Shinsegae Duty Free Policies

Article 1 How to consent to the collection and use of personal information

To consent to the collection, use, consignment of processing and provision of personal information to third parties in accordance with Shinsegae Duty Free's 'Privacy Policy', the customer must read the details in the 'Agreement on Collection and Use of Personal Information' included in the respective 'Membership Application Form' and sign the agreement (check the consent button in the online shopping mall) or, in the case of telephone consultation with the call centre, follow the instructions of the agent and submit the 'Privacy Policy' posted on the Shinsegae Internet Duty Free website (www. ssgdfs.com), you may choose one of the following methods of consent: expressing your intention to consent over the phone; signing, sealing and submitting the consent form by mail or modem transmission; posting the consent form on the above website and having the member indicate whether he/she agrees or disagrees; or other methods prescribed by relevant laws and regulations.

 

ico ico Article 2 Purpose of processing personal information and items of personal information collected

1. Purpose of collecting and using personal information

Shinsegae Duty Free collects and uses the minimum necessary personal information to provide customers with product purchases and various services as follows.

1.     
2. Verifying and authenticating your identity and determining whether you are a minor in order to use our member services


3.     
4. Communicating with customers, including contacting them to fulfil contracts and handling complaints


5.     
6. Processing orders, deliveries, order history, payments, cancellations, refunds, etc.


7.     
8. Preventing fraudulent use, such as member impersonation and violations of the Terms of Use


9.     
10. Announcing event information such as new products, discounts and partnerships, and use as marketing material including telemarketing


11.     
12. Creating work-related statistics and developing services


13.     
14. Complying with applicable legal obligations in relation to the above tasks



 
15.  

If you do not enter the required personal information, you will not be able to register for membership or use the service, but if you do not enter the optional personal information, you will not be restricted from registering for membership and using the service.

2. Personal data collection items

The specific items, purposes, retention periods and collection methods of the personal information collected by Shinsegae Duty Free are as set out in the table below.

* We do not collect sensitive personal information that may infringe your fundamental human rights (such as race and ethnicity, ideas and beliefs, place of birth and family origin, political opinions, health condition and sexual life).

The items, purposes, retention periods and collection methods of the personal information optionally collected by Shinsegae Duty Free are as set out in the table below.

3. How we collect personal information

1.     
2. We collect information entered and transmitted by customers through the Shinsegae Internet Duty Free website (www.ssgdfs.com), written forms, telephone and fax when customers register for membership, use the consultation board, enter prize events, or request delivery.


3.     
4. The following information may be generated and collected by electronic collection devices in the course of using the service or handling business.



 
5.  

- Service history, access logs, cookies, access IP information, payment history, suspension history, ADID/IDFA (advertising identifiers)

4. What to do if you enter false information

Customers must ensure the accuracy, truthfulness, and legality of their personal information. If a customer violates this and enters false information in various ways, such as stealing other people's information or entering fictitious information, Shinsegae Duty Free may report the customer in accordance with relevant laws and regulations, and may proceed with service use restriction procedures such as compulsory withdrawal of membership.

5. Managing non-members

1.     
2. We accept non-member customers to purchase goods and services in our offline stores only. For non-member purchases, we request only the personal information that is strictly necessary for delivery and payment.


3.     
4. If you make a purchase from us as a non-member, the payment and recipient information you provide will not be used for any purpose other than payment and delivery of the goods.



 
5.  

ico Article 3 Outsourcing of Personal Data Processing

Shinsegae Duty Free entrusts the processing of personal information to external specialist companies as follows to provide essential services to customers and promote customer convenience.

When entrusting the processing of personal information, we stipulate compliance with laws and regulations related to personal information protection, confidentiality of personal information, prohibition of use for purposes other than the entrusted business and provision to third parties, liability in case of accidents, the entrustment period, and the obligation to return or destroy personal information after the end of processing through documents such as entrustment contracts, and we manage the entrusted companies to ensure compliance.

1. Personal information entrustment status

2. Status of personal information re-entrustment

ico Article 4 Provision of Personal Information to Third Parties

If Shinsegae Duty Free needs to provide a customer's personal information to a third party for purposes such as providing better services, it obtains separate consent by specifying the 'recipient of the personal information, the recipient's purpose of use, the items of personal information provided, and the recipient's retention and use period', and does not provide the information to third parties beyond the scope notified at the time of collection or the scope consented to. However, the following cases are exceptions.

