PERSONAL INFORMATION PROCESSING POLICY
(“PRIVACY POLICY”)

 

1. General Provisions

Prada Korea LLC, with its registered office in Seoul, Republic of Korea, as the company which directly operates the sale of products offered on https://www.prada.com/kr/en/ (hereinafter the “Website”) with shipping in Korea (“Prada Korea”), together with its parent company Prada S.p.A., with registered office in Milan (Italy), the operating holding company of the Prada Group and manager of www.prada.com brand website, (hereinafter, both referred to as “PRADA”) recognise the importance of maintaining the confidentiality, integrity and security of your personal information (“Personal Data”), and hereby inform you that any Personal Data which you provide to PRADA through our Website, as well as any Personal Data which you may provide to a Prada Group store, including through its subsidiaries and/or affiliates (collectively the “Prada Group”), will be processed in compliance with privacy laws as applicable from time to time, including the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc. (“Network Act”), the Personal Information Protection Act (“PIPA”), and the General Data Protection Regulation (EU) 2016/679 (“GDPR”) together with the principles and general rules of conduct contained in the Code of Ethics adopted by the Prada Group.

2. Items of Personal Data to be Collected and Methods of Collection

In order to provide you with services requested, Prada Korea collects your Personal Data as listed below. There are mandatory and optional items. Mandatory items are strictly necessary for the provision of services. The optional ones are useful for improving services and allow us to better meet your requests; even if you do not consent to those optional items, there will be no restriction in using the services.
Personal Data will be collected by means of website, written form, fax, telephone, e-mail, event participation, etc., and Personal Data will only be collected through online shopping malls (including the Website), brand websites, and stores directly operated by Prada Korea and franchised stores.

Data created/collected in the course of using or processing our services both online and offline at a Prada Group store directly operated by Prada Korea or by phone:

A. Registration to the Website and account creation

- Mandatory items: title, first name, last name, location, e-mail address, password

B. Fulfilling online or phone purchase orders

- Mandatory items: title, first name, last name, e-mail address, billing and shipping addresses (including country, city/province, Si/Gun/Gu and postal code), method of payment, mobile phone/telephone number, purchase details (including exchanges, refunds and repairs), (these items are automatically uploaded from data saved in your account if you place a purchase order as registered member), details of conversations

C. Sending a request to/Contacting our Client Service

- Mandatory items: title, first name, last name, location, e-mail address and/or phone number, language, details of conversations

D. Request for repair service

- Mandatory items: first name, last name, contact details (e-mail address or mobile phone/telephone number), details of product to be repaired (including purchase date and location), (these items may be automatically uploaded from data saved in your account if you are a registered member)    

E. Subscription to the newsletter

- Mandatory items: e-mail address, location, collection you are interested in (man/woman)

F. Registration into the Prada Group customer database by filling out a customer card (“Customer Card”)

- Mandatory items: title, first name, last name, location, e-mail address or mobile phone number
- Optional items: address (including city/province, Si/Gun/Gu and postal code), date of birth
- Additional items (automatically collected): purchase details (including exchanges, refunds and repairs), any other information collected in the course of managing your relationship with the Prada Group.

G. In addition, we may also obtain information about you as a result of authentication or identity checks (for example, you will be asked to present your identity document when you pick up your purchase in-store). We use this information to identify you as a customer, to process your order, to deliver products and services, and to process payments, but this information will not be retained by Prada Korea.

Please note that when contacting our client service, we may respond to your request by SMS message if you agree for us to do so. We may also provide delivery information via SMS message to the mobile phone number you have provided us with.

The provision of Personal Data is optional. However, if you wish to make a purchase order for the products offered on our Website, and/or register to the Prada Group customer database, and/or use any other services offered on the Website, you need to fill in all mandatory fields of the relevant forms, otherwise Prada Korea cannot proceed with the contractual services requested.

