Ktown4u Privacy Policy
1. General Provisions
① Ktown4u (hereinafter referred to as the “Company”) complies with applicable personal data protection laws and regulations, including the Personal Information Protection Act, the Act on Promotion of Information and Communications Network Utilization and Information Protection, and the Protection of Communications Secrets Act, to protect the personal information of users of its online shopping mall.
② The Company does not use users’ personal information for any purpose other than those for which it was originally collected. The Company processes and retains personal information only within the retention period prescribed by applicable laws or within the period notified to and agreed upon by users at the time of collection.
2. Categories of Personal Information Collected and Purpose of Processing
The Company collects and processes personal information for the following purposes. The personal information collected will not be used for any purpose other than those specified below. If the purpose of processing changes, the Company will take necessary measures, including obtaining separate consent where required.
In addition, the Company does not collect or process the personal information of children under the age of 14.
A. Personal Information Processed Without the Data Subject’s Consent
Ktown4u processes the following categories of personal information without obtaining the data subject’s consent.
| Legal Basis | Category | Purpose | Items | Retention & Processing Period |
|---|---|---|---|---|
| Article 15(1)4 of the Personal Information Protection Act (Performance of Contract) | Membership Registration and Management | Use of the Ktown4u website, earning and using mileage points, provision of information related to services available on the Ktown4u website (delivery of notices, service inquiries and consultation, complaint handling, etc.), verification of whether the user is under the age of 14, updating member information | (Required) ID (Email Address), Password, Nickname, Date of Birth, Mobile Phone Number | Until membership withdrawal |
| Article 15(1)4 of the Personal Information Protection Act (Performance of Contract) | Service | Order processing, delivery, returns, after-sales service (A/S) | (Required) Name, Shipping Address, Mobile Phone Number | For 5 years from the completion of the supply of goods/services and settlement of payment |
| Article 15(1)4 of the Personal Information Protection Act (Performance of Contract) | Payment | Payment processing and refunds | (Required) Bank Account Information, Payment Information | For 5 years from the completion of the supply of goods/services and settlement of payment |
3. Outsourcing of Personal Information Processing
To provide better services and enhance customer convenience, the Company outsources certain personal information processing tasks to external service providers as follows.
When entering into outsourcing agreements, the Company specifies in writing, in accordance with Article 26 of the Personal Information Protection Act, matters concerning the prohibition of processing personal information for purposes other than the outsourced tasks, technical and administrative safeguards, restrictions on re-outsourcing, management and supervision of entrusted parties, liability for damages, and other related responsibilities. The Company also supervises entrusted parties to ensure that personal information is processed securely.
| Purpose of Outsourcing | Service Provider |
|---|---|
| Payment processing for ordered products | KG INICIS, Toss Payments, Eximbay, ICB, PayPal |
| Email service | Stibee |
| SMS service | BloomAI, Humuson |
| Customer service support | Channel Corporation |
| Product delivery | CJ Logistics, FBK Co., Ltd. (Sub-processors: SAGAWA, SF EXPRESS, Korea Post, ACI, DOORA LOGISTIC, YTO Express, UPS, FedEx, YunExpress Korea Co., Ltd.), DHL |
| Data storage and infrastructure management | Amazon Web Services, Inc. |
4. Provision of Personal Information to Third Parties
The Company may provide users' personal information to third parties in accordance with applicable laws and lawful procedures where the user has given consent or where such provision is specifically required or permitted by other applicable laws. In addition, in the event of emergencies such as disasters, infectious disease outbreaks, incidents or accidents posing an imminent threat to life or physical safety, or an imminent risk of significant property loss, the Company may provide personal information to the relevant authorities without the user's consent, as permitted by applicable laws.
