Hyundai Duty Free Privacy Policy

 

Hyundai DF Co., Ltd. (hereinafter "Hyundai Duty Free") has established this Privacy Policy to thoroughly protect all personal information provided by customers, and discloses the measures it takes to protect customers' personal information by posting this Policy at the bottom of the main page of the Hyundai Duty Free website, so that customers can easily view and check it at any time. In addition, Hyundai Duty Free's Privacy Policy may be amended due to changes in relevant laws, policies, or other reasons, and in the event of any amendment, we will notify customers of all details, including the effective date, through notices, pop-up windows, etc., so that they can easily check the changes.

 

This Privacy Policy consists of the following articles.

Article 1 Methods of Obtaining Consent to the Collection and Use of Personal Information

Article 2 Purposes of Processing and Items of Personal Information Collected

Article 3 Entrustment of Personal Information Processing for the Provision of Services

Article 4 Provision of Personal Information to Third Parties

Article 5 Retention and Use Period of Personal Information

Article 6 Procedures and Methods for the Destruction of Personal Information

Article 7 Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them

Article 8 Installation and Operation of Automatic Collection Devices and How to Refuse Them

Article 9 Collection, Use and Refusal of Behavioral Information

Article 10 Technical and Administrative Measures for the Protection of Personal Information

Article 11 Linked Sites

Article 12 Management of and Responsibility for Posts

Article 13 Department in Charge of Personal Information Protection

Article 14 Remedies for Infringement of Rights

Article 15 Protection of Personal Information of Children Under 14

Article 16 Collection and Protection of Personal Information of Non-member Customers

Article 17 Restrictions on the Transmission of Advertising Information

Article 18 Duty to Give Notice of the Privacy Policy

 

Article 1 Methods of Obtaining Consent to the Collection and Use of Personal Information

Hyundai Duty Free obtains customers' consent using one of the following methods.

①      Posting the details of consent on the website and having the customer indicate whether they consent

②      Handing a written document containing the details of consent (membership application form) directly to the customer, or delivering it by mail or facsimile, and having the customer sign or seal and submit it

③      Sending an e-mail containing the details of consent and receiving an e-mail from the customer expressing their consent

④      Informing the customer of the details of consent by telephone and obtaining consent, or guiding the customer to a means of checking the details of consent, such as a web address, and obtaining consent through a follow-up telephone call

⑤      Provision by partner companies

⑥      Collection of information generated in the course of using PC or mobile services

 

Article 2 Purposes of Processing and Items of Personal Information Collected

①      Purposes of Collection and Use of Personal Information

Hyundai Duty Free collects and uses the personal information necessary to allow customers to purchase goods and to provide various services, as set out below.

Category	Purpose of Use
Member management	• Identity verification for the use of membership services • Prevention of fraudulent and unauthorized use • Retention of records for customer consultation, receipt and handling of customer complaints, and dispute resolution • Delivery of notices and age verification (confirmation of whether under 14) • Where necessary for the settlement of payments for transactions in goods, etc.
Performance of service provision	• User identification and identity verification • Provision of content, notification of event/prize results, delivery of goods, and response to inquiries • Conclusion and performance of contracts (purchases, payment, refunds, delivery of goods) • Provision of reward points and discount benefits, and compliance with information management obligations
Marketing and advertising	• Information on new services and events • Data for providing personalized services and use for marketing • Provision of services and advertising based on statistical characteristics • Analysis of website visit frequency and statistics on service use • Sending of periodicals and information on new products or services • Customer surveys and information on services and products

※ Fraudulent use refers to illegal or improper acts, such as repeatedly re-registering after withdrawing membership or cancelling purchases after buying products, unlawfully or improperly obtaining economic benefits such as event benefits and discount coupons, acts prohibited under the Terms of Use, and stealing another person's identity.

