Privacy Policy

1. Purposes of Processing

The Company processes personal information for the following purposes only. If a purpose changes, the Company takes necessary measures such as obtaining separate consent under Article 18 of the Act.

• Membership registration and management: confirming intent to register, identification and authentication, maintaining membership, preventing misuse, notices, handling grievances
• Provision of goods or services: delivering products, providing services, sending contracts and invoices, identity verification, payment and settlement, managing order history
• Handling grievances: verifying the complainant, checking the complaint, contacting for fact-finding, notifying results
• Handling exchanges, returns and refunds, and responding to disputes
• Providing convenience features: publishing product reviews, wishlist, sending restock alerts, mobile phone verification, and choosing the language of notification e-mails and messages

2. Personal Information Collected and Methods

• Registration (e-mail): required — e-mail address, password (stored encrypted), name / optional — mobile phone number
• Registration (social login such as Kakao): required — social account identifier, e-mail address, name (nickname) / optional — profile image
• Orders and delivery: required — recipient name, mobile phone number, postal code and address, delivery note, order and payment history
• Payment: payments are processed by payment gateways (Toss Payments, Smartro). The Company does not store card or bank account numbers, and keeps only the approval number, payment method type and amount.
• Exchanges, returns and refunds: required — reason, refund account details (for bank-transfer refunds)
• Guest orders: required — e-mail address for order confirmation and notices (together with the recipient details)
• Mobile phone text verification: the date and time verification was completed (the verification code is not stored; it is delivered only by text message)
• Product reviews, 1:1 inquiries, restock alerts and wishlist: the review (including star rating) and inquiry content, the product option for which a restock alert was requested (alerts are sent to the registered e-mail), and wishlisted products
• Display language setting: kept to decide the language of notification e-mails and messages
• Automatically generated during use: IP address, access time, service usage records, device and browser information, cookies

Methods: entered directly by the user at registration, ordering or customer inquiries; provided by the social login provider; generated automatically during service use.

3. Processing and Retention Period

The Company retains personal information within the period required by law or agreed at collection.

• Membership registration and management: until withdrawal. However, if an investigation or inquiry into a violation of relevant laws is in progress, until that investigation or inquiry ends; and if claims or obligations arising from use of the service remain, until they are settled
• Goods or services: until supply and payment settlement are complete, subject to the following statutory retention under the Act on Consumer Protection in Electronic Commerce
• Records on contracts or withdrawal of offers: 5 years
• Records on payment and supply of goods: 5 years
• Records on consumer complaints or dispute handling: 3 years
• Records on labeling and advertising: 6 months
• Access records (login records, IP) under the Protection of Communications Secrets Act: 3 months
• Database backup files: only the latest 14 days of backups are kept on the server and older ones are deleted; the encrypted copy that the administrator keeps on a PC is limited to the latest 3 months
• Records on electronic financial transactions under the Electronic Financial Transactions Act: 5 years

4. Provision to Third Parties

The Company processes personal information only within the purposes in Section 1 and provides it to third parties only with the data subject's consent or where Articles 17 and 18 of the Act apply.

For delivery, the Company provides information as follows:

• Recipient: the courier designated at order time (e.g. CJ Logistics, Lotte, Hanjin, Korea Post) / Items: recipient name, mobile phone number, address, delivery note / Purpose: delivering products / Retention: until delivery is complete and the courier's statutory retention period ends

5. Outsourcing of Processing

The Company outsources processing as follows:

• Supabase, Inc.: member authentication and database hosting (servers in Singapore — see Section 6 on cross-border transfer)
• Gabia, Inc.: website server hosting, and storage of service access records and database backup files (servers located in the Republic of Korea)
• Toss Payments Co., Ltd. and Smartro Co., Ltd.: payment processing and settlement
• Resend, Inc.: sending transactional e-mails about orders and delivery
• NAVER Cloud Corp.: sending text messages (SMS) and Alimtalk (KakaoTalk notification) messages (mobile phone number, message content)
• Kakao Corp.: identity confirmation for social login
• NAVER Corp.: identity confirmation for social login

Under Article 26 of the Act, outsourcing contracts specify prohibition of processing beyond the outsourced purpose, technical and managerial safeguards, restrictions on sub-outsourcing, supervision and liability, and the Company supervises the processors. Changes to the outsourced work or processors are disclosed through this Policy without delay.

