Privacy policy

Privacy Policy

1. General Provisions

Kinfolk Beauty Inc. (hereinafter referred to as the "Company") deeply values the personal information of its users and complies with U.S. laws and regulations concerning personal information protection. Furthermore, it adheres to global privacy protection regulations, including the Korean Personal Information Protection Act (PIPA), the U.S. California Consumer Privacy Act (CCPA), and the Japanese Act on Protection of Personal Information (APPI), to safeguard the privacy and rights of users. This Privacy Policy explains how the personal information provided by the user while using the site is collected, utilized, shared, stored, and destroyed, and clearly defines the rights users possess regarding their personal information and how to exercise them.

This policy is applied concurrently with the Site Terms of Service, and matters concerning the protection of personal information not separately mentioned in the Terms of Service shall follow this Policy. The Company makes this Policy public on the initial screen of the site so that users can easily review it at any time. The definitions of terms used in this Policy follow related laws or the Terms of Service, and if not, they follow their general meaning.

2. Items of Personal Information Collected and Methods of Collection

The Company collects the minimum necessary personal information through lawful and fair means for the provision of global e-commerce services. It does not collect sensitive information without the user's prior consent, nor does it collect or use the information of children under the age of 14 without parental consent. The main items of personal information collected and the methods of collection are as follows:

1) Items Collected

Upon Membership Registration: Name, email address, password, contact information (phone number), country/region of residence, (if applicable) date of birth.
Upon Product Order: Recipient's name, shipping address, contact information (phone number), email address (for order confirmation and receipt), payment information (credit card company name, partial card number, payment approval number, and other information necessary for payment).
Payment Processing: Depending on the payment method, payment details such as credit card number, expiration date, CVC may be required. However, such information is processed through a payment gateway (PG) company, and the Company only stores or confirms the minimum information necessary for card company approval.
Automatically Collected during Service Use: Log data such as access IP address, Cookies, date and time of visit, browser and OS type, usage history (product viewing, adding to cart, etc.), and device information may be automatically generated and collected. This information, in principle, does not include content that can directly identify an individual, but if combined with other personal information, it is treated as personal information.
Other: Information additionally provided by the user during event participation or survey responses (collection items specified and separate consent obtained upon announcement of the relevant event).

2) Methods of Collection

Direct Provision: Collected through information directly entered and submitted by the user during membership registration, profile entry, and the order/payment process.
Automatic Collection: Automatically collected through the system or cookies when the user visits the site or uses the app. (Details on cookies are explained in the Cookie Usage Policy below).
Collection from Third Parties: Information required for delivery, such as delivery completion information (e.g., delivery tracking number, delivery completion confirmation) from logistics companies, or necessary information collected with consent from the relevant provider when using social login.
Communication and Consultation: Personal information voluntarily provided by the user during customer service inquiries or email consultations (name, contact information, etc.) and recorded during phone calls may be collected. In this case, the collected information is used only for the purpose of responding to inquiries and resolving disputes.

3. Purpose of Personal Information Utilization

The Company utilizes the collected personal information within the scope of the following purposes. If the purpose changes, the Company will seek the user's prior consent. The Company uses personal information only within the scope necessary to achieve the specific purposes agreed upon at the time of collection and does not use it for any other purpose.