① To provide its services smoothly, Ktown4u provides personal information to third parties only to the minimum extent necessary after obtaining the data subject's consent, in accordance with Article 17, Paragraph 1, Subparagraph 1 of the Personal Information Protection Act.
| Recipient | Purpose of Provision | Information Provided | Retention and Use Period |
|---|---|---|---|
| Event Organize | Event application and participation | Applicant's Name, Date of Birth, Mobile Phone Number | Destroyed within 30 days after the end of the event |
② Ktown4u may provide personal information to relevant authorities without the data subject's consent in the following cases:
| Legal Basis | Recipient | Purpose of Provision | Information Provided |
|---|---|---|---|
| Article 15(1)2 and Article 17(1)2 of the Personal Information Protection Act, Article 165 of the Income Tax Act, and Articles 32 and 32-2 of the Value-Added Tax Act | National Tax Service (NTS) | Issuance of Cash Receipts and Electronic Tax Invoices | Name, Email Address, Mobile Phone Number |
| Article 18(2)2 of the Personal Information Protection Act (Special Provisions under Other Laws), Article 215 of the Criminal Procedure Act | Investigative Authorities (National Police Agency, Public Prosecutors' Office, etc.) | Compliance with Search and Seizure Warrants, Requests for Telecommunications Confirmation Data, Telecommunications Data, and Other Law Enforcement Cooperation Requests | Information within the scope of the request |
5. Transfer of Personal Information Overseas
To enhance user convenience and provide our services, the Company transfers personal information overseas as described below.
Users may refuse the collection of personal information and the overseas transfer of their personal information. However, if consent is withheld, certain services may be restricted.
| Legal Basis | Information Transferred | Method of Transfer | Country (Region) & Recipient | Purpose of Transfer | Retention and Use Period | How to Refuse |
|---|---|---|---|---|---|---|
| Article 28-8(1)3 of the Personal Information Protection Act (Processing Outsourcing & Storage) | IP Address, Cookies, Device Information, Browsing/Search History, Service Usage Records | Transferred on an ongoing basis via an information and communications network during the provision of services | (United States) Google Inc., Google LLC Privacy Team, googlekrsupport@google.com | User behavior analysis and improvement of application functionality | Until membership withdrawal or termination of the service agreement | You may refuse consent by following the method described in Section 9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices. Even if you refuse, you may continue to use the service. |
| Article 28-8(1)1 of the Personal Information Protection Act (Consent) | Payment Information (Name, Email Address, Address, Country, Mobile Phone Number) | Transmitted in real time via an encrypted Internet API when payment is made using an overseas payment method | (United States) PayPal, paypal@generalagent.co.kr | Overseas payment service | For 5 years from the date the transaction is completed | Personal information is not transferred overseas unless you choose an overseas payment method. Payment records are transferred overseas only upon your consent to use overseas payment services. You may refuse consent; however, overseas payment services will not be available. |
| Article 28-8(1)3 of the Personal Information Protection Act (Processing Outsourcing & Storage) | Order Information (Name, Email Address, Address, Country, Mobile Phone Number) | Transmitted in real time via an encrypted Internet API upon completion of an overseas order | (China) YTO Express (032-573-9555), (Japan) SAGAWA (03-4221-4290), (Germany) DHL (koreabill@dhl.com), (United States) UPS (customer.service@ups.com), (China) SF EXPRESS (kr_privacy@sf-express.com), (Hong Kong) YUN Express (+852 3845 2422) | International product delivery | For 5 years from the date the transaction is completed | Personal information is not transferred overseas before an international order is placed. Order information is transferred overseas only when you place an international order. You may refuse consent; however, international shipping services will not be available. |
| Article 28-8(1)3 of the Personal Information Protection Act (Processing Outsourcing & Storage) | IP Address, Cookies, Device Information, Browsing/Search History, Service Usage Records, User Identifiers, User Interaction and Webpage Activity Information (Clicks, Scrolling, Page Navigation, Screen/Element Information) | Transferred on an ongoing basis via an information and communications network during the provision of services | (United States) Microsoft Corporation, Microsoft Privacy, https://privacy.microsoft.com/support | User behavior analysis and session replay for customer service support | Until membership withdrawal or termination of the service agreement | You may refuse consent by following the method described in Section 9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices. Even if you refuse, you may continue to use the service. |
