Privacy Policy

Privacy Policy
Effective Date: July 2, 2026
SIXAM Privacy Policy

SIXAM INC. (hereinafter referred to as the "Company") values the personal information of data subjects and lawfully processes and safely manages personal information in compliance with the Personal Information Protection Act and related laws. Accordingly, pursuant to Article 30 of the Personal Information Protection Act, the Company establishes and discloses this Privacy Policy to inform data subjects of the procedures and standards for processing personal information and to promptly and smoothly handle grievances related thereto.

Table of Contents

  1. Purpose, Items, and Retention/Use Period of Personal Information

  2. Provision of Personal Information to Third Parties

  3. Entrustment of Personal Information Processing

  4. Overseas Transfer of Personal Information

  5. Additional Use and Provision of Personal Information

  6. Destruction Procedures and Methods of Personal Information

  7. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

  8. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices

  9. Measures to Ensure the Safety of Personal Information

  10. Personal Information Protection Officer

  11. Remedies for Infringement of Data Subject Rights

  12. Amendments to the Privacy Policy

Article 1 (Purpose, Items, and Retention/Use Period of Personal Information)
① Personal information processed with the consent of the data subject
The Company processes the following personal information pursuant to Article 15, Paragraph 1, Item 1 of the Personal Information Protection Act (Consent of Data Subject). Mandatory and optional items are indicated below, and refusing consent to optional items does not restrict the use of essential services.

  1. Member Registration (Email Account)
    Collected Items

  • Mandatory: Email, password, name, mobile phone number

  • Optional: Shipping address, date of birth
    Purpose of Collection and Use

  • Member identification and management

  • Service provision

  • Customer consultation
    Retention and Use Period

  • Until membership withdrawal

  • However, after withdrawal, to prevent unauthorized use and handle disputes after transaction completion, only the email address and withdrawal date are stored separately, and other information is destroyed without delay.

  1. Non-Member Order (Toss Pay Payment)
    Collected Items

  • Mandatory: Recipient's name, address, contact number, email, payment method information
    Purpose of Collection and Use

  • Contract performance

  • Payment processing

  • Goods delivery

  • Refund processing
    Retention and Use Period

  • Preservation period pursuant to relevant laws such as the Act on the Consumer Protection in Electronic Commerce

  1. Customer Consultation
    Collected Items

  • Mandatory: Inquiry content, contact number, processing details
    Purpose of Collection and Use

  • Customer consultation

  • Dispute resolution

  • Request processing and record keeping
    Retention and Use Period

  • 3 years after completion of consultation

  1. Reception of Marketing Information
    Collected Items

  • Optional: Email, mobile phone number
    Purpose of Collection and Use

  • Provision of event and promotional information
    Retention and Use Period

  • Until withdrawal of consent or membership withdrawal

② Personal information processed without the consent of the data subject
The Company processes the following information without the consent of the data subject based on Article 15, Paragraph 1, Item 4 of the Personal Information Protection Act (Inavoidable cases for the execution/performance of a contract).
Collected Items

  • Service usage records, connection logs, access IP, cookies, payment records
    Purpose of Processing

  • Prevention of unauthorized use

  • Service statistical analysis

  • Preservation of records under relevant laws
    Processing and Retention Period

  • 3 months pursuant to the Protection of Communications Secrets Act

  • Preservation period pursuant to the Act on the Consumer Protection in Electronic Commerce

③ Preservation of personal information pursuant to relevant laws
The Company preserves personal information in accordance with relevant laws as follows:

  1. Records on contract or withdrawal of subscription, etc.

  • Legal basis: Act on the Consumer Protection in Electronic Commerce

  • Retention period: 5 years

  1. Records on payment and supply of goods, etc.

  • Legal basis: Act on the Consumer Protection in Electronic Commerce

  • Retention period: 5 years

  1. Records on consumer complaints or dispute resolution

  • Legal basis: Act on the Consumer Protection in Electronic Commerce

  • Retention period: 3 years

  1. Records on display/advertising

  • Legal basis: Act on the Consumer Protection in Electronic Commerce

  • Retention period: 6 months

  1. Records on electronic financial transactions

  • Legal basis: Electronic Financial Transactions Act

  • Retention period: 5 years

  1. Log records regarding service use

  • Legal basis: Protection of Communications Secrets Act

  • Retention period: 3 months

④ Personal information of children under 14 years of age
The Company does not accept membership registration from children under 14 years of age. This is verified through a self-confirmation process stating "I am 14 years of age or older" on the registration screen.

