article 15(1)1 of the Personal Information Protection Act.

   Personalized Advertising and Marketing: Trade name; name of representative; name of contact person; contact person’s email address; contact person’s telephone number; business address.

3. 3.Under Article 2(1) of the Personal Information Protection Act, personal information means information relating to a living individual. Accordingly, information relating to corporations or organizations generally does not constitute personal information. Where a member is a corporate business, its trade name, business registration number, address and similar information do not constitute personal information; however, such information may constitute personal information where the member is a sole proprietor. The Company therefore discloses the information it collects as described above to protect members’ right to know.

Article 3 (Methods of Collecting Personal Information)

1. 1.Information the data subject directly enters during membership registration and order submission.
2. 2.Information automatically generated through cookies and similar tools while using the Site.
3. 3.Information collected during consultations through customer service channels.

Article 4 (Operation of Cookies and Opt-Out)

1. 1.The Company may use cookies to provide customized services to Members. A cookie is a small amount of information sent by the web server operating the Site to a Member's browser, and may be stored on the Member's hard disk.
2. 2.The Site is operated on the Shopify platform, and cookies and behavioral-data collection tools may be used for shopping cart persistence, visit analytics, and personalized marketing such as restock or discount notifications.
3. 3.Members may choose whether to allow cookies and may refuse cookie storage through their browser settings. However, refusing cookies may make certain features of the Service difficult to use.

   [How to block cookies in desktop web browsers]

   - Chrome: Select “⁝” in the upper-right corner of the browser > New Incognito Window (keyboard shortcut: Ctrl+Shift+N).

   - Edge: Select “…” in the upper-right corner of the browser > New InPrivate Window (keyboard shortcut: Ctrl+Shift+N).

   [How to block cookies in mobile browsers]

   - Chrome: Select “⋮” in the upper-right corner of the mobile browser > New Incognito Tab.

   - Safari: Mobile device Settings > Apps > Safari > Advanced > Block All Cookies.

   - Samsung Internet: Select the “Tabs” icon at the bottom of the mobile browser > Turn on Secret mode > Start.

Article 5 (Collection, Use and Provision of Behavioral Information)

1. 1.The Company collects and uses behavioral information through cookies during the use of the Service to provide data subjects with optimized personalized services and benefits, online personalized advertisements and similar offerings.
2. 2.The Company collects the following behavioral information through the Site it operates:

   Legal Basis	Items	Collection Method	Purpose	Retention and Use Period
   Article 15(1)1 of the Personal Information Protection Act (data subject’s consent)	Website visit history; shopping cart usage history; product click history	Automatically collected when visiting and using the Site	Provision of personalized services, advertisements and benefits	Until membership withdrawal

3. 3.The Company collects only the minimum behavioral information necessary for optimized personalized services and benefits and online personalized advertisements. It does not collect sensitive behavioral information that may infringe individuals’ rights, interests or privacy, such as information regarding thoughts, beliefs or medical history. The Company also does not provide personalized advertisements to children under the age of 14.

Article 6 (Retention and Use Period of Personal Information)

1. 1.The Company processes and retains personal information within the retention/use period required by law or the period consented to by the data subject at the time of collection.
2. 2.The retention period for each processing purpose is as follows:

   2-1. Membership registration and management: Until withdrawal from membership

   2-2. Order Processing and Contract Performance: Until membership withdrawal.

   2-3. Product Delivery: Until completion of delivery operations.

   2-4. Service-Related Consultation: Until membership withdrawal.

   2-5. Prevention of Fraudulent Use: Retained for one year following membership withdrawal and then destroyed.

   2-6. Service/Site Operation and Improvement: Until membership withdrawal.

   2-7. Records Relating to the Use of Marketing Information: Until the member withdraws consent or loses membership status.

3. 3.Notwithstanding Paragraph 2, where the following retention periods are prescribed by applicable law, those periods will apply:

   3-1. Records relating to contracts or withdrawal of offer: 5 years (Act on Consumer Protection in Electronic Commerce).

