1. Scope and processing principles
The personal information controller is the operator of NexSupply Korea on nexsupply.net. The service processes personal information to the extent necessary to provide members with product checks in China, purchasing, inspection, local processing, and coordination of international transport and customs clearance.
At registration, only information needed to operate the account is collected. Delivery addresses, business registration documents, personal customs-clearance codes and refund bank details are processed when actually needed for a quotation, order, customs clearance or refund, after the purpose and information required have been explained.
Important provision
2. Information processed, purposes and retention periods
The following information is entered directly by users on the service or generated while they use its features.
- Service
- Membership and accounts
- Information processed
- Name, email, mobile telephone number, membership type, company or business name (business members), password authentication information, and the times and versions of required and optional consents
- Purpose
- Identity verification, account creation and security, member inquiries, and evidence of consent
- Retention period
- Until membership termination or an account-deletion request. Records subject to statutory retention are stored separately for the periods in Section 3 below.
- Service
- Consultations, quotations and purchasing requests
- Information processed
- Name, company name, telephone number, email, consultation date, time, method and subject, product links, descriptions and photographs, variants, quantities, budget, schedule, sales channels and requirements
- Purpose
- Receiving inquiries, reviewing products and suppliers, preparing quotations, and communicating progress
- Retention period
- Deleted when the inquiry is withdrawn or its purpose is fulfilled. Records forming the basis of a contract or dispute are subject to the statutory periods below.
- Service
- Ordering, payment, inspection, transport and customs clearance
- Information processed
- Order and payment records, recipient names in Korean and English, telephone number, postcode and address, delivery method, inspection and packing requirements, business or personal customs-clearance category, business registration documents or personal customs-clearance code, and refund bank, account holder and account number
- Purpose
- Contract performance, ordering and payment, inspection and local processing, transport, customs clearance and delivery, and handling cancellations, refunds and disputes
- Retention period
- For the statutory periods below after the transaction ends. Separate identification information used for customs clearance or delivery is deleted after its purpose is fulfilled, except for information that must be retained by law.
- Service
- Access, security and usage analysis
- Information processed
- Cookie and session identifiers, IP address, access times and logs, browser and device information, referral sources, and page and button interaction events
- Purpose
- Maintaining sign-in, preventing misuse, responding to errors, security, usage statistics and interface improvements
- Retention period
- Session cookies remain until sign-out or expiry. Security and access records remain until their purpose is fulfilled or for the period set by the service provider or applicable law.
- Service
- Marketing communications (optional)
- Information processed
- Name, email, mobile telephone number, and times of consent and withdrawal
- Purpose
- Information about new services and benefits
- Retention period
- Until consent is withdrawn or membership is terminated. Evidence of consent is retained for the period required by applicable law.
| Service | Information processed | Purpose | Retention period |
|---|---|---|---|
| Membership and accounts | Name, email, mobile telephone number, membership type, company or business name (business members), password authentication information, and the times and versions of required and optional consents | Identity verification, account creation and security, member inquiries, and evidence of consent | Until membership termination or an account-deletion request. Records subject to statutory retention are stored separately for the periods in Section 3 below. |
| Consultations, quotations and purchasing requests | Name, company name, telephone number, email, consultation date, time, method and subject, product links, descriptions and photographs, variants, quantities, budget, schedule, sales channels and requirements | Receiving inquiries, reviewing products and suppliers, preparing quotations, and communicating progress | Deleted when the inquiry is withdrawn or its purpose is fulfilled. Records forming the basis of a contract or dispute are subject to the statutory periods below. |
| Ordering, payment, inspection, transport and customs clearance | Order and payment records, recipient names in Korean and English, telephone number, postcode and address, delivery method, inspection and packing requirements, business or personal customs-clearance category, business registration documents or personal customs-clearance code, and refund bank, account holder and account number | Contract performance, ordering and payment, inspection and local processing, transport, customs clearance and delivery, and handling cancellations, refunds and disputes | For the statutory periods below after the transaction ends. Separate identification information used for customs clearance or delivery is deleted after its purpose is fulfilled, except for information that must be retained by law. |
| Access, security and usage analysis | Cookie and session identifiers, IP address, access times and logs, browser and device information, referral sources, and page and button interaction events | Maintaining sign-in, preventing misuse, responding to errors, security, usage statistics and interface improvements | Session cookies remain until sign-out or expiry. Security and access records remain until their purpose is fulfilled or for the period set by the service provider or applicable law. |
| Marketing communications (optional) | Name, email, mobile telephone number, and times of consent and withdrawal | Information about new services and benefits | Until consent is withdrawn or membership is terminated. Evidence of consent is retained for the period required by applicable law. |
3. Statutory retention
Even after the processing purpose has been fulfilled, the following records are stored separately to address consumer disputes and meet legal obligations. Where applicable law provides different requirements for business-purpose transactions, the relevant statutory period applies.
