Personal information processing policy full revision (draft)

 

Hyundai DF Co., Ltd. (hereinafter referred to as "Hyundai Duty Free") has enacted a personal information processing policy to thoroughly protect all personal information provided by customers, and by posting at the bottom of the first screen of Hyundai Duty Free's website, we disclose what measures are being taken to protect customers' personal information so that customers can always easily read and check it. In addition, Hyundai Duty Free's personal information processing policy may be changed due to reasons such as changes in related laws and policies, and in case of change, we will inform customers of all information including the date of change through notices and pop-up windows.

 

Article 1. Method of consent for collecting and using personal information, etc

Hyundai Duty Free acquires customer consent using one of the following methods..

① Method of posting consent information on the Internet homepage and allowing customers to indicate whether they agree or not.

② A method of issuing a document containing the consent (membership application form) directly to the customer, or delivering it by mail or facsimile, and having the customer sign and seal the consent before submitting it.

③ Method of sending an e-mail containing consent details and receiving an e-mail from the customer expressing consent.

④ Inform the customer of the consent details over the phone and obtain consent, or provide instructions on how to check the consent details, such as the Internet address, and obtain consent through a phone call again.

⑤ Provision from affiliates

⑥ Method through collection of information generated during PC and mobile use

 

Article 2. Purpose of processing personal information and items of personal information to be collected

① Purpose of collection and use of personal information
Hyundai Duty Free collects and uses personal information necessary to purchase goods and provide various services to customers as follows.

Division	Purpose of use
Membership management	•       Identification according to the use of membership services •       Prevention of Unauthorized Use and Prevention of Unauthorized Use •       Preserving records for customer consultation, receipt and handling of customer complaints, and dispute settlement •       Notification delivery and age verification (confirmation under the age of 14) •       Where it is necessary for the settlement of the price following the transaction of goods, etc
Implementation of service provision	•       User identification and identity verification •       Content provision, information on event/prize winning results, product delivery, and response to inquiries •       Contract conclusion and performance (purchase, payment, refund, product delivery) •       Provision of points and discount benefits, compliance with information management obligations
Marketing and Advertising Utilization	•       Information on new services and events •       Use of materials and marketing to provide personal services •       Provision of services and posting of advertisements according to statistical characteristics •       Determination of web page access frequency and statistics on service use •       Sending periodicals, announcing new products or services •       Customer survey, service and product information

※ Unauthorized use : Re-enrollment after membership withdrawal, Repeated cancellation of purchase, etc. after purchasing the product, The act of receiving economic benefits such as event benefits and discount coupons by default or expediency, Acts prohibited by the terms and conditions of use, etc., Unlawful acts such as theft of another person's name, etc

 

② Personal Information Collection Items

The specific items, purpose, retention period, and collection method of personal information collected by Hyundai Duty Free are listed in the table below.

 

 

Legal Basis	Required/Optional	Collection items	Purpose of collection and processing	Retention period	Collection method
Personal Information Protection Act, Article 15 (1), Subparagraph 4 (Performance of Contract) and In-store Sales	Product Purchase	Name, email, mobile phone number, date of birth, gender, nationality, passport number, departure/entry information, shipping address (including zip code), occupation (job title), and payment information (credit card number, etc.)	Purpose of Collection and Processing	Retained for 5 years (or until withdrawal of membership)	Collected through website, mobile app, and in-store sales counters

 

③ Personal Information Processed with the Consent of the Data Subject

Legal Basis

Personal Information Protection Act

Legal Basis	Required/Optional	Collection items	Purpose of collection and processing	Retention period	Collection method
Personal Information Protection Act, Article 15 (1), Subparagraph 1 (Consent of the Data Subject)	simple Member, Foreign Member, Integrated Member, and In-store Member	ID, Name, Password, Date of Birth, Gender, Mobile Phone Number Email, CI, Nationality, Passport Number, English Name, Passport Expiration Date (However, CI is not collected from in-store members and foreign members.)	To identify and verify users, notify them of important information, and handle and communicate civil complaints.	Retained until membership withdrawal (however, if retention is required by law, retained for the legally mandated period).	Website, mobile app, and, for in-store members, the in-store electronic membership application form
	AirstarDF (Incheon Airport Smart Duty Free)	Phone Number Email, CI, Nationality, Passport Number, English Name, Passport Expiration Date	To identify and verify users, deliver notices, handle inquiries, fulfill purchase contracts, and comply with laws.	Retained until withdrawal from AIRSTAR membership and termination of partnership with Hyundai Department Store Duty Free.	AIRSTAR Mobile App
	Category	Collected Items	Purpose of Collection and Processing	Retention Period	Collection Method
	Adult Verification	Nationality, passport number, English name, passport expiration date	Verification of adult identity during purchase	Destroyed immediately after verification	Homepage, Mobile App
	Product Purchase	Passport number	Identification and verification of users, delivery of notices, handling of inquiries, fulfillment of purchase contracts, and compliance with legal obligations	5 years (until membership withdrawal for members)	Homepage, Mobile App
	Identity Verification at Store	Passport information (photo, English name, date of birth, passport number, passport expiration date)	Verification of identity, delivery of notices, handling of inquiries, fulfillment of purchase contracts, and compliance with legal obligations	Until membership withdrawal	In-store
	Duty-Free Deposit Refund	Account information (bank name, account holder, account number)	Refund processing for prepaid deposits	Until membership withdrawal	Homepage, Mobile App