 

②      Personal information processed without the consent of the data subject

Legal Basis	Category	Items Collected	Purpose of Collection and Processing	Retention Period
Article 15(1)4 of the Personal Information Protection Act (Performance of a contract)	Online Membership registration	[Conversion of offline members to online integrated members] ID, name (Korean/English), e-mail, password, mobile phone number, date of birth, nationality, gender, customer number, identity verification value (CI) ※ However, CI is not collected from foreign nationals	Provision of membership services, user identification and identity verification, delivery of notices and handling of complaints, etc.	Upon withdrawal of membership (However, where retention for a certain period is required by law, until the end of that period)
Article 15(1)4 of the Personal Information Protection Act (Performance of a contract)	Offline Membership registration	Name, nationality, gender, date of birth, passport number, passport expiration date, mobile phone number, purchase information (items purchased, transaction date and time, payment amount, payment method information)	Identification for providing and managing membership services, notices, service improvement, accident investigation, handling of complaints, contact for customer satisfaction surveys, performance of contracts, and fulfillment of legal obligations	Upon withdrawal of membership or until the purpose of collection and use of personal information is achieved (However, where retention for a certain period is required by law, until the end of that period)
Article 15(1)4 of the Personal Information Protection Act (Performance of a contract); Article 27 (Obligations of Operators) of the Public Notice on the Patent and Operation of Bonded Stores	Non-member Product purchase	Name (including English name), e-mail, password, mobile phone number, date of birth, nationality, gender, departure information (departure date, place of departure and destination, flight number, direct/connecting flight, etc.), payment information (payment card number, acquiring card company name, expiration year/month, number of installment months, approval date), (for online non-members) order password	Identity verification for duty-free purchases, communication such as contact for contract performance and handling of complaints, verification of whether the customer is a child under 14	3 years after delivery of goods (However, where retention for a certain period is required by law, until the end of that period)
Article 15(1)4 of the Personal Information Protection Act (Performance of a contract)	Power of attorney for cancellation (For foreign nationals)	[Principal] Name, date of birth, passport number, passport expiration date [Agent] Copy of ID card (photo, name, date of birth)	Identity verification and processing of requests, performance of purchase contracts and compliance with obligations under relevant laws	5 years

 

 

③      Personal information processed with the consent of the data subject

Legal Basis	Category	Items Collected	Purpose of Collection and Processing	Retention Period
Article 15(1)1 of the Personal Information Protection Act (Consent of the data subject)	Online Membership registration	[H.Point integrated member] ID, name, password, date of birth, gender, mobile phone number, e-mail, CI, nationality, passport number, English name, passport expiration date, customer number (However, CI is not collected from foreign nationals)	Provision of membership services, user identification and identity verification, delivery of notices and handling of complaints, etc.	Upon withdrawal of membership  (However, where retention for a certain period is required by law, until the end of that period)
		[AIRSTAR Hyundai Duty Free member] ID, name, password, date of birth, gender, mobile phone number, e-mail, nationality, English name, passport expiration date		Until withdrawal from AIRSTAR membership and termination of the Hyundai Duty Free partnership
	Product purchase	Passport number	User identification and identity verification, delivery of notices and handling of complaints, etc., performance of purchase contracts and compliance with obligations under relevant laws	5 years (For members, until withdrawal of membership)
	Overseas Korean verification	Passport information (photo, English name, date of birth, passport number, passport expiration date)	Identity verification and processing of requests, performance of purchase contracts and compliance with obligations under relevant laws	Upon request for exclusion from overseas Korean status
	Refund of bank transfer payments	Account information (account holder, bank, refund account number)	Refund of payments (deposits)	Upon withdrawal of membership
	Partner membership	SKYPASS membership number	Korean Air mileage accrual	Upon withdrawal of membership
	Main hotline inquiries	Name, purchasing store, e-mail, contact information (mobile phone number, telephone number), inquiry details, call recording file	Customer identification for responding to inquiries, response actions, notification of results	3 years
	Inquiries on changes to passport information	Passport number, copy of passport (photo, English name, nationality, date of birth, gender, passport number, passport expiration date)	Processing of changes to passport information	Upon withdrawal of membership (However, where retention for a certain period is required by law, until the end of that period)
	Wedding Shop event	Spouse information (name, ID), scheduled departure date, wedding date, wedding invitation	Provision of reward points and congratulatory coupons	Until withdrawal of membership (However, the wedding invitation image is destroyed immediately after approval)
	Member events such as reviews, purchases, and comments	ID, name, contact number, e-mail, address (for physical prizes) (※ Event details can be found on the winner announcement page)	Notification of winners and delivery of prizes	Until withdrawal of membership
	Marketing and advertising	Name, e-mail, mobile phone number,	Provision of and information on duty-free services Information on events and products	Until withdrawal of membership or withdrawal of consent (However, where retention for a certain period is required by law, until the end of that period)
		Nationality, gender, date of birth, purchase information	Use for marketing to provide event information Market research and product research and development
	Store entry/partnership	Name, mobile phone number, e-mail	Receipt of and response to partnership/store entry inquiries	3 years
Income Tax Act Article 21 (Other Income), Article 164 (Submission of Payment Statements)	Processing of taxes and public charges	Resident registration number	Processing of taxes and public charges on event prizes (other income)	5 years

