Shinsegae Duty Free Policies

Article 1 How to consent to the collection and use of personal information

To consent to the collection, use, consignment of processing and provision of personal information to third parties in accordance with Shinsegae Duty Free's 'Privacy Policy', the customer must read the details in the 'Agreement on Collection and Use of Personal Information' included in the respective 'Membership Application Form' and sign the agreement (check the consent button in the online shopping mall) or, in the case of telephone consultation with the call centre, follow the instructions of the agent and submit the 'Privacy Policy' posted on the Shinsegae Internet Duty Free website (www. ssgdfs.com), you may choose one of the following methods of consent: expressing your intention to consent over the phone; signing, sealing and submitting the consent form by mail or modem transmission; posting the consent form on the above website and having the member indicate whether he/she agrees or disagrees; or other methods prescribed by relevant laws and regulations.
 

Article 2 Purpose of processing personal information and items of personal information collected

1. Purpose of collecting and using personal information

Shinsegae Duty Free collects and uses personal information necessary to purchase goods and provide various services to customers as follows.

1. Verifying and authenticating your identity and determining whether you are a minor in order to use our member services
2. Communicating with customers, including contacting them to fulfil contracts and handling complaints
3. Process orders, deliveries, order history, payments, cancellations, refunds, etc.
4. Prevent fraudulent use, such as member impersonation and violations of the Terms of Use.
5. Announcement of events such as new products, discounts, partnerships, etc.
6. Create work-related statistics and develop services
7. Comply with applicable legal obligations in relation to the above tasks

If you do not enter the required personal information, you will not be able to register for membership or use the service, but if you do not enter the optional personal information, you will not be restricted from registering for membership and using the service.

2. Personal data collection items

The specific items, purposes, retention periods, and collection methods of personal information collected by Shinsegae Duty Free are shown in the table below.

* We do not collect sensitive personal data (such as race and ethnicity, ideas and beliefs, place and habitual residence, political opinions, political affiliations, health and sexual life) that may violate your fundamental human rights.

3. How we collect personal information

1. Shinsegae Internet Duty Free collects information entered and transmitted by customers through the Shinsegae Internet Duty Free website (www.ssgdfs.com), written forms, telephone, and fax when customers register for membership, use consultation boards, apply for sweepstakes, and request delivery.
2. The following information may be generated and collected by electronic collection devices in the course of using the service or handling business.

- Service history, access logs, cookies, access IP information, payment history, suspension history, ADID/IDFA (advertising identifiers)

4. What to do if you enter false information

Customers must ensure the accuracy, truthfulness, and legality of their personal information. If a customer violates this and enters false information in various ways, such as stealing other people's information or entering fictitious information, Shinsegae Duty Free may report the customer in accordance with relevant laws and regulations, and may proceed with service use restriction procedures such as forced withdrawal.

5.Managing non-members

1. We accept non-member customers to purchase goods and services in our brick-and-mortar stores only. For non-member purchases, we only ask for personal information that is necessary for delivery, payment, and shipping.
2. If you make a purchase from us as a non-member, the payment and recipient information you provide will not be used for any other purpose except in connection with payment and delivery of the goods.

Article 3. Entrustment of Personal Information Processing to Provide Services

Shinsegae Duty Free entrusts the processing of personal information to external specialist companies as follows to provide essential services to customers and promote customer convenience.

When entrusting the processing of personal information, we stipulate compliance with laws and regulations related to personal information protection, confidentiality of personal information, prohibition of use for purposes other than the entrusted business and provision to third parties, liability in case of accidents, entrustment period, obligation to return or destroy personal information after the end of processing, etc. through documents such as entrustment contracts, and manage to comply with them.