1.     
2. Where the customer's prior consent has been obtained


3.     
4. Where there are special provisions in other relevant laws such as the Protection of Communications Secrets Act, the Act on Real Name Financial Transactions and Confidentiality, the Credit Information Use and Protection Act, the Framework Act on Telecommunications, the Telecommunications Business Act, the Consumer Protection Act, the Criminal Procedure Act, the Customs Act and the Framework Act on National Taxes (provided that, even where 'there are special provisions in the law' and an administrative or investigative agency makes a request for administrative or investigative purposes, the customer's personal information is provided only where the request is made through due process, such as by a warrant or a written document bearing the seal of the head of the agency as prescribed by law).


5.     
6. On the other hand, in order to provide better services, we may provide your personal information to, or share it with, the following 'affiliates' with your consent. However, when providing or sharing personal information, we individually obtain your consent through email, our website, telephone or in writing regarding the recipient, the purpose of use, the items provided, and the retention and use period; if you do not consent, we will not provide it to or share it with the affiliate.



 
7.  

You may withdraw your consent to such provision at any time after the fact.

Shinsegae Duty Free transfers personal information to overseas companies solely for customers who use certain affiliated services, in order to provide those services.

    If you do not wish your information to be transferred overseas, you may request withdrawal of the provision in the My Page – Shopping Service – Partner Mileage/Points menu.

For the behavioural information below, the core infrastructure and the managing entity for service operation are located overseas. If you do not wish your information to be transferred overseas, you may block cookie settings by referring to Article 8.

* You have the right to refuse the overseas transfer of your personal information. However, if you refuse, you will not be able to receive the services specified for the purposes above.

ico Article 5 Period of retention and use of personal information

1.     
2. In principle, customer's personal information shall be destroyed without delay after the purpose of collecting and using personal information is achieved, such as withdrawal or loss of qualification. Specific destruction points are as follows
       
   
   
   1.         
   2. Membership information: when you unsubscribe or are removed from a membership.
   
   
   3.         
   4. Delivery information: when the goods or services are delivered or provided.
   
   
   5.         
   6. Collected for the purpose of a survey, event, etc.: 3 months from the end of the event (Entry must be separately stated or announced)
   
   
   7.         
   8. Non-member purchases: when the non-member's purchases and services have been delivered or provided and all procedures have been completed.
   
   
   9.     
   
       

   In addition, if it has been provided to a third party pursuant to Article 4, we will ensure that the third party also destroys it without delay.

   
       


3.     
4. Notwithstanding Paragraph 1 above, if Shinsegae Duty Free is obliged to preserve the personal information held under the Commercial Act, the Act on Consumer Protection in Electronic Commerce, and the Customs Act, Shinsegae Duty Free will use the information for archiving purposes only, and the retention period is as follows.
       
   
   
   1.         
   2. Records relating to contracts or withdrawals
              
      
      
      1.             
      2. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      
      
      3.             
      4. Retention period: 5 years
      
      
      5.         
      
              
   
   
   3.         
   4. Records of payments and supplies of goods, etc.
              
      
      
      1.             
      2. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      
      
      3.             
      4. Retention period: 5 years
      
      
      5.         
      
              
   
   
   5.         
   6. Records of consumer complaints or dispute handling
              
      
      
      1.             
      2. Reason for retention: Act on Consumer Protection in Electronic Commerce, etc.
      
      
      3.             
      4. Retention period: 3 years
      
      
      5.         
      
              
   
   
   7.         
   8. Purchase and delivery history (including delivery location, passport details, and departure information)
              
      
      
      1.             
      2. Reason for retention: Customs Act, Enforcement Decree of the Act, Notice on the operation of bonded sales outlets
      
      
      3.             
      4. Retention period: Delivery history 3 years / Purchase history 2 years
      
      
      5.         
      
              
   
   
   9.         
   10. If you have obtained consent from other customers: Retain for as long as you have obtained consent
   
   
   11.     
   
