SHINSEGAE HYPER GROUND Privacy Policy

Article 1 Purpose of collecting and using personal information
Article 2 Personal Information Collection Items and Collection Methods
Article 3 Retention and Use Period of Personal Information
Article 4 Procedures and methods for destroying personal information
Article 5 Use of Personal Information and Provision to Third Parties
Article 6 Outsourcing of Personal Information and Details of Work
Article 7 How to access, correct, delete, and withdraw consent to personal information
Article 8 Technical and administrative protection measures for personal information
Article 9 Installation, operation and rejection of automatic personal information collection devices
Article 10 Personal Information Protection Officer
Article 11 Personal Information Protection of Children
Article 12 Duty of Notification

The Internet shopping site (hereinafter referred to as "KASHION82") operated by Shinsegae Co., Ltd.(hereinafter referred to as the "Company") has established the following privacy policy to protect the personal information and rights and interests of users in accordance with relevant laws such as 「the Personal Information Protection Act」 and 「the Act on Promotion of Information and Communications Network Utilization and Information Protection」, and to facilitate the handling of user grievances related to personal information. If the Company revises this Privacy Policy, it will be notified through the website notice (or individual notice).

Article 1 Purpose of collecting and using personal information  
The Company collects personal information for the following purposes. The collected personal information will not be used for any purpose other than the following, and prior consent will be obtained when the purpose of use is changed.

① Member management
Identification, personal identification, prevention of unauthorized use by rogue members and prevention of unauthorized use, confirmation of intention to join, age verification, handling of complaints, and delivery of notices in accordance with the use of the service.

② Provide goods or services
Provide sales and purchase services, deliver goods, send invoices, verify age, settle payments, and other inputs.

Article 2 Personal Information Collection Items and Collection Methods    
SHINSEGAE HYPER GROUND collects and uses personal information as follows.

Category	Type	Collection items	Purpose of Collection	Retention and usage periods
Sign up	Buyer	Name, ID, Password, email address	Identification of users, provision of information based on service use (delivery of notices, confirmation of personal information, service-related consultation, handling of complaints, notes, etc.)
	Seller	ID, Password, Name, Business name, email address, mobile phone number, account information (bank name, account holder, account number), business name, business license number, business phone number, representative name, industry, business type, contact name, contact phone number, contact email address.	Providing business membership services, preventing duplicate memberships, managing information for receiving payments, etc.
		Business license, bank statement	Registering partners for recurring payments and collect information to receive payments
In the course of using the Services or conducting business	Buyer	Login (IP address, OS information, Device identification value)	Prevention of illegal/fraudulent use, provision of customized services, development of new services and quality improvement through statistics and analysis of service usage performance and surveys, and integrated service operation

Article 3 Retention and Use Period of Personal Information  
The Company shall retain and use personal information within the period of personal information retention and use agreed upon at the time of collection of personal information from the user or within the period required by law.

① For members, the period of retention and use of personal information is from the signing of the service use contract (membership) to the termination of the service use contract (including withdrawal application and ex officio withdrawal). However, if there is a special provision in the law, we will retain and use it in accordance with the relevant law.

② The retention period for personal information under applicable laws is as follows.
1. Records of consumer complaints or dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce, etc.)
2. Records on payment and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
3. Records on contract or subscription withdrawal: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
4. Records on display/advertising: 6 months (Act on Consumer Protection in Electronic Commerce, etc.)
5. Records of access: 3 months (Enforcement Decree of the Act on Protection of Communications Secrets)

③ Introducing an expiration date for personal information
The Company stores and manages the personal information of long-term non-users separately from the personal information of other users to protect the personal information of non-users of the service. Members who have not logged in for more than one year are automatically treated as dormant members and their personal information is separated and stored separately. However, the Company will notify the user of the relevant contents via email, text, etc. one month prior to the separation of personal information of non-users.

Article 4 Procedures and methods for destroying personal information  
① Destruction Process
Information entered by users for membership registration, etc. shall be destroyed without delay when the purpose of collection or the purpose for which it was provided is fulfilled. If it is necessary to keep it for a certain period of time according to internal policies and related laws, it is transferred to a separate database (separate filing cabinet for paper) and destroyed after storage. In this case, the personal information transferred to the database will not be used for other purposes unless required by law.

② Destruction Method
Information in the form of electronic files uses technical methods that make the records unrecoverable. Personal information printed on paper is destroyed by shredding or incineration.

Article 5 Use of Personal Information and Provision to Third Parties  
① The Company processes personal information only within the scope specified in Article 1, "Purpose of Collecting and Using Personal Information," and provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as the consent of the information subject and special provisions of the law, and otherwise does not provide personal information to third parties.

② The Company provides personal information to third parties as follows in order to provide smoother services to users.

recipient	Purpose of Provision	Provide information	Retention and usage periods
Seller [리스트 보기]	Provide delivery services	Buyer name, buyer ID, buyer email address, buyer cell phone number, recipient name, recipient address, recipient cell phone number
	Customer support and complaints	Name, email address, ID

Article 6 Outsourcing of Personal Information and Details of Work  
① In order to provide users with smoother services, the Company entrusts the handling of personal information to external specialized companies as follows.

A. Status of consignment

* Period of retention and use of personal information: until withdrawal of membership or termination of consignment contract

B. Re-entrusted status

 (1) No re-entrustment work 

② When entering into a consignment contract, the Company shall specify in the contract the prohibition of processing personal information other than for the purpose of performing consignment work, technical/administrative protection measures, restrictions on re-consignment, management and supervision of the consignee, and responsibilities such as compensation for damages, and shall manage and supervise whether the consignee processes personal information safely.

