Notice

Notice of Changes to the Privacy Policy

□ Changes to the Privacy Policy

① This Privacy Policy will take effect from August 6, 2025.

② You can view the previous version of the Privacy Policy at the link below:

Effective as of March 12, 2025 (Click)

F&F Co., Ltd. (the “Company”) values the personal information of its users and manages its Privacy Policy transparently in accordance with applicable laws and regulations.
In line with this commitment, we hereby inform you in advance of the following changes to our Privacy Policy.

1. Effective Dates of the Changes
• Date of Notice: [August 6, 2025]
• Effective Date: [August 13, 2025]

2. Reasons for the Changes
• Modification of the types of personal information collected
• Updates to the details of third-party processing (changes to entrusted service providers)
• Addition of provisions regarding the collection and transfer of personal information overseas
• Revisions to behavioral information handling, including clarification on de-identification, retention periods, provision of behavioral data, and methods for opting in or out of personalized advertising
• Addition of provisions regarding the collection and use of behavioral information by third parties through automated data collection tools, as well as how to refuse such collection
• Updates to the Personal Information Protection Officer and the procedures for requesting access to personal data
• Addition of information on remedies for rights violations
• Addition of voluntarily defined standards and protection measures set by the data controller in the Privacy Policy

3. Key Changes

Details of Revisions

Before

After

Purpose, Types, and Retention Period of Personal Information

Purpose of Processing Personal Information	Items of Personal Information Collected	Retention Period
Membership Registration and Management	Website General Sign-up [Required] Email, Password, Last Name, First Name	Until Membership Withdrawal
Provision of Products and Services	[Required] Order Information: Last Name, First Name, Mobile Phone Number, Email Shipping Information: Last Name, First Name, Mobile Phone Number, Shipping Address Payment Information	5 Years (per Article 6 of the E-Commerce Act Enforcement Decree) for transaction-related data.
Customer Support (Support via 1:1 Inquiry)	[Required] Email Address, Mobile Phone Number	3 Years after consultation ends (Article 6 of the E-Commerce Act Enforcement Decree)

Purpose of Processing Personal Information	Items of Personal Information Collected	Retention Period
Membership Registration and Management	Website General Sign-up [Required] Email [Optional] Last Name, First Name	Until Membership Withdrawal
Provision of Products and Services	[Required] Order Information: Last Name, First Name, Mobile Phone Number, Email Address Shipping Information: Last Name, First Name, Mobile Phone Number, Shipping Address Payment Information: Last Name, First Name, Mobile Phone Number, Shipping Address, Email Address	5 Years (per Article 6 of the E-Commerce Act Enforcement Decree) for transaction-related data.
Customer Support (Support via 1:1 Inquiry)	[Required] Email Address, Mobile Phone Number	3 Years after consultation ends (Article 6 of the E-Commerce Act Enforcement Decree)

Entrustment of Personal Information Processing

Entrusted Parties	Entrusted Tasks
shopify	Online Shopping Mall Platform Provider
Logen Logistics	Order and Prize Delivery
MXN Commerce USA, INC	Order Payment and Settlement Processing
Meta M	Customer Support and CS Handling
AWS.	System Operation and Data Storage via Cloud Services
Fastbox	International Shipping and Delivery
Channel Corporation	Online Chat Support and Delivery of Marketing Messages

Entrusted Parties	Entrusted Tasks
shopify	Online Shopping Mall Platform Provider
Logen Logistics	Order and Prize Delivery
MXN Commerce USA, INC	Order Payment and Settlement Processing
Boboslink	Customer Support and CS Handling
Fastbox	International Shipping and Delivery
Channel Corporation	Online Chat Support and Delivery of Marketing Messages

Matters Concerning the Collection and Transfer of Personal Information Overseas

< Newly Established >

6. Matters Concerning the Collection and Transfer of Personal Information Overseas

F&F transfers personal information overseas under the following conditions:

1) Legal Basis for Cross-Border Transfer:
In accordance with Article 28-8(1)(3) of the Personal Information Protection Act of Korea (Outsourcing or storage of personal information overseas for contract fulfillment)

2) Personal Information Transferred:

Basic Account Information: Name, email address, phone number
Order and Payment Details: Shipping address, billing address, payment method
( Note: Shopify does not store complete payment information )
Device and Usage Data: IP address, browser type, device information, cookies, and browsing behavior
Customer Interactions: Support inquiries, messages, and order history

3) Country, Timing, and Method of Transfer:

Countries:
Canada – Location of Shopify headquarters
United States – Where some infrastructure and service providers are based
Depending on third-party apps and integrations, data may pass through or be processed in other jurisdictions.
Timing:
Transfer of personal information begins as soon as the user interacts with the store (e.g., browsing, account creation, checkout)
and continues throughout the use of the store and related services (e.g., order processing, marketing, customer support).
Transfers may occur in real-time or periodically depending on the nature of the activity.
Method:
All data is securely transmitted using encryption protocols such as TLS (Transport Layer Security).
Shopify maintains strict security measures during the transmission and storage of personal information to comply with international standards.