Member Management: Identity verification for the use of membership services, personal identification, confirmation of intent to join, age verification (confirmation of parental consent if under 14, etc.), maintenance and management of membership status, prevention of fraudulent use, prevention of unauthorized use, and restriction of registration and registration count.
Order Processing and Customer Service: Identity verification for the fulfillment of transactions such as product ordering, payment, and delivery, purchase and payment processing, delivery of ordered products (domestic and international shipping), notification of delivery status, refund/cancellation processing, AS and inquiry response, and other tasks necessary for the fulfillment of the contract.
Communication: Sending order confirmations and receipts, conveying important service announcements such as delivery delays, and contacting for customer inquiry response or dispute resolution. (These transactional messages are sent for transaction fulfillment regardless of member consent.)
Marketing and Promotion (Upon separate consent): Sending news about new products, sales events, and other events (such as sending newsletter emails). In this case, users receive information only if they have given prior consent, and they can opt out of receiving messages at any time. If opt-out is requested, the use for marketing purposes will cease.
Service Improvement and Research: Analysis of user service usage patterns, improving service quality through web/app log analysis, developing new features, and statistical analysis. The data used is anonymized or pseudonymized and is not used for personal identification purposes.
Compliance with Legal Obligations: Compliance with record retention obligations prescribed by domestic and foreign laws (e.g., retention of contract/subscription withdrawal records for 5 years in accordance with the Act on Consumer Protection in Electronic Commerce, etc.), cooperation with legitimate requests from investigative/supervisory agencies, accounting audits, and tax calculation.
Security and Abuse Prevention: Monitoring to protect the safety and integrity of the site, such as preventing hacking, unauthorized login, and fraudulent transactions. Detection and response to suspicious transactions, investigation and action against violations of terms or laws.

4. Provision of Personal Information to Third Parties

The Company does not, in principle, provide users' personal information to external parties. However, personal information may be exceptionally provided to third parties in the following cases:

When the User Has Given Prior Consent: When the user is notified of the third-party recipient, items, and purpose of personal information provision for a specific service use or promotion, and explicit consent is received.
When Required by Law: Where there is a specific provision in the law, or when an investigative agency requests it in accordance with the law for investigation purposes. Even in these cases, the Company will notify the user of the fact as much as possible and comply with legal procedures.
When Unavoidable for Service Fulfillment: When providing shipping address information and contact details to a delivery company for the delivery of ordered products, or when providing payment information to financial institutions for payment processing, the information may be provided within the scope allowed by relevant laws for transaction fulfillment. In such cases, the relevant company is typically prohibited from using personal information for any purpose other than providing the service. (e.g., information provided to the shipping company is prohibited from being used for purposes other than delivery).
Corporate Merger/Acquisition, etc.: In relation to a merger, acquisition, or asset transfer of the Company, in which the user's personal information is succeeded. In this case, the user will be notified of the fact and the information of the new recipient of personal information in advance, and the user will be given the option to withdraw consent, etc.

※ In particular regarding sensitive information (race, religion, health information, etc.) and the sale of personal information, the Company does not provide or sell information to third parties without the user's consent under any circumstances. Even by CCPA standards, the Company does not "sell" users' personal information. If the Company decides to sell information in the future, we will provide a “Do Not Sell My Personal Information” option to ensure the right to opt-out for California residents.

5. Outsourcing of Personal Information Processing

The Company may outsource some tasks to external professional companies for smooth service provision. The outsourced tasks and the recipients are as follows. The Company takes necessary measures and manages/supervises the recipients to ensure they comply with the Personal Information Protection Act through outsourcing contracts.

Payment Processing – Subcontractor: INICIS, PortOne Payment Gateway (PG) companies / Outsourced Service: Processing payments such as credit cards and account transfers, and managing payment security.
Product Delivery – Subcontractor: CJ Logistics, FedEx, DHL, and other logistics companies / Outsourced Service: Product packaging, international/domestic transportation, and tracking guidance.
Email/SMS Dispatch – Subcontractor: Shopify, Klaviyo mailing service providers / Outsourced Service: Sending mass emails/SMS such as order confirmations and newsletters.
Data Storage (Infrastructure) – Subcontractor: Amazon Cloud Services (AWS, etc.) / Outsourced Service: Storing service databases and server operation (physical servers may be located overseas; refer to the section on International Transfer below for details).

If new outsourcing becomes necessary, the Company will disclose the recipient and the scope of work through site notices and this Policy in advance and obtain consent.

The Company manages and supervises the recipients to ensure that they do not use personal information for purposes other than the entrusted tasks or re-entrust it to third parties, and specifies the responsibilities and obligations for the safe processing of personal information in the outsourcing contract.

