Privacy Policy

Privacy Policy

Eight Eight Co., Ltd. (the "Company") establishes and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly.

This Policy applies to the Company website (88coffee.co.kr). The Company website has no membership sign-up, login or online payment features, and personal information is collected only through the five application forms below.

At a Glance

Summary of Personal Information Processing

Information Collected	Name (or company), contact number, email, address, and details of your application or inquiry
Purpose of Use	Contacting and responding to you regarding experience, subscription, wholesale and sample applications and inquiries
Retention Period	1 year after processing is completed · Where a transaction takes place, the period prescribed by law
Provision to Third Parties	Not provided to third parties
Entrusted Processing	Cloudflare, Inc. (USA) — website traffic delivery and security (including overseas transfer)
Contact	Chief Privacy Officer: SUH JI MIN, CEO · Main line 054-841-9980 · info@88coffee.co.kr

Table of Contents

1. Purposes of Processing, Items Processed, and Retention and Use Period
2. Procedures and Methods for Destroying Personal Information
3. Provision of Personal Information to Third Parties
4. Entrustment of Personal Information Processing
5. Overseas Transfer of Personal Information
6. Criteria for Additional Use and Provision
7. Measures to Ensure the Security of Personal Information
8. Installation, Operation and Refusal of Devices that Automatically Collect Personal Information
9. Processing of Personal Information of Children Under 14
10. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
11. Chief Privacy Officer and Department Handling Access Requests
12. Remedies for Infringement of Data Subjects' Rights
13. Changes to This Privacy Policy

Article 1 (Purposes of Processing, Items Processed, and Retention and Use Period)

① The Company processes personal information only for the purposes below. If a purpose changes, the Company will take the necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

Purposes, Items and Legal Basis by Application Form

Application Form	Purpose of Processing	Required Items	Optional Items	Legal Basis
Experience	Confirming coffee experience (cupping, roasting, etc.) applications and contacting you about scheduling	Name (or company), contact number, preferred experience	Other Inquiries	Consent of the data subject (Article 15(1)1 of the Act)
Office Coffee Subscription	Contacting you for subscription consultations, quotes and terms, and to conclude a contract	Name (or company), contact number, email, address, requested quantity	Other Inquiries	Consent of the data subject (Article 15(1)1 of the Act); measures requested by the data subject to conclude a contract (subparagraph 4 of the same paragraph)
Wholesale Membership Application	Contacting you for wholesale consultations, supply terms, and to conclude a contract	Name (or company), contact number, email, quantity, expected price range, coffee preference	Address, other inquiry details	Consent of the data subject (Article 15(1)1 of the Act); measures requested by the data subject to conclude a contract (subparagraph 4 of the same paragraph)
Sample Request	Confirming sample requests, shipping samples, and contacting you about shipping	Name (or company), contact number, email, requested quantity	Address, other inquiry details	Consent of the data subject (Article 15(1)1 of the Act)
Q&A Inquiry	Confirming inquiries and contacting you with a response	Name (or company), contact number, email, subject	Message	Consent of the data subject (Article 15(1)1 of the Act)
Common to All Forms	Preventing misuse of forms, such as repeated or automated submissions by the same person	A transformed value (hash) of the connecting IP address, generated automatically when a form is submitted; the original IP address is not stored		Legitimate interests of the Company (Article 15(1)6 of the Act)

② You may submit an application without filling in optional items. Required items are essential for contacting and responding to you, so if you do not consent, your application cannot be accepted through the website forms. In that case, you may contact us directly via our main line (054-841-9980).

③ The Company does not collect resident registration numbers, sensitive information (such as health, ideology or beliefs), or payment information.

④ The retention and use periods are as follows.

Retention and Use Period

Category	Retention and Use Period	Basis
Application and inquiry information (common to all five forms)	1 year from the date the application or inquiry has been fully processed. If you request deletion before then, it will be destroyed without delay	Consent of the data subject
Transaction records where a wholesale or subscription transaction takes place after the application	Period prescribed by relevant laws (e.g., 5 years for books and supporting documents related to transactions)	Article 85-3 of the Framework Act on National Taxes, etc.
Hashed connecting IP address	Same period as the corresponding application information	Legitimate interests of the Company

Article 2 (Procedures and Methods for Destroying Personal Information)

① The Company destroys personal information without delay (within 5 days) once the retention period expires or the purpose of processing has been achieved.