       



 
5.  

ico Article 6 Procedures and methods of destruction of personal data

In principle, Shinsegae Duty Free destroys the information without delay after the purpose of collecting and using personal information is achieved. The procedure and method of destruction are as follows.

1.     
2. Destruction procedures
       
   
   
   1.         
   2. The information you enter for membership, etc. will be stored for a certain period of time after the purpose is achieved and then destroyed in accordance with the reasons for storing information under internal policies and other relevant laws (see Retention and Use Period).
   
   
   3.         
   4. Personal information will not be used for any purpose other than the purposes for which it is kept in accordance with applicable laws.
   
   
   5.     
   
       


3.     
4. Destruction method
       
   
   
   1.         
   2. Personal information printed on paper is destroyed by shredding or incineration.
   
   
   3.         
   4. Personal information stored in electronic form is deleted using technical methods that make the records unrecoverable.
   
   
   5.     
   
       



 
5.  

ico ico Article 7 How to access, correct, unsubscribe from and withdraw consent to your personal information

1.     
2. Access to Personal Information
   
       Members may request access to their personal information at any time. However, access to personal information may be restricted or denied in any of the following cases
       
   
   
   1.         
   2. Where access is prohibited or restricted by law
   
   
   3.         
   4. Where there is a risk of harming the life or physical safety of another person, or of unjustly infringing upon another person’s property or other interests
   
   
   5.     
   
       
   
   
   •         
   • If access is restricted or denied, the reason will be notified without delay.
   
   
   •     
   
       


3.     
4. Correction of Personal Information
   
       If a member requests correction of errors in their personal information, the relevant personal information will not be used or provided until the correction is completed. If incorrect personal information has already been provided to a third party, the result of the correction will be notified to the third party without delay.


5.     
6. Deletion of Personal Information (Membership Withdrawal)
   
       Members may request deletion of their personal information or withdrawal from membership. However, requests for deletion or withdrawal may be restricted in the following cases:
       
   
   
   1.         
   2. Where personal information must be retained for a certain period in accordance with applicable laws and regulations
   
   
   3.         
   4. Where there are undelivered purchased items, in which case personal information may be retained to the extent necessary until delivery is completed
   
   
   5.     
   
       
   
   
   •         
   • In such cases, deletion or withdrawal will be processed without delay once the relevant reason has been resolved.
   
   
   •     
   
       


7.     
8. Suspension of Processing and Withdrawal of Consent
   
       Members may withdraw their consent to the processing of personal information or request suspension of such processing. However, a request for suspension of processing may be denied in any of the following cases:
       
   
   
   1.         
   2. Where processing is unavoidable to comply with obligations under applicable laws and regulations
   
   
   3.         
   4. Where there is a risk of harming the life or physical safety of another person, or of unjustly infringing upon another person’s property or other interests
   
   
   5.     
   
       
   
   
   •         
   • If a request for suspension of processing is denied, the reason will be notified without delay.
   
   
   •     
   
       



 
9.  

ico ico Article 8 Operation and Use of Automatic Personal Information Collection Devices [Cookies]

1. Shinsegae Duty Free operates 'cookies' that store and retrieve member's information from time to time. A cookie is a small amount of information sent to a member's browser by the server used to operate the website.

2. Shinsegae Duty Free uses cookies for the following purposes.

- How to Set Cookie Preferences on PC Web Browsers

1.     
2. Microsoft Edge: Settings → Privacy, search, and services → Cookies and site permissions → Manage cookies


3.     
4. Google Chrome: Settings → Privacy and security → Cookies and other site data


5.     
6. NAVER Whale: Settings → Privacy protection → Cookies and other site data


7.     
8. Safari (macOS): Preferences → Privacy → Block/Manage cookies and website data



 
9.  

- How to Set Cookie Preferences on Mobile Browsers

1.     
2. Mobile Chrome (Android / iOS): Settings → Privacy and security → Cookies


3.     
4. Mobile Safari (iOS): Settings app → Safari → Privacy & Security → Block Cookies


5.     
6. Samsung Internet Browser (Android): Settings → Privacy dashboard → Smart tracking prevention / Cookie settings



 
7.  

ico ico Article 9 Collection, Use and Rejection of Behavioural Information

1.     
2. Shinsegae Duty Free uses behavioural information to provide customers with optimised and customised services and benefits in the course of their use of the services. Behavioural information refers to online user activity information, based on 'cookies' or 'advertising identifiers' (ADID/IDFA), that makes it possible to identify and analyse users' interests, preferences and inclinations, such as website visit history, app usage history, and purchase and search history. Behavioural information is used in a state in which individuals cannot be identified and is not used in combination with personal information. However, in order to provide members with customised services and benefit information, it may be processed in connection with a member identifier; even in such cases, it is used only within the service channels operated by the Company and is not provided to any third party.
   
