Shinsegae Duty Free Policies

Article 1 How to consent to the collection and use of personal information

To consent to the collection, use, consignment of processing and provision of personal information to third parties in accordance with Shinsegae Duty Free's 'Privacy Policy', the customer must read the details in the 'Agreement on Collection and Use of Personal Information' included in the respective 'Membership Application Form' and sign the agreement (check the consent button in the online shopping mall) or, in the case of telephone consultation with the call centre, follow the instructions of the agent and submit the 'Privacy Policy' posted on the Shinsegae Internet Duty Free website (www. ssgdfs.com), you may choose one of the following methods of consent: expressing your intention to consent over the phone; signing, sealing and submitting the consent form by mail or modem transmission; posting the consent form on the above website and having the member indicate whether he/she agrees or disagrees; or other methods prescribed by relevant laws and regulations.
 

ico ico Article 2 Purpose of processing personal information and items of personal information collected

1. Purpose of collecting and using personal information

Shinsegae Duty Free collects and uses the minimum necessary personal information to provide customers with product purchases and various services as follows.

1. Verifying and authenticating your identity and determining whether you are a minor in order to use our member services
2. Communicating with customers, including contacting them to fulfil contracts and handling complaints
3. Process orders, deliveries, order history, payments, cancellations, refunds, etc.
4. Prevent fraudulent use, such as member impersonation and violations of the Terms of Use.
5. Announcement of events such as new products, discounts, partnerships, etc.
6. Create work-related statistics and develop services
7. Comply with applicable legal obligations in relation to the above tasks

If you do not enter the required personal information, you will not be able to register for membership or use the service, but if you do not enter the optional personal information, you will not be restricted from registering for membership and using the service.

2. Personal data collection items

① Notice on the Collection and Use of Mandatory Personal Information

The items of personal information that Shinsegae Duty Free is required to collect for the purpose of concluding and fulfilling service contracts, along with their purposes, retention periods, and collection methods, are as follows in the table below.

* We do not collect sensitive personal data (such as race and ethnicity, ideas and beliefs, place and habitual residence, political opinions, political affiliations, health and sexual life) that may violate your fundamental human rights.

② Optional Personal Information Collection and Use Notice

The items of personal information selectively collected by Shinsegae Duty Free, along with their purposes, retention periods, and collection methods, are outlined in the table below.

3. How we collect personal information

1. Shinsegae Internet Duty Free collects information entered and transmitted by customers through the Shinsegae Internet Duty Free website (www.ssgdfs.com), written forms, telephone, and fax when customers register for membership, use consultation boards, apply for sweepstakes, and request delivery.
2. The following information may be generated and collected by electronic collection devices in the course of using the service or handling business.

- Service history, access logs, cookies, access IP information, payment history, suspension history, ADID/IDFA (advertising identifiers)

4. What to do if you enter false information

Customers must ensure the accuracy, truthfulness, and legality of their personal information. If a customer violates this and enters false information in various ways, such as stealing other people's information or entering fictitious information, Shinsegae Duty Free may report the customer in accordance with relevant laws and regulations, and may proceed with service use restriction procedures such as forced withdrawal.

5.Managing non-members

1. We accept non-member customers to purchase goods and services in our brick-and-mortar stores only. For non-member purchases, we only ask for personal information that is necessary for delivery, payment, and shipping.
2. If you make a purchase from us as a non-member, the payment and recipient information you provide will not be used for any other purpose except in connection with payment and delivery of the goods.

ico Article 3. Entrustment of Personal Information Processing to Provide Services

Shinsegae Duty Free entrusts the processing of personal information to external specialist companies as follows to provide essential services to customers and promote customer convenience.

When entrusting the processing of personal information, we stipulate compliance with laws and regulations related to personal information protection, confidentiality of personal information, prohibition of use for purposes other than the entrusted business and provision to third parties, liability in case of accidents, entrustment period, obligation to return or destroy personal information after the end of processing, etc. through documents such as entrustment contracts, and manage to comply with them.