② Where personal information must be retained under other laws, it is stored separately from other information and used only for the purposes prescribed by those laws. The grounds for retention and the items retained are as set out in the table in Article 1.

③ Destruction procedure: The person in charge identifies the personal information to be destroyed and destroys it with the approval of the Chief Privacy Officer.

④ Destruction method: Electronic files are deleted using methods that make them unrecoverable, and printed paper documents are shredded or incinerated.

Article 3 (Provision of Personal Information to Third Parties)

The Company processes data subjects' personal information only within the scope of the purposes set out in Article 1 and does not provide it to other companies or organizations. Personal information is provided only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as where the data subject gives separate consent or where a law specifically provides otherwise.

Article 4 (Entrustment of Personal Information Processing)

① To operate the website reliably, the Company entrusts personal information processing tasks as follows.

Entrustment of Personal Information Processing

Entrustee	Entrusted Tasks
Cloudflare, Inc.	Website traffic delivery (content delivery network), blocking of security threats (such as DDoS attacks), and encrypted communication (HTTPS) processing

② Through the entrustment contract (Cloudflare Terms of Service and Data Processing Addendum), the Company stipulates the prohibition of processing for purposes other than the entrusted tasks, security measures, restrictions on re-entrustment, management and supervision, and liability for damages, and monitors whether the entrustee processes personal information securely.

③ If the entrustee or the entrusted tasks change, the Company will give notice without delay through this Privacy Policy.

Article 5 (Overseas Transfer of Personal Information)

① The Company website runs on a server in the Company's office (Republic of Korea), and submitted applications are also stored on this server. However, because access to the website is delivered through Cloudflare's global servers, personal information is transferred overseas in the process as described below (Article 28-8 of the Personal Information Protection Act).

Overseas Transfer of Personal Information

Recipient	Cloudflare, Inc.
Contact	101 Townsend St., San Francisco, CA 94107, USA / privacyquestions@cloudflare.com
Destination Countries	The United States and countries where Cloudflare servers are located (users are connected to the nearest server based on their location, which may include servers within the Republic of Korea)
Items Transferred	Access records such as IP address and browser information, and content entered and submitted in forms (passing through during transmission)
Time and Method of Transfer	Transmitted over an encrypted network (HTTPS) each time you access the website or submit a form
Purpose of Use	Website traffic delivery and blocking of security threats
Retention and Use Period	Form content is passed on to the Company's server immediately and is not separately stored by Cloudflare. Access records are retained for Cloudflare's security log retention period and then deleted
How to Refuse, Procedure and Consequences	If you do not wish your information to be transferred overseas, you may apply or inquire via our main line (054-841-9980) instead of using the website forms. However, since access to the website itself goes through Cloudflare, refusing means you will not be able to use the website.

② This overseas transfer is made in connection with the entrustment of processing under Article 4, and is carried out by disclosing it in this Privacy Policy and informing you when you give consent on a form.

Article 6 (Criteria for Additional Use and Provision)

Within a scope reasonably related to the original purpose of collection, the Company may make additional use of personal information without consent after considering whether it would disadvantage the data subject and whether safety measures such as encryption have been taken (Article 15(3) of the Personal Information Protection Act). The Company does not currently engage in any such additional use or provision, and should it do so in the future, it will first disclose the criteria in this Privacy Policy.

Article 7 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to process personal information securely.

1. Restricted access: Application details are stored only in the Company's internal business system, and access is restricted to the staff responsible for contacting applicants.
2. Encrypted communication: All website traffic and form submissions use encrypted communication (HTTPS).
3. Minimal collection: Only a transformed value (hash) of the connecting IP address is stored, not the original.
4. Server management: The server storing application details is managed directly at the Company's office (Republic of Korea).
5. Blocking security threats: External attacks such as DDoS attacks are filtered out through Cloudflare.

Article 8 (Installation, Operation and Refusal of Devices that Automatically Collect Personal Information)

① As the Company website has no member login, the Company does not create or use its own cookies to identify users. Nor does it use tools that analyze visit history or deliver personalized (behavioral) advertising.

② However, some website features work by loading the external services below. When you use these features, your browser connects directly to that company's servers, so basic connection information such as your IP address is passed to that company, which may also store cookies. The Company does not receive or retain this information, and each company's own privacy policy applies.