       
   
       ※ Braze and Amplitude are processors entrusted by the Company. In accordance with Articles 3 and 4, they are used solely for the purposes of customised recommendations and message delivery within the service channels operated by the Company.
   
       
           
               
               
               
               
               
           
           
               
                   
                   
                   
                   
                   
               
           
           
               
                   
                   
                   
                   
                   
               
           
       

   Legal Basis	Behavioural Information Items	Purpose of Collection	Method of Collection	Retention Period
   Article 15, Paragraph 1, Subparagraph 4 of the Personal Information Protection Act (Conclusion and Performance of Contracts)	Encrypted member identification information, gender, age group, birthday (year and month of birth), nationality, service visit and usage records, areas of interest, purchase and payment history within the service, cookie information	Service statistics and analysis, service improvement, and provision of customised recommended service information	Automatically collected during service use	Destroyed within 5 days after membership withdrawal or removal from membership, or within 5 days of the date of a request to stop customised product and service recommendations

   
       
   
       


3.     
4. Shinsegae Duty Free allows online customised advertising service providers to collect and process behavioural information as follows.
   
       
   
       
           
               
               
               
               
               
               
           
           
               
                   
                   
                   
                   
                   
                   
               
           
           
               
                   
                   
                   
                   
                   
                   
               
               
                   
                   
                   
               
               
                   
                   
                   
                   
               
               
                   
                   
                   
                   
               
               
                   
                   
                   
                   
                   
               
               
                   
                   
                   
                   
                   
               
               
                   
                   
                   
                   
                   
               
               
                   
                   
                   
                   
                   
               
               
                   
                   
                   
               
           
       

   Recipient	Service name	Behavioural Information Items	Purpose of Collection	Method of Collection	Retention Period
   Google	Google Analytics/Ads	User's service visit and usage records, cookies, activity log records, advertising identifier	Service statistics and analysis, and service improvement	Automatically collected during service use	For 14 months from the date of collection
   Naver	Naver Analytics				For 12 months from the date of collection
   Meta	Facebook Pixel		Service statistics and analysis, service improvement, display of customised advertisements, and analysis of advertising campaign effectiveness		Up to 24 months from the date of collection
   bizspring	CTS		Website usage statistics analysis and advertising performance measurement		6 months after service termination
   Enliple Co., Ltd.	Mobion / TUNE	User's service visit and usage records, cookies, activity log records, advertising identifier	Service statistics and analysis, service improvement, and analysis of advertising campaign effectiveness		Up to 24 months from the date of collection
   XK Planet	recopick	User's service visit and usage records, cookies, activity log records, advertising identifier	Personalised product recommendations		For 6 months from the date of collection
   Criteo	Criteo	User's product browsing history, items of interest, shopping cart, purchase events, advertising identifier	Display of customised advertisements based on user interests, and analysis of advertising campaign effectiveness		For 13 months from the date of collection
   Braze, Inc	Braze	Encrypted member identification information, gender, age group, birthday (year and month of birth), nationality, service usage records, areas of interest, purchase and payment history within the service, cookie information	Automatic information collection, analysis of service and usage behaviour, information statistics, CRM, customised recommendations, and message delivery		Destroyed within 5 days after membership withdrawal or removal from membership, within 5 days of the date of a request to stop customised product and service recommendations, or within 5 days of termination of the entrustment agreement
   Amplitude, Inc	Amplitude		Automatic information collection, analysis of service and usage behaviour, information statistics, and CRM

   
       
   
       


5.     
6. Customers may block or allow the collection and use of the 'cookies' or 'advertising identifiers' (ADID/IDFA) used for behavioural information. The methods of collection, use and blocking can be found in 'Article 8 Operation and Use of Automatic Personal Information Collection Devices [Cookies]'. Suspension of the use of behavioural information, such as customised product and service recommendations through Braze/Amplitude, may be requested through our customer centre.