You may expressly choose whether or not to consent to the collection, processing and use of your Personal Data for the purposes referred to under section 3, letters (f) and (g) below. If you do not consent, you may still place purchase orders or use our services, but we will not be able to proceed with the indicated purposes including notifying you of any initiatives of interest to you, and/or send you any other commercial information on products, services, initiatives and events of the Prada Group, and you will not have access to the additional exclusive features reserved for registered members that may be useful for your shopping experience.

3. Purpose of the Collection and Use of Personal Data

Your Personal Data may be collected, processed and used for the following purposes:

(a) Responding to all your requests and managing your relationship with PRADA;
(b) Fulfilling your purchase orders, performing all management activities connected with it (including management of the contract, financial transactions, delivery of goods, delivery of invoice, etc., purchase and payment processing, management of any claims and litigation, and fraud prevention), and complying with any applicable legal or regulatory obligations;
(c)Provision of post-sale service (including repairs service);
(d) sending by email the newsletters regarding Prada and the other Prada Group’s products, services, initiatives and events as a result of your subscription to the service.

Furthermore, if you agree to register to the Website or fill out and sign the Customer Card at a Prada Group store, your Personal Data may be collected, processed and used, together with the details of your purchases online and/or in stores, for the following purpose:

(e) Confirmation of identity as a registered customer and, consequently, to provide a customized Customer Service and post-sale service and allow you to access exclusive services and benefits reserved for registered members (e.g.: preservation of the purchase order history, faster checkout online process, simplified procedure for product repair and warranty, commercial discounts, pre-sale and other promotional events, etc.);

and, specifically after obtaining your consent, for these optional purposes:

(f) Marketing: contacting and/or sending you information and promotions including commercial information, advertising material, catalogues and invitations to events related to Prada and other brands, products and services of the Prada Group;
(g) Profiling: performing individual or group studies, surveys, statistical analyses and market research with regards to your preferences for Prada and other brands, products and services of the Prada Group, so that a personalised service can be offered and cultural and recreational activities may be promoted based on customer’s interests.

The Personal Data processing referred to letters (a) to (e) is necessary to provide the service requested and execute and perform the contract with you or the related pre-contractual measures and to fulfill the connected legal obligations of an administrative and fiscal nature. Further, the data processing referred to letters (f) and (g) is based on your prior separate consent.

4. Provision of Personal Data to a Third Party

Provision of Personal Data to the Prada Group

Subject to your separate prior consent, your Personal Data will be provided to the parent company and operating holding company of the Prada Group in Italy, Prada S.p.A., to be included in its Prada Group customer data base, through its Customer Relationship Management System, and visible to all Prada Group’s stores globally (the stores directly operated by Prada S.p.A. and/or its subsidiaries or affiliates) to provide a global customized Customer Service at your request. Your Personal Data, together with the details of your purchases and any other information collected in the course of managing your relationship with the Prada Group, will be processed as set forth below:

A. Recipient (Contact Information) and Location (Country): Prada S.p.A. (Italy)
B. Time and Method of Transfer: online transmission immediately upon collection of your Personal Data and your registration into the Prada Group customer database
C. Recipient’s Purpose of Using Personal Data

(a) Global Customized Customer Service: to recognize you as a registered customer at any Prada Group store so that we can offer you a personalized and more efficient service and allow you to access to exclusive services and benefits reserved for registered members;
(b) Profiling: to perform individual or group studies, surveys, statistical analyses and market research with regards to your preferences for Prada and other brands, products and services of the Prada Group, so that a personalised service can be offered and cultural and recreational activities may be promoted based on customers’ interests;
(c) Marketing: to contact and/or send you information and promotions, including commercial information, advertising, catalogues and invitations to events related to Prada and other brands, products and services of the Prada Group.
(d) Newsletter: to send you by email the newsletters regarding Prada and the other Prada Group’s products, services, initiatives and events as a result of your subscription to the service.