| Article 28-8(1)3 of the Personal Information Protection Act (Processing Outsourcing & Storage) | IP Address, Cookies, Device Information, Browsing/Search History, Service Usage Records (including conversion event data such as cart, payment, purchase, and refund) | Transferred on an ongoing basis via an information and communications network during the provision of services | (United States) X Corp. privacy@x.com | Measurement and analysis of purchase conversion performance for online advertising | Until membership withdrawal or termination of the service agreement | You may refuse consent by following the method described in Section 9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices. Even if you refuse, you may continue to use the service. |
| Article 28-8(1)3 of the Personal Information Protection Act (Processing Outsourcing & Storage) | IP Address, Cookies, Device Information, Browsing/Search History, Service Usage Records (including conversion event data such as cart, payment, purchase, and refund) | Transferred on an ongoing basis via an information and communications network during the provision of services | (United States) Meta Platforms. Inc Data Protection Officer privacy@meta.com | Measurement and analysis of purchase conversion performance for online advertising | Until membership withdrawal or termination of the service agreement | You may refuse consent by following the method described in Section 9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices. Even if you refuse, you may continue to use the service. |
| Article 28-8(1)3 of the Personal Information Protection Act (Processing Outsourcing & Storage) | IP Address, Cookies, Device Information, Browsing/Search History, Service Usage Records (including conversion event data such as cart, payment, purchase, and refund) | Transferred on an ongoing basis via an information and communications network during the provision of services | (Singapore) TikTok Pte. Ltd. privacy@tiktok.com | Measurement and analysis of purchase conversion performance for online advertising | 회원 탈퇴시까지 또는 서비스 계약 종료시까지 | You may refuse consent by following the method described in Section 9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices. Even if you refuse, you may continue to use the service. |
6. Retention and Use Period of Personal Information
The Company retains and uses customers' personal information for the period notified to and consented by the data subject. Personal information collected will be destroyed so that it can no longer be accessed or used once the purpose of its collection and use has been achieved, the retention period has expired, or the data subject has withdrawn consent for its collection and use.
However, where the data subject has provided prior consent or where retention is required under applicable laws and regulations, the Company will retain personal information for the periods specified below. In the event of withdrawal of consent or membership termination, such personal information will be stored separately.
| Items Retained | Retention Period | Legal Basis |
|---|---|---|
| Service usage records, access logs, IP address information, and Cookies | 3 months | Protection of Communications Secrets Act |
| Records related to display and advertising | 6 months | Act on the Consumer Protection in Electronic Commerce, etc. |
| Records related to consumer complaints or dispute resolution | 3 years | Act on the Consumer Protection in Electronic Commerce, etc. |
| Records related to contracts or withdrawal of subscription | 5 years | Act on the Consumer Protection in Electronic Commerce, etc. |
| Records related to payment and the supply of goods or services | 5 years | Act on the Consumer Protection in Electronic Commerce, etc. |
7. Procedures and Methods for Destruction of Personal Information
① The Company shall, without delay, destroy personal information when it is no longer necessary due to the expiration of the retention period or the achievement of the purpose for which it was processed, in accordance with Section 6. Retention and Use Period of Personal Information.
② Personal information printed on paper shall be destroyed by shredding or incineration. Personal information stored in electronic file format shall be permanently deleted using technical methods that prevent the recovery or reproduction of the records.
③ Where the retention period consented to by the data subject has expired or the purpose of processing has been achieved, but the continued retention of personal information is required by other applicable laws, such personal information shall be transferred to a separate database (DB) or stored in a separate storage location.
8. Rights of Data Subjects and Their Legal Representatives, and How to Exercise Those Rights
① The data subject may, at any time, request Ktown4u to access, transfer, correct, delete, suspend the processing of, or withdraw consent for the processing of their personal information (hereinafter referred to as the "Exercise of Rights").
※ The rights of children under the age of 14 must be exercised directly by their legal representatives. Data subjects who are minors aged 14 or older may exercise their rights directly or through their legal representatives with respect to their personal information.