7.     
8. Customers may contact the Chief Privacy Officer of Shinsegae Duty Free for inquiries regarding behavioural information and to report damages; details can be found in 'Article 11 Collecting opinions and handling complaints regarding personal information' below.



 
9.  

ico ico Article 10 Rights and obligations of users and legal representatives and how to exercise them

1.     
2. Customers may request to view, correct, delete, stop processing, or withdraw consent to their personal information registered with Shinsegae Duty Free at any time. The procedures and methods for accessing, correcting, deleting, suspending processing, and withdrawing consent to personal information are detailed in Article 7.


3.     
4. Customers are requested to enter their personal information accurately and update it whenever there is a change to prevent unjustified accidents. The customer is responsible for any accidents caused by inaccurate information entered by the customer, and entering false information, such as stealing other people's information, may result in loss of membership.Along with the right to privacy, you also have the obligation to protect yourself and not infringe on the privacy and rights of others. Please be careful to manage information such as IDs and passwords so that your personal information does not leak, and be careful not to infringe on the personal information of others, including postings. If you fail to comply with these responsibilities and infringe on the personal information or other rights of others, you may be punished in accordance with relevant laws and regulations.


5.     
6. The rights under Paragraph 1 may be exercised through a representative, such as the legal representative of the information subject or a person who has been delegated. In this case, a power of attorney in the form of Appendix No. 11 to the Notice on how to process personal information must be submitted.



 
7.  

ico Article 11 Collecting opinions and handling complaints regarding personal information

1. In order to protect members' personal information and handle complaints related to personal information, Shinsegae Duty Free has designated relevant departments and personal information management officers as follows.

1.     
2. Privacy Officer : Joo Wook Son, Information Security


3.     
4. Phone number : 1661-8778


5.     
6. Email : df_cpo@shinsegae.com



 
7.  

2. If you have any other privacy concerns, you can contact the organisations below.

1.     
2. Personal Information Infringement Reporting Centre : 118 (without area code) (http://privacy.kisa.or.kr)


3.     
4. Privacy Dispute Resolution Board  : 1833-6972 (http://kopico.go.kr)


5.     
6. Supreme Prosecutors’ Office : (without area code)1301, cid@spo.go.kr (http://spo.go.kr)


7.     
8. National Police Agency Cyber Investigation Bureau: (without area code)182 (http://ecrm.police.go.kr)



 
9.  

ico ico Article 12 Technical/institutional management for personal information protection

1.     
2. In processing members' personal information, Shinsegae Duty Free takes the following technical measures to ensure safety so that personal information is not lost, stolen, leaked, altered or damaged.
       
   
   
   1.         
   2. Establishment and implementation of internal management plan: Shinsegae Duty Free establishes and implements an internal management plan in accordance with the 'Standards for Measures to Secure the Safety of Personal Information'.
   
   
   3.         
   4. Your personal information is protected by a password, and we use encryption to protect your files and transmitted data. Sensitive data is also protected by separate security features.
   
   
   5.         
   6. Shinsegae Duty Free adopts a security device (Secure Socket Layer) that can safely transmit personal information on the network using cryptographic algorithms.
   
   
   7.         
   8. To prevent users' personal information from being leaked due to hacking or computer viruses, we use a two-layer firewall to block unauthorised access from the outside, and install an intrusion detection system on each server to monitor intrusions around the clock.
   
   
   9.         
   10. We keep and manage records of access to the personal information processing system for at least two years, and use security features to prevent access records from being falsified, stolen, or lost.
   
   
   11.         
   12. We set aside a separate physical storage location for the personal information system and establish and operate access control procedures for it. Necessary measures are taken to control access to personal information by granting, changing, and cancelling access rights to the database of the personal information processing system, and unauthorised access from the outside is controlled using an intrusion prevention system.
   
   
   13.     
   
       


3.     
4. Shinsegae Duty Free emphasises compliance with this policy by limiting the number of employees handling personal information to a minimum and providing frequent training to employees in charge, and takes immediate corrective action if any problems are found.
       