1. Personal information entrustment status

2. The status of personal information resubcontracting

ico Article 4 Provision of Personal Data to Third Parties

If Shinsegae Duty Free needs to provide the customer's personal information to a third party for the purpose of providing better services to the customer, Shinsegae Duty Free shall obtain separate consent by specifying the 'person to whom the personal information is provided, the purpose of using the personal information by the person to whom the personal information is provided, the items of personal information to be provided, and the period of retention and use of personal information by the person to whom the personal information is provided' and shall not provide it to a third party beyond the scope notified at the time of collection or the scope of consent. However, the following cases are exceptions.

1. You have the customer's informed consent
2. If there are special provisions in other relevant laws such as the Communications Secrecy Act, the Act on Financial Real Name Transactions and Confidentiality, the Act on the Use and Protection of Credit Information, the Telecommunications Basic Act, the Telecommunications Business Act, the Consumer Protection Act, the Criminal Procedure Act, etc. (However, "if there are special provisions in the law" means that even if the customer's personal information is requested by an administrative or investigative agency for administrative or investigative purposes, it will be provided only if it is requested in accordance with due process, such as by a warrant or a written document bearing the seal of the head of the agency as prescribed by law).
3. On the other hand, in order to provide better services, we may provide your personal information to or share it with the following "affiliates" with your consent. However, when providing or sharing personal information, we will individually ask for your consent through e-mail, internet homepage, telephone, or in writing regarding the person to whom the personal information is provided, the purpose of use, the items of personal information provided, and the period of retention and use, and if you do not agree, we will not provide it to or share it with the affiliate.

You may withdraw your consent to such provision at any time after the fact..

Shinsegae Duty Free transfers personal information to overseas companies for the purpose of providing certain affiliated services to customers who use them
If you do not wish to have your information transferred overseas, you can request to withdraw consent in the My Page – Shopping Service – Partner Mileage/Points menu.

For the behavioral information listed below, the core infrastructure and management entities required for service operation are located overseas. If you do not wish your information to be transferred overseas, you may block cookie settings by referring to Article 8.

* You have the right to refuse the transfer of your personal information abroad. However, if you refuse, you will not be able to receive the services specified for this purpose.

ico Article 5 Period of retention and use of personal information

1. In principle, customer's personal information shall be destroyed without delay after the purpose of collecting and using personal information is achieved, such as withdrawal or loss of qualification. Specific destruction points are as follows
   1. Membership information: when you unsubscribe or are removed from a membership.
   2. Delivery information: when the goods or services are delivered or provided.
   3. Collected for the purpose of a survey, event, etc.: 3 months from the end of the event (Entry must be separately stated or announced)
   4. Non-member purchases: when the non-member's purchases and services have been delivered or provided and all procedures have been completed.

   In addition, if it has been provided to a third party pursuant to Article 4, we will ensure that the third party also destroys it without delay.

2. Notwithstanding Paragraph 1 above, if Shinsegae Duty Free is obliged to preserve the personal information held under the Commercial Act, the Act on Consumer Protection in Electronic Commerce, and the Customs Act, Shinsegae Duty Free will use the information for archiving purposes only, and the retention period is as follows.
   1. Records relating to contracts or withdrawals
      1. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      2. Retention period: 5 years
   2. Records of payments and supplies of goods, etc.
      1. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      2. Retention period: 5 years
   3. Records of consumer complaints or dispute handling
      1. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      2. Retention period: 3 years
   4. Purchase and delivery history (including delivery location, passport details, and departure information)
      1. Reason for retention: Customs Act, Enforcement Decree of the Act, Notice on the operation of bonded sales outlets
      2. Retention period: Delivery history 3 years / Purchase history 2 years
   5. If you have obtained consent from other customers: Retain for as long as you have obtained consent

ico Article 6 Procedures and methods of destruction of personal data

In principle, Shinsegae Duty Free destroys the information without delay after the purpose of collecting and using personal information is achieved. The procedure and method of destruction are as follows.