② The Exercise of Rights may be made to Ktown4u in writing, by telephone, e-mail, facsimile (FAX), the Internet, or by other means in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and Ktown4u will take appropriate action without undue delay.
Data subjects may directly access, correct, delete, suspend the processing of, or withdraw consent regarding their personal information at any time through My Page > Edit Member Information and My Page > Edit Member Information > Membership Withdrawal on the website, or request access through My Page > 1:1 Inquiry.
Data subjects may also request the refusal of automated decision-making and request an explanation at any time through My Page > 1:1 Inquiry.
③ The Exercise of Rights may also be made through a legal representative or an authorized agent. In such cases, a power of attorney in the form prescribed in Appendix Form No. 11 of the Notice on the Methods of Processing Personal Information must be submitted.
④ The data subject's right to request access to or suspension of the processing of personal information may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.
⑤ Where other applicable laws specify that certain personal information must be collected, the data subject may not request the deletion of such personal information.
⑥ Ktown4u verifies whether the person exercising the rights is the data subject or a duly authorized representative.
⑦ Data subjects may exercise their rights by contacting the department below. Ktown4u will respond within 10 days from the date the request is received (or without delay in the case of a request for data transfer).
▶ Department Responsible for Receiving and Processing Requests Regarding Personal Information Rights
Department: Management Support Team
Address: Suite 305-1, Trade Tower, 511 Yeongdong-daero, Gangnam-gu, Seoul, Republic of Korea
Contact: +82-2-552-9855 / privacy@ktown4u.com
9. Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
① Use of Cookies
- The Company uses cookies for member authentication on its website.
- A cookie is a small piece of information sent by an HTTP server to a user's browser to identify legitimate users between a website and the user's computer.
- The Company uses cookies to identify user IDs in order to provide services that are more appropriate and useful to users.
- Users may choose whether to allow the use of cookies. By changing their web browser settings, users may allow all cookies, be notified whenever a cookie is stored, or refuse the storage of all cookies. However, if all cookies are refused, certain services requiring login may not be available.
② How to Refuse Cookie Collection in Web Browsers
Edge: Menu > Settings > Cookies and Site Permissions > Manage and Delete Cookies and Site Data > Enable "Block third-party cookies"
Chrome: Menu > Settings > Privacy and Security > Third-party Cookies > Enable "Block third-party cookies"
Safari: Preferences > Enable "Prevent Cross-Site Tracking" and "Block All Cookies"
③ How to Block/Allow Advertising Identifiers on Smartphones
Android: Settings > Security & Privacy > Privacy > More Privacy Settings > Ads > Reset Advertising ID or Delete Advertising ID
iPhone: Settings > Privacy & Security > Tracking > Disable Allow Apps to Request to Track
※ The menu names and methods may vary depending on the version of the mobile operating system.
④ Push Notifications
- The Company sends benefits, event information, and product recommendations through push notifications to users who have consented to receive promotional information.
- Users may change their push notification preferences at any time in the app under My Page > Notification Settings.
- To provide services smoothly, the Company collects and stores users' push notification consent status and device identification information (Device Token) on its servers.
⑤ How to Disable Push Notifications
Ktown4u App: Log in > My Page > Notification Settings > Turn Push Notifications OFF
⑥ Behavioral Information
A. During the provision of its services, the Company processes behavioral information using automatic collection technologies such as cookies and advertising identifiers (ADID/IDFA) to identify individuals for the purpose of providing personalized services, benefits, and customized online advertisements.
