Privacy Policy
Version 2
nexonbook Corp. ("the Company") protects the personal data of Tilewind customers in accordance with the Korean Personal Information Protection Act and other applicable law.
Orders are taken without an account. The Company collects only what an order needs, and reopens that order with the order number and email address alone.
1. What is collected, and why
| Item | Collected at | Purpose | Kept for |
|---|---|---|---|
| Email address | Order · enquiry | Order confirmation, delivery updates, verifying who may open an order, replies | See clause 2 |
| Recipient name, phone number, shipping address | Order | Delivery, contact during delivery, returns | See clause 2 |
| Order contents (item, quantity, amount, currency, language) | Order | Performing the contract, handling withdrawal | 5 years |
| Payment identifiers (transaction ID, payment method type, approval time — not the card number) | Payment | Confirming payment, refunds | 5 years |
| Licence number, engraved USB number, tracking number | Dispatch | Authenticity, tracking, after-sales support | 5 years |
| Enquiries and replies (support tickets) | Enquiry | Answering, handling disputes | 3 years |
| Access logs, cookies | Use | Security, keeping an order open, preventing abuse | Access logs 3 months |
| (Optional) account email and password, stored hashed | Only if you register | Sign-in, linking orders | Deleted when the account closes |
- The Company does not store card numbers or other payment credentials — payment happens on Toss Payments' own screen and the Company receives only an identifier.
- The Company does not collect national identification numbers.
- Photos and video placed on the USB are never sent to the Company. The product runs offline; the Company can neither collect nor see them.
2. Retention
Data is destroyed without delay once its purpose is met, except where the Electronic Commerce Act or other law requires it be kept:
- records of contracts and withdrawal — 5 years
- records of payment and supply of goods — 5 years
- records of consumer complaints and disputes — 3 years
- records of labelling and advertising — 6 months
- access logs — 3 months under the Protection of Communications Secrets Act
3. Disclosure to third parties
The Company does not sell or otherwise disclose personal data to third parties. It does pass the recipient's name, phone number and address to the courier so the parcel can be delivered, which is what performing the contract requires. Lawful requests from investigative authorities are handled under the applicable procedure.
4. Processors and cross-border transfers
| Processor | Task | Data transferred | Stored in |
|---|---|---|---|
| Toss Payments Co., Ltd. | Payment, approval, refunds | Order number, amount, currency, email, phone | Republic of Korea |
| Courier [ ] | Delivery | Recipient name, phone, address | Republic of Korea (destination country for international orders) |
| Amazon Web Services, Inc. | Servers and database | The stored items in clause 1 | Republic of Korea (Seoul region) |
| Amazon Web Services, Inc. (SES) | Sending notification email | Email address and message body | United States |
| PayPal (if chosen for an international payment) | Payment | Order number, amount, email | United States and others |
- The items, countries, timing, method, purpose and retention of cross-border transfers are as set out above. You may refuse a transfer, but that payment or notification route then cannot be used.
- The Company contracts each processor on data protection terms and supervises their handling.
5. Your rights and how to use them
- You may at any time ask to see, correct, delete your personal data or to stop its processing.
- If you ordered without an account: confirm the order with its order number and the email used at checkout, then ask — or write to the support centre. The Company asks for both, and does not reveal whether a given order number exists, so that nobody can discover someone else's order.
- Once a parcel has been dispatched, deleting the data the delivery needs may not be possible, and records the law requires be kept are not deleted before that period ends.
- Write to support@nexonbook.com or use the support centre; the Company acts without delay.
6. Destruction
Data whose retention period has expired, or whose purpose is met, is destroyed without delay — electronic files by a method that prevents recovery, paper by shredding or incineration.
7. Security
Transport encryption (TLS), one-way hashing of passwords, least-privilege access, retained access logs, separated permissions in the admin screens, and an incident response procedure. Payment credentials are never stored in the first place.
8. Cookies
The Company uses the cookies below and no advertising cookies.
- Session cookie — lets someone who ordered without an account reopen that order after returning from the payment screen. It holds only the few most recent orders and disappears when browser data is cleared; after that the order number and email open it.
- Preference cookie — the chosen display language and light or dark theme.
- You may refuse cookies in your browser; returning straight to the order screen after payment may then not work.
9. Data protection officer
Name: Hyung Park · Title: Chief Executive Officer · Contact: support@nexonbook.com
Complaints may also be made to the Korea Internet & Security Agency's privacy centre (privacy.kisa.or.kr, 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, +82-1833-6972), or the supervisory authority in your own country.
10. Changes
Changes are announced 7 days before they take effect, or
30 days where the change is material.
Effective date: [ / / ]
nexonbook Corp. · CEO: Hyung Park · Business Reg. No. 106-86-79298 ·
26F, V557, POSCO Tower-Songdo, 165, Convensia-daero, Songdo International Business District,
Yeonsu-gu, Incheon, Republic of Korea · Contact: support@nexonbook.com