D. Items of Personal Data to be Provided:
Title, first name, last name, date of birth, location, postal address (including city/province, Si/Gun/Gu and postal code), e-mail address, telephone and mobile phone, purchase details (including exchanges, refunds and repairs) and any other information collected in the course of managing your relationship with the Prada Group.
E. Period of Retention and Use of Personal Data by Recipient:

(a) regarding the data processing of registered members into Prada Group customer database:
Personally identifiable information and contact details are kept for a period of 7 years from the date of your last interaction with the PRADA Group, and purchase details are kept for a period of 7 years from the date of purchase.
(b) regarding the data processing for providing the newsletter service: until you unsubscribe from the service

Your Personal Data may be provided exceptionally to a third party without your consent in following cases:

(a) When providing data in a personally unidentifiable form for statistics, academic study or market research purposes;
(b) When there is any special provision set forth in applicable laws and regulations, including the Criminal Procedure Act, the Act on Real Name Financial Transactions and Confidentiality, the Credit Information Use and Protection Act, the Framework Act on Telecommunications, the Telecommunications Business Act, the Radio Waves Act, the Local Tax Act, the Act on Consumer Protection, and the Bank of Korea Act.

5. Outsourcing of the Processing of Personal Data (Korea)

For smooth provision and quality improvement of our services, Prada Korea may delegate the processing of your Personal Data to an outside service provider.

A. Upon outsourcing the processing of Personal Data, we will enter into an outsourcing agreement, etc. to clearly stipulate the outside service provider’ strict compliance with our instructions on protection of Personal Data, prohibition of provision to a third party and liability for an incident, if any, and such agreement will be maintained either in writing or electronically.
B. When you make payment for products, your credit card data (including credit card numbers and other payment information) are provided to our payment services providers who process payment details further. PRADA does not store or maintain your credit card data or use it directly.
C. Please see below the list of Prada Korea’s service providers together with the specific processing tasks to be outsourced. The service providers will use Personal Data adopting the appropriate technical and organizational measures in such a manner that processing will meet any regulatory requirements in accordance with any applicable laws. The service providers will not use any Personal Data beyond the scope of the work outsourced and will retain data only to the extent necessary for the execution of the outsourcing agreement.

Service Providers in Korea

Service Provider	Outsourced Service
NHN KCP Co., Ltd	Payment Services Provider
ILYANG Logis Ltd.	Courier Services
Iron Mountain Korea Co., Ltd.	Document Management Agency Service
Saeromteo	Product Repair, and Recording and Management of Relevant Matters
Seongeunsa	Product Repair, and Recording and Management of Relevant Matters
SeoHyeonSa	Product Repair, and Recording and Management of Relevant Matters
MB Repair	Product Repair, and Recording and Management of Relevant Matters
Busan Myeongdongsa	Product Repair, and Recording and Management of Relevant Matters
Shinsegye Clothing Repair Shop	Product Repair, and Recording and Management of Relevant Matters
Songwha Clothing Repair Shop	Product Repair, and Recording and Management of Relevant Matters
Wizard Clothing Repair Shop	Product Repair, and Recording and Management of Relevant Matters
Aladdin Clothing Repair Shop	Product Repair, and Recording and Management of Relevant Matters
BaekHwaJeom Clothing Repair Shop	Product Repair, and Recording and Management of Relevant Matters
ShinSeung Workroom	Product Repair, and Recording and Management of Relevant Matters
KT corp.	SMS service provider
MBI Solution inc.	KAKAO Chat service provider

6. Overseas Outsourcing of Personal Data Processing, and Overseas Transfer of Personal Data

Your Personal Data will be transferred overseas for overseas outsourcing of the data processing as set forth below.

Service Provider (Country)	Outsourced Service	Items of Personal Data to be Transferred	Time/Method of Transfer	Period of the Retention and Use by Service Provider	Contact Information
Prada S.p.A. (Italy)	IT management services provider	All Personal Data	Immediate collection/automatic transfer through information network	(a) until the term of the service agreement to carry out the outsourced services; (b) to the extent necessary to meet any regulatory requirement in accordance with any applicable laws;	Data Protection Officer privacy@prada.com
CyberSource Limited (United Kingdom)	Payment Services Provider	Merchant ID and number, postal address, telephone number, IP address, other payment information	Immediate collection/automatic transfer through information network	(a) until the term of the service agreement to carry out the outsourced services; (b) to the extent necessary to meet any regulatory requirement in accordance with any applicable laws;	Visa Global Privacy Office privacy@visa.com

D. Your Personal Data will not be used for the promotion of products, services or initiatives by entities other than the Prada Group, nor shall they be disclosed to unknown persons under any circumstances.