   
   
   1.         
   2. Shinsegae Duty Free is not responsible for anything that happens due to members' mistakes or basic internet risks. Each member must properly manage and be responsible for their unique identification number, such as their passport number, and their ID and password to protect their personal information.
   
   
   3.         
   4. In the event of loss, leakage, alteration, or damage of personal information due to an internal manager's mistake or technical management accident, Shinsegae Duty Free will immediately notify the user and take appropriate measures and compensation.
   
   
   5.     
   
       



 
5.  

ico Article 13 Protection of Personal Information of Children Under the Age of 14

In principle, Shinsegae Duty Free does not collect personal information of children under the age of 14. However, if it is necessary to collect personal information of children under the age of 14, we will comply with the standards required by law, such as obtaining the consent of a legal representative.

ico Article 14 Collection and Protection of Personal Information of Non-member Customers

Not only Shinsegae Duty Free members but also non-members can purchase products (however, non-member purchases can only be made in person). In the case of non-member orders, we request only the personal information necessary for payment and delivery of products. If you make a purchase as a non-member, the personal information entered by the non-member customer will not be used for any other purpose other than for payment and delivery of goods, and to comply with legal obligations such as archiving. We protect personal information in the same way as members.

ico Article 15 Processing of Personal Location Information

1.     
2. Shinsegae Duty Free provides services using location information, but does not collect/store personal location information or provide it to third parties.


3.     
4. The purpose of processing an the retention period of personal location information are as follows
   
        
       
   
       
           
               
               
           
           
               
                   
                   
               
           
           
               
                   
                   
               
               
                   
               
           
       

   Purpose of Processing Personal Location Information	Retention Period
   Queue Number Ticketing Service at the Pickup Counter	Upon completion of the location information service (Location information is used only within the customer’s device and is neither stored nor transmitted by Shinsegae Duty Free.)
   Branch location guide service

   
       
   
       


5.     
6. Use of location information for the protection of children aged 8 or younger In accordance with the membership policy to protect minors, persons under the age of 14 are not eligible for membership. Therefore, services using personal location information are not provided to children aged 8 or younger who are unable to sign up for membership.


7.     
8. Information on the location information manager The location information manager of Shinsegae Duty Free also serves as the personal information protection officer.



 
9.  

ico Article 16 Restriction on Transmission of Advertising Information

1.     
2. Shinsegae Duty Free does not transmit commercial advertising information for profit-making purposes against the user’s explicit intention to refuse receipt.


3.     
4. When Shinsegae Duty Free transmits advertising information by e-mail for online marketing, such as product information, Shinsegae Duty Free takes measures to ensure that users can easily recognise the following in the body of the e-mail.


5.     
6. Body of the e-mail: The phrase (advertisement) is displayed in Korean without any spaces at the beginning of the body, and the name of the sender, e-mail address or telephone number, and address where the user can express his/her intention to unsubscribe are specified. The method by which users can easily indicate their intention to unsubscribe shall be specified in Korean and English respectively.



 
7.  

ico Article 17 Judgment Criteria for Additional Use or Provision without the Consent of the Information Subject

Pursuant to Articles 15(3) and 17(4) of the Personal Information Protection Act, Shinsegae Duty Free may additionally use and provide personal information without the consent of the information subject in consideration of Article 14(2) of the Enforcement Decree of the Personal Information Protection Act. Accordingly, Shinsegae Duty Free considers the following points when making additional use and provision without the consent of the information subject.

1.     
2. whether it is relevant to the original purpose of collection


3.     
4. whether the additional use or provision of personal information is foreseeable in light of the circumstances under which the personal information was collected or the processing practices


5.     
6. whether it unreasonably infringes on the interests of the data subject


7.     
8. whether necessary measures have been taken to ensure safety, such as pseudonymization or encryption



 
9.  

ico Article 18 Duty of Notification

1.     
2. If there is any addition, deletion or modification to the contents of this Privacy Policy in accordance with government policy or the policy of Shinsegae Duty Free, we will give notice through the Shinsegae Internet Duty Free website seven days before the revision takes effect.


3.     
4. This Privacy Policy shall be applied from September 3, 2026, and the previous Privacy Policy shall be replaced by this Privacy Policy.



 
5.