6. International Transfer of Personal Information

Where necessary for global service operation, the Company may transfer the user's personal information to overseas servers or third parties located overseas (e.g., overseas subsidiaries or service providers). In the event of international transfer, the Company will notify the user of the details and obtain necessary consent or implement appropriate safeguards as permitted by relevant laws, such as PIPA Articles 17 and 29. The items and locations of international transfer are as follows:

Email Service: Emails sent to customers may be transmitted through overseas email service providers. – Destination: USA, etc., Information Transferred: Name, email address, email content.
Logistics and Payment: For international delivery, information necessary for shipping may be provided to local delivery companies, and overseas payment processing may involve overseas financial institutions.

The Company takes contractual measures to ensure that personal information transferred overseas receives a level of protection equivalent to that in Korea, considering the privacy protection level of the destination country and the recipient's safety measures. Users have the right not to consent to international transfer, and refusal may restrict the use of some global services.

7. Retention and Use Period of Personal Information

In principle, personal information is destroyed without delay when the purpose of collection is achieved. However, the Company safely stores information for the period prescribed by law or for which the user has given prior consent. The Company applies the most flexible retention policy possible within the scope of Korean law, aiming to strike a balance between protecting the legitimate interests of the seller (Company) and not infringing upon the user's rights.

Principles of Retention Period by User:

Member Information: Retained until membership withdrawal. Upon withdrawal request, information is destroyed immediately or after a certain period in accordance with relevant laws. However, identifying information may be retained for up to 30 days after withdrawal to prevent fraudulent use (e.g., to prevent misuse of duplicate discounts, etc.).
Order/Transaction Information: Retained for 5 years from the date of the last transaction for the purpose of proving transaction details and responding to consumer disputes (compliance with the mandatory retention period under the Act on Consumer Protection in Electronic Commerce, etc.). After this period, the information is destroyed without delay or anonymized.
Customer Inquiry Records: Retained for 3 years after the inquiry is resolved for the purpose of responding to inquiries and preventing disputes. (Mandatory retention of consumer complaint or dispute handling records for 3 years under the Act on Consumer Protection in Electronic Commerce, etc.).
Log Records (IP, etc.): Logs collected for security and service quality improvement are retained for 3 months from the date of collection (retention of access logs for 3 months under the Protection of Communications Secrets Act).
Marketing Consent Information: Records of marketing consent or refusal are retained for 5 years from the time of withdrawal or termination of consent to be used as evidence in the event of future disputes.

Mandatory Retention under Law:

Where relevant laws require the retention of personal information or related records for a certain period, the information is retained for that period.

Act on Consumer Protection in Electronic Commerce, etc.: Records related to contracts or subscription withdrawal (5 years retention); Records related to payment and supply of goods (5 years retention); Records related to consumer complaints or dispute resolution (3 years retention).
Tax-Related Laws (e.g., Framework Act on National Taxes): Transaction details such as tax invoices and receipts (5 years retention - Mandatory under tax law).
Electronic Financial Transaction Act: Records related to electronic financial transactions (5 years retention).
Protection of Communications Secrets Act: Login records (IP) (3 months retention).

Separate Storage of Personal Information for Long-Term Unused Accounts:

In accordance with relevant laws (PIPA and Enforcement Decree), the personal information of users who have not used the service for 1 year or more (no login or usage records) is separated and stored/managed separately from the personal information of other users. Separately stored personal information will be reused upon the user's request, except where there are special legal grounds, and will be safely destroyed after a certain period. The Company will notify long-term inactive users 30 days before the separate storage measure via email, etc., and will request a login within the notice period if the user wishes to continue using the service. (※ However, if the user has separately consented to long-term retention, the information will be retained within the scope of that consent.)

Destruction Procedure and Method:

Personal information for which the retention period has expired or the processing purpose has been achieved is destroyed using safe methods in accordance with Article 8 (Destruction Procedure and Method) of this Policy.

Note:

Notwithstanding the above retention periods, if the user requests the deletion of personal information, the Company will destroy the information or process it into an unidentifiable form without a special reason. However, a deletion request does not override the legal obligation to retain information. For example, even if the deletion of transaction records is requested, if the legal retention period remains, the information will be separated and stored until the period expires before destruction.

