Privacy Policy

ADAM COMPANY
PRIVACY POLICY
Effective Date: 2026.06.01
Adam Company Co., Ltd. (the “Company”, “we,” “us,” or “our”) is committed to protecting your privacy and personal information. This Adam Company Privacy Policy (this “Privacy Policy”) explains how we collect, use, disclose, and safeguard your personal information when you access or use our Services, in compliance with Applicable Laws, including the Personal Information Protection Act (the “PIPA”) of the Republic of Korea.
Please read this Privacy Policy carefully. If you do not agree to all provisions of this Privacy Policy, you may not access or use any of the Services.
The Company may provide a separate privacy policy applicable to Users in the Republic of Korea. In such case, the local privacy policy shall prevail over this Privacy Policy to the extent of any conflict or inconsistency.
Any capitalized terms used but not defined in this Privacy Policy shall have the meaning ascribed to such terms under the Adam Company Master Terms of Service (the “Master Terms”) or any applicable Supplemental Terms or Policies of the Company.
PURPOSE OF PROCESSING PERSONAL INFORMATION
We process personal information solely for the following purposes:
User Registration and Account Management.
Account creation and authentication
identity verification
prevention of fraudulent or unauthorized use
Provision of Services.
order processing, payment, and delivery
operation of the Website and Services
account and transaction management
Ambassador Program Operation.
eligibility verification and approval
attribution of transactions
calculation, validation, and allocation of Points
fraud detection and enforcement
User Support.
responding to inquiries, complaints, and requests
Marketing and Communications.
sending promotional information (subject to consent where required)
Compliance and Legal Enforcement.
compliance with Applicable Laws
dispute resolution and enforcement of Terms
LEGAL BASES FOR PROCESSING PERSONAL INFORMATION
We rely on the following legal bases (each, a “Legitimate Ground”):
consent of the data subject, in accordance with Subparagraph 15①1 of PIPA
necessity for performance of a contract (e.g., Master Terms, Ambassador Terms), in accordance with Subparagraph 15①4 of PIPA
compliance with legal obligations;
legitimate interests, including:
fraud prevention,
Service improvement,
enforcement of contractual rights.
You may withdraw consent at any time. Such withdrawal does not affect prior lawful processing.
PERSONAL INFORMATION PROCESSED
We collect and use your personal information only to the extent necessary for the provision of our Services:
Personal Information Processed Without Separate Consent.
Regarding All Members
USER REGISTRATION
Legal Basis: necessity for contractual performance under Subparagraph 15①4 of PIPA
Purpose: identity verification and confirmation of intent to register as Member
Personal Information Processed: 
Name
Account ID, password
Email address
Phone number
Retention Period: until withdrawal of membership, after which the information is destroyed without delay unless a Legitimate Ground applies
PURCHASE, PAYMENT, DELIVERY, RETURNS, AND REFUNDS
Legal Basis: necessity for contractual performance under Subparagraph 15①4 of PIPA
Purpose: processing orders, payments, delivery, returns, and refunds
Personal Information Processed: 
Order information: Account ID, name, email address, phone number
Recipient information: name, address, phone number
Payment information: payment method, transaction identifier
Refund information: bank name, account number, account holder name
Retention Period: five (5) years under Subparagraph 6①3 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce of the Republic of Korea
CUSTOMER SUPPORT
Legal Basis: necessity for contractual performance under Subparagraph 15①4 of PIPA
Purpose: handling inquiries, complaints, and dispute resolution
Personal Information Processed:
Name
Account ID, password
Email address
Phone number
Inquiry details
Records of complaints and dispute resolution results
Retention Period: three (3) years under Subparagraph 6①4 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce of the Republic of Korea
Regarding Ambassadors 
AMBASSADOR PROGRAM OPERATION
Legal Basis: necessity for contractual performance necessity for contractual performance under Subparagraph 15①4 of PIPA;  compliance with Applicable Laws regarding tax reporting under Subparagraph 15①2 of PIPA and Articles 127, 164 of the Income Tax Act of the Republic of Korea 
Purpose: operation of the Ambassador Program, including Code tracking, verification of Qualified Transactions, Attribution of eligible purchases, accrual and management of Points, cash settlement processing, tax compliance, fraud prevention, and related recordkeeping