4) Recipient’s Name and Contact Information:

Name: Shopify Inc.
Address: Shopify Commerce Singapore Pte. Ltd.
Attn: Data Protection Officer
77 Robinson Road, #13-00 Robinson 77, Singapore 068896
Email: privacy@shopify.com

5) Purpose of Use and Retention Period by the Recipient:

Purpose:
To provide the e-commerce platform, process orders and payments, track deliveries, and manage customer relations
Retention Period:
Until the termination of the contract or until the period required under relevant laws and regulations

6) How to Refuse Transfer, Procedures, and Consequences:

How:
Users may request to refuse cross-border data transfers by contacting the Data Protection Officer via email or through the customer service center
Procedure:
Upon confirmation of the request, the result will be communicated to the user
Consequences:
Refusal of overseas transfer may result in limitations on the use of services

Collection, Use, Provision, and Rejection of Behavioral Information

1) The Company collects and uses behavioral information to provide optimized personalized services, benefits, and online targeted advertising during service usage.

Types of Behavioral Information Collected	Methods of Behavioral Information Collection	Purpose of Behavioral Information Collection	Retention and Usage Period & Subsequent Processing of Information
Website/App Visit History Search History Purchase History	Automatically Collected Upon Website and App Visit/Execution	Providing Personalized Product Recommendation Services Based on User Interests and Preferences	1 year from the date of collection

2)The Company collects and uses behavioral information to provide optimized personalized services, benefits, and online targeted advertising during service usage.

Advertising Service Providers Collecting and Processing Behavioral Information

Methods of Behavioral Information Collection

Purpose of Behavioral Information Collection

Retention and Usage Period

Google

Automatically Collected and Transmitted When Users Visit the Website or Launch the App

Basic User Information: Age, Gender, Location, Device Information
[Visit History]
Referral Source, Visited Pages, Duration of Stay

[Search History ]

Keywords, Search Queries
[Purchase History ]

Products Viewed, Items Purchased

1 year from the date of collection

3) Data subjects can enable or disable online targeted advertising by changing their cookie settings in their web browser. However, modifying cookie settings may affect the availability of certain services, such as automatic login on websites.

‣ Enable/Disable Targeted Advertising in Web Browsers

(1) Internet Explorer (Windows 10 - Internet Explorer 11)

- In Internet Explorer, select Tools and then Internet Options.

- Select the Privacy tab, click Advanced in Settings, then choose to Block or Allow Cookies.

(2) Microsoft Edge

- In Edge, click the "…" (Menu) icon in the top-right corner, then select Settings.

- In the Settings page, click "Privacy, Search, and Services" on the left, then select the Tracking Prevention option and choose the desired level.

- Select whether to "Always use 'Strict' tracking prevention when browsing InPrivate."

- In the "Privacy" section, select whether to enable "Send 'Do Not Track' requests."

(3) Chrome Browser

- In Chrome, click the "Customize and control Chrome" ( ⋮ ) icon in the top-right corner, then select Settings.

- On the Settings page, scroll down and click "Privacy and security", then under the "Ad privacy" section, click "Site-recommended ads" settings.

- In the "Site-recommended ads" section, block unwanted sites by adjusting the settings for "Block sites from showing personalized ads."

1) The Company uses cookies and other automated data collection tools to process behavioral information in a non-identifiable manner in order to provide data subjects with optimized, personalized services, benefits, and online targeted advertisements during their use of the services.

Types of Behavioral Information Collected	Methods of Behavioral Information Collection	Purpose of Behavioral Information Collection	Retention and Usage Period & Subsequent Processing of Information
Website/App Visit History Search History Purchase History	Automatically Collected Upon Website and App Visit/Execution	Providing Personalized Product Recommendation Services Based on User Interests and Preferences	2 years from the date of collection

2) The Company provides behavioral information as follows.