1. Destruction procedures
   1. The information you enter for membership, etc. will be stored for a certain period of time after the purpose is achieved and then destroyed in accordance with the reasons for storing information under internal policies and other relevant laws (see Retention and Use Period).
   2. Personal information will not be used for any purpose other than the purposes for which it is kept in accordance with applicable laws.
2. Destruction method
   1. Personal information printed on paper is destroyed by shredding or incineration.
   2. Personal information stored in electronic form is deleted using technical methods that make the records unrecoverable.

ico ico Article 7 How to access, correct, unsubscribe from and withdraw consent to your personal information

1. Access to Personal Information
   Members may request access to their personal information at any time. However, access to personal information may be restricted or denied in any of the following cases
   1. Where access is prohibited or restricted by law
   2. Where there is a risk of harming the life or physical safety of another person, or of unjustly infringing upon another person’s property or other interests
   • If access is restricted or denied, the reason will be notified without delay.
2. Correction of Personal Information
   If a member requests correction of errors in their personal information, the relevant personal information will not be used or provided until the correction is completed. If incorrect personal information has already been provided to a third party, the result of the correction will be notified to the third party without delay.
3. Deletion of Personal Information (Membership Withdrawal)
   Members may request deletion of their personal information or withdrawal from membership. However, requests for deletion or withdrawal may be restricted in the following cases:
   1. Where personal information must be retained for a certain period in accordance with applicable laws and regulations
   2. Where there are undelivered purchased items, in which case personal information may be retained to the extent necessary until delivery is completed
   • In such cases, deletion or withdrawal will be processed without delay once the relevant reason has been resolved.
4. Suspension of Processing and Withdrawal of Consent
   Members may withdraw their consent to the processing of personal information or request suspension of such processing. However, a request for suspension of processing may be denied in any of the following cases:
   1. Where processing is unavoidable to comply with obligations under applicable laws and regulations
   2. Where there is a risk of harming the life or physical safety of another person, or of unjustly infringing upon another person’s property or other interests
   • If a request for suspension of processing is denied, the reason will be notified without delay.

ico ico Article 8 Operation and Use of Automatic Personal Information Collection Devices [Cookies]

1. Shinsegae Duty Free operates 'cookies' that store and retrieve member's information from time to time. A cookie is a small amount of information sent to a member's browser by the server used to operate the website.

2. Shinsegae Duty Free uses cookies for the following purposes.

- How to Set Cookie Preferences on PC Web Browsers

1. Microsoft Edge: Settings → Privacy, search, and services → Cookies and site permissions → Manage cookies
2. Google Chrome: Settings → Privacy and security → Cookies and other site data
3. NAVER Whale: Settings → Privacy protection → Cookies and other site data
4. Safari (macOS): Preferences → Privacy → Block/Manage cookies and website data

- How to Set Cookie Preferences on Mobile Browsers

1. Mobile Chrome (Android / iOS): Settings → Privacy and security → Cookies
2. Mobile Safari (iOS): Settings app → Safari → Privacy & Security → Block Cookies
3. Samsung Internet Browser (Android): Settings → Privacy dashboard → Smart tracking prevention / Cookie settings

ico ico Article 9 Collection, Use and Rejection of Behavioral Information

1. Shinsegae Duty Free uses behavioral information to provide customized services and benefits optimized for customers in the process of using services. Behavioral information refers to online user activity information based on 'cookies' or 'advertising identifiers' (ADID/IDFA) to identify and analyze user's interests, interests, preferences, and inclinations, such as website visit history, app usage history, purchase and search history. However, behavioral information is utilized in a non-personally identifiable state and is not used in combination with personal information.
    

   Legal Basis	Purpose of use and processing	Collection items	Collection methods	Retention period
   Article 15(1)4 of the Personal Information Protection Act (Conclusion and Performance of a Contract)	Your visit to and use of the Services, activity logs and browsing history, and advertising identifiers	Service statistics-analyzing and improving our services and providing personalized recommendations	Automatically collected when you use the Service	Upon withdrawal/removal (deleted within 5 days) or termination of service

2. Shinsegae Duty Free allows online customized advertising service providers to collect and process behavioral information as follows.
    