6. Cross-border Transfer

Under Article 28-8(1)(3) of the Act (outsourcing or storage necessary to conclude and perform a contract with the data subject), the Company transfers personal information abroad as follows:

• Recipient: Resend, Inc. / Country: United States / When and how: transmitted over the network when an e-mail is sent / Items: e-mail address, name, order details / Purpose: sending transactional e-mails / Retention: 30 days after sending / Contact for inquiries and refusals: ravirabs26@naver.com
• Recipient: Supabase, Inc. / Country: Singapore / When and how: transmitted and stored over the network when members sign up, log in or place orders / Items: personal information listed in Section 2 (e-mail address, name, mobile phone number, shipping address, order and payment records, social account identifier, etc.) / Purpose: member authentication and database storage / Retention: until the retention period under Section 3 ends / Contact for inquiries and refusals: ravirabs26@naver.com

Data subjects may refuse the cross-border transfer by contacting the privacy officer in Section 12. Refusal may limit use of the service.

7. Destruction of Personal Information

1. The Company destroys personal information without delay when it becomes unnecessary, such as when the retention period expires or the purpose is achieved.
2. Where information must be kept under other laws after the period expires or the purpose is achieved, it is moved to a separate database or storage location.
3. Procedure: the Company selects the information to be destroyed and destroys it with the approval of the privacy officer.
4. Method: electronic files are deleted using technical methods that prevent recovery; printed information is shredded or incinerated.
5. Backup files: because backups are deleted when the backup retention period in Section 3 ends, personal information that has been deleted on request also disappears from backup files once that period has passed.

8. Rights of Data Subjects and Legal Representatives

1. Data subjects may at any time request access, correction, deletion or suspension of processing and withdraw consent.
2. Rights may be exercised through My Page (edit profile, withdraw membership) or by contacting the privacy officer in Section 12 in writing, by phone or by e-mail. The Company acts without delay.
3. Rights may be exercised through a legal representative or an authorized agent, in which case a power of attorney in the form prescribed by the Notice on Personal Information Processing Methods must be submitted.
4. Requests for access or suspension may be limited under Articles 35(4) and 37(2) of the Act.
5. Deletion cannot be requested where other laws designate the information as subject to collection.
6. The Company verifies that the person making a request is the data subject or a legitimate agent.

9. Security Measures

• Managerial: establishing and implementing an internal management plan, minimizing and training staff handling personal information
• Technical: managing access rights to processing systems (separated administrator roles), access control (row-level security), one-way encryption of passwords, encryption in transit (HTTPS), retention of access logs, restricted access to database backup files (owner-only permissions on the server) and encryption of the PC copy
• Physical: the database is stored in a data center in Singapore, with controlled physical access

10. Cookies and Automatic Collection

1. The Company uses cookies and browser storage to store and retrieve usage information for personalized service.
2. Items used: login session cookie (authentication), language preference cookie (lavi-locale), guest cart (browser local storage). The Company does not use cookies for advertising or behavioral tracking.
3. You may refuse cookies in your browser settings (Settings > Privacy > Cookies and other site data). Refusing cookies may limit some features such as staying logged in.

11. Children under 14

The Company does not accept registration from, or collect personal information of, children under 14. If it learns that such information has been collected, it destroys it without delay.

12. Privacy Officer

The Company designates the following privacy officer to take overall responsibility for processing and to handle complaints and remedies.

• Privacy officer: 박윤진 (Representative) / Contact: 010-8452-7820 / Email: ravirabs26@naver.com / Address: 경기도 용인시 처인구 금학로515 나동

Data subjects may direct all privacy-related inquiries, complaints and remedy requests to the privacy officer, who will respond and act without delay.

13. Remedies for Infringement

Data subjects may apply for dispute resolution or consultation with the following bodies in the Republic of Korea:

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.police.go.kr)

A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35, 36 or 37 of the Act may file an administrative appeal under the Administrative Appeals Act.

14. Changes to this Policy

1. This Policy applies from 2026-09-07.
2. Additions, deletions or amendments due to changes in law, policy or security technology are announced through the Store's notices at least 7 days before they take effect.
3. Revision history: on 2026-10-08, Section 5 (Outsourcing of Processing) was updated to add the provider of text and Alimtalk messaging and the provider of Naver social login. On 2026-10-16, the Supabase server location in Sections 5 and 9 was corrected to the actual location (Singapore) and Supabase was added to Section 6 (cross-border transfer). On the same day, Sections 2, 3, 5, 7 and 9 were updated to add database backup and access log storage and the items for guest-order e-mail, mobile text verification, reviews, inquiries, restock alerts, wishlist and display language. On 2026-10-19, a contact for inquiries and refusals about cross-border transfer was added to Section 6.
4. This Policy was written in Korean. If a translated version differs from the Korean version, the Korean version prevails.