Advertising Service Providers Collecting and Processing Behavioral Information	Types of Behavioral Information Collected and Processed	Purpose of Use by the Recipient	Retention and Usage Period
Google	User’s basic information (age, gender, region, device information), visit history (referral source, visited pages, time spent), search history , and purchase history	Provision of personalized advertisements	540 days from the date of collection
META(Facebook, instagram)	User’s basic information (age, gender, region, device information), visit history (referral source, visited pages, time spent), search history , and purchase history	Provision of personalized advertisements	180 days from the date of collection
TikTok	User’s basic information (age, gender, region, device information), visit history (referral source, visited pages, time spent), search history , and purchase history	Provision of personalized advertisements	390 days from the date of collection

▶ Blocking/Allowing Personalized Ads via Web Browsers

(1) Chrome

① How to delete cookies stored in your web browser:

Click the “ ⋮ ” icon at the top right of Chrome and select Settings .
On the left panel, click Privacy and Security , then select Clear browsing data to choose which data to delete.

② How to block third-party cookies in your web browser:

Click the “ ⋮ ” icon at the top right of Chrome and select Settings .
On the left panel, click Privacy and Security , then select Third-party cookies and choose to Block third-party cookies .

③ How to block all cookie storage in your web browser:

Click the “ ⋮ ” icon at the top right of Chrome and select New Incognito Window .
In incognito mode, browsing history, cookies, site data, and form inputs are not saved on your device.

(2) Edge

① How to delete cookies stored in your web browser:

Click the “…” icon at the top right of Edge and select Settings .
On the left panel, click Cookies and site permissions , then select Manage and delete cookies and site data to remove all cookies and site data.

② How to block third-party cookies in your web browser:

Click the “…” icon at the top right of Edge and select Settings .
On the left panel, click Privacy, search, and services , then under the Tracking prevention section, select your preferred level (Balanced or Strict).
Alternatively, go to Cookies and site permissions → Manage and delete cookies and site data , and select Block third-party cookies .

③ How to block all cookie storage in your web browser:

Click the “…” icon at the top right of Edge and select New InPrivate Window .
In InPrivate mode, browsing history, cookies, site data, and form inputs are not saved on your device.

(3) Contact for Behavioral Information Inquiries

If you have any questions regarding behavioral information, or wish to exercise your right to opt out or file a complaint, please contact us using the information below.

▶ Department in Charge of Personal Information Protection
Department Name: Information Security Team

Person in Charge : Won-jun-seok

Contact : 02-520-0020, privacy@fnfcorp.com

Details on the Collection and Use of Behavioral Information by Third Parties through Automated Means and the User’s Right to Refuse Such Collection

< Newly Established >

When a data subject visits or uses the website, the Company allows third parties to collect behavioral information through automated tools such as third-party cookies and advertising identifiers for the purpose of providing efficient services, advertising, and marketing.

The behavioral information collected by third parties from the Company’s website includes the following:

Name of the Collection Tool	Type of Collection Tool	Third-Party Data Collector	Behavioral Information Collected by Third Parties	Purpose of Collection
Google Analytics4	JavaScript Injection via GTM (Google Tag Manager)	Google	User behavioral data such as website visits, page views, and e-commerce activities	Statistical analysis of service usage
Google Tag Manager	JavaScript Injection via GTM (Google Tag Manager)	Google	User behavioral data such as website visits, page views, and e-commerce activities	Statistical analysis of service usage
Facebook, instagram pixel	JavaScript / Pixel	Meta(Facebook, instagram)	User behavioral data such as website visits, page views, and e-commerce activities	Serving interest-based personalized advertisements
Google Ads	JavaScript	Google	User behavioral data such as website visits, page views, and e-commerce activities	Serving interest-based personalized advertisements
TikTok pixel	JavaScript / Pixel	TIkTok	User behavioral data such as website visits, page views, and e-commerce activities	Serving interest-based personalized advertisements

How to Allow or Block Behavioral Information Collected by Third Parties

Data subjects can control whether behavioral information is collected by third parties through browser settings such as cookie preferences.

▶ On Web Browsers

(1) Chrome
① How to block third-party cookies:

Click the “ ⋮ ” icon at the top right of Chrome and select Settings .
Go to Privacy and security on the left panel, then click Third-party cookies , and choose the Block third-party cookies option.