- Records retained
- Contracts, withdrawal and related records
- Period
- 5 years
- Legal basis
- Act on Consumer Protection in Electronic Commerce, Etc.
- Records retained
- Payments and the supply of goods or services
- Period
- 5 years
- Legal basis
- Act on Consumer Protection in Electronic Commerce, Etc.
- Records retained
- Consumer complaints and dispute handling
- Period
- 3 years
- Legal basis
- Act on Consumer Protection in Electronic Commerce, Etc.
- Records retained
- Descriptions and advertising
- Period
- 6 months
- Legal basis
- Act on Consumer Protection in Electronic Commerce, Etc.
| Records retained | Period | Legal basis |
|---|---|---|
| Contracts, withdrawal and related records | 5 years | Act on Consumer Protection in Electronic Commerce, Etc. |
| Payments and the supply of goods or services | 5 years | Act on Consumer Protection in Electronic Commerce, Etc. |
| Consumer complaints and dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce, Etc. |
| Descriptions and advertising | 6 months | Act on Consumer Protection in Electronic Commerce, Etc. |
Important provision
4. Disclosure to third parties
As a rule, personal information is not disclosed to third parties without separate consent. However, the minimum necessary information may be provided to the recipients below to fulfil a customer-confirmed order or meet legal obligations. Before information is first shared, the actual company name and contact details of each order partner in China, and the information to be disclosed, are communicated through the order screen, quotation or registered email, and any necessary consent is obtained.
- Recipient
- Sellers and factories in China for the relevant order
- Purpose
- Checking stock and specifications, ordering and production
- Information
- Order identifiers, products, variants, quantities and work specifications. As a rule, personal recipient information is not provided; if required, separate notice is given before ordering.
- Retention period
- Until the ordering or production purpose is fulfilled and the recipient’s statutory retention period has ended.
- Recipient
- Warehouse, inspection and international transport partners in China for the relevant order
- Purpose
- Identifying inbound goods, inspection, local processing and international transport
- Information
- The information needed for the relevant work from among order numbers, products, quantities, work specifications, recipient names, telephone numbers, addresses and identifiers required for customs clearance.
- Retention period
- Until the order is completed and the recipient’s statutory retention period has ended.
| Recipient | Purpose | Information | Retention period |
|---|---|---|---|
| Sellers and factories in China for the relevant order | Checking stock and specifications, ordering and production | Order identifiers, products, variants, quantities and work specifications. As a rule, personal recipient information is not provided; if required, separate notice is given before ordering. | Until the ordering or production purpose is fulfilled and the recipient’s statutory retention period has ended. |
| Warehouse, inspection and international transport partners in China for the relevant order | Identifying inbound goods, inspection, local processing and international transport | The information needed for the relevant work from among order numbers, products, quantities, work specifications, recipient names, telephone numbers, addresses and identifiers required for customs clearance. | Until the order is completed and the recipient’s statutory retention period has ended. |
5. Entrusted processing
The following providers are entrusted with work needed to operate the service. Their data-protection obligations are checked through contracts and management procedures.
- Processor
- Google LLC and the contracted Google Cloud provider (Firebase Authentication, Firestore and Storage; Google Cloud Run in the Seoul region)
- Entrusted activities
- Member authentication, storage of data and attachments, server hosting in the Seoul region, and processing security and access logs
- Processor
- Google LLC (Google Calendar and Google Meet)
- Entrusted activities
- Creating consultation schedules, inviting attendees and issuing video consultation links
- Processor
- Resend, Inc.
- Entrusted activities
- Sending service emails concerning registration, consultations and order status, and processing delivery records
- Processor
- Customs brokers and customs-clearance providers for each order
- Entrusted activities
- Import declarations, customs-clearance representation and related documents. The actual provider is identified before the order proceeds.
- Processor
- Domestic delivery carriers for each order
- Entrusted activities
- Delivery within Korea and handling delivery incidents and returns. The actual carrier is identified before dispatch.
| Processor | Entrusted activities |
|---|---|
| Google LLC and the contracted Google Cloud provider (Firebase Authentication, Firestore and Storage; Google Cloud Run in the Seoul region) | Member authentication, storage of data and attachments, server hosting in the Seoul region, and processing security and access logs |
| Google LLC (Google Calendar and Google Meet) | Creating consultation schedules, inviting attendees and issuing video consultation links |
| Resend, Inc. | Sending service emails concerning registration, consultations and order status, and processing delivery records |
| Customs brokers and customs-clearance providers for each order | Import declarations, customs-clearance representation and related documents. The actual provider is identified before the order proceeds. |
| Domestic delivery carriers for each order | Delivery within Korea and handling delivery incidents and returns. The actual carrier is identified before dispatch. |
Important provision
6. Overseas transfers
Personal information may be transferred overseas through cloud and email features and the fulfillment of orders in China. Users who do not wish their information to be transferred may contact the email address below or withdraw before using the relevant feature or proceeding with the order. Refusing a transfer required for authentication, consultation scheduling or fulfillment in China may make it difficult to provide the relevant feature or order.