7. Period of the Retention and Use of Personal Data, and Procedure and Methods of Destruction

The Personal Data you provided will be safely retained while you receive the services provided by Prada Korea, and in principle, will be retained and used for seven (7) years from the final purchase date in accordance with the storage periods required by the applicable laws, or until you revoke your consent to the processing, if applicable. Upon lapse of the retention period or fulfilment of the purposes of use, any Personal Data printed out on paper will be destroyed by means of shredding or incinerating, unless otherwise required to be retained under other laws and regulations, for example, as set forth below. Any Personal Data stored in the form of electronic files will be destroyed using a technical method which makes the files irrecoverable.

- Records on withdrawal of agreement or subscription, etc.: five (5) years (Act on Consumer Protection in Electronic Commerce, etc.)
- Records on payment and supply of goods: five (5) years (Act on Consumer Protection in Electronic Commerce, etc.)
- Records on handling of consumers’ complaints or disputes: three (3) years (Act on Consumer Protection in Electronic Commerce, etc.)
- Records on website visit: three (3) years (Protection of Communications Secrets Act)
- Personal Data relating to the newsletter service: until you unsubscribe from the service

In particular, regarding the data processing of registered members collected for the purposes of section 3 letters (e), (f) and (g):

- Personally identifiable information and contact details are kept for a period of 7 years from the date of your last interaction with PRADA
- Purchase details are kept 7 years from the date of purchase.

8. Your Rights as Customer and Methods of Exercising Rights thereof

A. You may at any time access or correct your registered Personal Data. If you would like to access or correct the Personal Data, you may access or correct your Personal Data directly at our store or on our Website, or may contact our Data Protection Officer via e-mail for us to make the corrections.

B. If you request correction of an error in your Personal Data, we will not use such Personal Data until the correction is completed.

C. If you have an online customer account, you can also access, amend or update your information by logging into My Account on the Website and amending your details as appropriate. If you have registered into the Prada Group customer database offline at a store, you can also access, amend or update your information by visiting a store and speaking to one of our sales associates or writing to the parent company Prada S.p.A. at privacy@prada.com.

D. You also have the right to withdraw your consent at any time by writing to Prada Korea and/or Prada S.p.A. at the contact details set out in Section 11 or by using the “unsubscribe” link included in all of our commercial electronic communications, and/or by using any other appropriate procedures which may be made available to you by PRADA. The withdrawal of your consent will not affect the lawfulness of processing based on your consent before its withdrawal.

E. Please note that you, or your legal guardian if you are a minor (applicable if you are under the age of 16 or older depending on your country or state of residence), may exercise the rights under the applicable privacy laws and specifically the right to request information as to whether your Personal Data is being processed and as to the characteristics of the processing, the right to rectification and erasure of your Personal Data, the right to object to the processing and/or the right to have those Personal Data transmitted to another controller.

F. Please also note that if you consent to the provision of your Personal Data to Prada S.p.A., the holding company of the Prada Group, as described in Section 4 above, you may exercise the rights under the GDPR writing to Prada S.p.A., and specifically the right to request information as to whether your Personal Data is being processed and as to the characteristics of the processing, the right to rectification and erasure of your Personal Data, the right to object to the processing and/or the right to have those Personal Data transmitted to another controller.

If you consider that the processing of your Personal Data infringes the GDPR you have the right to lodge a complaint with the Italian Garante per la protezione dei dati personali (www.garanteprivacy.it) or take legal action.