③ If the contents of the consignment work or the trustee are changed, we will notify you through this privacy policy without delay.

Article 7 How to access, correct, delete, and withdraw consent to personal information  
① Users may exercise their rights to view, correct, or delete their personal information and withdraw their consent to the Company at any time.

② The rights in the preceding paragraph may be exercised through the following methods in accordance with Article 41 of the Enforcement Decree of the Personal Information Protection Act, and may also be exercised through an agent, such as the user's legal representative or a person who has been delegated. However, if you use an agent, you must submit a power of attorney in the form of Appendix No. 11 to the Notification on Personal Information Processing Methods (No. 2020-7).
- Homepag e: After logging in, click "My Page" to view, correct, or withdraw personal information.
- Help Center : main phone) 82-2-727-1824, 82-2-727-1825
- Privacy Officer : separk@shinsegae.com
- Mail: Fashion Platform TF, New Retail, 5F, 194, Sinbanpo-ro, Seocho-gu, Seoul, Korea

③ If a user requests correction of errors in personal information, we will not use or provide the personal information until the correction is completed. In addition, if we have already provided incorrect personal information to a third party, we will notify the third party of the results of the correction process without delay so that the correction can be made.

④ The Company handles personal information that has been terminated or deleted at the request of the user as specified in the retention and use period of personal information collected by the Company, and does not allow it to be viewed or used for any other purpose.

Article 8 Technical and administrative protection measures for personal information  
In handling members' personal information, the Company takes the following technical and administrative protection measures to ensure reliability so that personal information is not lost, stolen, leaked, altered or damaged.

① Members' personal information is protected by a password, and important data is protected by separate security features, such as encrypting file and transmission data or using the file lock function (LOCK).

② The Company takes measures to prevent damage from computer viruses by using antivirus programs. The antivirus program is updated regularly, and if a virus suddenly appears, the Company provides a vaccine as soon as it is available to prevent personal information from being compromised.

③ The Company adopts a security device (SSL or SET) that can safely transmit personal information on the network using cryptographic algorithms.

④ To prevent external intrusions such as hacking, we use intrusion prevention systems and vulnerability analysis systems for each server to ensure security.

⑤ When accessing internal systems that can access customer information, access is restricted through SMS authentication.

⑥ We do not mix personal and general data and keep them separate.

⑦ The Company limits access to members' personal information to a minimum number of persons. The minimum number of persons includes the following.
1. Those who work directly with users in sales and marketing.
2. Persons who perform personal information management duties, such as the personal information protection officer and person in charge
3. Other persons who are required to handle personal information for business purposes

⑧ We provide regular in-house and outsourced training to employees who handle personal information on acquiring new security technologies and their obligations to protect personal information.

⑨ We have internal procedures in place to prevent information leakage by humans through the security pledge of personal information handlers when they join the company, and to monitor the implementation of the personal information protection policy and the compliance of employees.

⑩ Handover of duties of personal information-related handlers is conducted thoroughly while maintaining security, and responsibilities for personal information incidents are clarified after joining and leaving the company.

Article 9 Installation, operation and rejection of automatic personal information collection devices  
① A "cookie" is a very small piece of data sent by an HTTP server to a user's browser and stored on the customer's computer's hard drive. A cookie identifies the customer's computer but does not identify the customer personally.

② Cookies expire when you close your browser or log out. Cookies expire after one day and can be deleted by using your browser's 'delete cookies' function.

③ Installing and rejecting cookies
1. Customers have a choice about the installation of cookies, so they can accept all cookies, confirm each time a cookie is stored, or refuse to store all cookies by setting options in their web browser.
2. However, if you refuse to save cookies, you may have difficulty using some services that require you to log in.
3. How to specify whether to allow cookies to be installed (for Internet Explorer)
(1) Select [Internet Options] from the [Tools] menu
(2) Click [Personal information
(3) Click [Advanced]
(4) Select whether to accept cookies
4. How to specify whether to allow cookies to be installed (for Safari)
(1) Select [Safari] -> [Preferences] from the top left menu bar of MacOS
(2) In the [Preferences] window, go to [Security] and select whether to allow cookies.

Article 10 Personal Information Protection Officer  

① In order to protect your personal information and handle complaints and inquiries related to personal information, we have designated the relevant departments and personal information protection officers as follows.

② If you need to report or consult about other personal information infringement, please contact the following organizations.
- Personal Information Infringement Report Center (HTTPS://PRIVACY.KISA.OR.KR / 118 without area code)
- Personal Information Dispute Mediation Committee (HTTPS://KOPICO.GO.KR / 1833-6972)
- Supreme Prosecutors' Office Cyber Investigation Division (HTTPS://WWW.SPO.GO.KR / 1301 without area code)
- National Police Agency Cyber Investigation Bureau (HTTPS://CYBERBUREAU.POLICE.GO.KR / 182 without area code)

Article 11 Personal Information Protection of Children  
We do not accept registrations from children under the age of 14 to provide our website services.

Article 12 Duty of Notification  
The current Privacy Policy was revised on October 10, 2024, and any additions, deletions, or modifications to the contents due to changes in government policy or security technology will be notified on the homepage at least 7 days prior to the revision.

Effective Date
Privacy Policy Effective Date : October 10, 2024
Privacy Policy Notice Date : October 2, 2024