Privacy policy

Effective Date: November 2, 2026

Wave Company Co., Ltd. (the "Company," "we," "us," or "our"), a company incorporated and headquartered in the Republic of Korea, together with its U.S. subsidiary WaveWear Corp., which operates this online store, processes personal information in accordance with the Personal Information Protection Act of the Republic of Korea ("PIPA") and related laws. Wave Company Co., Ltd. is the party responsible for the personal information described in this policy. This Privacy Policy applies to the website wavewear.cc (the "Site"), including purchases, inquiries, reviews, surveys and marketing communications made through it.

Company: Wave Company Co., Ltd. (Business Registration No. 215-87-44601)

Address: #716 DMC Hi-Tech Industry Center, 330 Seongam-ro, Mapo-gu, Seoul 03920, Republic of Korea

Online store operator: WaveWear Corp., 4056 Via Ingresso, Cypress, CA 90630, USA

1. Personal Information We Process and Why

(1) Orders, payment and delivery

  • Items: name, email, phone number, shipping and billing address, order details (products, sizes, amounts), payment status. Card numbers are entered with the payment provider and are not stored by us.
  • Purpose: processing orders and payments, shipping products from Korea (international shipping requires the recipient's name, address and phone number), returns, refunds and customer support

(2) Inquiries and customer support

  • Items: name, email, phone number (if provided), inquiry details
  • Purpose: responding to inquiries and handling claims

(3) Reviews, surveys and restock alerts

  • Items: name or nickname, email, review text and photos you choose to submit, survey answers, the product you want to be notified about
  • Purpose: publishing reviews, understanding customer needs, and telling you when a product is back in stock. Reviews you post may be visible to the public.

(4) Marketing emails and text messages

  • Items: email address, phone number (for text messages), name, purchase and browsing activity related to our emails
  • Purpose: sending news, offers and reminders by email (and by text message only if you sign up for it). These are sent with your consent, which you may withdraw at any time; every message includes an unsubscribe option.

(5) Automatically collected information

  • Items: IP address, browser type, device type, pages visited, products viewed, cart activity, visit date and time, cookie IDs, and the website usage records described in Section 7
  • Purpose: operating, securing and improving the Site, measuring and improving our advertising, and identifying visiting businesses (see Apollo.io in Section 5)

2. Retention Period

We destroy personal information without delay once the purpose of processing has been achieved, unless the law requires us to keep it.

  • Records of contracts, orders, payment and supply: 5 years (Act on the Consumer Protection in Electronic Commerce)
  • Records of consumer complaints and dispute handling: 3 years
  • Records of advertisements and marketing: 6 months
  • Inquiry records: until the inquiry is handled and related communication ends
  • Marketing subscribers: until you unsubscribe
  • Website usage records by our own analytics tool: up to 1 year
  • Other records held by service providers: according to the provider's settings and policies, as described in Section 5

3. Provision to Third Parties

We do not sell personal information. We provide personal information to third parties only with your consent, where the law requires it, or as described in this section.

Meta Platforms, Inc. (Meta Pixel and Conversions API through the Facebook & Instagram app) receives website and purchase activity (cookie ID, pages and products viewed, cart, checkout and purchase events, device and browser information, IP address, and, when you check out or are signed in, your email address, phone number, first and last name, city, state, ZIP code and country, sent in hashed (scrambled) form as Meta requires) to measure and improve our advertising. For visitors in the EU/EEA and the United Kingdom this happens only after they accept cookies. Meta processes it under its own privacy policy.

Shipping carriers receive the recipient's name, address and phone number to deliver your order.

4. Entrustment of Processing

We entrust the following work to service providers:

  • Shopify Inc.: online store hosting, checkout and order management
  • Shopify Payments and Stripe: card payment processing
  • PayPal: payment processing (if you choose PayPal)
  • Google LLC: website statistics (Google Analytics and Google Tag Manager)
  • Hotjar Ltd.: website usage analysis (heatmaps and session recordings)
  • UAB Omnisend: email marketing
  • Judge.me and Stamped: customer reviews
  • Pop Convert: website pop-ups
  • Notify Me!: restock alerts
  • Zigpoll: customer surveys
  • GemPages: page builder (does not receive personal information unless you submit a form built with it)
  • Shipping carriers (international couriers): delivery

We also use Apollo.io, Inc. to identify the business behind some website visits (B2B visitor identification). See Section 5.

