SKIN9HARI POLICY
Third Parties & Processors
In accordance with Articles 17, 26, and 28-8 of the Personal Information Protection Act of Korea, KW Cosmetic Co., Ltd. discloses the provision of personal information to third parties, the outsourcing of processing, overseas transfers, and the operation of automatic collection tools as follows. This document explains the Privacy Policy in detail, and the two documents are always kept consistent.
1. Provision of Personal Information to Third Parties
The Company processes users’ personal information only within the scope of the purposes stated in the Privacy Policy and does not provide it externally without the user’s consent, except in the cases listed below.
However, automatic collection tools (cookies, pixels, and scripts) of external advertising and analytics providers are installed on the Company’s websites, through which those providers directly collect users’ behavioral information. The list of providers, the items collected, retention periods, and opt-out methods are described below in “4. Operation of Automatic Collection Tools (Cookies and Pixels) on the Website and How to Opt Out”.
| Recipient | Purpose | Items provided | Retention period |
|---|---|---|---|
| Naver Financial Corp. (Naver Pay) | Processing Naver Pay payments, order integration, purchase confirmation, cancellation, and refunds | Order number, ordered product information, payment amount, name and contact number of the orderer and recipient, shipping address | Period prescribed by applicable laws |
| Kakao Pay Corp. | Processing Kakao Pay payments, payment cancellation and refunds | Order number, payment amount, payment approval information | Period prescribed by applicable laws |
Apart from the above, personal information may be provided only where special provisions exist in law or where an investigative agency requests it in accordance with the procedures and methods set out in law.
When using social login
When a user chooses to log in with a Kakao or Naver account, the Company does not provide information to that provider; rather, the Company receives from that provider the items the user has agreed to share. The items received and the consent procedure can be checked on each login screen.
2. Outsourcing of Personal Information Processing
| Processor | Outsourced tasks | Processor’s privacy policy |
|---|---|---|
| Cafe24 Corp. | Building and operating the online store system, server management, providing order and payment processing infrastructure | cafe24.com privacy policy (effective August 5, 2026) |
| CJ Logistics Corp. | Product delivery | See the processor’s privacy policy |
| KG Mobilians Co., Ltd. | Electronic payment processing | See the processor’s privacy policy |
| CREMA Inc. | Operating the product review service (writing, managing, and compiling statistics on reviews) | See the processor’s privacy policy |
| Automattic Inc. | Brand site hosting and visit statistics | automattic.com/privacy |
| Aligo Inc. | Sending notification text messages and KakaoTalk notifications | See the processor’s privacy policy |
When concluding outsourcing contracts, the Company specifies matters concerning the safe management of personal information in the contract and supervises how processors handle it. If the outsourced tasks or processors change, the Company will disclose this on this page.
3. Transfer of Personal Information Overseas
In accordance with Article 28-8 of the Personal Information Protection Act, the Company discloses its overseas transfers of personal information as follows. The servers of the online store system that processes orders and payments (Cafe24) and of the review service (CREMA) are located in Korea. However, through the advertising and analytics tools installed on the brand site, users’ behavioral information is transferred overseas as shown in the table below.
