BREAK SILENCE PRIVACY POLICY

브레이크 사일런스, trading as BREAK SILENCE (“BREAK SILENCE,” “we,” “us,” or “our”), processes personal data in accordance with the Personal Information Protection Act of the Republic of Korea and other applicable laws.

1. CONTROLLER INFORMATION

- Legal business name: 브레이크 사일런스
- Store name: BREAK SILENCE
- Representative: Kim In-hee (김인희)
- Business registration number: 463-26-01758
- Mail-order business registration number: 2024-경기하남-2080
- Address: 2F, 61 Gamcho-ro, Hanam-si, Gyeonggi-do 12991, Republic of Korea
- Telephone: +82-70-4155-4319
- Email: contact@break-silence.com
- Website: https://global.break-silence.com


2. PURPOSES OF PROCESSING

We process personal data for the following purposes:

a. Creating and managing customer accounts;
b. Receiving, processing, and confirming orders;
c. Processing payments, cancellations, refunds, and fraud prevention;
d. Packing, shipping, customs clearance, delivery tracking, exchanges, and returns;
e. Responding to customer inquiries and resolving complaints or disputes;
f. Maintaining the security and proper operation of the Store;
g. Sending marketing messages only where the customer has separately consented; and
h. Complying with applicable legal, accounting, tax, and regulatory obligations.


3. PERSONAL DATA WE PROCESS

3.1 Account registration

- Email address
- Password processed through the Cafe24 authentication system
- Marketing consent status, where separately selected

3.2 Orders and delivery

- Customer name
- Email address
- Telephone or mobile number
- Recipient name
- Shipping address, postal code, country, and region
- Recipient telephone number
- Order number, purchased items, options, quantity, price, and order status
- Delivery, exchange, return, and refund information
- Customs or import information where required by the destination country or carrier

3.3 Payments

- Payment method
- Payment amount
- Payment approval result, transaction ID, and refund information
- Other information required by Eximbay, PayPal, a card network, card issuer, acquiring institution, or fraud-prevention provider

Full card numbers and other sensitive payment credentials are generally entered directly into the payment provider’s secure payment interface and are not stored directly by BREAK SILENCE.

3.4 Customer support

- Name, email address, telephone number, order number, inquiry details, and any information or attachments voluntarily submitted by the customer

3.5 Automatically generated information

- IP address
- Cookies
- Date and time of access
- Browser, device, operating-system, and language information
- Service-use, order, payment, security, and fraud-prevention records


4. METHODS OF COLLECTION

We collect personal data:

a. Directly from customers through registration, checkout, customer-support, return, and refund forms;
b. From payment, shipping, and platform providers to the extent necessary to perform the transaction; and
c. Automatically through cookies, logs, and similar technologies when the Store is used.


5. RETENTION PERIODS

We delete personal data when the relevant purpose has been completed, unless retention is required by law.

a. Account information: Until account deletion or withdrawal of membership
b. Marketing information: Until consent is withdrawn
c. Records of contracts, orders, and withdrawal or cancellation: 5 years
d. Records of payment and supply of Goods: 5 years
e. Records of customer complaints and dispute resolution: 3 years
f. Records concerning labels and advertising: 6 months
g. Electronic financial transaction records: For the period required by applicable law
h. Access logs and security records: For the period required by applicable law

Information retained to comply with law is kept separately and used only for the legally required purpose.


6. CHILDREN

Where Korean law applies, we obtain consent from a legal representative before knowingly processing the personal data of a child under fourteen years of age.

Where another country or region requires a higher age or additional parental consent, the applicable local requirement may also apply. A legal representative may exercise the child’s rights on the child’s behalf.


7. DISCLOSURE TO THIRD PARTIES

We do not sell personal data.

We disclose personal data to a third party only where:

a. The customer has provided consent;
b. Disclosure is necessary to perform a payment, shipping, customs, refund, or other transaction requested by the customer;
c. Disclosure is required by law or a valid request from a competent authority; or
d. Disclosure is necessary to protect an individual’s life, safety, or property as permitted by law.

Payment institutions, card issuers, card networks, PayPal, customs authorities, and destination-country authorities may process personal data independently under their own privacy policies.


8. SERVICE PROVIDERS

We use the following service providers:

8.1 Cafe24 Corp.

- Service: E-commerce hosting, Store operation, account and order management, database operation, and technical support
- Data: Account, order, customer-support, and technical log information
- Retention: Until completion of the relevant purpose or termination of the service agreement, subject to legal retention requirements

8.2 Eximbay Co., Ltd.

- Service: Global payment processing, payment authentication, fraud prevention, cancellation, and refund
- Data: Customer name, email, telephone number, IP address, purchased-item information, payment amount, transaction information, device information, and payment data required for the selected payment method
- Retention: According to electronic-financial-transaction and e-commerce laws and Eximbay’s Privacy Policy
- Privacy information: https://www.eximbay.com/privacy.do

8.3 PayPal and the card/payment provider selected by the customer

- Service: Payment authorization, settlement, fraud prevention, cancellation, and refund
- Data: Customer and transaction data required to complete the selected payment
- Retention: According to the provider’s privacy policy and applicable law

8.4 FASTBOX, Korea Post/EMS, and the postal or parcel carrier actually used for the order

- Service: Export handling, international shipping, customs support, tracking, delivery, exchange, and return collection
- Data: Customer or recipient name, address, country, postal code, telephone number, order and item information, and customs information where required
- Retention: Until delivery or return is completed, subject to legal retention requirements

The actual payment or shipping provider used for an order can be confirmed at checkout, in the payment receipt, shipment notice, or tracking information.