④    Personal information generated in the course of using other services or conducting business

- Service use records, access logs, access information, cookies, access IP information

- (Mobile app) Device identification number, device OS information, device model name, whether push notifications are enabled

 

⑤   Personal information collected from sources other than the data subject

 

Legal Basis	Category	Items Collected	Purpose of Collection and Processing	Retention Period
Article 15(1)4 of the Personal Information Protection Act (Performance of a contract)	Simple login	[Naver] Serial number and e-mail sent from the SNS [Kakao] Serial number and e-mail sent from the SNS	Provision of Naver/Kakao/ simple login service	Upon withdrawal of membership or as long as the simple login setting is maintained
	AIRSTAR membership	CI, e-mail, passport number, name, date of birth, mobile phone number	Checking whether the customer is a duty-free shop member	Destroyed immediately after the membership check is completed
		AIRSTAR ID, name, mobile phone number, e-mail, passport number, country/region, name on passport, date of birth, gender code, passport expiration date, departure date and time, airline, flight number, departure airport, arrival airport, terminal name, stopover, ordered products	Duty-free product order processing	Service provision period (where retention is required under relevant laws, or where prior consent has been obtained, the applicable retention period)
		Card number, expiration date, first 2 digits of password, date of birth	Duty-free product simple payment	5 years (For members, until withdrawal of membership)

※ Pursuant to Article 37 of the Personal Information Protection Act, customers may request the suspension of the processing of their personal information or withdraw their consent to the processing of personal information.

 

⑥   Measures in case of entry of false information

Customers must ensure the accuracy, truthfulness and legality of their personal information. If a customer violates this by entering false information in any way, such as stealing another person's information or entering fictitious information, Hyundai Duty Free may report the customer in accordance with relevant laws and may take measures to restrict the use of services, such as forced withdrawal of membership.

 

Article 3. Entrustment of Personal Information Processing for the Provision of Services

①    Hyundai Duty Free entrusts some of its work to external parties for the performance of contracts and improvement of services. The details of the entrusted work and the entrusted parties are as follows.

