Privacy Policy

Naivy Inc. ("Company") has established this Privacy Policy in accordance with the Personal Information Protection Act of the Republic of Korea to protect the personal information of Objem shop users and handle related concerns promptly.

1. Personal Information We Process and Why

1) Membership: email, password (stored encrypted), name, phone number (optional), marketing consent. If you sign up with Google, the email and name provided by Google. — identity verification, account management, order history, notices

2) Orders, delivery and payment: orderer name, email and phone; recipient name, phone and address; destination country; tax ID for customs (only for countries that require it, e.g. Brazil); payment method, amount and approval details. — delivery, payment and refunds, order tracking, customer support

3) Inquiries: email, phone (optional), inquiry content and attachments. — handling and answering inquiries

4) Event and offer emails (only if you opt in): email, name.

5) Automatically generated: IP address, access logs, cookies (cart, selected country and language, keeping you logged in). You can refuse cookies in your browser settings, but the cart and login will not work.

2. Retention Period

1) Member information is kept until you delete your account and destroyed immediately afterwards. Inquiries are destroyed without delay once handled (records of consumer complaints are kept as below).

2) As required by Korean law: records of contracts or withdrawals 5 years, records of payment and supply of goods 5 years, records of consumer complaints and disputes 3 years (Act on Consumer Protection in Electronic Commerce), access logs 3 months (Protection of Communications Secrets Act).

3. Children

We do not accept sign-ups from children under 14.

4. Provision to Third Parties

We process personal information only for the purposes above and do not provide it to third parties without your consent unless required by law. For international shipments, recipient details may be submitted to customs in the destination country.

5. Processors

We entrust the processing of personal information as follows:

· KG Inicis Co., Ltd.: domestic payment processing

· Eximbay Inc.: international payment processing

· Korea PortOne Co., Ltd.: payment integration

· Domestic couriers and international carriers (e.g. EMS): delivery

· Supabase Inc.: member and order database (data stored in the Seoul, Korea region)

· Vercel Inc.: website hosting

We set out the necessary safeguards in our contracts and supervise our processors. Changes will be announced in this policy.

6. International Transfers

· Vercel Inc. (USA, privacy@vercel.com): website hosting — access logs and page request data — transmitted over the network when you use the Shop — until the end of the contract

· Google LLC (USA): account verification if you choose Google login — email and name — transmitted at login — until you delete your account

· International payment and delivery: if you choose international payment or shipping, the necessary information is transmitted to payment providers, carriers and the destination country.

If you do not want your information transferred abroad, you may choose not to use these features (Google login, international payment or shipping), in which case those services will not be available.

7. Destruction

Personal information is destroyed without delay once the retention period ends or the purpose is achieved. Electronic files are deleted irrecoverably and paper documents are shredded or incinerated.

8. Your Rights

You may request access to, correction or deletion of, or suspension of processing of your personal information at any time. Members can edit their details or delete their account in My account; other requests can be sent to the contact below. You can withdraw marketing consent at any time in My account.

9. Security

We protect personal information through password encryption, access control, encrypted connections (HTTPS) and retention of access logs.

10. Privacy Officer

Privacy officer: 김동현 (CEO) · contact@naivy.me · +82 1833-6845

For privacy complaints you may also contact the Korea Internet & Security Agency Privacy Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr).

Addendum

This policy takes effect on November 4, 2026.