   Recipient	Service name	Behavioral Information Items Provided	Purpose of Collection	Method of Collection	Retention Period
   Google	Google Analytics/Ads	User’s service access and usage records, cookies, activity log records, advertising identifier	Service statistics and analysis, service improvement	Automatically collected during service use	For 14 months from the date of collection
   Naver	Naver Analytics	User’s service access and usage records, cookies, activity log records, advertising identifier	Service statistics and analysis, service improvement		For 12 months from the date of collection
   Criteo	Criteo	User’s product browsing history, favorite products, shopping cart, purchase activities, advertising identifier	Display of personalized advertisements based on user interests, and analysis of advertising campaign effectiveness		For 13 months from the date of collection
   Meta	Facebook Pixel	User’s service access and usage records, cookies, activity log records, content ID and content, advertising identifier	Service statistics and analysis, service improvement, display of personalized advertisements, and analysis of advertising campaign effectiveness		Up to 24 months from the date of collection
   bizspring	CTS	User’s service access and usage records, cookies, activity log records, advertising identifier	Website usage statistics analysis and advertising performance measurement		Six months after service termination
   Enliple Co., Ltd	Mobion/TUNE	User’s service access and usage records, cookies, activity log records, advertising identifier	service statistics and analysis, service improvement, and analysis of advertising campaign effectiveness		Up to 24 months from the date of collection
   SK Planet	recopick	User’s service access and usage records, cookies, activity log records, advertising identifier	Personalized Product Recommendations		For 6 months from the date of collection



3. Customers may allow or block the collection and use of cookies or advertising identifiers (ADID/IDFA) used for behavioral information. Details on the methods for collection, use, and blocking can be found in Article 8, “Operation and Use of Automatic Personal Information Collection Devices [Cookies]”.
4. Customers may contact the person in charge of personal information protection at Shinsegae Duty Free Shop for inquiries regarding behavioral information and damage reports, and details can be found under 'Article 11 Opinion Collection and Complaint Handling' below.

ico ico Article 10 Rights and obligations of users and legal representatives and how to exercise them

1. Customers may request to view, correct, delete, stop processing, or withdraw consent to their personal information registered with Shinsegae Duty Free at any time. The procedures and methods for accessing, correcting, deleting, suspending processing, and withdrawing consent to personal information are detailed in Article 7.
2. Customers are requested to enter their personal information accurately and update it whenever there is a change to prevent unjustified accidents. The customer is responsible for any accidents caused by inaccurate information entered by the customer, and entering false information, such as stealing other people's information, may result in loss of membership.Along with the right to privacy, you also have the obligation to protect yourself and not infringe on the privacy and rights of others. Please be careful to manage information such as IDs and passwords so that your personal information does not leak, and be careful not to infringe on the personal information of others, including postings. If you fail to comply with these responsibilities and infringe on the personal information or other rights of others, you may be punished in accordance with relevant laws and regulations.
3. The rights under Paragraph 1 may be exercised through a representative, such as the legal representative of the information subject or a person who has been delegated. In this case, a power of attorney in the form of Appendix No. 11 to the Notice on how to process personal information must be submitted.

ico Article 11 Collecting opinions and handling complaints regarding personal information

1. In order to protect members' personal information and handle complaints related to personal information, Shinsegae Duty Free has designated relevant departments and personal information management officers as follows.

1. Privacy Officer : Joo Wook Son, Information Security
2. Phone number : 1661-8778
3. Email : df_cpo@shinsegae.com

2. If you have any other privacy concerns, you can contact the organisations below.

1. Personal Information Infringement Reporting Centre : 118 (without area code) (http://privacy.kisa.or.kr)
2. Privacy Dispute Resolution Board  : 1833-6972 (http://kopico.go.kr)
3. Supreme Prosecutors’ Office : (without area code)1301, cid@spo.go.kr (http://spo.go.kr)
4. National Police Agency Cyber Investigation Bureau: (without area code)182 (http://ecrm.police.go.kr)

ico ico Article 12 Technical/institutional management for personal information protection