   3-2. Records relating to payment and supply of Goods: 5 years (Act on Consumer Protection in Electronic Commerce).

   3-3. Records relating to consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce).

   3-4. Records relating to use of indication and advertisement: 6 months(Act on the Consumer Protection in Electronic Commerce)

   3-5. Books and supporting documents for all transactions under tax laws: 5 years (Framework Act on National Taxes, Corporate Tax Act)

   3-6. Computer communications, internet log records and connection-tracing data: 3 months (Protection of Communications Secrets Act).

4. 4.Notwithstanding Paragraphs 2 and 3, the Company retains personal information until the relevant circumstances have ended in the following cases:

   4-1. Where an investigation or inquiry into a violation of applicable law is ongoing: Until completion of the relevant investigation or inquiry.

   4-2. Where outstanding claims or obligations arising from use of the Service remain: Until such claims or obligations have been settled.

Article 7 (Provision of Personal Information to Third Parties)

The Company processes data subjects' personal information only within the scope specified in Article 1, and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the data subject's consent or pursuant to a specific legal provision.

Article 8 (Outsourcing of Personal Information Processing)

1. 1.The Company outsources personal information processing as follows for the operation of the Site.

   Processor	Outsourced Task
   Shopify Inc.	Hosting for the Site (catalog/orders), order data processing, and integration with email delivery platforms
   I-Logis Co., Ltd.(주식회사 아이로지스)	B2B goods delivery and dispatch management for transportation drivers; integration with export cargo forwarders; customer support relating to delivery.
   Tooeasy Co., Ltd.(투이지 주식회사)	Site development, operation and maintenance; data storage and management.

2. 2.When entering into an outsourcing agreement, the Company specifies, in the agreement or other documentation, matters required under Article 26 of the Personal Information Protection Act — including prohibition on processing personal information for purposes beyond the outsourced task, technical and administrative safeguards, restrictions on re-outsourcing, supervision of the processor, and liability for damages — and supervises whether the processor handles personal information safely.
3. 3.In accordance with Article 26(6) of the Personal Information Protection Act, where a service provider further outsources the Company’s personal information processing tasks, the Company obtains its consent and discloses the further service provider and the details of the further-outsourced tasks through this Privacy Policy.

Article 9 (Overseas Transfer of Personal Information)

The Company transfers personal information collected from members overseas as described below and provides the following information regarding overseas transfers pursuant to Article 28-8(2) of the Personal Information Protection Act. If a member refuses the overseas transfer, the member will be unable to use the Service. Members who do not wish their personal information to be transferred overseas may withdraw their membership through the website or mobile site or request membership withdrawal through the customer service center.

Legal Basis	Items	Destination Countries	Timing and Method	Recipient	Purpose of Use	Retention Period
Article 28-8(1)3 of the Personal Information Protection Act (outsourced processing/storage)	Trade name and company name; business address; country; contact person’s name; contact person’s email address (user ID); contact person’s telephone number; business registration certificate; shipping address; order/usage information (ordered items, quantities, amounts, order numbers, access IP addresses, cookies, and usage and login records).	Canada, United States	Real-time transfer via encrypted HTTPS communications upon membership registration or during use of the Service.	Shopify Inc. (Contact: privacy.shopify.com / help.shopify.com)	Web catalog hosting; order processing; membership account management; service security and quality improvement.	Until membership withdrawal or the expiration of the retention period prescribed by applicable laws

Article 10 (Rights and Obligations of Data Subjects and How to Exercise Them)

1. 1.A data subject may exercise the following personal-information-related rights against the Company at any time:

   1-1. Requesting access to and transmission of their personal information;

   1-2. Requesting correction where there is an error;

   1-3. Requesting deletion; and

   1-4. Requesting suspension of processing.