8. Personal Information Destruction Procedure and Method

When the purpose of processing personal information is achieved or the retention period expires, the Company destroys the information without delay. The procedures and methods of destruction are as follows:

Destruction Procedure:

When a user requests the deletion of personal information (e.g., through membership withdrawal) or when the purpose of collection and use is achieved, the personal information is stored for a certain period according to internal policies and laws and then destroyed. During this period, the personal information is not used for any purpose other than those defined by law. Example: Upon membership withdrawal, the withdrawal is processed immediately, but identifying information is retained for 30 days to prevent fraudulent use and respond to inquiries, and then destroyed (refer to Article 7, Paragraph 1, Member Information Retention Period).

Destruction Method:

Personal information in the form of electronic files is permanently deleted using a method that makes recovery or reproduction impossible (low-level formatting, use of permanent data deletion software, etc.). Personal information printed on paper documents is destroyed by shredding or incineration.

Partial Destruction:

If only information specified by law is stored separately, the remaining personal information can be destroyed, excluding that information. For example, deleting email addresses and other information while retaining transaction records that require 5 years of retention.

Destruction Confirmation:

The Company internally supervises these destruction tasks, and the Chief Privacy Officer (CPO) confirms the completion of destruction. Records related to destruction are maintained for a certain period to manage and confirm that the destruction procedure has been lawfully executed.

9. Rights and Exercise Methods of Users and Legal Representatives

The Company guarantees users the following rights regarding their personal information. Users can exercise these rights at any time, and the Company will take necessary measures without delay. However, if the exercise of rights may be restricted by relevant laws such as the PIPA, the Company will inform the user of the reasons.

Right of Access (열람권): Users can request access to the personal information the Company holds about them. Accordingly, the Company provides access to the categories and specific details of the personal information requested by the user. However, reasonable procedures for identity verification may be required when requesting access (e.g., requiring submission of an ID for verification, etc.).
Right to Rectification and Deletion (정정·삭제권): Users can request the rectification of errors in their personal information held by the Company, and request the deletion of unnecessary personal information after the purpose of collection/use is achieved. Upon receiving a request for rectification or deletion, the Company completes the measures within the legal period without undue delay. However, if other laws require the preservation of the information, the Company may separate the relevant part and defer processing.
Right to Restrict or Object Processing (처리정지권): Users have the right to request a temporary suspension of personal information processing or object to specific processing activities. For example, users can withdraw consent and request the cessation of processing for marketing purposes at any time. The Company accepts user requests for processing suspension, except when permitted by law, and the withdrawal does not apply retroactively to marketing activities performed before the withdrawal.
Right to Data Portability (데이터 이동권): Where stipulated by law, users can request to obtain the personal information they provided in a structured, machine-readable format and transfer it to another controller. (While the current South Korean PIPA, etc., does not explicitly mandate portability, the Company will provide a copy of the user's information within the lawful scope upon request.)
Right to Object to Automated Decision-Making: Where the Company makes decisions based on automated algorithms using the user's personal information (e.g., credit scoring through profiling; not currently applicable to our services), the user has the right to demand human intervention, request an explanation, and object to the decision.

Methods for Exercising Rights:

These rights can be exercised by contacting the Customer Center (phone or email) or through the personal information access/rectification/deletion request menu on the website. Upon application, the Company may request necessary information to verify the identity of the requester or their legal agent, and will notify the results of the action within 10 days (or within the period otherwise stipulated by relevant laws). For California residents subject to CCPA, we will respond within 45 days of the request, and will notify if an extension of up to an additional 45 days is necessary. Requests from Japan residents are typically processed within 2 weeks.
Requests for access and processing suspension of personal information are processed free of charge. However, a certain fee may be charged for excessive or unreasonable requests, such as repeated requests for the same content (within the scope permitted by law).
Legal representatives have the right to request access, correction, and deletion of personal information of children under the age of 14. In this case, additional information to prove legal representative status may be requested.
When the Company receives a request to exercise user rights, it verifies the identity of the requester or their legal agent and takes necessary action without delay, and notifies the processing result. If the Company refuses the request or takes only partial action for a legitimate reason, the reason and basis will be explained. Furthermore, upon deletion or processing suspension, the Company will notify the third party (if any) who received the personal information to ensure the same processing is performed.