- Recipient and country
- Google LLC · United States (Firebase Authentication)
- Information and purpose
- Email, unique account identifiers, authentication status, and IP, device and access information · Member authentication and misuse prevention
- Timing and method
- Transferred over an encrypted network during registration, sign-in and authentication renewal
- Retention period
- Until membership termination or a deletion request, or for the retention period under the contract with Google or applicable law.
- Recipient and country
- Google LLC and the contracted Google Cloud provider · Selected resource locations in the Republic of Korea and countries used for support and security processing, including the United States (Firestore and Storage)
- Information and purpose
- Member, consultation, quotation and order information, and stored attachments · Service data and file storage, recovery and security support
- Timing and method
- Transferred over an encrypted network when storing, retrieving or recovering data
- Retention period
- For the retention period applicable to each category in Section 2, or under the contract with Google or applicable law.
- Recipient and country
- Google LLC · United States (Google Calendar and Meet)
- Information and purpose
- Consultation company name, contact name, email, contact details, schedule, booking reference and product summary · Managing consultation schedules and creating video links
- Timing and method
- Previously transferred over an encrypted network when consultations were booked. New transfers for booking purposes have ceased.
- Retention period
- Until the consultation purpose is fulfilled, or for the retention period under the contract with Google or applicable law.
- Recipient and country
- Resend, Inc. · United States and other service processing locations
- Information and purpose
- Recipient email address, name, email content, and sending and receiving status · Sending service emails
- Timing and method
- Transferred over an encrypted network when email is sent
- Retention period
- Until the email-delivery purpose is fulfilled, or for the retention period under Resend’s contract or applicable law.
- Recipient and country
- Order-specific sellers, factories, warehouses, inspection and transport partners · China
- Information and purpose
- The minimum order, product, recipient and customs information in Section 4 required to fulfil the order · Ordering, inspection, local processing and international transport
- Timing and method
- Transferred through the order system, email or business communication channels after the customer confirms the order-specific disclosure and transfer details
- Retention period
- Until the order is completed and the recipient’s retention period under applicable law has ended.
| Recipient and country | Information and purpose | Timing and method | Retention period |
|---|---|---|---|
| Google LLC · United States (Firebase Authentication) | Email, unique account identifiers, authentication status, and IP, device and access information · Member authentication and misuse prevention | Transferred over an encrypted network during registration, sign-in and authentication renewal | Until membership termination or a deletion request, or for the retention period under the contract with Google or applicable law. |
| Google LLC and the contracted Google Cloud provider · Selected resource locations in the Republic of Korea and countries used for support and security processing, including the United States (Firestore and Storage) | Member, consultation, quotation and order information, and stored attachments · Service data and file storage, recovery and security support | Transferred over an encrypted network when storing, retrieving or recovering data | For the retention period applicable to each category in Section 2, or under the contract with Google or applicable law. |
| Google LLC · United States (Google Calendar and Meet) | Consultation company name, contact name, email, contact details, schedule, booking reference and product summary · Managing consultation schedules and creating video links | Previously transferred over an encrypted network when consultations were booked. New transfers for booking purposes have ceased. | Until the consultation purpose is fulfilled, or for the retention period under the contract with Google or applicable law. |
| Resend, Inc. · United States and other service processing locations | Recipient email address, name, email content, and sending and receiving status · Sending service emails | Transferred over an encrypted network when email is sent | Until the email-delivery purpose is fulfilled, or for the retention period under Resend’s contract or applicable law. |
| Order-specific sellers, factories, warehouses, inspection and transport partners · China | The minimum order, product, recipient and customs information in Section 4 required to fulfil the order · Ordering, inspection, local processing and international transport | Transferred through the order system, email or business communication channels after the customer confirms the order-specific disclosure and transfer details | Until the order is completed and the recipient’s retention period under applicable law has ended. |
7. Automatically collected information, cookies and behavioural data
Firebase authentication session cookies, IP addresses, access times and logs, and browser and device information may be generated automatically to maintain sign-in and security. Blocking cookies may prevent some features, including persistent sign-in, from working.