② How to block all cookies (incognito mode):

Click the “ ⋮ ” icon at the top right of Chrome and select New Incognito Window .
In Incognito mode, browsing history, cookies, site data, and form inputs are not saved on your device.

(2) Microsoft Edge
① How to block third-party cookies:

Click the “…” icon at the top right of Edge and go to Settings .
In the left menu, click Privacy, Search, and Services , and in the Tracking prevention section, choose a prevention level (Balanced or Strict).
Alternatively, go to Cookies and site permissions → Manage and delete cookies and site data , and enable Block third-party cookies .

② How to block all cookies (InPrivate mode):

Click the “…” icon at the top right and select New InPrivate Window .
In this mode, browsing history, cookies, and form data will not be saved.

▶ On Mobile Browsers

(1) Chrome (Android Devices)
① How to block third-party cookies:

Open the Chrome app, tap the “ ⋮ ” icon at the top right, and go to Settings .
Tap Site settings → Third-party cookies , and choose to block them.
To allow exceptions, tap Add site exception and enter the desired site URL.

② How to block all cookies (Incognito mode):

Open Chrome and tap the “ ⋮ ” icon, then select New Incognito Tab .
In Incognito mode, browsing history, cookies, and site data are not stored.

(2) Safari (iOS Devices)

Open Settings on your device, scroll to and tap Safari .
Tap Advanced , then enable Block All Cookies .

(3) Samsung Internet
① How to block third-party cookies:

Open the Samsung Internet app, tap the “≡” icon at the bottom, and go to Privacy .
Under Privacy dashboard , tap Smart anti-tracking , and select Always .

② How to block all cookies (Secret mode):

Tap the Tabs icon at the bottom of the Samsung Internet app, then tap Turn on Secret mode , and press Start .
In Secret mode, no browsing history, cookies, or site data will be saved.

Personal Information Protection Officer and Access Requests

[Personal Information Protection Officer]

Name: Ryu Young-seok

Position: Chief Privacy Officer (CPO)

[Personal Information Access Request Department]

Department: Information Security Team

Contact Person: Kim Hwa-rang

Address: 541, Eonju-ro, Gangnam-gu, Seoul (06138), F&F Building

Email: privacy@fnfcorp.com

Phone: 02-6411-1500

Discovery Expedition: 080-820-8802

[Personal Information Protection Officer]

Name: Ryu Young-seok

Position: Chief Privacy Officer (CPO)

Email : privacy@fnfcorp.com

Contact : 02-520-0020

[Personal Information Access Request Department]

Department: Information Security Team

E-mail : privacy@fnfcorp.com

Contact : 02-520-0020

Remedies for Data Subjects

< Newly Established >

If you believe that your personal data has been misused, you may contact the data protection authority in your country of residence or file a complaint with our Data Protection Officer ([ privacy@fnfcorp.com ]).

Additionally, data subjects may file complaints or report privacy violations to the following external organizations:

· Personal Information Infringement Report Center (KISA): https://privacy.kisa.or.kr , ☎ +82-118

· Personal Information Protection Commission (PIPC): https://www.pipc.go.kr , ☎ +82-1833-6972

Country/Region	Data Protection Authority	Website
Hong Kong	PCPD	www.pcpd.org.hk
Macao	GPDP	www.gpdp.gov.mo
Indonesia	Kominfo	www.kominfo.go.id
Japan	PPC	www.ppc.go.jp
Malaysia	JPDP	www.pdp.gov.my
Myanmar	MoTC	www.motc.gov.mm
Philippines	NPC	www.privacy.gov.ph
Singapore	PDPC	www.pdpc.gov.sg
Vietnam	A05 under MPS / MIC Department	www.mic.gov.vn

Voluntary Measures Specified by the Data Controller Regarding Personal Data Processing Standards and Safeguards

< Newly Established >

To enhance awareness of personal data protection and foster a culture of privacy within the company, we are implementing the following voluntary protection activities:

Operation of Personal Data Protection Campaigns
We conduct internal campaigns to raise awareness of personal data protection. These include posting informational posters and internal notifications targeting all employees to emphasize the importance of safeguarding personal information.

※ For inquiries regarding the revised Privacy Policy of F&F, please contact our Personal Information Inquiry Department.
▶ Responsible Department: Information Security Team
Person in Charge: [Won-Jun-Seok]
Phone: +82-2-520-0020
Email: privacy@fnfcorp.com

※ You can view the full details of the changes on our website at https://en.discovery-expedition.com/ > Privacy Policy .

▶ Go to Privacy Policy