2. 2.Under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, the rights under Paragraph 1 may be exercised in writing, by email, fax (FAX), over the internet or by similar means, and the Company will take action without delay.
3. 3.Rights may also be exercised through a legal representative or an authorized agent of the data subject. In such cases, a power of attorney in Form No. 11 annexed to the Notification on Methods of Processing Personal Information must be submitted.
4. 4.The right to request access to personal information or suspension of its processing may be restricted under Articles 35(4) and 37(2) of the Personal Information Protection Act.
5. 5.Deletion of personal information may not be requested where another law expressly requires the collection of such information.
6. 6.The Company verifies whether the person exercising a right is the data subject or a duly authorized representative.

Article 11 (Destruction of Personal Information)

1. 1.The Company, without delay, destroys personal information that has become unnecessary, such as where the retention period has elapsed or the processing purpose has been achieved.
2. 2.Where personal information must continue to be retained under another law despite the expiration of the agreed retention period or achievement of the processing purpose, the Company retains the relevant information by transferring it to a separate database (DB) or storing it in a separate location. The items retained, legal grounds and retention periods are set out in Article 6(3).
3. 3.The procedures and methods for destruction are as follows:

   3-1. Destruction Procedure: The Company identifies personal information subject to destruction and destroys it upon approval by the Company’s Personal Information Protection Officer.

   3-2. Destruction Method: Personal information stored in electronic files is deleted using technical methods that prevent recovery of the records. Personal information recorded or stored on paper is destroyed by shredding or incineration.

Article 12 (Measures to Ensure the Safety of Personal Information)

The Company implements the following measures to ensure the security of personal information:

1. Administrative Measures: Establishment and implementation of an internal management plan; regular employee training.

2. Technical Measures: Management of access rights to personal information processing systems; encryption of personal information; installation and updating of security software.

3. Physical Measures: Access controls for server rooms and similar facilities.

Article 13 (Notification and Reporting of Personal Information Breaches)

1. 1.Where the Company becomes aware that personal information has been lost, stolen, or leaked (a "Breach"), the Company notifies the affected data subjects without delay of the following matters:

   1-1. The items of personal information affected by the Breach;

   1-2. The time and circumstances of the Breach;

   1-3. Information on measures the data subject may take to minimize any resulting harm;

   1-4. The Company's response measures and remedy procedures; and

   1-5. The department and contact information the data subject may use to report any resulting harm.

2. 2.Where the Company becomes aware of a Breach, it reports the matter without delay to the Personal Information Protection Commission or the Korea Internet & Security Agency, unless an exception to the reporting requirement under applicable law applies in light of the scale of the Breach, the extent of harm, and similar factors.

Article 14 (Personal Information Protection Officer)

1. 1.The Company has designated a Personal Information Protection Officer, who is responsible for overseeing personal information processing and handling data subjects' complaints and remedies related to personal information processing, as follows.

- Personal Information Protection Officer: Hak-soon Lee (Operations Director).

- Contact (Email): harry@wishcompany.net

1. 2.Members may contact the Personal Information Protection Officer regarding any privacy-related inquiries, complaints or requests for remedies arising from their use of the Company’s services. The Company will respond to and handle members’ inquiries without delay.

Article 15 (Remedies for Infringement of Rights)

Data subjects may seek dispute resolution or consultation regarding remedies for personal information infringement from the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, and similar bodies. Inquiries regarding reporting or consultation on personal information infringement may also be directed to the following:

- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)

- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)

- Korean National Police Agency: 182 (ecrm.police.go.kr)

Article 16 (Changes to This Privacy Policy)

This Privacy Policy applies from its effective date. Where there are additions, deletions, or corrections to this Policy due to changes in law or Company policy, such changes will be announced on the Site at least 7 days before they take effect.

Article 17 (Publication and Amendment of This Privacy Policy)

The Company may amend this Privacy Policy as a result of changes in laws, the Service or other circumstances. When the Privacy Policy is amended, the Company will provide notice of the changes at least seven days in advance.

Addendum

This Policy takes effect as of October 1, 2026.

View Previous Privacy Policies

Previous versions of this Privacy Policy are available below.