B. Behavioral information refers to information about users' online activities that can be used to identify and analyze their interests, preferences, and tendencies, including website visit history, app usage history, purchase history, and search history. Such information may also be automatically collected and stored during the use of the Company's services. The Company collects behavioral information through the websites and mobile applications it operates.
| Legal Basis | Purpose | Collection Method | Information Collected | Retention and Use Period |
|---|---|---|---|---|
| Article 15(1)1 of the Personal Information Protection Act (Consent) | Statistical analysis for service improvement, provision of personalized services and benefits, and delivery of customized online advertisements | Automatically collected during website visits and app usage | Service visit history, service usage history, purchase and search history, device information, advertising identifiers, and other online activity information | Until membership withdrawal or until the user refuses the collection of behavioral information |
C. When users visit or use the Company's website or mobile application, the Company allows third parties to collect information through automatic collection technologies, such as third-party cookies and advertising identifiers, for the purpose of providing effective services and conducting advertising and marketing activities.
| Collection Technology | Type | Third Party Collecting the Information | Behavioral Information Collected | Purpose |
|---|---|---|---|---|
| Google Analytics Tag | JavaScript (Web Page)) | Google LLC | IP address, cookies, device information, browsing and search history, service usage records | Analysis of user behavior and improvement of application functionality |
| Google Ads Tag | JavaScript (Web Page) | Google LLC | IP address, cookies, device information, browsing and search history, service usage records (including conversion events such as cart activity, payment, purchases, and refunds) | Measurement and analysis of conversion performance for online advertising campaigns |
| Microsoft Clarity | ||||
| Tag | JavaScript (Web Page) | Microsoft Corporation | IP address, cookies, device information, browsing and search history, service usage records, user identifiers, user interactions, and webpage composition information (including clicks, scrolling, page navigation, and screen/element information) | Analysis of user behavior and session replay for customer support (CS) purposes |
| X Pixel | JavaScript (Web Page) | X Corp. | IP address, cookies, device information, browsing and search history, service usage records (including conversion events such as cart activity, payment, purchases, and refunds) | Measurement and analysis of conversion performance for online advertising campaigns |
| Meta Pixel | JavaScript (Web Page) | Meta Platforms, Inc. | IP address, cookies, device information, browsing and search history, service usage records (including conversion events such as cart activity, payment, purchases, and refunds) | Measurement and analysis of conversion performance for online advertising campaigns |
| TikTok Pixel | JavaScript (Web Page) | TikTok Pte. Ltd. | IP address, cookies, device information, browsing and search history, service usage records (including conversion events such as cart activity, payment, purchases, and refunds) | Measurement and analysis of conversion performance for online advertising campaigns |
D. Users may configure their browser settings to allow or block the collection of behavioral information, including cookies. Instructions for managing these settings are provided below. Please note that disabling cookies may restrict the use of certain website features, such as automatic login.
- Allowing/Blocking Behavioral Information Collected by Third Parties in Web Browsers
Chrome
- How to Delete Cookies Stored in Your Web Browser
- Click the three-dot menu (⋮) in the upper-right corner of Chrome and select Settings.
- In the left menu, click Privacy and Security, then select Delete browsing data and choose whether to delete your browsing history and cookies.
- How to Block Third-Party Cookies
- Click the three-dot menu (⋮) in the upper-right corner of Chrome and select Settings.
- In the left menu, click Privacy and Security, then select Third-party cookies and enable Block third-party cookies.
- How to Prevent All Cookies from Being Stored
- Click the three-dot menu (⋮) in the upper-right corner of Chrome and select New Incognito Window.
- In Incognito mode, your browsing history, cookies and site data, and information entered into forms are not saved on your device.
Microsoft Edge
- How to Delete Cookies Stored in Your Web Browser
Click the three-dot menu (… ) in the upper-right corner of Edge and select Settings.
In the left menu, click Cookies and site permissions, then select Manage and delete cookies and site data, and choose whether to remove all cookies and site data.
- How to Block Third-Party Cookies
Click the three-dot menu (… ) in the upper-right corner of Edge and select Settings.
In the left menu, click Privacy, search, and services, then under Tracking prevention, select the desired tracking prevention level (Balanced or Strict).
Alternatively, click Privacy, search, and services, then Cookies, and enable Block third-party cookies.
- How to Prevent All Cookies from Being Stored
Click the three-dot menu (… ) in the upper-right corner of Edge and select New InPrivate Window.
In InPrivate mode, your browsing history, cookies and site data, and information entered into forms are not saved on your device.