1. In processing members' personal information, Shinsegae Duty Free takes the following technical measures to ensure safety so that personal information is not lost, stolen, leaked, altered or damaged.
   1. Establishment and implementation of internal management plan: Shinsegae Duty Free establishes and implements an internal management plan in accordance with the 'Standards for Measures to Secure the Safety of Personal Information'.
   2. Your personal information is protected by a password, and we use encryption to protect your files and transmitted data. Sensitive data is also protected by separate security features.
   3. Shinsegae Duty Free adopts a security device (Secure Socket Layer) that can safely transmit personal information on the network using cryptographic algorithms.
   4. To prevent users' personal information from being leaked due to hacking or computer viruses, we use a two-layer firewall to block unauthorised access from the outside, and install an intrusion detection system on each server to monitor intrusions around the clock.
   5. We keep and manage records of access to the personal information processing system for at least two years, and use security features to prevent access records from being falsified, stolen, or lost.
   6. We set aside a separate physical storage location for the personal information system and establish and operate access control procedures for it. Necessary measures are taken to control access to personal information by granting, changing, and cancelling access rights to the database of the personal information processing system, and unauthorised access from the outside is controlled using an intrusion prevention system.
2. Shinsegae Duty Free emphasises compliance with this policy by limiting the number of employees handling personal information to a minimum and providing frequent training to employees in charge, and takes immediate corrective action if any problems are found.
   1. Shinsegae Duty Free is not responsible for anything that happens due to members' mistakes or basic internet risks. Each member must properly manage and be responsible for their unique identification number, such as their passport number, and their ID and password to protect their personal information.
   2. In the event of loss, leakage, alteration, or damage of personal information due to an internal manager's mistake or technical management accident, Shinsegae Duty Free will immediately notify the user and take appropriate measures and compensation.

ico Article 13 Protection of Personal Information of Children Under the Age of 14

In principle, Shinsegae Duty Free does not collect personal information of children under the age of 14. However, if it is necessary to collect personal information of children under the age of 14, we will comply with the standards required by law, such as obtaining the consent of a legal representative.

ico Article 14 Collection and Protection of Personal Information of Non-member Customers

Not only Shinsegae Duty Free members but also non-members can purchase products (however, non-member purchases can only be made in person). In the case of non-member orders, we request only the personal information necessary for payment and delivery of products. If you make a purchase as a non-member, the personal information entered by the non-member customer will not be used for any other purpose other than for payment and delivery of goods, and to comply with legal obligations such as archiving. We protect personal information in the same way as members.

ico Article 15 Processing of Personal Location Information

1. Shinsegae Duty Free provides services using location information, but does not collect/store personal location information or provide it to third parties.
2. The purpose of processing an the retention period of personal location information are as follows
    

   Purpose of Processing Personal Location Information	Retention Period
   Queue Number Ticketing Service at the Pickup Counter	Upon completion of the location information service (Location information is used only within the customer’s device and is neither stored nor transmitted by Shinsegae Duty Free.)
   Branch location guide service

3. Use of location information for the protection of children aged 8 or younger In accordance with the membership policy to protect minors, persons under the age of 14 are not eligible for membership. Therefore, services using personal location information are not provided to children aged 8 or younger who are unable to sign up for membership.
4. Information on the location information manager The location information manager of Shinsegae Duty Free also serves as the personal information protection officer.

ico Article 16 Restriction on Transmission of Advertising Information

1. Shinsegae Duty Free does not transmit commercial advertising information for profit-making purposes against the user’s explicit intention to refuse receipt.
2. When Shinsegae Duty Free transmits advertising information by e-mail for online marketing, such as product information, Shinsegae Duty Free takes measures to ensure that users can easily recognise the following in the body of the e-mail.
3. Body of the e-mail: The phrase (advertisement) is displayed in Korean without any spaces at the beginning of the body, and the name of the sender, e-mail address or telephone number, and address where the user can express his/her intention to unsubscribe are specified. The method by which users can easily indicate their intention to unsubscribe shall be specified in Korean and English respectively.

ico Article 17 Judgment Criteria for Additional Use or Provision without the Consent of the Information Subject

Pursuant to Articles 15(3) and 17(4) of the Personal Information Protection Act, Shinsegae Duty Free may additionally use and provide personal information without the consent of the information subject in consideration of Article 14(2) of the Enforcement Decree of the Personal Information Protection Act. Accordingly, Shinsegae Duty Free considers the following points when making additional use and provision without the consent of the information subject.

1. whether it is relevant to the original purpose of collection
2. whether the additional use or provision of personal information is foreseeable in light of the circumstances under which the personal information was collected or the processing practices
3. whether it unreasonably infringes on the interests of the data subject
4. whether necessary measures have been taken to ensure safety, such as pseudonymization or encryption

ico Article 18 Duty of Notification

1. If the government's policy or Shinsegae Duty Free's policy is added, deleted, or modified, the contents of this personal information processing policy will be notified through the Shinsegae Internet Duty Free website seven days before the revision.
2. This Privacy Policy shall be applied from February 19, 2026, and the previous Privacy Policy shall be replaced by this Privacy Policy.