Privacy Policy (International)

1. Personal data we collect

1. Account — required: email address (your login), password, name. Optional: mobile number, display name, whether you want marketing emails. You can add a phone number and address later in My Page.
2. Sign-in with another account (Google, Naver or Kakao, where offered) — that provider's account identifier, your email and name. We never receive your password for that provider and we do not keep its access tokens.
3. Two-step verification (optional) — your authenticator key (stored encrypted) and recovery codes (stored in a form that cannot be reversed).
4. Orders (members and guests) — buyer's and recipient's name, email, phone or mobile number, postal address, country, state and city, delivery note; a guest order password (stored hashed); and, only where the destination country's customs require it, the recipient's tax ID (for example the CPF in Brazil).
5. Payments — PayPal order ID and amount. We never receive your PayPal login or card details. For bank transfers: the sender's name.
6. Customer support — your messages, name and (for guests) the email address for our reply.
7. Quote requests (members) — required: contact name, email for our reply, quantity; optional: company, phone, preferred delivery date, your message.
8. Business registration (members, for bulk quotes) — company name, country, company website and a copy of your company registration document; optional: business or VAT registration number; and whether our staff approved or rejected it (with the reason).
9. Bulk quote requests (members with an approved registration) — required: contact name, email, phone, quantity; optional: preferred delivery date, your message; and whether and when you confirmed your email address. Company details are taken from your approved registration.
10. Quote and registration submission records — whenever you send a quote request (including bulk requests) or a business registration, we record the time, your IP address and browser information, the notices shown on the form and whether you ticked the acknowledgement box.
11. Quote block list — the registration number, member number, IP address or email domain of requests we have decided not to answer.
12. Downloads — member number, name, file, date and IP address.
13. Collected automatically — cookies (section 9), recently viewed products (linked to your account or a random cart ID), and the IP address in security logs of failed or blocked sign-ins.

We do not ask for special categories of data (such as health or beliefs). Required fields are needed to create an account or deliver an order; without them we cannot do so.

2. Why we use it

1. To create and manage your account, verify it is you and protect it (including two-step verification), and to send you service notices such as changes to our terms.
2. To take, charge, ship and track your orders, provide downloads, carry out programming, made-to-order and work services, and handle cancellations, returns and refunds.
3. To provide after-sales service (paid or free repairs) and to verify that a product was bought from us.
4. To prepare customs documents (the commercial invoice travels with every parcel).
5. To answer your questions and quote requests, and resolve complaints and disputes.
6. To check and approve the companies that register for bulk quotes, to prevent quote requests made for improper purposes (such as competitors gathering prices), and to keep submission records in case of a dispute.
7. To keep the Site secure — blocking abuse, limiting sign-in attempts, investigating incidents.
8. To send marketing emails — only if you opted in; you can opt out at any time in My Page.

3. Legal bases (EU / UK GDPR)

• Contract (Art. 6(1)(b)) — account, orders, delivery, returns, support.
• Legal obligation (Art. 6(1)(c)) — keeping transaction and tax records, customs documents.
• Legitimate interests (Art. 6(1)(f)) — security and fraud prevention, keeping records needed to defend legal claims, and keeping order details so we can verify your purchase when you ask for after-sales service; checking and approving companies that register for bulk quotes, preventing misuse of quote requests and keeping tamper-evident quote submission records.
• Consent (Art. 6(1)(a)) — marketing emails, the optional "remember my ID" cookie. You can withdraw consent at any time.

Answering a quote request is a step taken at your request before a possible contract (Art. 6(1)(b)). The boxes you tick on the business registration and bulk quote forms record that you have read our notice; for customers outside Korea we do not rely on those ticks as consent under the GDPR.

4. Who we share it with

We do not sell your personal data, and we do not share it for cross-context behavioural advertising. We share it only with:

We may also disclose data where the law requires it, for example to courts or law-enforcement authorities acting under a lawful procedure.

5. International transfers

1. Your data is stored and processed in the Republic of Korea. The European Commission (December 2021) and the United Kingdom (December 2022) have recognised Korea as providing an adequate level of data protection, so transfers from the EU/EEA and the UK to us need no further safeguards.
2. Delivery abroad necessarily involves passing your delivery details to postal and customs authorities in your country.
3. PayPal and the sign-in providers operate under their own privacy policies and transfer safeguards.

7. Your rights

1. You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. You can withdraw consent at any time without affecting earlier processing.
2. In My Page you can view and edit your details, change your email, unlink sign-in providers, turn off marketing emails and close your account. For anything else, email support@easyflow.co.kr; we reply within one month (Korean law requires action within 10 days for Korean requests).
3. We may need to keep some data when the law requires it, and we will tell you why if we cannot meet a request.
4. We do not make decisions about you based solely on automated processing.
5. If you are in the EU/EEA or the UK, you may complain to your local data protection authority. Residents of California and other US states have the right to know, delete and correct, and to opt out of sale or sharing — we do neither.

8. Security

• Passwords are stored with an industry-standard one-way hash; we cannot read them.
• All connections are encrypted (HTTPS, with HSTS).
• Sign-in attempts are rate-limited, and two-step verification is available.
• New passwords are checked against known breached passwords without sending the password anywhere.
• Changing your password signs out your other devices.
• Admin access is limited by role and requires two-step verification; admin activity is logged and the logs are reviewed monthly.
• Quote submission records are kept in a tamper-evident form — each record is chained to the previous one with a cryptographic hash. Only top-level administrators can view them, and every view is logged.
• Copies of registration documents are stored outside the public website; only the administrators who review registrations can open them, and every view is logged.

9. Cookies

We use only cookies needed to run the Site and remember your choices. We use no advertising or analytics cookies, so we do not show a cookie consent banner.

You can block or delete cookies in your browser, but you will then be unable to sign in or order.

10. Children

The Site is not intended for children. We do not knowingly create accounts for anyone under 16 (under 14 in Korea). If we learn that we have, we will delete the data.

11. Changes

We will post any change to this policy on the Site at least 7 days before it takes effect, and tell members by email if the change is significant.

12. Contact

Our privacy officer (Deputy General Manager) handles all privacy questions and requests: support@easyflow.co.kr — Easyflow Inc., Rm 1709, Samgu Bldg., 40 Cheongpa-ro, Yongsan-gu, Seoul 04373, Republic of Korea — tel. +82 2 705 7770.