External Services Used on the Website

Feature	Service Provider	Information That May Be Transferred
Store location map	OpenStreetMap(OpenStreetMap Foundation)	IP address and browser information when loading map images
Language selection (translation)	Google LLC (Google Translate)	IP address, browser information, on-screen content to be translated, Google cookies
Font display	Google LLC(Google Fonts)	IP address, browser information
Delivery of page layout files	jsDelivr	IP address, browser information
Address search (postal code)	Kakao (Daum Postcode Service)	Search terms entered in the address search window, IP address, browser information

③ If you do not want cookies to be stored, you can block them in your browser settings. Even with cookies blocked, you can still use the website forms, but some features such as translation may not work.

• Chrome: Settings > Privacy and security > Third-party cookies
• Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
• Safari: Settings > Privacy > Prevent cross-site tracking

Article 9 (Processing of Personal Information of Children Under 14)

The forms on the Company website are intended for business and adult customers, and the Company does not collect personal information from children under the age of 14. If the Company becomes aware that information from a child under 14 has been received, it will destroy it without delay.

Article 10 (Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them)

① Data subjects may exercise the following rights against the Company at any time.

1. Request for access to personal information (Article 35 of the Act)
2. Request for correction or deletion of personal information (Article 36 of the Act)
3. Request for suspension of processing and withdrawal of consent (Article 37 of the Act)

② You may exercise these rights by contacting the Chief Privacy Officer named in Article 11 in writing, by phone or by email, and the Company will take action without delay (within 10 days) and notify you of the outcome.

③ You may also exercise your rights through a representative, such as a legal representative or a person you have authorized. In this case, you must submit a power of attorney in the format of Annex Form No. 11 of the Public Notice on Methods of Processing Personal Information.

④ Personal information that other laws require to be retained cannot be subject to a deletion request, and requests for access or suspension of processing may be restricted where Article 35(4) or Article 37(2) of the Act applies, such as where there is a risk of harm to another person's life, body or property.

⑤ The Company verifies that the person making a request is the data subject or a legitimate representative.

⑥ Data subjects must provide their personal information accurately and must not enter another person's information without authorization.

Article 11 (Chief Privacy Officer and Department Handling Access Requests)

① The Company designates a Chief Privacy Officer as follows to oversee the processing of personal information and to handle complaints and provide remedies for damages related to personal information.

Chief Privacy Officer and Responsible Department

Category	Name & Title	Contact
Chief Privacy Officer	SUH JI MIN, CEO	Tel 054-841-9980 / Email info@88coffee.co.kr
Responsible Department (receiving and handling access requests)	Management Support (handled directly by the CEO)	Tel 054-841-9980 / Email info@88coffee.co.kr

② Requests for access, correction, deletion or suspension of processing of personal information, and any other inquiries, may be directed to the department above.

Article 12 (Remedies for Infringement of Data Subjects' Rights)

① To seek remedies for an infringement of personal information, you may apply for dispute mediation or counseling with the organizations below.

Organizations Providing Remedies

Organization	Phone (no area code needed)	Website
Personal Information Dispute Mediation Committee	1833-6972	www.kopico.go.kr
Personal Information Infringement Report Center (Korea Internet & Security Agency)	118	privacy.kisa.or.kr
Supreme Prosecutors' Office	1301	www.spo.go.kr
Korean National Police Agency	182	ecrm.police.go.kr

② For any privacy-related complaints about the Company, please contact the Chief Privacy Officer named in Article 11 first, and we will address them promptly.

Article 13 (Changes to This Privacy Policy)

① This Privacy Policy is effective from November 15, 2026. [Draft — update once the publication date is confirmed]

② If this Policy is amended, the changes and their effective date will be announced on the website. Changes that materially affect data subjects' rights, such as additional items or purposes of collection, will be announced in advance of the effective date.

③ Previous privacy policies (from when the Company operated its former online store) are available upon request.

Company Information

Personal Information Controller

Company Name	Eight Eight Co., Ltd.
Representative	SUH JI MIN
Address	15 Amsan 1-gil, Namhu-myeon, Andong-si, Gyeongsangbuk-do
Main Phone	054-841-9980
Business Registration No.	164-86-01739