Entrusted party (Sub-entrusted party)	Details of entrusted work
Hyosung ITX	Customer consultation and customer center operation
Humuson (Kakao, Daou Technology)	SMS, MMS, app push notification services, identity verification
Dreamsecurity	Age verification and identity verification services
KICC	Credit card payment processing
KRP	Payment gateway (PG)
KSNET	Credit card payment processing
KG Mobilians (MetaM)	Mobile phone micropayments
LG CNS (E-Commerce Tech, Hansung MS)	Simple payment services
Hyundai Futurenet (SK Inc.)	Maintenance and development of IT systems
Hyundai Department Store (Hyundai Futurenet)	Operation of integrated membership registration
GS M-Biz (LG Uplus, GS ITM)	Sending of mobile coupons for event prizes
Capstec, Prostech	Access security and CCTV operation at stores and the integrated logistics center
UNIES	Store warehouse operation
E-System	Integrated logistics center warehouse operation
MARS30	SNS operation and delivery of event prizes
Plateer (NHN)	Maintenance of marketing service solutions
Joeun System, eBridge	Store sales
Korea Duty Free Shops Association (Will & Withs, E-System, Yongjin TNS)	Operation of store delivery counters

②    Information shared with entrusted parties is limited to the minimum information necessary to achieve the relevant purpose, and personal information is selectively provided to the relevant companies according to the customer's service requests.

③    When entering into an entrustment contract, we clearly stipulate the purpose and scope of the entrusted work, the prohibition on processing personal information for purposes other than the entrusted work, safety measures such as restriction of access to personal information and technical and administrative protection measures, restrictions on sub-entrustment, and supervision of the status of personal information management, and we keep the contract in writing or electronically.

④    If there are any changes in the entrusted parties or the details of the entrusted work, we will announce them on the Privacy Policy page of our website.

⑤    In the following cases, personal information may be provided without the customer's consent in accordance with the provisions of relevant laws.

l   Where the minimum user information necessary for delivery (name, address, telephone number) is provided to a delivery company for delivery purposes

l   Where necessary for the settlement of payments for transactions in goods, etc.

l   Where necessary for identity verification to prevent identity theft

 

Article 4 Provision of Personal Information to Third Parties

①    Hyundai Duty Free processes customers' personal information within the scope notified in "Purposes of Collection and Use of Personal Information," and provides personal information to third parties only with the customer's consent or where there are special provisions in the law.

Basis for Provision	Recipient	Items Provided	Purpose of Provision	Recipient's Retention Period
Articles 12 and 196 of the Customs Act and Articles 3 and 213 of the Enforcement Decree of the same Act	Korea Customs Service	Name, nationality, date of birth, passport number, departure information, delivery information	Reporting to the Korea Customs Service (Article 289 of the Enforcement Decree of the Customs Act, etc.)	Semi-permanent
Article 17(1) of the Personal Information Protection Act (Consent of the data subject)	Hyundai Department Store	CI, ID, password, name, customer number, date of birth, gender, mobile phone number, e-mail, Korean/foreign national status, purchase information, payment information (limited to items eligible for H.Point accrual)	H.Point membership registration, website login, accrual and use of H.Point, and provision of other H.Point membership-related services	Until withdrawal of membership or until the purpose of collection and use of personal information is achieved (However, where retention for a certain period is required by law, until the end of that period)
	Korean Air	SKYPASS membership number, English name	Korean Air mileage accrual	Until withdrawal from Korean Air mileage program
Article 17(4) of the Personal Information Protection Act (Additional use and provision of personal information)	AIRSTAR DF	AIRSTAR membership number, membership tier	AIRSTAR membership linkage and service provision, membership tier management	Until withdrawal from AIRSTAR membership

②    When providing or sharing customer information through partnerships, we notify customers in advance of the party receiving or sharing the information, the items of personal information provided or shared and the purpose of provision, the retention period, the fact that the customer has the right to refuse consent, and any disadvantages resulting from refusal to consent, and then obtain their consent. If there is any change in or termination of a partnership, we will notify customers without delay through the notices on the main page of the online website and, where necessary, individually at least once by e-mail, etc.

③    If the transfer of customers' personal information becomes necessary due to a sale, merger and acquisition, business transfer, etc., Hyundai Duty Free will notify customers in advance of the transfer of personal information in accordance with the procedures and methods prescribed by relevant laws such as the Personal Information Protection Act, and will grant members the right to withdraw consent to the transfer of personal information.