Personal Information Processed: 
Common: name, address, bank account number, settlement history, and payment records
For individuals without business registration: tax identification number, date of birth, nationality, only to the extent required under Applicable Laws or applicable tax treaties
For registered business operators: corporate name, representative person’s name, tax identification number, tax invoice email address, only to the extent required under Applicable Laws or applicable tax treaties
Retention Period: five (5) years under Subparagraph 6①3 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce of the Republic of Korea
Regarding Non-Member Users
PURCHASE, PAYMENT, DELIVERY, RETURNS, AND REFUNDS
Legal Basis: necessity for contractual performance under Subparagraph 15①4 
Purpose: processing orders, payments, delivery, returns, and refunds
Personal Information Processed:
Order information: name, email address, phone number, 
Recipient information: name, address, phone number
Payment information: payment method, transaction identifier
Refund information: bank name, account number, account holder name
Retention Period: five (5) years under Subparagraph 6①3 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce of the Republic of Korea
RETENTION OF PERSONAL INFORMATION
We retain your personal information only for the period necessary to fulfill the purposes described in this Privacy Policy or for the period to which you consented at the time of collection, unless a longer retention period is required or permitted under Applicable Laws. To clarify, we may retain personal information beyond the original retention period where necessary to:
comply with legal obligations;
respond to investigations or inquiries related to violations of Applicable Laws;
resolve outstanding debts or claims arising from your use of the Services; or
fulfill other legitimate purposes recognized under Applicable Laws.
In the above cases, personal information will be retained solely for the relevant purposes and only to the extent necessary. Where retention is required beyond the original purpose, such data will be stored separately and managed with appropriate safeguards.
Once the applicable retention period has expired or the relevant purpose has been fulfilled, we will securely destroy the personal information without undue delay in accordance with this Privacy Policy.
PERSONAL INFORMATION PROTECTION
We take the following measures to ensure the security and integrity of Personal Data in accordance with Article 29 of PIPA:
Administrative Measures. Establishment and implementation of internal management plans, supervision and training of personnel handling Personal Data, designation of a privacy officer, and regular employee training
Technical Measures. Access control for Personal Data processing systems, secure storage of access logs, encryption of Personal Data, and regular installation and updates of security programs
Physical Measures. Access control for server rooms, data storage rooms, and other restricted areas
DESTRUCTION OF PERSONAL INFORMATION
We promptly destroy personal information without delay when the retention period has expired or the purpose of processing has been achieved, and the personal information is no longer necessary.
If retention is required under Applicable Laws after the consented retention period expires or the processing purpose is fulfilled, the personal information will be stored and managed separately from other personal information.
The procedures and methods for the destruction of personal information are as follows:
Destruction Procedure. We identify the personal information for which a reason for destruction has arisen and proceed with destruction upon approval from our Privacy Officer, as identified below. 
Destruction Method.
Personal information recorded or stored in electronic format is permanently deleted using a method that renders the records unrestorable.
Personal information in paper format is destroyed by shredding or incineration.
THIRD-PARTY TRANSFER OF PERSONAL INFORMATION
We process your personal information only for the purposes of processing specified in this Privacy Policy and disclose it to third parties solely in the following cases, as permitted under Articles 17 and 18 of PIPA:
with your separate consent;
where required by Applicable Laws; or
where clearly necessary to protect you or a third party from imminent risk to life, body, or property.
ENTRUSTMENT OF PROCESSING
The Company may entrust the processing of personal information to third-party service providers for payment processing and related services as follows:

┌─ [표] ─────────────────────────────────
│ Service Providers | Scope of Entrusted Processing
│ KG Inicis Co., Ltd.,  Toss Payments Co., Ltd.,  Naver Financial Co., Ltd.,  Kakao Pay Corp. | Payment Processing
│ Korea Post | Delivery of Products
└────────────────────────────────────────

In accordance with Article 26 of PIPA, we will disclose in this Privacy Policy any entrustment of personal information processing, including the entrusted party, assigned tasks, and any subsequent changes.
If and when we entrust personal information processing, we specify in writing the obligations of the entrusted party in accordance with Article 26 of PIPA, including purpose limitation, security safeguards, sub-entrustment restrictions, supervision, and liability. We also monitor entrusted parties to ensure the secure handling of personal information.
If there are any changes to the entrusted tasks or service providers, the Company will disclose such changes in this Privacy Policy without undue delay.
Entrustment involving the overseas transfer of personal information, if any, is not covered in this provision and will be addressed separately in another provision of this Privacy Policy.
OVERSEAS TRANSFER OF PERSONAL INFORMATION
Upon your separate consent, we make the following overseas transfer of your personal information. You may refuse such transfer or withdraw your consent at any time, including by terminating your membership; however, in such case, you may not be able to access or use all or part of the Services. 

┌─ [표] ─────────────────────────────────
│ Transferee | Amazon Web Services, Inc.
│ Legal Grounds | Art. 26, Subpara. 28-1①3 of PIPA
│ Information Transferred | all personal information necessary for the provision and operation of the Services.
│ Destination of Transfer | Personal information may be processed at AWS data centers located in the United States, the European Union, and the Asia-Pacific regions. For the latest information regarding the names of the countries and/or territories where such data centers are located, please refer to https://aws.amazon.com/about-aws/global-infrastructure/ .
│ Time and Manner of Transfer | Personal information is transferred on a real-time or near-real-time basis via automated, encrypted network connections upon your use of the Services.
│ Purpose of Transfer | To operate, store, and manage the cloud infrastructure required for the delivery, security, and performance of the Services.
│ Retention Period | Transferee retains your personal information until (i) you withdraw your consent, (ii) termination of the service agreement between the Company and the Transferee, or (iii) as otherwise required under Applicable Laws.
└────────────────────────────────────────

┌─ [표] ─────────────────────────────────
│ Transferee | Airwallex (Hong Kong) Limited
│ Legal Grounds | Art. 26, Subpara. 28-1①3 of PIPA
│ Information Transferred | name, bank account number, email address.
│ Destination of Transfer | Singapore, Belgium, the Netherlands, Japan, Australia, Malaysia, United States
│ Time and Manner of Transfer | transmitted via network each time a cash settlement of Points is processed
│ Purpose of Transfer | to process cash settlement of Points for Ambassador Members; accordingly, cash settlement of Points will not be available upon withdrawal of consent
│ Retention Period | five (5) years pursuant to Subparagraph 6①3 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce of the Republic of Korea
└────────────────────────────────────────

┌─ [표] ─────────────────────────────────
│ Transferee | Mailchimp (Contact: privacy@mailchimp.com)
│ Legal Grounds | Art. 26, Subpara. 28-1①3 of PIPA
│ Information Transferred | name, email address.
│ Destination of Transfer | United States
│ Time and Manner of Transfer | transmitted via network each time the Services are used.
│ Purpose of Transfer | for email delivery services.
│ Retention Period | Transferee retains your personal information until (i) you withdraw your consent, (ii) termination of the service agreement between the Company and the Transferee, or (iii) as otherwise required under Applicable Laws.
└────────────────────────────────────────

┌─ [표] ─────────────────────────────────
│ Transferee | SendGrid (Contact: datasubjectrequests@sendgrid.com)
│ Legal Grounds | Art. 26, Subpara. 28-1①3 of PIPA
│ Information Transferred | name, email address.
│ Destination of Transfer | United States
│ Time and Manner of Transfer | transmitted via network each time the Services are used.
│ Purpose of Transfer | for email delivery services.
│ Retention Period | Transferee retains your personal information until (i) you withdraw your consent, (ii) termination of the service agreement between the Company and the Transferee, or (iii) as otherwise required under Applicable Laws.
└────────────────────────────────────────