Google Analytics 4 is currently used to analyse page views, referral sources and button interaction events statistically. User-level event data is retained for up to 14 months within the Google Analytics settings; aggregated statistics may remain for longer. Advertising identifiers or analytics cookies can be rejected through browser cookie-blocking or deletion settings, or the Google Analytics opt-out tool. Meta Pixel and Naver advertising tracking tools are not currently used in the production environment. This Policy and any necessary consent screens will be updated before they are enabled.
8. Google sign-in information
Google sign-in requests only the openid, email and profile scopes needed to verify an account. Basic profile and email-verification information are used for Firebase authentication. Google access tokens are not separately stored as business data. NexSupply does not access Gmail messages, Google Drive files or the user’s Google Calendar events.
Website consultation booking and the associated Google Calendar integration have ended, and no new booking information is transferred. Previously stored records and external calendar events are not automatically deleted or cancelled. Customer Google sign-in is separate. Information about its use, retention and deletion is available in the Google API and Data Use Disclosure.
9. Deletion procedures and methods
Information is deleted without delay when its retention period ends or its purpose has been fulfilled. Information that must be retained under other laws is separated and is not used for other purposes. Electronic files are deleted using methods that make recovery difficult, and paper records are shredded or securely disposed of. Processors are also asked to delete retained copies in accordance with their contracts and service procedures.
Important provision
10. User rights and how to exercise them
Users may request access, correction, deletion or suspension of processing, withdraw consent, or refuse overseas transfers. The user or a lawful representative may send the account email address, the request and a preferred reply method to the contact email below. Requests are handled after identity verification. For access, deletion and similar requests, the action taken or the reason for any extension or restriction is communicated within 10 days of receipt.
Some requests may be restricted where retention is required by law or another person’s rights may be infringed. In such cases, the grounds and how to object are explained. Consent to marketing communications may be withdrawn at any time, independently of service use, by unchecking the setting on the workspace account-information screen or contacting the email address below.
When entering information about a third party, such as a recipient other than the user, the user must provide the necessary notice and obtain the data subject’s consent. NexSupply uses that information only for order fulfillment, customs clearance and delivery.
11. Security measures
- Account authentication through Firebase Authentication and server-side authorisation checks
- HTTPS transmission and the storage and transmission protection features of Firebase and Google Cloud
- Separate administrator and member access rights, with data access limited to what is necessary
- Validation of uploaded file types and sizes, request-rate limits, and review of error and access records
- Avoiding storage of raw sensitive identifiers, such as consultation management tokens, or storing them in hashed form
12. Children under 14
This service is intended for trade orders by businesses, sellers and adult individuals, and is not directed at children under 14. If a user is confirmed to be under 14, the service verifies consent from a legal representative or restricts use, and deletes information for which there is no lawful basis for retention.
Important provision
13. Privacy contact and remedies
- Responsible team
- NexSupply Operations Team · Privacy protection and access requests
- Requests handled
- Access, correction, deletion, suspension of processing, withdrawal of consent, refusal of overseas transfers and privacy-infringement inquiries
If the internal response does not resolve the matter, users may seek advice or dispute mediation from the following organisations.
- Personal Information Infringement Report Center · 118, without an area code in Korea
- Personal Information Dispute Mediation Committee · 1833-6972
- Korean National Police Agency Cybercrime Reporting System · 182, without an area code in Korea
14. Notices of changes and revision history
If the information processed, purposes, processors or overseas-transfer arrangements change, the effective date and reasons are communicated through the service and verifiable methods, such as registered email, at least 7 days before an ordinary change and at least 30 days before a material change or one disadvantageous to users’ rights. Consent is obtained again where separate consent is required.
- Version
- 2026-07-30-v1
- Effective date
- 2026-07-30
- Summary
- Initial personal information processing policy for membership and trade orders
- Version
- 2026-08-13-v2
- Effective date
- 2026-08-13
- Summary
- Expanded information on data categories and retention, third-party disclosure, entrusted processing, overseas transfers, automatic collection, rights, deletion and safeguards
- Version
- 2026-08-16-v3
- Effective date
- 2026-08-16
- Summary
- Removed processing disclosures concerning AI product diagnostics that are not currently provided
| Version | Effective date | Summary |
|---|---|---|
| 2026-07-30-v1 | 2026-07-30 | Initial personal information processing policy for membership and trade orders |
| 2026-08-13-v2 | 2026-08-13 | Expanded information on data categories and retention, third-party disclosure, entrusted processing, overseas transfers, automatic collection, rights, deletion and safeguards |
| 2026-08-16-v3 | 2026-08-16 | Removed processing disclosures concerning AI product diagnostics that are not currently provided |