 

Article 5 Retention and Use Period of Personal Information

①    Hyundai Duty Free destroys the relevant personal information without delay when the purpose of collection and use of the customer's personal information has been achieved, when the customer withdraws membership, or when the customer withdraws consent to the provision of personal information. (However, if a member is expelled due to fraudulent or unauthorized use, the information is retained and used for 6 months and then destroyed.)

②    Where retention is required to fulfill legal obligations, the information is stored separately in a database or table separate from the operating database, according to the following criteria.

Category		Retention Period
Article 6 of the Act on the Consumer Protection in Electronic Commerce, etc.	Records of contracts or withdrawal of offers	5 years
	Records of payment and supply of goods, etc.	5 years
	Records of consumer complaints or dispute handling	3 years
	Records of labeling and advertising	6 months
Article 33 of the Commercial Act	Important business-related documents such as contracts, applications, and invoices	10 years
Article 15-2 of the Protection of Communications Secrets Act	Website visit records (logs), access location tracking data	3 months
Article 12 of the Customs Act and Article 3 of the Enforcement Decree of the same Act; Article 30 of the Public Notice on the Operation of Bonded Stores	Purchase history	2 years
	Delivery history	3 years

 

 

Article 6 Procedures and Methods for the Destruction of Personal Information

Hyundai Duty Free destroys personal information without delay once the purpose of processing has been achieved or the retention and use period has expired. The specific procedures and methods of destruction are as follows.

①    Procedures for destruction

l   Information entered by members for membership registration, etc. is stored for a certain period after the purpose has been achieved, in accordance with internal policies and other reasons for retaining information under relevant laws (see Retention and Use Period), and is then destroyed.

l   Personal information is not used for any purpose other than the retention purpose prescribed by the relevant laws.

②    Methods of destruction

l   Personal information printed on paper is destroyed by shredding or incineration.

l   Personal information stored in electronic file form is deleted using a technical method that makes the records unrecoverable.

 

Article 7 Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them

①    Customers may at any time view, correct, delete, or request suspension of processing of their registered personal information. Customers may view, correct or delete their information directly by clicking "Manage Basic Information" on the website, or contact the Chief Privacy Officer or the person in charge in writing, by telephone or by e-mail, and we will take action without delay after a verification procedure.

l   PC (website): After logging in, click the person icon at the top right → Info tab → "Manage Basic Information" → Enter password → "Edit Member Information / Withdraw Membership"

l   Mobile (app): After logging in, tap the person icon at the bottom right → Info tab at the bottom of the screen → "Manage Basic Information" (fourth from the bottom) → Enter password → "Edit Member Information / Withdraw Membership"

l   The rights of children under 14 must be exercised directly by their legal representative. Customers who are minors aged 14 or older may exercise their rights regarding their personal information themselves or through their legal representative.

②    If a customer requests correction of an error in their personal information, we will not use the personal information or provide it to third parties until the correction is completed. In addition, if incorrect personal information has already been provided to a third party, we will notify the third party of the result of the correction without delay so that the correction can be made.

③    Even if a customer using the Hyundai Duty Free app deletes the app from their mobile device, a separate request, such as withdrawal of membership, is required if their information remains with Hyundai Duty Free.

④    Customers may also make requests to view, correct, delete, or suspend processing of their personal information through an agent, such as a legal representative or a person delegated by the customer. In this case, a power of attorney in the form of [Annex Form 11] of the "Public Notice on Personal Information Processing Methods" must be submitted.

⑤    Customers are requested to enter their personal information accurately and keep it up to date to prevent unexpected incidents. Customers are responsible for any incidents arising from inaccurate information they have entered, and membership may be revoked if false information is entered, such as by stealing another person's information.