┌─ [표] ─────────────────────────────────
│ Transferee | Shopify Inc.
│ Legal Grounds | Art. 26, Subpara. 28-1①3 of PIPA
│ Information Transferred | name, email address, contact information, order information, Service usage records
│ Destination of Transfer | Canada
│ Time and Manner of Transfer | transmitted via network each time the Services are used.
│ Purpose of Transfer | for database storage, e-commerce platform hosting, and maintenance.
│ Retention Period | Transferee retains your personal information until (i) you withdraw your consent, (ii) termination of the service agreement between the Company and the Transferee, or (iii) as otherwise required under Applicable Laws.
└────────────────────────────────────────

We supervise the transferees above to ensure that your personal information is processed securely and in compliance with Applicable Laws and our Policies. If there are any changes to the transferees or the details of their personal information processing, we will notify you in advance through this Privacy Policy or other appropriate means.
Should there be any changes in the future regarding the overseas transfer of your personal information, we will notify you in advance and obtain your separate consent in accordance with Applicable Laws.
DATA SUBJECT RIGHTS
You can exercise your rights over your personal information at any time, including the rights to access, correct, object to, or request an explanation of any automated decision-making.
You have the right to request deletion or suspension of processing regarding your personal information, unless retention is necessary for a Legitimate Ground. Upon your request to delete your Account, we will delete your personal information collected within thirty (30) days of receiving the request, provided that no Legitimate Ground applies. 
You have the right to limit the use and disclosure of your sensitive personal information, if any, to what is necessary to perform the Services, as reasonably expected by an average consumer requesting services of such nature.
You have the right to restrict our processing of your Personal information when:
the accuracy of your personal information is contested;
the processing is unnecessary or unlawful, but you prefer not to have your personal information deleted, whether for the establishment, exercise, or defense of legal claims, or for any other reason; or
the verification of any Legitimate Grounds for retaining your personal information despite your objection is pending.
Despite any Legitimate Ground for our processing your personal information, you have the right to object to such processing unless we demonstrate a compelling Legitimate Ground. Notwithstanding, you have the right to object at any time to our processing of your personal information for direct marketing purposes.
You have the right to opt-out of any sale or sharing of your personal information with a third party for cross-context behavioral advertising. To clarify, we do not engage in any sale or sharing of your personal information.
You have the right to request that we transfer your personal information collected to another organization or directly to you, under certain conditions.
You have the right not to be discriminated against for exercising any of the rights listed under this Article, provided that the unavailability of our Services that require the processing of your personal information, which has been restricted or deleted as a result of exercising such rights, shall not be deemed discrimination.
You are entitled to withdraw your consent to our processing of your personal information at any time. However, withdrawing your consent will not affect the lawfulness of any processing conducted before the withdrawal. We may retain your personal information collected before the withdrawal if it is necessary based on any Legitimate Grounds.
You can exercise the above rights by submitting a request in writing, by email, or by fax, and we will respond without undue delay.
You can exercise the above rights through a legal representative or an authorized agent by submitting a legitimate power of attorney.
Your rights to access or suspend the processing of personal information may be restricted under Paragraphs 35④ and 37② of PIPA. You may not request deletion of personal information if its collection is mandated by the Applicable Laws.
We reserve the right to verify whether the person requesting the exercise of the above rights is the data subject or a duly authorized representative or delegate.
AUTOMATIC COLLECTION AND OPT-OUT
Automatic Collection. When you access or use the Services, we automatically collect the following information to ensure secure operation, improve functionality, and enhance User experience:
Device Information: IP address, browser type and version, operating system, device type, and screen resolution
