Privacy Policy
Effective: 2026-08-24
Mobility Suksan Co.,LTD (the “Company”) is the personal data controller for BOMTOLL. This Policy explains how the Company processes personal data under the laws of the Republic of Korea.
1. Data, Purposes and Retention
| Activity | Data | Purpose / basis | Retention |
|---|---|---|---|
| Account | Required: company or name, user ID, email, password. Optional: contact name, department, title and phone numbers. | Create, authenticate and manage an account; perform a contract; consent where requested. | Until account closure, except legally retained records. |
| Delivery | Consignee, phone, country, postal code, address and delivery note. | Perform the order and delivery contract. | Five years for payment and supply records. |
| Order, payment and refund | Order details, payment method/status/key, payer information and, for bank refunds, bank, account number and holder. The Company does not store full card numbers. | Perform payment, cancellation and refund; prevent fraud. | Five years for contract, withdrawal, payment and supply records. |
| Tax and transaction documents | Business registration number, legal name, representative, business type, address and billing contact details. | Issue statutory documents and comply with tax law. | The statutory tax period, generally five years. |
| International quote and invoice | English company name/address, country, contact details, importer identifier, Incoterms, quote and invoice information. | Prepare a requested quotation and perform an international transaction. | Five years for a completed transaction; three years after final handling for an unconverted quote. |
| Support and disputes | Account details or guest name/email, message, attachment, response and handling history. | Answer requests, handle rights and resolve disputes. | Three years for consumer complaints and disputes. |
| Security | IP address, access time, browser/device information, session and usage logs. | Security, incident response, fraud prevention and legal duties. | The applicable statutory period or three months; incident/dispute records until resolved. |
The Company processes only data reasonably necessary for each purpose. Optional data is not required to create an account, although a related feature may be unavailable without it.
2. Children
The Store does not accept registration by children under 14. Data discovered to have been collected from such a child will be deleted without undue delay.
3. Disclosure to Third Parties
The Company does not routinely disclose personal data to a third party for domestic orders or ordinary Store use. Disclosure occurs only with separate consent or another basis permitted by law.
This depends on how the goods are shipped. Where goods first arrive from an overseas fulfilment centre at the Company's domestic warehouse and are then delivered by a Korean courier, your name, address and phone number do not leave Korea. Where goods are shipped directly from an overseas fulfilment centre to your address, the recipient's name, address and phone number may be entrusted to that fulfilment centre and to an international carrier in order to carry out the delivery. In that case the Company will first identify the recipient, country, data, purpose, retention period and how to refuse, and complete the procedure required by law. Submitting a quote request alone does not transfer personal data overseas.
4. Processors
| Processor | Processing service |
|---|---|
| Mogmate Co., Ltd. | BOMTOLL development, maintenance, operational support, incident response and controlled access to the data system. |
| Cafe24 Corp. | Server hosting and data storage. |
| Toss Payments Co., Ltd. | Payment, cancellation/refund, escrow and fraud prevention. |
| Linkhub (Popbill) | Issuing and transmitting electronic tax and transaction documents. |
| Carrier identified on the order’s tracking information | Delivery, tracking and return transport. |
This Policy will be updated before a new processor is used. Mogmate is the Company’s development and operations processor, not the Store’s seller or personal data controller, and processes data only within the Company’s documented instructions.
5. Overseas Transfer
No routine overseas transfer is currently active. Before enabling an overseas email, analytics or dropship service, the Company will verify and publish the overseas recipient, country, time/method, data, purpose, retention, refusal method and effect, and establish a lawful basis under Korean privacy law.
6. Deletion
Data is deleted without undue delay when its purpose or retention period ends. Records retained by law are segregated by storage or access controls. Electronic files are deleted so that recovery is impracticable, and paper is shredded or incinerated.
7. Your Rights
You may request access, correction, deletion, suspension of processing or withdrawal of consent. A lawful representative may act for you, subject to identity and authority verification. Requests may be made through My Account or to the Privacy Officer below. Where law restricts a request, the Company will explain the reason.
8. Security
The Company applies reasonable safeguards including least-privilege access, access reviews, encryption of passwords and key data, protected transmission, access log retention and review, vulnerability and malware response, backups and processor oversight. The Company does not directly collect or store full card numbers.
9. Cookies
The Store uses cookies for login, security and cart functions. You may block or delete cookies in browser settings, but some functions may stop working. The Company currently does not collect behavioral data for personalized advertising. Before enabling Google Analytics or a similar tool, this Policy will disclose the actual data, provider, opt-out method and any overseas transfer.
10. Privacy Officer and Remedies
Privacy Officer: Choi, Hong Gil
Email: suksan0@suksan.com · Phone: 02-704-5002 · Address: 3F, 77 Gyeongin-ro 53-gil, Guro-gu, Seoul, Republic of Korea
Korean privacy assistance: Privacy Infringement Report Center (118), Personal Information Dispute Mediation Committee (1833-6972), Korean National Police (182).
11. Changes
Changes will be announced at least seven days before taking effect, or 30 days in advance for a material change affecting data-subject rights.
Published: 2026-08-24 · Effective: 2026-08-24. This English version is for convenience. The Korean version governs in the event of an interpretive difference, subject to mandatory law.