⑥    Customers have not only the right to have their personal information protected, but also the obligation to protect themselves and not to infringe on the information of others. Please take care that your personal information, including your password, is not leaked, and be careful not to damage the personal information of others, including in posts.

⑦    If a customer fails to fulfill these responsibilities and damages the information or dignity of others, they may be punished under the Personal Information Protection Act, etc.

⑧    The customer's right to request access to and suspension of processing of personal information may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act.

⑨    Where other laws specify the customer's personal information as subject to collection, the customer may not request deletion of that personal information.

⑩    Hyundai Duty Free verifies whether the person exercising the right is the customer or a legitimate agent.

⑪    Hyundai Duty Free guarantees the data subject's right to self-determination of personal information and strives to provide consultation and remedies for damage caused by infringement of personal information. If you need to report or consult about an infringement of personal information, please contact our Customer Service Center.

l   Department: Information Security Team

l   Telephone: 1811-6688

l   E-mail: privacy_hddfs@hddfs.com

 

Article 8 Installation and Operation of Automatic Collection Devices and How to Refuse Them

①      Hyundai Duty Free installs and operates cookies*, and users may refuse them.

l   A cookie is a temporary file automatically created when you access a website; it is a very small text file sent by the server used to operate the website to the user's browser and stored on the hard disk of the user's computer.

②      Users have a choice regarding cookies and, by setting the options of their web browser as follows, may choose to accept all cookies, be asked each time a cookie is stored, or block all cookies. However, if a user refuses to store cookies, there may be restrictions on use, such as having to re-enter login information when using some services that require login.

l   The methods for specifying whether to allow the installation of cookies are as follows.

[WEB]

Category	Method
Edge web browser	[Settings] at the top right of the web browser > [Cookies and site permissions] > Manage and delete cookies and site data
Chrome web browser	[Settings] at the top right of the web browser > [Privacy and security] > Manage and delete third-party cookies

[APP]

Category	Method
Android	[Home] > [Settings] > [Google] > [Ads] > Turn off ads personalization
iPhone	[Home] > [Settings] > [Privacy & Security] > [Tracking] > Turn off "Allow Apps to Request to Track"

③      Hyundai Duty Free may read the contents of cookies in the user's browser and find additional user information on the user's computer to provide services without requiring the user to enter additional information such as their name upon access.

④      Hyundai Duty Free analyzes users' interests, preferences, tastes and tendencies based on advertising identifiers, etc. Details are as follows.

Category	Method
Items collected	Service use records and access logs (clicks, search history, etc.)
Collection method	Automatically collected during service use
Purpose of collection	Provision of personalized services by analyzing users' interests and preferences
Retention and use period	Destroyed after being retained for 1 year and 3 months
How to exercise control	- Edge: [Settings] at the top right of the web browser > [Cookies and site permissions] > Manage and delete cookies and site data                    - Chrome: [Settings] at the top right of the web browser > [Privacy and security] > Manage and delete third-party cookies                    - Android: [Home] > [Settings] > [Google] > [Ads] > Turn off ads personalization - iPhone: [Home] > [Settings] > [Privacy & Security] > [Tracking] > Turn off "Allow Apps to Request to Track"
Remedies for damage	- Custoer Service Center: 1811-6688 - Website: Customer Center > 1:1 Inquiry

 

Article 9 Collection, Use and Refusal of Behavioral Information

①      Hyundai Duty Free collects and uses behavioral information in a form that can identify individuals by using cookies in order to provide users with optimized, personalized services and benefits, online personalized advertising, etc. in the course of service use.

②      Hyundai Duty Free analyzes users' interests, preferences, tastes and tendencies based on advertising identifiers, etc. Details are as follows.

