SKIN9HARI POLICY

Privacy Policy

KW Cosmetic Co., Ltd. (the “Company”) values the personal information of its users and establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of Korea.

Article 1. Scope

This Policy applies to both the SKIN9HARI brand site and the SKIN9HARI online store operated by the Company. The two sites are separate channels run by the same business: membership, order, and payment information is processed on the online store, while access logs, cookies, and similar data are processed on both sites.

Where any previously posted privacy policy differs from this Policy, this Policy prevails.

Article 2. Purposes of Processing Personal Information

Article 3. Personal Information Processed and How It Is Collected

The Company does not itself store detailed payment information such as card numbers or bank account numbers; that information is processed directly by the electronic payment service provider.

Article 4. Retention and Use Period

The Company destroys personal information without delay once the purpose of collection and use has been achieved. However, the following information is kept for the periods below as required by applicable laws.

Member information is destroyed without delay when a member withdraws. However, the minimum information needed to prevent misuse may be kept separately within the scope permitted by applicable laws.

Article 5. Provision of Personal Information to Third Parties

The Company does not use personal information beyond the purposes stated in Article 2 and does not provide it to third parties, except in the following cases:

• Where the user has given separate prior consent
• Where special provisions exist in law, or where an investigative agency requests it in accordance with the procedures and methods set out in law

When a user chooses a simple payment service such as Naver Pay or Kakao Pay, order and payment information is passed to that provider to the extent necessary to process the payment. Details are available in the Third Parties & Processors document.

In addition, automatic collection tools (cookies and pixels) of external advertising and analytics providers (Google LLC, Meta Platforms, Inc., NAVER Corporation, Kakao Corp., TikTok Pte. Ltd., and others) are installed on the Company’s websites, through which those providers directly collect users’ behavioral information. The items collected, retention periods, and opt-out methods for each provider are described in “4. Operation of Automatic Collection Tools on the Website and How to Opt Out” in the separate disclosure document.

Article 6. Outsourcing of Personal Information Processing

To provide its services smoothly, the Company outsources personal information processing to Cafe24 (online store system operation and hosting), CJ Logistics (shipping), KG Mobilians (electronic payment processing), CREMA (review service), Automattic Inc. (brand site hosting and access statistics), and others, and its outsourcing contracts set out the matters necessary to keep personal information safe. The full list of processors and outsourced tasks is given in the Third Parties & Processors document, and the two documents are always kept consistent.

Article 7. Transfer of Personal Information Overseas

For website operation, advertising, and analytics, the Company transfers personal information (including behavioral information) overseas to the following providers.

The items transferred, the time and method of transfer, the retention and use period, contact details, and how to refuse for each provider are disclosed in detail in the table “3. Transfer of Personal Information Overseas” in the Third Parties & Processors document. Users can refuse overseas transfer by blocking cookies in their browser or by using each provider’s opt-out tools; refusing does not restrict core services such as product search, ordering, and payment.

The servers of the online store system that processes orders and payments (Cafe24) and of the review service (CREMA) are located in Korea.

Article 8. Procedure and Method of Destruction

Procedure — Personal information whose retention period has expired or whose processing purpose has been achieved is destroyed without delay. Information that must be kept under applicable laws is moved to a separate database or stored in a different location, kept for the required period, and then destroyed.

Method — Information in electronic file form is deleted using technical methods that make it unrecoverable, and information printed on paper is shredded or incinerated.

Article 9. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

Users may exercise the following rights at any time:

• Request to access personal information
• Request correction of errors
• Request deletion
• Request suspension of processing
• Withdraw consent to collection and use

Users can exercise these rights directly on the online store’s My Page, or request them in writing, by phone, or by email using the contact details below. The Company takes the necessary action immediately upon receiving a request and notifies the user of the result.

Personal information of children under 14 is processed only with the consent of their legal representative, and the legal representative may exercise the above rights with respect to the child’s personal information.

When exercising rights through an agent, a power of attorney in the form prescribed by Annex Form No. 11 of the Enforcement Rule of the Personal Information Protection Act must be submitted.

Article 10. Operation of Cookies and Other Automatic Collection Tools, and How to Refuse Them

The Company uses cookies to provide users with customized screens and to understand usage statistics. A cookie is a small text file that a website stores in the user’s browser.

• Purpose — Keeping users logged in, keeping shopping cart information, and analyzing visit frequency and usage patterns
• How to refuse — You can set your browser to refuse cookies or to ask for confirmation before storing them. However, if you refuse all cookies, some services such as login and ordering may be difficult to use.

The brand site uses a tool for access statistics (Jetpack Stats), through which access records are compiled.

In addition, the following external automatic collection tools for advertising and analytics operate on the Company’s websites: Google Analytics 4 (G-W37YY6P2J0), Google Ads conversion tracking (AW-768525450) and Google tag container (GT-WFMM7QDP), Meta Pixel (623276008117051), Kakao Pixel (6574928757734814002), and TikTok Pixel (CG41DDRC77U5H3K1QN9G). The items collected, cookie names, retention periods, and opt-out methods for each tool are described in detail in “4. Operation of Automatic Collection Tools on the Website and How to Opt Out” in the separate disclosure document. The Company does not operate a separate cookie consent banner, so users may refuse collection at any time using the methods described in that document.

A Naver log analysis script is also used to identify visit paths through Naver advertising and search, and cookies for checking the visit path (NA_CO, NVADID, CPAValidator, etc.) may be stored. These cookies are used only to check which path a visit came through in order to measure advertising performance, and they are not stored if cookies are blocked in the browser settings.

Article 11. Measures to Ensure the Security of Personal Information

• Administrative measures — The Company designates the minimum number of personal information handlers, provides regular training, and establishes and implements an internal management plan.
• Technical measures — The Company manages access rights to the personal information processing system and stores passwords in encrypted form. Personal information is transmitted over encrypted connections (HTTPS).
• Physical measures — Systems that store personal information are operated in access-controlled environments.
• Retention of access records — The Company keeps access records of the personal information processing system and protects them from forgery and alteration.

Article 12. Chief Privacy Officer and Department Handling Access Requests

The Company has designated the following Chief Privacy Officer, who oversees personal information processing and is responsible for handling user complaints and remedying damage. Requests to access personal information are also received and handled here.

Article 13. Remedies for Infringement of Rights

If you need counseling or relief for damage caused by an infringement of personal information, you may contact the following organizations.

If your rights or interests have been infringed by the Company’s disposition or omission in response to a request under Article 35 (access), Article 36 (correction and deletion), or Article 37 (suspension of processing) of the Personal Information Protection Act, you may file an administrative appeal under the Administrative Appeals Act.

Supplementary Provisions

This Privacy Policy is effective from August 20, 2026.

If this Policy changes due to changes in laws, policies, or services, we will announce it through the site’s notices at least 7 days before it takes effect.

Business Information