10. Rights of California Residents (CCPA, etc.)

California consumers have additional rights under the CCPA and its amendments (CPRA). The Company faithfully implements the following for California residents:

Right to Know: The Company discloses the categories of personal information collected in the past 12 months, the source of each piece of information, the purpose of collection, and whether it was provided to third parties and their identities. Users can request a list of their personal information collected in the past 12 months and a specific copy of that personal information up to twice per year.
Right to Deletion: Similar to the right to deletion mentioned above, California consumers can request the deletion of their personal information. The Company complies with user deletion requests, excluding certain exceptions specified by the CCPA (information necessary to complete transactions, information required for legal compliance, etc.).
Right to Opt-Out of Sale: The Company does not sell users' personal information and therefore does not provide a "Do Not Sell My Info" link. If the sale of personal information to a third party (the act of providing personal information for monetary consideration) occurs in the future, the Company will clearly post a “Do Not Sell My Personal Information” option on the website to allow users to opt-out of the sale at any time. Furthermore, the personal information of minors under the age of 16 will not be sold without prior opt-in consent.
Right to Non-Discrimination: Users are guaranteed the right not to be discriminated against in terms of service quality or price due to exercising their rights under the CCPA. For example, the Company will not deny service use or increase prices as a penalty for requesting personal information deletion.
Exercise of Rights by an Agent: California residents can exercise their rights through an authorized agent. In this case, the Company may request proof of the agent's authority and will handle legitimate agent requests the same way as personal requests.

These CCPA-related rights can be exercised through the methods described above (contacting the Customer Center, etc.), and the Company will respond within the legal time limit after a verification process.

11. Remedies for Infringement of Data Subject Rights

The Company is committed to responding quickly and sincerely to personal information-related requests. If a user is not satisfied with the Company's measures or wishes to seek additional remedies for damages, they can contact the following organizations (based on Korean users):

Personal Information Infringement Report Center (operated by KISA): Website: privacy.kisa.or.kr / Phone: 118 (without area code).
Personal Information Dispute Mediation Committee: Website: www.kopico.go.kr / Phone: 1833-6972.
Supreme Prosecutors' Office Cyber Investigation Division: Phone: 1301 (without area code), cid@spo.go.kr.
National Police Agency Cyber Crime Report System (eCRM): Phone: 182 (without area code), cyberbureau.police.go.kr.

Overseas users may also inquire with the personal information supervisory authority or reporting center in their country of residence. (e.g., Japan Personal Information Protection Commission, Data Protection Authority in each country for EU residents, etc.)

12. Protection of Children's Personal Information

The Company's service is not intended for children under the age of 14, and the Company does not knowingly collect or use the personal information of children under 14. If the Company needs to register a child under the age of 14 (or under 15 in some countries like Japan) as a member or collect their personal information, we will obtain the prior consent of their parent (legal representative). If information about a child collected without parental consent is discovered, it will be deleted without delay. Furthermore, personal information of children under the age of 13, as stipulated by the U.S. Children's Online Privacy Protection Act (COPPA), is not collected or processed without parental consent, and if a violation is confirmed, the information will be destroyed immediately.

Parents or legal representatives have the right to request access, rectification, and deletion of personal information of children under the age of 14. Upon such a request, the Company will verify the identity of the requesting party as the legitimate representative and take the necessary action promptly.

13. Measures to Secure the Safety of Personal Information

The Company implements technical, administrative, and physical safety measures as follows to safely manage users' personal information:

Technical Measures: Personal information is safely protected by methods such as passwords, and important data is encrypted during storage and transmission. For example, user passwords are stored using one-way encryption, and security protocols such as SSL are used when transmitting payment-related information. Furthermore, to prepare for hacking and malicious code, firewalls, intrusion detection systems (IDS), etc., are installed, and security programs are regularly updated and checked.
Administrative Measures: The Company designates a Chief Privacy Officer (CPO) and establishes internal personal information protection policies, ensuring that employees are educated on and comply with them. Access rights to personal information are limited to the minimum necessary personnel, and internal inspections and audit procedures are used to monitor employees' personal information processing activities. Security pledges are signed and regular training is conducted to prevent personal information leakage/damage by employees or recipients.
Physical Measures: Facilities where personal information processing systems are located are designated as access-controlled areas, restricting entry to authorized personnel. An access control system is operated for server rooms and data storage rooms, and important data is stored in secure locations with locking devices.
Data Minimization and Pseudonymization: Only the minimum personal information necessary for business operations is processed, and if necessary, some personal information is masked or converted into pseudonymized information for utilization. For example, data is minimized by separately storing or deleting parts of the address information after a certain period following delivery completion.
Retention of Access Records and Prevention of Forgery/Alteration: Records of access to the personal information processing system are stored and managed for a minimum of 6 months, and security features are used to prevent forgery, theft, or loss of access records.

The Company is committed to preventing the loss, theft, leakage, forgery, alteration, or damage of users' personal information through these safety measures. If a personal information infringement incident occurs due to internal management negligence or technical issues, the Company will notify the facts without delay and take necessary countermeasures and actions.

14. Use and Refusal of Technologies such as Cookies

The Company may use cookies and similar technologies to provide better services to users. A cookie is a small text file stored on the user's device via the browser when visiting a website, and is used for the following purposes:

Purpose of Cookie Use: Cookies are used to maintain user login (session management), save shopping cart items, analyze site visit and usage patterns (providing customized services based on preference identification), etc. This allows users to avoid the hassle of repetitive information entry, and the Company can provide information tailored to user preferences.
Information Collected by Cookies: Information about the user's site usage, such as pages visited, links clicked, IP address, browser type, and access time, may be collected through cookies. However, cookies do not directly contain personally identifiable information, and the cookie ID is only an internal identifier and is not publicly disclosed to identify individual users externally.
Third-Party Cookies: The Company may utilize third-party web analytics tools such as Google Analytics, in which case user visit statistics may be collected through cookies provided by the third party. Furthermore, advertising cookies, such as Facebook Pixel, may be installed to provide customized advertising (provided based on separate consent).
How to Refuse Cookies: Users have the right to choose whether to allow cookie installation. Users can adjust the settings in the web browser's "Tools > Internet Options > Privacy" to allow all cookies, confirm each time a cookie is saved, or refuse the storage of all cookies. However, refusing to save cookies may lead to difficulties in using services that require login or some features that require customized settings.

Example Cookie Settings:

Internet Explorer: Tools > Internet Options > Privacy > Advanced: Set to allow/block cookies.
Chrome: Settings > Privacy and Security > Cookies and other site data: Set to block all cookies, etc.
Safari: Preferences > Privacy > Block cookies and website data setting.

15. Chief Privacy Officer and Contact Information

The Company is responsible for overseeing all personal information processing tasks and has designated the following Chief Privacy Officer (CPO) to handle user complaints and provide remedies for damages related to personal information processing:

Chief Privacy Officer (Data Protection Officer)
- Name: Kinfolk Beauty Inc.
- Contact: 02-790-3101
- Address: 4F, 33, Yeonmujang-gil, Seongdong-gu, Seoul, Republic of Korea
Personal Information Protection Department
- Department Name: CX
- Contact: 02-790-3101
- Responsibilities: Responding to personal information inquiries, processing requests for access/rectification/deletion, and checking security measures.

Users can contact the Chief Privacy Officer or the relevant department for all personal information protection-related inquiries, complaints, and remedies for damages arising while using the service. The Company will provide a prompt and sufficient response to such inquiries.

16. Changes to the Privacy Policy

If there are additions, deletions, or modifications to the Privacy Policy due to changes in laws, policies, or security technology, the Company will announce the reason and content of the changes on the website at least 7 days before the revision. However, in the event of a significant change to user rights (e.g., changes to collected personal information items, purpose of use, etc.), the Company will provide advance notice at least 30 days prior and may seek user consent again if necessary.

This Privacy Policy was established on July 1, 2025, and the time of the latest update is indicated at the bottom.

Date of Announcement: July 1, 2025
Date of Enforcement: August 1, 2025