Article 2 (Provision of Personal Information to Third Parties)
The Company processes the data subject's personal information within the scope notified in Article 1 and does not provide it to third parties, except in cases corresponding to Articles 17 and 18 of the Personal Information Protection Act (consent of data subject, legal basis, request from public institutions, etc.).
Currently, the Company provides personal information to third parties as follows:

  1. Delivery Companies

  • Recipient: CJ Logistics, Hanjin Express, etc.

  • Purpose of provision: Product delivery

  • Provided items: Recipient's name, address, contact number

  • Retention and use period: Until completion of delivery

  1. Payment Processing Companies

  • Recipient: PortOne and connected PG companies (Toss Pay, etc.)

  • Purpose of provision: Payment processing and payment result confirmation

  • Provided items: Order number, payment amount, payment method information

  • Retention period: Pursuant to relevant laws

Article 3 (Entrustment of Personal Information Processing)
The Company entrusts personal information processing operations as follows to ensure smooth service provision. Obligations for protection pursuant to Article 26 of the Personal Information Protection Act are specified in entrustment contracts, and any changes in trustees will be notified through this Privacy Policy.

  1. Shopify Inc. / Shopify International Limited

  • Entrusted task: Shopping mall hosting and operation platform provision

  • Retention and use period: Until termination of entrustment contract

  1. PortOne

  • Entrusted task: Electronic payment (PG) processing agency (Toss Pay, etc.)

  • Retention and use period: Until termination of entrustment contract

  1. CJ Logistics, Hanjin Express, etc.

  • Entrusted task: Product delivery

  • Retention and use period: Until termination of entrustment contract

Article 4 (Overseas Transfer of Personal Information)
The Company transfers personal information overseas pursuant to Article 28-8 of the Personal Information Protection Act as follows. This transfer occurs as the Company utilizes Shopify as its shopping mall platform.

  • Recipient: Shopify Inc. or Shopify International Limited

  • Destination country: Countries where Shopify servers are located (Canada, etc.)

  • Timing and method of transfer: Transmission via network at the time of service use

  • Transferred items: Personal information necessary for service use, such as order information, shipping information, and payment-related information

  • Purpose of use: Provision of shopping mall hosting services

  • Retention and use period: Until membership withdrawal or termination of entrustment contract

Data subjects have the right to refuse overseas transfers pursuant to Article 28-8, Paragraph 5 of the Personal Information Protection Act. Please notify the personal information protection department specified in Article 10 if you wish to exercise your refusal. However, refusing overseas transfer may restrict the use of shopping mall services based on the Shopify platform.
Other than the above overseas transfer, the Company does not provide or separately transfer personal information to third parties overseas, and any future additions to overseas transfer subjects will be notified in advance through this Privacy Policy.

Article 5 (Additional Use and Provision of Personal Information)
The Company does not utilize collected personal information for additional use or provision under Article 15, Paragraph 3 and Article 17, Paragraph 4 of the Personal Information Protection Act.
Should additional use or provision occur in the future, it will be evaluated based on criteria under Article 14-2 of the Enforcement Decree of the same Act—such as relevance to collection purpose, predictability, infringement on data subject interests, and safety measures—and will be notified in advance through this Privacy Policy.

Article 6 (Destruction Procedures and Methods of Personal Information)
When personal information becomes unnecessary due to the expiration of the retention period or fulfillment of the processing purpose, the Company destroys the personal information without delay.

Destruction Procedure

  • Information entered by users is moved to a separate database after the purpose is achieved, stored for a certain period according to internal policies and relevant laws, and then destroyed.

  • Personal information stored separately will not be used for other purposes unless required by law.

Destruction Method

  • Personal information in electronic file format is deleted using technical methods that render records unrecoverable.