Article 4 Provision of Personal Data to Third Parties

If Shinsegae Duty Free needs to provide the customer's personal information to a third party for the purpose of providing better services to the customer, Shinsegae Duty Free shall obtain separate consent by specifying the 'person to whom the personal information is provided, the purpose of using the personal information by the person to whom the personal information is provided, the items of personal information to be provided, and the period of retention and use of personal information by the person to whom the personal information is provided' and shall not provide it to a third party beyond the scope notified at the time of collection or the scope of consent. However, the following cases are exceptions.

1. You have the customer's informed consent
2. If there are special provisions in other relevant laws such as the Communications Secrecy Act, the Act on Financial Real Name Transactions and Confidentiality, the Act on the Use and Protection of Credit Information, the Telecommunications Basic Act, the Telecommunications Business Act, the Consumer Protection Act, the Criminal Procedure Act, etc. (However, "if there are special provisions in the law" means that even if the customer's personal information is requested by an administrative or investigative agency for administrative or investigative purposes, it will be provided only if it is requested in accordance with due process, such as by a warrant or a written document bearing the seal of the head of the agency as prescribed by law).
3. On the other hand, in order to provide better services, we may provide your personal information to or share it with the following "affiliates" with your consent. However, when providing or sharing personal information, we will individually ask for your consent through e-mail, internet homepage, telephone, or in writing regarding the person to whom the personal information is provided, the purpose of use, the items of personal information provided, and the period of retention and use, and if you do not agree, we will not provide it to or share it with the affiliate.

You may withdraw your consent to such provision at any time after the fact..

Article 5 Period of retention and use of personal information

1. In principle, customer's personal information shall be destroyed without delay after the purpose of collecting and using personal information is achieved, such as withdrawal or loss of qualification. Specific destruction points are as follows
   1. Membership information: when you unsubscribe or are removed from a membership.
   2. Delivery information: when the goods or services are delivered or provided.
   3. ollected for the purpose of a survey, event, etc.: Fora certain periodof timeafter the end of the event (specified or announced on the entry ticket)
   4. Non-member purchases: when the non-member's purchases and services have been delivered or provided and all procedures have been completed.

   In addition, if it has been provided to a third party pursuant to Article 4, we will ensure that the third party also destroys it without delay.

2. Notwithstanding Paragraph 1 above, if Shinsegae Duty Free is obliged to preserve the personal information held under the Commercial Act, the Act on Consumer Protection in Electronic Commerce, and the Customs Act, Shinsegae Duty Free will use the information for archiving purposes only, and the retention period is as follows.
   1. Records relating to contracts or withdrawals
      1. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      2. Retention period: 5 years
   2. Records of payments and supplies of goods, etc.
      1. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      2. Retention period: 5 years
   3. Records of consumer complaints or dispute handling
      1. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      2. Retention period: 3 years
   4. Purchase and delivery history (including delivery location, passport details, and departure information)
      1. Reason for retention: Customs Act, Enforcement Decree of the Act, Notice on the operation of bonded sales outlets
      2. Retention period: Purchase  2 year / delivery history 3 year
   5. If you have obtained consent from other customers: Retain for as long as you have obtained consent

Article 6 Procedures and methods of destruction of personal data

In principle, Shinsegae Duty Free destroys the information without delay after the purpose of collecting and using personal information is achieved. The procedure and method of destruction are as follows.

1. Destruction procedures
   1. The information you enter for membership, etc. will be stored for a certain period of time after the purpose is achieved and then destroyed in accordance with the reasons for storing information under internal policies and other relevant laws (see Retention and Use Period).
   2. Personal information will not be used for any purpose other than the purposes for which it is kept in accordance with applicable laws.
2. Destruction method
   1. Personal information printed on paper is destroyed by shredding or incineration.
   2. Personal information stored in electronic form is deleted using technical methods that make the records unrecoverable.