Category	Method
Items collected	Mobile app/website service use history (website visit history/app installation history/app usage history), access logs, advertising identifiers (ADID, IDFA)
Collection method	Automatic log collection of customers' key actions when users visit the website or run the app
Purpose of collection	User analysis such as product/service development, statistics and customer analysis, and provision of personalized advertising based on users' behavioral information
Retention and use period	1 year and 3 months
Remedies for damage	- Customer Service Center: 1811-6688 - Website: Customer Center > 1:1 Inquiry

 The methods for blocking/allowing personalized advertising are as follows. However, changing cookie settings may restrict the use of some services, such as automatic login to the website.

Category	Method
Chrome	Settings > Privacy and security > Delete browsing data Settings > Privacy and security > Third-party cookies > Block third-party cookies
Safari	Settings > Safari > Advanced > Block All Cookies
Edge	Settings > Privacy, search, and services > Tracking prevention > Select whether to use tracking prevention and its level > Select whether to always use "Strict" tracking prevention when browsing InPrivate
Android (mobile)	Settings > Security and privacy > Privacy > Other privacy settings > Ads > Reset advertising ID or Delete advertising ID
iPhone (mobile)	Settings > Privacy & Security > Tracking > Turn off app tracking ※ Menus and methods may vary slightly depending on the mobile OS version
Google Analytics	Install the opt-out browser add-on (tools.google.com/dlpage/gaoptout)

③      Information on the provision of behavioral information

Users' behavioral information is provided to analytics companies and partner advertising businesses in a non-identifiable form, as follows.

1) Recipients: Plateer, Google Analytics

2) Behavioral information items provided: Advertising identifiers targeted to specific interest groups

3) Recipients' retention and purpose of use: Provision of personalized advertising based on user interests

④      If we intend to provide personalized advertising to a child known to be under 14, we obtain the prior consent of the legal representative. Otherwise, we do not collect children's behavioral information for the purpose of personalized advertising and do not provide personalized advertising to children.

⑤      We collect only the minimum behavioral information necessary for optimized, personalized services and benefits and online personalized advertising, and we do not collect sensitive behavioral information that may infringe on an individual's rights, interests or privacy, such as ideology, beliefs, educational background or medical history.

 

Article 10 Technical and Administrative Measures for the Protection of Personal Information

In accordance with Article 29 of the Personal Information Protection Act, Hyundai Duty Free takes the following technical, administrative and physical measures necessary to ensure the safety of personal information so that it is not lost, stolen, leaked, forged, altered or damaged.

①      Minimization and training of personnel handling personal information
We keep the number of employees handling personal information to a minimum and provide regular training for the safe processing of personal information.

②      Regular internal audits

We conduct regular internal audits to ensure the safety of personal information processing.

③      Management and training of entrusted parties
When entrusting personal information processing, we regularly manage and train the entrusted parties.

④      Establishment and implementation of an internal management plan
We have established and implement an internal management plan for the safe processing of personal information.

⑤      Encryption of personal information
Among users' personal information, unique identification information (passport number) and passwords are encrypted for storage and management, and important data is protected by separate security features such as encryption or encryption during transmission.

⑥      Technical measures against hacking, etc.
To prevent the leakage, infringement and damage of personal information caused by hacking, computer viruses, etc., Hyundai Duty Free installs security programs, performs periodic updates and inspections, installs systems in areas with controlled external access, and monitors and blocks threats technically and physically.

⑦      Restriction of access to personal information
We record and manage the granting, change and cancellation of access rights to database systems that process personal information, and control unauthorized external access using an intrusion prevention system.

⑧      Retention of access records and prevention of forgery and alteration
We retain and manage records of access to the personal information processing system for at least 2 years, and take security measures to prevent access records from being forged, altered, stolen or lost.

⑨      Use of locking devices for document security
Documents and auxiliary storage media containing personal information are kept in a secure place with a locking device.

⑩      Access control for unauthorized persons
We have a separate physical storage location for personal information and have established and operate access control procedures for it.

