Privacy Policy and Cookies

Mango Korea Ltd. (hereinafter the "Company") processes personal information in compliance with the Personal Information Protection Act ("PIPA") and all other applicable laws and regulations of the Republic of Korea, in order to protect the rights and interests of data subjects. In accordance with Article 30 of PIPA, the Company establishes and publicly discloses this Privacy Policy to inform data subjects of the procedures and standards governing the processing of their personal information and to ensure that any related grievances are handled promptly and effectively.

This Privacy Policy applies to personal information processed by the Company through its online shopping platform (https://shop.mango.com) and mobile application (collectively, the "Platform").

The Company processes only the minimum personal information necessary for the purposes set out below, and does not use personal information for any purpose other than those described herein. Where the purpose of processing changes, the Company will take all necessary measures in accordance with Article 18 of PIPA, including obtaining separate consent where required.

1-1. Personal Information Collected and Processed Without Consent

Legal basis: PIPA Art. 15(1)(iv)—performance of a contract.

1-2. Personal Information Collected and Processed With Consent

Legal basis: PIPA Art. 15(1)(i)—data subject’s consent.

Data subjects who decline to consent to marketing communications will NOT be restricted in their use of the Company’s core services (purchase, delivery, customer service, etc.).

Notwithstanding the retention periods set out in Article 1, the Company retains the following categories of personal information for the periods required by applicable law. Such information is stored separately from active data and is not used for any other purpose:

The Company destroys personal information without delay once it has become unnecessary—whether due to expiry of the retention period, achievement of the processing purpose, or any other reason.

Exception: Where continued retention is required by applicable law, the relevant personal information is transferred to a separate database or retained at a separate location. Such information is not used for any purpose other than compliance with the applicable legal requirement.

The Company’s procedure and method of discarding personal information is as follows:

The Company processes personal information only within the scope of the purposes set out in Article 1, and provides personal information to third parties only where the data subject has consented or where otherwise permitted under Articles 17 and 18 of PIPA. The Company does not otherwise provide personal information to any third party.

The Company outsources certain personal information processing activities to the processors listed below. In all outsourcing agreements, the Company includes provisions pursuant to Article 26 of PIPA prohibiting processing outside the scope of the outsourced task, requiring the implementation of technical and managerial protective measures, restricting sub-processing, providing for supervision and audit rights, and establishing liability for damages. The Company supervises all processors to ensure the safe handling of personal information. Any change to the scope of outsourced tasks or the identity of processors will be disclosed through this Privacy Policy without delay.

5-1. Domestic Processors

The Company transfers personal information overseas as set out below, pursuant to Article 28-8 of PIPA. Transfers to EU/EEA member states are made on the basis of the equivalency recognition notified by the PIPC in September 2025 pursuant to Article 28-8(1) of PIPA, recognizing that the level of personal information protection in the EU/EEA is equivalent to that provided under Korean law.

How to refuse overseas transfer: Data subjects may refuse the overseas transfer of their personal information. However, because the transfers described below are necessary for the operation of the Platform and the provision of services, refusal may result in the restriction of or inability to use some or all services.

Data subjects who do not wish to have their personal information transferred overseas may withdraw from membership via Platform > Account > delete account or by contacting the Company by phone at 00-7983218084, by email at personaldata@mango.com, or by post at: Atención al Cliente, Via Augusta, 10 (Polígono Industrial Riera Caldes), 08184 Palau-solità i Plegamans, Barcelona, Spain. Data subjects may also exercise their rights under Article 8 of this Privacy Policy.

The Company implements the following technical, managerial, and physical measures pursuant to Article 29 of PIPA and the Enforcement Decree thereunder, to ensure the security and integrity of personal information and to prevent loss, theft, unauthorized disclosure, alteration, or damage:

8-1. Rights of Data Subjects

Data subjects may exercise the following rights against the Company at any time:

• Right to request access
• Right to request correction of errors
• Right to request deletion
• Right to request suspension of processing
• Right to withdraw consent

Rights of access and suspension of processing may be restricted pursuant to Articles 35(4) and 37(2) of PIPA.

8-2. How to Exercise Rights

Data subjects may submit requests to exercise their rights by email to the Chief Privacy Officer at the address below. The Company will respond within 10 days of receipt in accordance with Article 35(3) of PIPA.

• Chief Privacy Officer: Margarita Salvans Puigbo,
• Title: DPO
• Email: personaldata@mango.com

The Company uses cookies and similar automatic collection tools (collectively, "Cookies") on the Platform to store and retrieve usage information in order to provide individually tailored services. Cookies are files sent by the Platform's server to the user's browser and stored on the user's device. They are automatically transmitted to the server each time the Platform is accessed. The Company does not store sensitive personal identification information such as passwords or financial account details in Cookies.

9-1. Types of Cookies Used

Cookies on the Platform are managed as follows:

• First-party Cookies: Created and managed by the Company in its capacity as operator of the Platform.
• Third-party Cookies: Managed by external service providers. Third parties whose Cookies are in use are listed in the cookie settings panel on the Platform.

9-2. Cookie Retention

Personal information collected through Cookies is retained only for the period reasonably necessary to respond to user inquiries, resolve issues, improve the service, and comply with applicable law. Upon expiry of the applicable retention period, such information will be blocked across all Company systems.

The validity period of consent given for non-essential Cookies does not exceed 13 months. Upon expiry, the Company will request fresh consent when the user next visits the Platform.

9-3. Overseas Transfer of Cookie Data

Cookie data may be transferred to service providers located outside the Republic of Korea. Such transfers are made only where a lawful basis exists under Article 28-8(1) of PIPA, including where the destination country has been recognized as providing an equivalent level of personal information protection, or where the data subject has given separate consent. The Company does not sell Cookie data to any third party.

The third countries to which Cookie data may be transferred are as follows: the United States, Canada, and EU/EEA nations.

9-4. Managing Cookie Settings

Users may allow, restrict, or delete Cookies at any time through the Platform's cookie settings menu or through their browser or device settings. Refusing certain Cookies may limit access to some features of the Platform.

The button to access the cookie settings panel is available at the bottom of the page.

For guidance on managing cookie preferences, please refer to the help section of the following browsers:

• Internet Explorer
• Google Chrome
• Mozilla Firefox
• Safari
• Opera

For Internet Explorer, cookie settings may be configured as follows:

Click "Internet Options" in the "Tools" menu

Click the "Privacy" tab

Set the desired "Privacy Level"

For further information on how third-party service providers handle personal information collected through their cookies, users are encouraged to consult the respective privacy policies available on each provider's platform.

The Company designates the following Chief Privacy Officer (CPO), who has overall responsibility for personal information processing and for the handling of data subject complaints and requests for remedies:

Data subjects may direct all personal information-related inquiries, complaints, and requests for remedies to the Chief Privacy Officer or the responsible department. The Company will respond without delay.

Data subjects may seek relief or consultation in connection with personal information infringement through the following institutions. The Company is committed to protecting the personal information rights of data subjects and to providing prompt consultation and remedies in the event of any infringement.

This Privacy Policy is effective from 01/07/2026.

In the event of any addition, deletion, or revision to this Privacy Policy, the Company will provide notice through the Platform.

Previous versions of this Privacy Policy are available here.