| Recipient (entity and contact) | Country | Time and method of transfer | Purpose | Items transferred | Retention period |
|---|---|---|---|---|---|
| Google LLC Privacy policy and contact | United States | In real time each time a user accesses a web page, sent through automatic calls to the HTTPS-based gtag.js script | Website usage statistics (Google Analytics 4); advertising conversion measurement, bid optimization, and remarketing (Google Ads); product information integration (Google tag container and Merchant Center) | Visited page URL, visit date and time, time on page, device and browser information, ad click identifier (gclid), cookie identifiers (_ga, _ga_W37YY6P2J0, _gcl_au, _gcl_aw, _gac_<wpid>, etc.) | Cookies: _ga and _ga_W37YY6P2J0 2 years each; advertising cookies 90 days (IDE 24 months)Google Analytics event and user data retention: event data 2 months, user data 14 months (reset when new user activity occurs) — the Company’s settings as checked in the GA4 admin screen on August 30, 2026 |
| Meta Platforms, Inc. Privacy policy and contact | United States | In real time each time a user accesses a web page, sent through automatic calls to the HTTPS-based pixel script (connect.facebook.net) and image requests | Serving personalized ads and measuring advertising effectiveness | Visited page URL, visit date and time, browser and device information, event parameters such as purchases, cookie identifiers (_fbp, _fbc) | _fbc 90 days. Other server-side retention periods follow Meta’s privacy policy and are not controlled by the Company |
| TikTok Pte. Ltd. Privacy policy and contact | Singapore | In real time each time a user accesses a web page, sent through automatic calls to the analytics.tiktok.com pixel script (pixel ID CG41DDRC77U5H3K1QN9G) | Measuring TikTok advertising performance and serving personalized ads | Visited page URL, visit date and time, usage behavior such as clicks, adding to cart, purchases, and searches, device identifiers, browser cookies | Follows TikTok’s privacy policy and advertising service terms |
| Automattic Inc. Privacy policy and contact | United States | In real time each time a user accesses a web page, sent through automatic calls to stats.wp.com and s0.wp.com scripts | Brand site visit statistics and hosting performance monitoring | IP address, access date and time, browser and device information, cookies (tk_ai, tk_qs, etc.) | Web server logs approximately 30 days |
How to refuse overseas transfer — Users can refuse overseas transfer using each provider’s opt-out methods described below in “4. Operation of Automatic Collection Tools (Cookies and Pixels) on the Website and How to Opt Out,” or by blocking or deleting cookies in their browser. Refusing does not restrict core services such as product search, ordering, and payment; personalized ads will not be provided and some statistics functions may not work.
4. Operation of Automatic Collection Tools (Cookies and Pixels) on the Website and How to Opt Out
For service usage statistics and online personalized advertising, the Company allows the following automatic collection tools (cookies, pixels, and scripts) of external providers to operate on its websites. The Company does not operate a separate cookie consent banner, and users may refuse collection at any time using the methods described for each item below.
| Provider (country) | Purpose | Items collected and cookie names | Retention period | How to opt out |
|---|---|---|---|---|
| Google LLC (United States) Google Analytics 4 Measurement ID G-W37YY6P2J0 | Statistical analysis of website visits and usage behavior; service quality improvement | Visited page URL, visit date and time, time on page, device and browser information Cookies: _ga (distinguishing users), _ga_W37YY6P2J0 (maintaining session state) | Cookie validity 2 years each Event and user data: event data 2 months, user data 14 months (reset when new user activity occurs) — the Company’s settings as checked in the GA4 admin screen on August 30, 2026 Google signals data 26 months |
|
| Google LLC (United States) Google Ads conversion tracking — conversion ID AW-768525450Google tag container GT-WFMM7QDP(linked to Merchant Center MC-GSWX59SPM2) | Measuring conversions such as visits and purchases after ad clicks, optimizing ad performance, remarketing, product information integration | Ad click identifier (gclid), visited and conversion page URL, visit date and time Cookies: _gcl_au, _gcl_aw, _gac_<wpid>, Conversion, IDE, NID, DSID, TAID, test_cookie | Cookie validity 90 days (_gcl_au, _gcl_aw, _gac_<wpid>, Conversion), IDE 24 months, NID 6 months, DSID 2 weeks, TAID 14 days, test_cookie 15 minutes |
|
| Meta Platforms, Inc. (United States) Meta Pixel ID 623276008117051 | Analyzing website visit and purchase behavior; serving and measuring personalized ads on Facebook and Instagram | Visited page URL, visit date and time, browser and device information, purchase event parameters Cookies: _fbp (pixel unique identifier), _fbc (ad click identifier) | _fbc validity 90 daysOther retention periods follow Meta’s privacy policy and are not controlled by the Company |
|
| NAVER Corporation (Republic of Korea) Naver log analysis (WCS) Account s_16e0b7858513 | Analyzing referral paths through Naver search and advertising; measuring advertising conversions | Referral path (referrer), search keywords, access date and time Cookies: NA_CO, NVADID, CPAValidator | Website visit records 3 months |