 

Article 11 Linked Sites

Hyundai Duty Free may provide customers with links to other companies' websites or materials. In this case, since Hyundai Duty Free has no control over external sites and materials, it cannot be held responsible for, or guarantee, the usefulness of services or materials provided by them. If you click a link included by Hyundai Duty Free and move to a page on another site, the privacy policy of that site has nothing to do with Hyundai Duty Free, so please check the policy of the newly visited site.

 

Article 12 Management of and Responsibility for Posts

①      Hyundai Duty Free values customers' posts and does its best to protect them from being altered, damaged or deleted. However, in the following cases, posts may be deleted after an explicit or individual warning.

l   Posts that damage the reputation of others by spreading false information for the purpose of defaming them

l   Posts that disclose another person's personal details without the data subject's consent, infringe on the rights of Hyundai Duty Free or third parties such as copyrights, or are otherwise unrelated to the topic of the bulletin board

l   Spam posts (e.g., advertisements for specific sites or products)

l   Other posts that may violate the law

②      Fundamentally, all rights and responsibilities related to a post belong to its author. Information voluntarily disclosed through posts is difficult to protect, so please consider carefully before disclosing information.

 

Article 13 Department in Charge of Personal Information Protection

To protect customers' personal information and to collect opinions and handle complaints regarding personal information, Hyundai Duty Free has designated the relevant department and a Chief Privacy Officer as follows.

l   Chief Privacy Officer: Ban Hyung-chul

l   Department: Information Security Team

l   Position: CPO

l   Telephone: 1811-6688

l   E-mail: privacy_hddfs@hddfs.com

 

Article 14 Remedies for Infringement of Rights

Customers may apply for dispute resolution or consultation to obtain remedies for infringement of personal information. For reports and consultations on infringement of personal information, please contact the following organizations.

l   Personal Information Infringement Report Center: 118 (no area code needed) (https://privacy.kisa.or.kr)

l   Personal Information Dispute Mediation Committee: 1833-6972 (https://www.kopico.go.kr)

l   Cyber Investigation Division, Supreme Prosecutors' Office: 1301 (no area code needed) (https://www.spo.go.kr)

l   Cyber Crime Reporting System: 182 (no area code needed) (ecrm.police.go.kr)

 

Article 15 Protection of Personal Information of Children Under 14

In principle, Hyundai Duty Free does not collect personal information of children under 14. However, if it becomes necessary to collect personal information of children under 14, we will obtain the consent of their legal representative and comply with other standards required by law.

 

Article 16 Collection and Protection of Personal Information of Non-member Customers

①      Non-member customers may also purchase goods or service products. For non-member orders, Hyundai Duty Free collects only the personal information strictly necessary for payment and delivery of goods.

②      For purchases made as a non-member, the payer and recipient information entered by the non-member customer is not used for any purpose other than payment and delivery of goods.

③      The personal information of non-members is protected in the same way as that of members.

 

Article 17 Restrictions on the Transmission of Advertising Information

①      In principle, Hyundai Duty Free does not send advertising information for commercial purposes without the customer's prior consent (or where the customer has opted out or withdrawn prior consent).

②      If a customer has consented to receive advertising information for marketing purposes, such as event information and newsletters, we send it in accordance with the following measures.

l   Subject line of e-mail: The word "(Ad)" is displayed in the subject line

l   Body of e-mail: The sender's name, contact number, e-mail address and address through which the customer can opt out are specified, along with a method by which the customer can easily opt out or withdraw consent

③      However, prior consent is not obtained in the following case.

Where a person who has collected contact information directly from a recipient through a transaction in goods, etc. intends to send advertising information for commercial purposes regarding goods, etc. of the same kind as those it handles and traded with the recipient, within 6 months from the date the transaction ended

 

Article 18 Duty to Give Notice of the Privacy Policy

①      If any content of this Privacy Policy is added, deleted or modified in accordance with government policy or Hyundai Duty Free policy, the changes will be announced through the "Notices" section of the website.

②      This Privacy Policy is effective from September 29, 2026