Article 7 How to access, correct, unsubscribe from and withdraw consent to your personal information

1. Members may view, correct, or withdraw their registered personal information at any time.
   1. You can view, correct, or withdraw your personal information by logging in to this website and clicking 'My Page→Information Management'.
   2. If you contact the customer service representative number 1661-8778 or the person in charge of personal information protection in writing, by phone or email, we will take action without delay after the confirmation process.
   3. However, even if you make a request for withdrawal, if there is an undelivered item for the purchased item, the withdrawal will be processed after the delivery of the item is completed.
2. If a member requests correction of errors in personal information, we will not use or provide the personal information until the correction is completed. In addition, if we have already provided incorrect personal information to a third party, we will notify the third party of the results of the correction process without delay so that the correction can be made.
3. Shinsegae Duty Free handles personal information requested to be withdrawn or deleted at the request of a member as specified in the period of retention and use of personal information collected by Shinsegae Duty Free, and prevents it from being viewed or used for any other purpose. However, if there are special provisions in the relevant laws or if it is unavoidable to comply with statutory obligations, and if there is a possibility of harming the life or body of another person or unreasonably infringing on the property and other interests of another person, we may refuse the request, and we will notify you without delay if relevant reasons arise.

Article 8 Operation and Use of Automatic Personal Information Collection Devices [Cookies]

1. Shinsegae Duty Free operates 'cookies' that store and retrieve member's information from time to time. A cookie is a small amount of information sent to a member's browser by the server used to operate the website.

2. Shinsegae Duty Free uses cookies for the following purposes.

1. We analyse the access frequency and visiting time of members and non-members, and identify users' tastes and interests, and use them as a measure for service reorganisation.
2. It is used to identify the level of participation and number of visits in various events held by Shinsegae Duty Free to provide differentiated application opportunities and provide differentiated information according to individual interests.
3. You have a choice about the installation of cookies. Therefore, you can accept all cookies, confirm each time a cookie is stored, or refuse to store all cookies by setting the options in your web browser using the procedure below. However, if you refuse to install cookies, you may be restricted from using the Service.

1. Edge : Settings menu in the top right corner of your web browser > Cookies and site permissions > Manage and delete cookies and site data
2. Chrome : Settings menu in the top right corner of your web browser > Privacy & security > Cookies and other site data
3. Whale : Settings menu in the top right corner of your web browser > Privacy > Cookies and other site data

Article 9 Rights and obligations of users and legal representatives and how to exercise them

1. Customers may request to view, correct, delete, stop processing, or withdraw consent to their personal information registered with Shinsegae Duty Free at any time. The procedures and methods for accessing, correcting, deleting, suspending processing, and withdrawing consent to personal information are detailed in Article 7.
2. Customers are requested to enter their personal information accurately and update it whenever there is a change to prevent unjustified accidents. The customer is responsible for any accidents caused by inaccurate information entered by the customer, and entering false information, such as stealing other people's information, may result in loss of membership.Along with the right to privacy, you also have the obligation to protect yourself and not infringe on the privacy and rights of others. Please be careful to manage information such as IDs and passwords so that your personal information does not leak, and be careful not to infringe on the personal information of others, including postings. If you fail to comply with these responsibilities and infringe on the personal information or other rights of others, you may be punished in accordance with relevant laws and regulations.
3. The rights under Paragraph 1 may be exercised through a representative, such as the legal representative of the information subject or a person who has been delegated. In this case, a power of attorney in the form of Appendix No. 11 to the Notice on how to process personal information must be submitted.

Article 10 Collecting opinions and handling complaints regarding personal information

1. In order to protect members' personal information and handle complaints related to personal information, Shinsegae Duty Free has designated relevant departments and personal information management officers as follows.