|
| Kakao Corp. (Republic of Korea) Kakao Pixel 6574928757734814002( t1.daumcdn.net) | Serving and measuring personalized ads on KakaoTalk and Daum placements | De-identified ad cookie aid, mobile advertising identifiers (ADID, IDFA), event type and tags, URL of the web page where the pixel ran, referrer URL, IP address, browser user agent | Follows Kakao’s privacy policy and advertising service terms |
|
| TikTok Pte. Ltd. (Singapore) TikTok Pixel CG41DDRC77U5H3K1QN9G( analytics.tiktok.com) | Measuring TikTok advertising performance; serving personalized ads | Visited page URL, visit date and time, usage behavior such as clicks, adding to cart, purchases, searches, and content views, device identifiers (GAID, IDFA), browser cookies | Follows TikTok’s privacy policy and advertising service terms |
|
| CREMA Inc. (Republic of Korea) Review widget ( cre.ma) | Providing the product review writing, management, and statistics service | Order information (product name, order number), review content and images, member identifier (within the outsourced scope), widget-related cookies | Until the outsourcing contract ends, or until membership withdrawal or a request to delete a review |
|
| Automattic Inc. (United States) Jetpack / WordPress.com Stats ( stats.wp.com, s0.wp.com) | Brand site visit statistics; hosting performance monitoring | IP address, access date and time, browser and device information, cookies (tk_ai, tk_qs, etc.) | Web server logs approximately 30 days |
|
Collection, use, and refusal of behavioral information
1) De-identification principle — Behavioral information collected by the Company is, in principle, processed without identifying specific individuals. However, where it can identify an individual when combined with other information, it is treated as personal information and the Personal Information Protection Act applies.
2) Behavioral information collected — Visited page URL, visit date and time, time on page, usage behavior such as clicks, scrolling, adding to cart, and purchases, referrer (referral path), search keywords, IP address, browser user agent, device and operating system information, ad click identifier (gclid), mobile advertising identifiers (ADID, IDFA), and cookie identifiers.
Cookie identifiers in detail: _ga, _ga_W37YY6P2J0, _gcl_au, _gcl_aw, _gac_<wpid>, Conversion, IDE, NID, DSID, TAID, test_cookie (Google) / _fbp, _fbc (Meta) / NA_CO, NVADID, CPAValidator (Naver) / aid (Kakao) / tk_ai, tk_qs (Automattic)
3) How behavioral information is collected — When a user accesses the website, it is automatically generated and collected through cookies and similar technologies running in the browser (pixel tags, JavaScript scripts, image beacons) and sent to each provider.
4) Purpose of collecting behavioral information — Statistical analysis of website visits and usage, service quality improvement, and serving online personalized ads and measuring advertising effectiveness (including conversion tracking and remarketing)
5) Retention and use period — The validity of the cookies themselves ranges from a minimum of 15 minutes to a maximum of 2 years, and advertising cookies are generally 90 days. The retention period of data stored on each platform’s servers is as shown in the “Retention period” column of the table above. Website access records kept directly by the Company are retained for 3 months.
6) User control — how to refuse the collection of behavioral information
- Browser settings
- Chrome: Settings > Privacy and security > Third-party cookies
- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
- Safari: Preferences > Privacy > Prevent cross-site tracking
- Opting out of ads by platform: See the “How to opt out” column of the table above.
- Industry-wide opt-out tools: DAA WebChoices, NAI opt-out guide
- Resetting mobile advertising identifiers: Android (Settings > Google > Ads), iOS (Settings > Privacy & Security > Tracking)
If you refuse to store cookies, you may have difficulty using some services such as staying logged in and the shopping cart.
5. Contact
For inquiries about provision to third parties, outsourcing, overseas transfers, or automatic collection tools, please contact the Chief Privacy Officer.
| Chief Privacy Officer | Kyungwan Park |
|---|---|
| Phone | +82-70-8838-4467 |
| skin9hari@naver.com |
Supplementary Provisions
(1) This policy is effective from August 29, 2026.
(2) Main changes in this revision
– The providers receiving overseas transfers were corrected from one company, Automattic Inc., to four companies — Google LLC, Meta Platforms, Inc., TikTok Pte. Ltd., and Automattic Inc. — and the items transferred, purposes, retention periods, and how to refuse were specified.
– A new section, “4. Operation of Automatic Collection Tools (Cookies and Pixels) on the Website and How to Opt Out,” was added describing the external automatic collection tools (cookies and pixels) operating on the Company’s websites and how to opt out.
– The formal names of processors and links to their privacy policies were added to the outsourcing table.
(3) The previous policy (effective August 20, 2026) is available on request from the Chief Privacy Officer.