Usage Information: pages visited, links clicked, time spent, referral sources, search terms
Technical Information: Cookies, Session data, JavaScript settings, plugins
Location Information: approximate geographic location based on IP address
Cookies. We use cookies to provide login functionality and operate other features of the Services as follows:
Essential Cookies
Purpose: Website functionality and security
Examples: Session management, authentication
Can be disabled: No (required for Service operation)
Analytics Cookies
Purpose: Website performance and usage analysis
Examples: Google Analytics, heatmap tools
Can be disabled: Yes (through browser settings or our cookie preferences)
Functional Cookies
Purpose: Enhanced user experience
Examples: Language preferences, personalization
Can be disabled: Yes (may affect functionality)
Marketing Cookies
Purpose: Personalized advertising and marketing
Examples: Social media pixels, advertising networks
Can be disabled: Yes (through cookie preferences)
User Control and Opt-Out. You can control cookies through:
Browser Settings: most browsers allow you to refuse or delete cookies
Cookie Preference Center: available on the Website
Third-Party Opt-Outs: direct opt-out links for advertising networks
Please note that disabling certain cookies may limit Website Functionality.
Sessions. Sessions are necessary for secure access to the Services and are automatically created upon connecting to our servers. These cannot be disabled.
Assistance. For more information regarding automatic collection of personal information and ways to opt out, please contact our Privacy Officer.
CHILDREN’S PRIVACY
We do not knowingly process personal information of children below the age requiring parental consent under Applicable Laws.
Where required:
Legal guardian’s consent must be obtained;
verification may be requested.
PRIVACY OFFICER AND CONTACT
The following person is appointed as our privacy officer (“Privacy Officer”), responsible for handling inquiries and complaints regarding personal information processing, as well as remedies and other associated matters: 
Name: jeonyedam
Title: Representative Director
Email: support@adamthefirstsin.com
Telephone: 070-8098-2521
We are currently evaluating the applicability of Article 27 of the General Data Protection Regulation regarding the designation of a European Union representative. Where legally required, we will appoint a representative and update this Privacy Policy accordingly. Until then, please contact our Privacy Officer with any inquiries.
REMEDIES FOR PRIVACY INFRINGEMENT
If you need further assistance regarding personal information infringements, you can contact Korea Internet & Security Agency's Personal Information Infringement Reporting Center, Korean National Policy Agency Cyber Safety Bureau, and other relevant institutions. For calls originating from outside Korea, dial the international calling code and the country code of Korea (82) before the numbers below:
Personal Information Infringement Reporting Center: (without area code) 118 ( https://privacy.kisa.or.kr )
Personal Information Dispute Mediation Committee: (without area code) 1833-6972 ( https://kopico.go.kr )
Supreme Public Prosecutors' Office Cyber CID: 1301 (without area code) ( https://cybercid.spo.go.kr )
National Police Agency Cyber Safety Bureau: (without area code) 182 ( https://ecrm.cyber.go.kr )
For residents outside Korea, if you wish to report a complaint or if you feel that we have not addressed your concern in a satisfactory manner, you can contact your local data protection authority. The following are examples of relevant authorities in certain jurisdictions:
European Union
Your local Data Protection Authority
European Data Protection Board (https://edpb.europa.eu/) 
United Kingdom
Information Commissioner's Office (https://ico.org.uk/) 
United States
Federal Trade Commission (https://www.ftc.gov/) 
MISCELLANEOUS
Changes. This Privacy Policy may be updated in accordance with changes in Applicable Laws or our Policies. Any revisions will be publicly announced on the Website, specifying the effective date and the reason for the change. You will be provided with an opportunity to review the revised Policy before deciding if you would like to continue using the Services. 
Governing Law and Dispute Resolution. Any dispute arising out of or in connection herewith shall be governed by, and resolved in accordance with, the governing law and dispute resolution provisions set forth in the Master Terms, mutatis mutandis, unless otherwise required by Applicable Laws.
Governing Language. This Privacy Policy may be translated into other languages for reference and convenience. In the event of any conflict or inconsistency between the different versions, the English version shall prevail and govern.
Version. This Privacy Policy is the initial version, and there are no previous versions.