④ Personal Information Generated During the Use of Other Services or in the Course of Business Processing

-       Service usage records, access logs, access information, cookies, and access IP information

-       (Mobile App) Device identification number, device OS information, device model name, and PUSH notification reception status

⑤ Personal Information Collected from Third Parties

Legal Basis	Category	Collected Items	Purpose of Collection and Processing	Retention Period	Collection Method
Personal Information Protection Act Article 15 (1) and Article 17 (1)	Simple Login	Information transferred from Naver SNS (name, email), Kakao SNS (name, email)	Providing Hyundai Duty Free login service through Naver/Kakao/SNS Simple Login settings	Upon withdrawal of membership or deletion of SNS Simple Login settings	Website, Mobile App
Personal Information Protection Act Article 15 (1), Article 17 (1), and Article 26 (Consignment)	AIRSTAR Membership	CI, email, passport number, name, date of birth, mobile phone number	Verification of membership registration with Hyundai Duty Free	Immediately destroyed upon completion of membership verification	AIRSTAR Mobile App

 

※ In accordance with Article 37 of the Personal Information Protection Act, customers may request the suspension of processing of their personal information or withdraw their consent to such processing.

 

⑥ Precautions When Entering False Information

Customers must ensure the accuracy, authenticity, and validity of the personal information they provide. If a customer provides false information, uses another person’s information, or inputs fabricated data in any way, Hyundai Department Store Duty Free may report the incident in accordance with relevant laws and regulations, and may impose measures such as forced membership withdrawal or restrictions on service use

 

 

Article 3. Entrustment of personal information processing for service provision

① Hyundai Duty Free entrusts some tasks to external parties to fulfill contracts and improve services.    The details of the entrusted tasks and the trustees are as follows.

Consignment company(Re-consignment company)	Consignment work details
Hyosung ITX	Customer consultation and operation of the customer center
HumusOn (Kakao, Daou Technology)	SMS, MMS, app push notification service, identity verification
Dream Security	Age verification and identity authentication services
KICC	Credit card payment processing
KRP	Payment agency (PG company)
KSNET	Credit card payment processing
KG Mobilians(MetaM)	Cell phone micropayment
LG CNS(E-commerceTech, HanSungMS)	Easy payment service
Hyundai IT&E (SK Corporation)	Computer system maintenance and development
Hyundai Department Store(Hyundai IT&E)	Integrated membership registration operation
GS Mbiz (LG U+, GS ITM)	Sending event prize mobile coupons
S-Tech System	Branch operation and CCTV security operation management
Unies	Branch, integrated logistics center warehouse operation
E-system	Integrated logistics center warehouse operation
MARS30	SNS operation and event prize sending
Plateer (NHN)	Marketing Service Solution Maintenance
Joeun System, E-Bridge, Jeil BMC	Branch sales

② Information shared with the trustee is limited to the minimum information necessary to achieve the purpose, and personal information is selectively provided to the relevant company according to the customer's service request.

③ In the case of a consignment contract, the purpose and scope of the consignment work, the prohibition of processing personal information other than the purpose of the consignment work, technical and administrative protection measures, whether to restrict re-consignment, and supervision of the status of personal information management shall be clearly defined, and the contents of the contract shall be kept in writing or electronically.

④ When the details of the trustee or consignment work are changed, the fact is notified on the website's personal information processing policy screen.

⑤ In the following cases, it is possible to provide personal information without the customer's consent in accordance with the provisions of relevant laws and regulations.

§   When providing the minimum user information (name, address, phone number) required for delivery to the delivery company for delivery purposes.

§   When necessary for payment settlement due to transactions of goods, etc

§   When identity verification is required to prevent theft

 

Article 4. Provision of personal information to third parties

①Hyundai Duty Free processes customers' personal information within the scope notified in the "Purpose of Collection and Use of Personal Information", and provides personal information to a third party only if the customer's consent or the law provides it.

Legal Basis	Recipient	Information Provided	Purpose	Retention Period
Customs Act Art. 12, 196, 213	Korea Customs Service	Name, nationality, birth date, passport no., entry/exit info	Customs declaration	As required by law
PIPA Art. 17(1) (Data subject consent)	Hyundai Dept. Store Group	ID, name, gender, DOB, phone, email, purchase & payment info (H.Point)	H.Point service, login, points use	Until withdrawal or legal retention
PIPA Art. 17(1) (Data subject consent)	Korean Air	Skypass member no., English name	Mileage points accumulation	Until membership withdrawal
PIPA Art. 17(4) (Additional info use)	Airstar DF (Incheon Airport Duty Free)	ID, member no., purchase & discount info	Airstar service & linkage	Until Airstar withdrawal

 

 

 

 

② It is possible to provide personal information without the consent of the customer only if it falls under Article 17, Paragraph 1, Item 2 of the Personal Information Protection Act.