5. Transfer of Personal Information Overseas

Some of the entrusted work above involves storing or processing personal information outside Korea. Each item below applies only to visitors who use the related feature.

(1) Shopify Inc. (https://www.shopify.com/legal/privacy)

  • Country: Canada and the United States (and other countries where Shopify's data centers are located)
  • Items: order, customer, shipping and payment information; access records
  • When and how: transmitted over the internet whenever you visit the Site, create an order or submit a form
  • Purpose and retention: store hosting, checkout and order management / until the end of our service contract or until the retention period in Section 2 ends

(2) PayPal (https://www.paypal.com/privacy)

  • Country: United States and other countries where PayPal operates
  • Items: name, email, payment and billing information, order amount
  • When and how: transmitted over the internet when you pay with PayPal
  • Purpose and retention: payment processing / according to PayPal's policy and legal requirements

(3) Shopify Payments and Stripe, Inc. (https://stripe.com/privacy)

  • Country: United States and other countries where the provider operates
  • Items: card payment information, billing details, order amount
  • When and how: transmitted over the internet when you pay by card
  • Purpose and retention: payment processing / according to the provider's policy and legal requirements

(4) Google LLC (https://support.google.com/policies/contact/general_privacy_form)

  • Country: United States
  • Items: website usage records (cookie ID, pages visited, device information, IP address)
  • When and how: transmitted over the internet each time you visit the Site, where analytics are active (see Section 7)
  • Purpose and retention: website statistics / according to our Google Analytics data retention setting (up to 14 months)

(5) Meta Platforms, Inc. (Meta Pixel and Conversions API; https://www.facebook.com/privacy/policy)

  • Country: United States and Ireland
  • Items: cookie ID, pages and products viewed, cart, checkout and purchase events, device and browser information, IP address; at checkout or when signed in, hashed email address, phone number, first and last name, city, state, ZIP code and country
  • When and how: transmitted over the internet during your visit and checkout, where advertising measurement is active (see Section 7)
  • Purpose and retention: advertising measurement / according to Meta's privacy policy and our advertising settings

(6) Hotjar Ltd. (dpo@hotjar.com)

  • Country: Malta (servers in Ireland, EU)
  • Items: website usage records (clicks, scrolls, mouse movements, device information, IP address, country)
  • When and how: transmitted over the internet each time you visit the Site, where analytics are active
  • Purpose and retention: website usage analysis / up to 1 year

(7) Apollo.io (https://www.apollo.io/privacy-policy)

  • Country: United States
  • Items: IP address and pages visited, used to match the visit to a business
  • When and how: transmitted over the internet each time you visit the Site, where analytics are active
  • Purpose and retention: B2B visitor identification for sales outreach to businesses / under Apollo's privacy policy

(8) UAB Omnisend (Vilnius, Lithuania; https://www.omnisend.com/legal/privacy/)

  • Country: Lithuania (EU), and other countries where Omnisend's affiliates (United Kingdom, United States) and service providers are located
  • Items: name, email, phone number, browsing and purchase activity connected to our messages
  • When and how: transmitted over the internet when you sign up, shop or interact with our emails and text messages
  • Purpose and retention: email and text marketing / until you unsubscribe or ask us to delete

(9) Review, restock-alert, survey and pop-up apps

(10) Shipping carriers (the postal service or international courier used for your order)

  • Country: the countries of dispatch, transit and delivery
  • Items: recipient name, address, phone number, parcel contents and value (customs declaration)
  • When and how: provided when your order is shipped
  • Purpose and retention: delivery and customs clearance / as required by the carrier and customs law

If you do not want these transfers, you can refuse them by not using the related feature (for example, not creating an order or not submitting a form) and by blocking cookies as described in Section 7. In that case, we may not be able to complete your order or respond to you.

6. Destruction Procedures and Methods

When the retention period ends or the purpose has been achieved, we destroy electronic files using technical methods that prevent recovery, and destroy paper records by shredding or incineration.

7. Automatic Collection Devices (Cookies and Analytics) and How to Refuse Them

(1) Our own visitor analytics tool

  • It uses browser storage (local and session storage) to record how you interact with the Site, such as clicks, taps, scrolls and mouse movements, along with device type, browser, screen size and a random visitor ID.
  • We do not use this information to identify you by name. Text you type into forms, long numbers such as card or phone numbers, and email addresses are masked before they are recorded. The recording database of our own tool does not store IP addresses; IP addresses appear only in ordinary web server and platform access logs.
  • The records are stored on servers managed by the Company in Korea and kept for up to 1 year.