  • Personal information recorded/stored on paper documents is shredded with a shredder or incinerated.

Article 7 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

  1. Data subjects may request access to, correction of, deletion of, suspension of processing of, or withdrawal of consent for their personal information from the Company at any time.

  2. Rights may be exercised pursuant to Article 41, Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act via written form, email, fax, etc., and the Company will take action without delay.

  3. Rights may also be exercised through a legal representative or an authorized agent. In this case, a power of attorney according to Form No. 11 of the Notification on Personal Information Processing Methods must be submitted.

  4. Requests for access to and suspension of processing of personal information may be restricted pursuant to Article 35, Paragraph 4 and Article 37, Paragraph 2 of the Personal Information Protection Act.

  5. The Company verifies whether the requester is the data subject or a legitimate representative when rights are exercised.

Article 8 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

  1. The Company uses "cookies" that store and retrieve user information from time to time to provide customized services.

  2. The purpose of using cookies is to provide optimized services by analyzing shopping cart retention, visit and usage patterns, access frequency, secure connections, etc.

  3. Users can choose to allow all cookies, receive confirmation upon storage, or refuse all cookies through web browser option settings. However, refusing cookie storage may result in restrictions on certain service uses, such as shopping carts and logins.

How to set cookies

  • Chrome: Top right menu > Settings > Privacy and security > Site settings > Cookies and third-party data

  • Safari: Preferences > Privacy > Cookies and website data

  • Edge: Top right menu > Settings > Cookies and site permissions

  1. The Company currently does not use third-party behavioral information collection tools (e.g., Google Analytics, Meta Pixel, etc.). Any future implementation will be announced in advance through this Privacy Policy.

Article 9 (Measures to Ensure the Safety of Personal Information)
The Company implements the following safety measures pursuant to Article 29 of the Personal Information Protection Act and Article 30 of its Enforcement Decree:

Administrative Measures

  • Establishment and implementation of internal management plans

  • Designation and regular training of personnel handling personal information

Technical Measures

  • Management of access authority and installation/operation of access control systems for personal information processing systems

  • Encrypted storage and transmission of passwords and other sensitive data

  • Installation and periodic updates/inspections of security programs

  • Prevention of forgery/alteration of access logs and regular inspections

Physical Measures

  • Access control to locations where personal information is stored, such as computer rooms and data storage rooms

Article 10 (Personal Information Protection Officer)
① The Company designates a Personal Information Protection Officer as follows to take overall responsibility for personal information processing operations and handle grievances and damage relief for data subjects regarding personal information processing.

Personal Information Protection Officer

  • Name: Yemin Jeong

  • Position: CEO

  • Contact: +82-1600-4630

  • Email: info@tiporr.com

② Data subjects may inquire about all personal information protection inquiries, grievance handling, and damage relief that occur while using the Company's services to the Personal Information Protection Officer and department. The Company will answer and process inquiries without delay.

Article 11 (Remedies for Infringement of Data Subject Rights)
Data subjects may apply for dispute resolution or consultation with the following agencies to receive relief for personal information infringement:

  • Personal Information Dispute Mediation Committee: kopico.go.kr / +82-1833-6972

  • Personal Information Infringement Report Center: privacy.kisa.or.kr / 118 (within Korea)

  • Supreme Prosecutors' Office Cybercrime Investigation Division: spo.go.kr / 1301 (within Korea)

  • National Police Agency Cybercrime Reporting System: ecrm.police.go.kr / 182 (within Korea)

Article 12 (Amendments to the Privacy Policy)
If there are additions, deletions, or modifications to this Privacy Policy, prior notice will be given through website announcements at least 7 days before implementation. However, if there are important changes to data subject rights, notice will be given at least 30 days in advance.

Announcement Date: July 2, 2026
Effective Date: July 2, 2026

Company Information
Company Name: SIXAM INC.
Representative: Yemin Jeong
Business Registration Number: 224-81-70697
Address: 5F, Tower D, Le West City 07797, 143 Magokjungang-ro, Gangseo-gu, Seoul, Republic of Korea (07797)
Customer Center: +82-1600-4630
Email: info@tiporr.com