Privacy policy

Bault Global Privacy Policy

Version v1.0 | Published Sep. 4, 2026 | Effective Sep. 4, 2026

THE BAULT, INC. ("Bault," "we," "us," or "our"), the company behind the trading card collectibles brand Bault, respects your privacy and is committed to protecting the personal data you share with us. This Global Privacy Policy ("Policy") describes how we collect, use, disclose, and safeguard personal data of users located outside the Republic of Korea who interact with the Bault website, online store, redemption services, and related offline events (collectively, the "Services").

This Policy is designed to reflect the requirements of major international privacy frameworks, including the EU/UK General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), as applicable to you based on your location. Users located in the Republic of Korea are covered by our separate Korean-language Privacy Policy, which applies where domestic law is more specific.

1. Personal Data We Collect

1.1 Account registration

• Required: name, email address, password, mobile phone number

• Optional: date of birth, shipping address (if pre-registered)

1.2 Orders and purchases (including guest checkout)

• Required: purchaser name, recipient name, shipping address, contact number, payment method details

• Card numbers and other sensitive payment data are processed and stored by our payment processor, not by Bault directly.

1.3 Redemption card service

If you pull a redemption card from a Bault product and register it on our website to receive the physical premium card, we collect:

• Required: unique redemption card code, name, email address, shipping address, contact number

• Purpose: verifying the authenticity of the redemption code, confirming your identity, fulfilling shipment of the redeemed item, and providing status updates via customer support

1.4 Loyalty / mileage program (planned)

We are evaluating the introduction of a points/mileage loyalty program. If and when launched, we will collect payment amount data and points earned, redeemed, and balance history, and will update this Policy with the specific terms before the program takes effect.

1.5 Events, promotions, and pop-up stores

• Name, contact information, and (for prize fulfillment) shipping address

1.6 Marketing communications (optional)

• Email address, mobile phone number, collected only with your consent or another valid legal basis

1.7 Information collected automatically

• Cookies and similar technologies, IP address, visit date/time, device and browser information, pages viewed, and usage logs

2. How We Use Personal Data, and Our Legal Basis

Purpose	Examples	Legal basis (GDPR)
Account & service management	Identity verification, fraud/abuse prevention	Performance of a contract; legitimate interests
Order fulfillment	Shipping, payment processing, customer service	Performance of a contract
Redemption fulfillment	Verifying codes, shipping premium items	Performance of a contract
Loyalty program (planned)	Points accrual/redemption, abuse prevention	Performance of a contract; legitimate interests
Marketing	Product news, promotions, event invitations	Consent
Legal compliance	Responding to lawful requests, record-keeping	Legal obligation

For users in California and other jurisdictions that do not use the GDPR's "legal basis" framework, we process personal data as necessary to provide the Services you request, to comply with law, and for other business purposes described in this Policy.

3. Retention

• Order, payment, and redemption records are generally retained for up to 5 years after fulfillment to address warranty claims, disputes, and applicable legal record-keeping obligations, consistent with the retention periods used for our Korean operations.

• Loyalty/mileage records (if launched) will be retained until account closure or program termination, as further described when the program is introduced.

• Marketing data is retained until you withdraw consent or, absent activity, for a reasonable inactivity period, after which it is deleted or anonymized.

• We will delete or anonymize personal data once it is no longer needed for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

4. How We Share Personal Data

We do not sell your personal data for money. We share personal data only as described below or with your consent.

Recipient	Purpose	Data shared
Shopify Inc. (and its affiliates)	E-commerce platform hosting, storage, and infrastructure for our online store	Account information, order information
[Payment processor to be named]	Payment processing, fraud prevention, identity verification	Payment information
[International shipping/logistics carrier(s) to be named]	International shipment of orders and redemption items	Shipping information
[3PL warehousing provider to be named]	Warehousing and order fulfillment	Shipping information
Naver Corp. (Naver Smart Store)	Where you purchase through our Naver Smart Store channel, order processing and delivery coordination	Order information, shipping information

These service providers act on our instructions and are contractually bound to protect your personal data. This list will be finalized once vendor contracts (payment processor, international carrier, 3PL) are confirmed.

We may also disclose personal data where required by law, to protect the rights, property, or safety of Bault, our users, or others, or in connection with a merger, acquisition, or sale of assets, with notice to affected users where required.

5. International Data Transfers

Because Bault's e-commerce platform and certain service providers operate outside your country of residence, your personal data may be transferred to, stored, and processed in Canada, the United States, the Republic of Korea, and other countries where Bault or its service providers maintain operations.

• Where required by the GDPR, we rely on appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses, or transfers to jurisdictions recognized as providing an adequate level of protection.

• You may contact us using the details in Section 12 to request more information about the safeguards used for a specific transfer.

6. Your Privacy Rights

6.1 If you are located in the EEA, UK, or Switzerland (GDPR)

• Right to access the personal data we hold about you

• Right to rectification of inaccurate or incomplete data

• Right to erasure ("right to be forgotten"), subject to legal exceptions

• Right to restrict or object to processing, including for direct marketing

• Right to data portability

• Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

• Right to lodge a complaint with your local data protection supervisory authority

6.2 If you are a California resident (CCPA/CPRA)

• Right to know what personal information we collect, use, and disclose

• Right to delete personal information, subject to exceptions

• Right to correct inaccurate personal information

• Right to opt out of the "sale" or "sharing" of personal information — Bault does not sell personal information for monetary consideration and does not share it for cross-context behavioral advertising as of the effective date of this Policy

• Right to non-discrimination for exercising your privacy rights

6.3 Exercising your rights

You may exercise any of the above rights by contacting us using the details in Section 12. We will verify your identity before responding and will respond within the timeframe required by applicable law. If we are unable to fulfill a request, we will explain why.

7. Children's Privacy

Bault's Services are intended for users aged 14 and older, consistent with the age guidance we apply to our trading card products given their chance-based ("pull") elements. We do not knowingly collect personal data from children under the minimum age required by applicable law in their jurisdiction (for example, 13 in the United States, or 16 in the EEA unless a lower age is set by local law) without appropriate parental or guardian consent. If we learn that we have collected personal data from a child without the required consent, we will take steps to delete that information.

8. Cookies and Similar Technologies

• We use cookies and similar technologies to remember your preferences, keep you signed in, understand how the Services are used, and, where you consent, support marketing.

• You can control cookies through your browser settings. Blocking cookies may affect your ability to use certain features, such as staying logged in or completing checkout.

• Where required by law, we will request your consent to non-essential cookies through a cookie banner or similar mechanism before they are set.

9. Security

• We use encryption for passwords and sensitive data in transit and at rest, restrict access to personal data to authorized personnel, and use technical safeguards such as firewalls and access controls.

• No method of transmission or storage is completely secure; we cannot guarantee absolute security, and you are responsible for keeping your account credentials confidential.

10. Marketing Communications

• We only send marketing communications with your consent, where required by law, or on another applicable legal basis.

• Every marketing email includes a clear way to unsubscribe, and we will honor opt-out requests promptly.

11. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or applicable law. We will post the updated Policy on our website with a new effective date, and where changes are material, we will provide additional notice (such as an email or an on-site banner) before the changes take effect.

12. Contact Us

If you have questions about this Policy or wish to exercise your privacy rights, please contact us:

	Details
Data controller	THE BAULT, INC.
Privacy contact	DONGWAN HAN / CEO
Email	dongwan@bault.cards
Address	6F, 140 Sapyeong-daero, Seocho-gu, Seoul, Republic of Korea
EU/UK representative (if applicable)	[To be designated if required under GDPR Art. 27]