(2) Google Analytics and Google Tag Manager, Hotjar and Apollo.io use cookies or similar technologies to measure and analyze visits. Meta Pixel (and the Conversions API) measures advertising. Omnisend uses cookies to connect your browsing with our messages.

(3) Shopify and our payment providers also set cookies necessary for the Site to function, for security, for your cart and checkout, and to remember your choices.

(4) Cookie banner and when optional tools run:

  • Visitors in the 30 EU/EEA countries and the United Kingdom see the Shopify cookie banner. For these visitors, Meta Pixel and Conversions API, Hotjar, Apollo.io and our own visitor analytics tool run only after they accept, and they can change their choice at any time through the privacy settings link on the Site. Google Tag Manager and Google Analytics currently load for all visitors; we are working to make them follow the same rule.
  • For visitors elsewhere, no cookie banner is shown and these tools, including our own tool, run by default. These visitors can opt out as described in (5).

(5) How to refuse:

  • You can block cookies and delete site data in your browser (Chrome: Settings > Privacy and security > Delete browsing data; Edge, Safari and Firefox have equivalent settings).
  • To opt out of Google Analytics, use the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout).
  • In some U.S. states, Shopify shows a "Your privacy choices" (data sharing opt-out) page.
  • If your browser sends a Do Not Track or Global Privacy Control signal, our own tool does not record your visit. Do Not Track signals are not otherwise treated as an opt-out by the third-party tools listed above.
  • You can also ask us to stop using your information for marketing or advertising by emailing the Privacy Officer in Section 10; we honor such requests from anyone, wherever you live.

Blocking cookies does not limit your ability to browse the Site, though some features such as the cart may not work.

8. Your Rights and How to Exercise Them

You may request access to, correction or deletion of, or suspension of processing of your personal information, and you may withdraw your consent at any time. Please contact the Privacy Officer in Section 10 by email or phone. You may also do this through a legal representative or a person you have authorized. We may need to verify your identity first. We will respond without delay, within 10 days. To ask us to delete your website usage records, please tell us the date, time and device of your visit; because the recording database of our own tool does not store IP addresses, we may not always be able to locate a specific visit. We may need to keep some records (for example, order and payment records) for the periods required by law in Section 2.

U.S. residents: We do not sell personal information for money. Advertising partners such as Meta receive the website and purchase activity described in Section 3. You may opt out as described in Section 7(5), and we honor opt-out requests sent by email from anyone, wherever you live.

9. Security Measures

We take the measures required by PIPA, including limiting access to personal information to authorized staff, encrypted transmission (HTTPS), access control on the systems that store personal information, and restricting access to the analytics viewer to authorized staff. Payment card details are handled by our payment providers and are not stored by us.

10. Privacy Officer

  • Privacy Officer: Diana Choi
  • Department handling requests: Operations Team (Lee Dong-su)
  • Phone: +82-70-4044-7333
  • Email: contact-global@wavecompany.net

11. Children

This Site is not directed at children under 14 (and not at children under 13 in the United States). We do not knowingly collect personal information from children under 14. If you believe a child has given us personal information, contact the Privacy Officer and we will delete it.

12. Remedies

If you need to report or seek advice about a privacy infringement, you may contact:

  • Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr / +82-118
  • Personal Information Dispute Mediation Committee: www.kopico.go.kr / +82-1833-6972
  • Supreme Prosecutors' Office Cybercrime Investigation: www.spo.go.kr / 1301
  • Korean National Police Agency Cyber Bureau: ecrm.police.go.kr / 182

13. Governing Law

This Privacy Policy is governed by the laws of the Republic of Korea. Any dispute relating to it shall be subject to the competent courts of the Republic of Korea, to the extent permitted by applicable law. Residents of other countries may also have rights under the mandatory laws of their country of residence. Where the GDPR or UK GDPR applies to you, you may also lodge a complaint with your local supervisory authority.

14. Changes to This Policy

We will announce any changes to this Privacy Policy on this page at least 7 days before they take effect (30 days for material changes). Previous versions are available on request.

  • Effective Date: November 2, 2026