9. CROSS-BORDER TRANSFERS

Because BREAK SILENCE provides international payment and shipping, personal data may be transferred to a country outside the Republic of Korea.

9.1 Global payments

- Recipient: The card network, card issuer, acquiring institution, PayPal entity, payment partner, or fraud-prevention provider used for the selected payment, including Visa, Mastercard, American Express, Discover, and PayPal where applicable
- Destination country: The country in which the relevant payment provider, issuer, acquirer, network, or fraud-prevention system is located. The specific provider is identified at checkout or in the payment receipt.
- Data transferred: Name, email, telephone number, billing and transaction information, purchased-item information, payment amount, IP address, device information, and payment credentials required by the provider
- Timing and method: At payment, authentication, cancellation, or refund, through encrypted electronic communications or secure API connections
- Purpose: Payment authorization, settlement, fraud prevention, cancellation, refund, and legal compliance
- Retention: According to the recipient’s privacy policy and applicable financial and e-commerce laws

Eximbay may make further cross-border transfers to global payment providers as described in Eximbay’s current Privacy Policy:
https://www.eximbay.com/privacy.do

9.2 International shipping

- Recipient: FASTBOX, Korea Post/EMS, customs authorities, and the postal or parcel carrier in the destination country
- Destination country: The shipping destination selected by the customer
- Data transferred: Recipient name, address, postal code, country, telephone number, order and item information, value of Goods, and customs information where required
- Timing and method: When the order is prepared and shipped, through the carrier’s secure system, shipping label, customs declaration, or electronic data interface
- Purpose: Export processing, customs clearance, transportation, delivery, tracking, exchange, and return
- Retention: Until delivery or return is completed and for any additional period required by customs, postal, or other applicable law

9.3 Right to object

A customer may decline a cross-border transfer by not using the relevant international payment or shipping service and by contacting us before placing an order.

Because cross-border payment and shipping are necessary to fulfil an international order, refusing the required transfer may prevent us from accepting or delivering the order.


10. DELETION OF PERSONAL DATA

When personal data is no longer required, we delete it without undue delay.

Electronic records are deleted using methods designed to prevent restoration. Paper records are shredded or otherwise securely destroyed.

Where retention is required by law, the relevant data is separated from active data and used only for the required purpose.


11. RIGHTS OF DATA SUBJECTS

Subject to applicable law, customers may request:

a. Access to their personal data;
b. Correction of inaccurate data;
c. Deletion of personal data;
d. Restriction or suspension of processing;
e. Withdrawal of consent;
f. Account deletion; and
g. Information about disclosures and cross-border transfers.

Requests may be submitted by email or telephone. We may request reasonable information to verify the identity and authority of the requester.

Where a correction is requested, we will not use or disclose the disputed information until the correction is completed, unless otherwise permitted by law.

Some rights may be limited where retention or processing is required by law or where fulfilling the request would infringe the rights of another person.


12. SECURITY

We take reasonable administrative, technical, and physical measures to protect personal data, including:

a. Limiting personnel and access rights;
b. Encryption and secure communications where appropriate;
c. Access controls and security logging;
d. Security software and vulnerability management;
e. Backup and incident-response measures; and
f. Supervision of service providers.


13. COOKIES

We may use cookies to maintain login sessions, shopping carts, language or region settings, security, and service performance.

Customers may block or delete cookies through their browser settings. Blocking cookies may prevent account, cart, checkout, or other Store functions from operating correctly.


14. PRIVACY CONTACT

Requests, inquiries, and complaints concerning personal data may be submitted to:

- Responsible department: BREAK SILENCE Operations
- Telephone: +82-70-4155-4319
- Email: contact@break-silence.com
- Address: 2F, 61 Gamcho-ro, Hanam-si, Gyeonggi-do 12991, Republic of Korea


15. COMPLAINTS

Customers may also contact the relevant data-protection authority. In the Republic of Korea, assistance is available from:

- Personal Information Infringement Report Center: +82-118 / privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: +82-1833-6972 / www.kopico.go.kr
- Korean National Police Agency: +82-182 / ecrm.police.go.kr


16. CHANGES TO THIS POLICY

We will post amendments to this Privacy Policy together with the announcement date and effective date. Material changes affecting customer rights will be announced in advance as required by applicable law.

- Announcement date: July 24, 2026
- Effective date: July 31, 2026