- Allowing/Blocking Behavioral Information Collected by Third Parties on Mobile Devices
Android
Settings > Security & Privacy > Privacy > More Privacy Settings > Ads > Reset Advertising ID or Delete Advertising ID
iPhone
Settings > Privacy & Security > Tracking > Turn Off "Allow Apps to Request to Track"
※ Menu names and navigation may vary depending on your mobile operating system version.
E. The Company collects only the minimum amount of behavioral information necessary to provide optimized personalized services, benefits, and customized online advertisements. The Company does not collect sensitive behavioral information that may infringe upon an individual's rights, interests, or privacy, such as information relating to political opinions, beliefs, or medical history.
F. The Company does not knowingly collect behavioral information from children under the age of 14 and does not provide personalized advertisements to children.
G. Users may contact the Personal Information Protection Officer or the 담당자 using the contact information provided below to inquire about behavioral information, exercise their right to opt out, or report any related concerns.
10. Measures to Ensure the Security of Personal Information
① Technical Safeguards
A. The Company maintains server and network security systems and performs regular vulnerability inspections and security enhancements.
B. The Company operates a web application firewall (WAF) to provide the highest level of protection for users' personal information.
C. Users' personal information is encrypted and stored in accordance with applicable laws. Files and transmitted data are also encrypted during storage and transmission.
D. The Company controls access to personal information by granting, modifying, and revoking access rights to its personal information processing systems.
E. Access logs for personal information processing systems are managed in accordance with applicable laws, and security measures are implemented to prevent forgery, alteration, theft, or loss of such records.
F. The Company installs security solutions, including antivirus software, on employees' computers that handle personal information and continuously updates them to protect against malware and other security threats.
② Administrative Safeguards
A. To ensure the secure protection of personal information, the Company operates its services under an Information Security Management System (ISMS) certified by an external professional certification body for its major systems and facilities.
B. The Company limits the number of employees who are authorized to access users' personal information to the minimum necessary.
C. The Company has established and implemented internal policies and procedures to ensure that employees understand and comply with the guidelines for accessing and managing personal information, and provides regular privacy protection training.
D. The Company establishes and implements internal management plans to ensure the secure processing of personal information.
③ Physical Safeguards
A. The Company protects its core infrastructure by operating security systems in areas where external access is restricted and controlled.
B. The Company strictly controls the use of storage media containing personal information and restricts their removal from or introduction into Company premises.
C. The Company establishes and implements protective measures to prevent the unauthorized exposure or leakage of personal information and other confidential information in employees' work environments, including office computers, desks, and storage cabinets.
11. Personal Information Protection Officer and Contact Information
The Company's Personal Information Protection Officer and Privacy Manager are as follows. We will respond promptly and sincerely to any inquiries regarding personal information.
① Personal Information Protection Officer
- Name: Myungseok Baek, Director
- Department: System Development Division
- Tel: +82-2-552-9855
- Email: privacy@ktown4u.com
② Personal Information Protection Manager
- Name: Siyeon Kim, Manager
- Department: Management Support Team
- Tel: +82-2-552-9855
- Email: privacy@ktown4u.com
If you require consultation or wish to report any privacy-related infringement, please contact one of the following organizations:
① Personal Information Dispute Mediation Committee
Tel: 1833-6972
Website: www.kopico.go.kr
② Personal Information Infringement Report Center
Tel: 118
Website: privacy.kisa.or.kr
③ Cyber Investigation Division, Supreme Prosecutors' Office
Tel: 1301
Website: www.spo.go.kr
④ Cyber Bureau, Korean National Police Agency
Tel: 182
Website: ecrm.police.go.kr
12. Supplementary Provisions
If this Privacy Policy is amended due to changes in applicable laws or Company policies, any additions, deletions, or revisions will be announced through the Notice section on the homepage at least seven (7) days prior to the effective date of the changes.
However, if the changes materially affect members' rights or obligations, the Company will provide notice at least thirty (30) days prior to the effective date.
- Date of Revision: July 10, 2026
- Effective Date: July 17, 2026