1. Privacy Officer : Gunil Son, Marketing innovation Manager
2. Phone number : 1661-8778
3. Email : ssgdfm_cs@shinsegae.com

2. If you have any other privacy concerns, you can contact the organisations below.

1. Personal Information Infringement Reporting Centre : 118 (without area code(http://privacy.kisa.or.kr)
2. Privacy Dispute Resolution Board  : 1833-6972 (http://kopico.go.kr)
3. Cyber Investigation Division, Crown Prosecution Service : (without area code)1301, cid@spo.go.kr(http://spo.go.kr)
4. National Police Agency Cyber Investigation Bureau: (without area code)182 (http://ecrm.police.go.kr)

Article 11 Technical/institutional management for personal information protection

1. In processing members' personal information, Shinsegae Duty Free takes the following technical measures to ensure safety so that personal information is not lost, stolen, leaked, altered or damaged.
   1. Establishment and implementation of internal management plan: Shinsegae Duty Free establishes and implements an internal management plan in accordance with the 'Standards for Measures to Secure the Safety of Personal Information'.
   2. Your personal information is protected by a password, and we use encryption to protect your files and transmitted data. Sensitive data is also protected by separate security features.
   3. Shinsegae Duty Free adopts a security device (Secure Socket Layer) that can safely transmit personal information on the network using cryptographic algorithms.
   4. To prevent users' personal information from being leaked due to hacking or computer viruses, we use a two-layer firewall to block unauthorised access from the outside, and install an intrusion detection system on each server to monitor intrusions around the clock.
   5. We keep and manage records of access to the personal information processing system for at least two years, and use security features to prevent access records from being falsified, stolen, or lost.
   6. We set aside a separate physical storage location for the personal information system and establish and operate access control procedures for it. Necessary measures are taken to control access to personal information by granting, changing, and cancelling access rights to the database of the personal information processing system, and unauthorised access from the outside is controlled using an intrusion prevention system.
2. Shinsegae Duty Free emphasises compliance with this policy by limiting the number of employees handling personal information to a minimum and providing frequent training to employees in charge, and takes immediate corrective action if any problems are found.
   1. Shinsegae Duty Free is not responsible for anything that happens due to members' mistakes or basic internet risks. Each member must properly manage and be responsible for their unique identification number, such as their passport number, and their ID and password to protect their personal information.
   2. In the event of loss, leakage, alteration, or damage of personal information due to an internal manager's mistake or technical management accident, Shinsegae Duty Free will immediately notify the user and take appropriate measures and compensation.

Article 12 Protection of Personal Information of Children Under the Age of 14

In principle, Shinsegae Duty Free does not collect personal information of children under the age of 14. However, if it is necessary to collect personal information of children under the age of 14, we will comply with the standards required by law, such as obtaining the consent of a legal representative.

Article 13 Collection and Protection of Personal Information of Non-member Customers

Not only Shinsegae Duty Free members but also non-members can purchase products (however, non-member purchases can only be made in person). In the case of non-member orders, we request only the personal information necessary for payment and delivery of products. If you make a purchase as a non-member, the personal information entered by the non-member customer will not be used for any other purpose other than for payment and delivery of goods, and to comply with legal obligations such as archiving. We protect personal information in the same way as members.

Article 14 Restriction on Transmission of Advertising Information

1. Shinsegae Duty Free does not transmit advertising information for commercial purposes against the user's explicit refusal to receive it.
2. When Shinsegae Duty Free transmits advertising information by e-mail for online marketing, such as product information, Shinsegae Duty Free takes measures to ensure that users can easily recognise the following in the body of the e-mail.
3. Body of the e-mail: The phrase (advertisement) is displayed in Korean without any spaces at the beginning of the body, and the name of the sender, e-mail address or telephone number, and address where the user can express his/her intention to unsubscribe are specified. The method by which users can easily indicate their intention to unsubscribe shall be specified in Korean and English respectively.

Article 15 Duty of Notification

1. If the government's policy or Shinsegae Duty Free's policy is added, deleted, or modified, the contents of this personal information processing policy will be notified through the Shinsegae Internet Duty Free website seven days before the revision.
2. This Privacy Policy shall be applied from 24 January 2024, and the previous Privacy Policy shall be replaced by this Privacy Policy.