9. Installation, Operation and Refusal of Automated Personal Data Collection System

A. Browsing Data
During normal operation, the computer systems and software procedures used to operate our Website collect certain personal data (log files). The transmission of such data is inherent to the use of internet communication protocols. This information is not collected in order to be associated to specific data subjects. However, due to its nature, this information can allow users to be identified by means of their processing and integration with data held by third parties. Such information includes the IP addresses or domain names of the computers you use to visit our Website, URIs (Uniform Resource Identifiers) of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical status code of the server reply (successful, error, etc.) and other parameters concerning the user's operating system and computer environment. This data is used with the sole purpose of obtaining anonymous statistical information on the use of our Website and to guarantee its correct operation.

B. Cookies
Our Website uses cookies to ensure its efficient functioning and to improve our services. Cookies are small text files that are sent to your computer (usually to your browser) by the websites you visit. Cookies are stored in your computer to be recognised by those websites on your subsequent visits.

For more information on cookies, on the types of cookies used on our Website, on how to disable them and on how you can revoke your consent, see our cookie policy.

If you want to block or delete cookies received from the Website or other websites, you may change your browser setting through a certain function. You can find information in the following links on how to refuse cookies in the browsers:

- Internet Explorer - http://windows.microsoft.com/en-gb/windows-vista/block-or-allow-cookies
- Chrome - https://support.google.com/chrome/answer/95647
- Fire Fox - https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-Website-preferences
- Opera - http://www.opera.com/help/tutorials/security/privacy/
- Safari - http://support.apple.com/kb/PH17191

10. Technical and Managerial Measures for the Protection of Personal Data

A. In order to prevent the loss, theft, leakage, falsification, and destruction of your Personal Data, we have implemented reasonable technical and managerial security measures required under the current applicable laws included the PIPA and the Network Act. In particular, your Personal Data will be processed by suitable electronic or automated means and computerised tools, or manually and on hard copy, exclusively for the purposes for which they have been collected and guaranteeing the security and confidentiality of any processed information through the adoption of appropriate measures to prevent the alteration, cancellation, destruction, unauthorised access or not allowed processing or not in accordance with the purpose of collection.

B. Your Personal Data will be processed only by PRADA internal staff duly authorised to do so under their respective job duties.

C. Please also note that if you consent to the provision of your Personal Data to Prada S.p.A., the holding company of the Prada Group, as described in Section 4 above, your Personal Data will be automatically visible to all Prada Group’s stores globally (the stores directly operated by Prada S.p.A. and/or its subsidiaries or affiliates), and PRADA will take all appropriate measures of security and confidentiality required by applicable legislation to ensure an adequate standard of data protection.

11. Names and Contacts of the Personal Data Management Officer and Protection Officer

If you have any request on your Personal Data, on this Privacy Policy or on how you might exercise your rights, you may contact the Chief Privacy Officer or the DPO free of charge.

Any request relating to your Personal Data processing for the purposes of managing and executing your online purchase order or other matters referred to in Section 3 above may be addressed to:

- Chief Privacy Officer
- Name: Wooche Cho
- Department: IT
- E-mail: client.service.kr@prada.com
-Contact: 080-522-7199

Prada Korea LLC., Dae-San building, 439, Apkujeong-Ro, Gangnam-Gu, Seoul, Republic of Korea
e-mail: client.service.kr@prada.com

Any request relating to the provision of your Personal Data to the Prada Group referred to in Section 4 above may be addressed to:

Prada S.p.A., Via Antonio Fogazzaro 28, 20135 Milan (Italy)
Position: Data Protection Officer (“DPO”)
e-mail: privacy@prada.com

12.  Obligation to Notify

PRADA reserves the right to amend this Privacy Policy at any time. Any material amendments to this Privacy Policy that are made pursuant to applicable laws and regulations or PRADA’s internal policies shall be notified to you at least 7 days prior to when the amendments are to take effect. The Privacy Policy currently in force is the one published on our Website. Prada Korea is not liable for i) any damage on data caused by an unexpected incident arising from inherent risks in the network, such as hacking, despite security measures technically taken by Prada Korea, or ii) any dispute arising from a post written by a visitor.

Effective Date: June 9^th, 2023

Previous versions:
August 1^st, 2022
April 21^st, 2022
May 6^th, 2020