 

③ When providing or sharing customer information through partnership, the person receiving or sharing it, the purpose of providing or sharing personal information and the purpose of providing it, the retention period, the fact that there is a right to refuse consent, and if there is a disadvantage due to refusal of consent, the customer shall be informed of the disadvantage in advance and consent shall be obtained.  If there is a change or termination in the partnership, we will notify you without delay through a notice on the initial screen of the online homepage, and if necessary, notify you individually at least once via email.

 

Article 5. Retention and use period of personal information

① Hyundai Duty Free will destroy the personal information without delay when the purpose of collecting and using the customer's personal information is achieved, when the customer withdraws membership, or when the customer withdraws consent to provide personal information. (However, if a member is expelled due to illegal or unauthorized use, it will be stored and used for 6 months and then destroyed)

② If storage is necessary to fulfill legal obligations, it is stored separately in a DB or table separate from the operating DB according to the standards below.

Division		Retention period
Article 6 of the Act on Consumer Protection in Electronic Commerce, etc.	Records of contracts or subscription cancellations	5 years
	Records of payment and supply of goods, etc.	5 years
	Records of handling consumer complaints or disputes	3 years
	Records of labeling and advertising	6 months
Article 33 of the Commercial Act	Important documents related to business, such as contracts, applications, and invoices	10 years
Article 15-2 of the Communications Secrets Protection Act	Website visit records (logs), access tracking data	3 months
Article 12 of the 「Customs Act」, Article 3 of the Enforcement Decree of the same Act, and Article 30 of the Notice on the Operation of Bonded Stores	Purchase history	2 years
	Delivery details	3 years

 

Article 6. Procedures and methods for destroying personal information

Hyundai Duty Free will destroy the personal information without delay after the purpose of processing personal information has been achieved or the retention and use period has elapsed. The specific destruction procedures and methods are as follows.

① Destruction Procedure

  The information you enter for membership registration, etc. is stored for a certain period of time and then destroyed according to the reasons for information storage according to internal policies and other related laws (see retention and use period) after the purpose is achieved.

 Personal information will not be used for any purpose other than storage purposes in accordance with applicable laws.

② Destruction method

 Personal information printed on paper is destroyed by shredding or incineration.

 Personal information stored in electronic file format is deleted using technical methods that render the records unrecoverable.

 

Article 7. Rights and Obligations of the Data Subject and Legal Representative and the Methods of Exercising Them

① Customers may view, correct, delete, or stop processing their registered personal information at any time. Customers can click on the ‘Basic Information Management’ item on the website to view, correct, or delete information directly, or contact the personal information protection manager or person in charge in writing, by phone, or e-mail, and we will take action without delay through a verification process.

 PC (homepage): After logging in, people icon in the upper right corner → Information tab → “Basic information management” → Enter password → “Proceed to edit member information and withdraw”

 Mobile (app): After logging in, the person icon at the bottom right → Information tab at the bottom of the screen → 4th from the bottom, “Basic information management” → Enter password → “Proceed to edit membership information and withdraw”

※ The exercise of rights by children under the age of 14 must be done directly by their legal representatives. Customers who are minors aged 14 or older may exercise their rights regarding their personal information either by themselves or through their legal representatives.

② If a customer requests correction of an error in personal information, the personal information will not be used or provided to a third party until the correction is completed. In addition, if incorrect personal information has already been provided to a third party, we will notify the third party of the result of the correction without delay and take action to correct it.

③ Even if a customer using the Hyundai Duty Free app deletes the app from their mobile device, if information remains in Hyundai Duty Free, a separate request, such as membership withdrawal, is required.

④ Customers may request access to, correction of, deletion of, or suspension of the processing of their personal information through a legal representative or an authorized proxy. In such cases, a power of attorney in the form specified in the "Notice on Methods of Personal Information Processing" [ix 11] must be submitted.

⑤ Customers are requested to prevent unexpected accidents by entering their personal information accurately and up-to-date. The customer is responsible for any accidents that occur due to inaccurate information entered by the customer. Membership may be lost if false information is entered, such as theft of another person's information.

⑥ Customers have the right to have their personal information protected, as well as the obligation to protect themselves and not to infringe on the information of others. Please be careful not to leak your personal information, including your password, and be careful not to damage other people's personal information, including posts.

⑦ If the customer fails to fulfill this responsibility and damages the information or dignity of others, he or she may be punished under the Personal Information Protection Act, etc.

⑧ The right to request access to or suspension of processing of personal information may be restricted in accordance with Article 35(4) and Article 37(2) of the Personal Information Protection Act.
⑨ If the collection of a customer’s personal information is explicitly specified under other laws, the request for deletion of such information cannot be accepted.
⑩ Hyundai Department Store Duty Free verifies whether the individual exercising the rights is the data subject or a legitimate representative.
⑪ Hyundai Department Store Duty Free respects the data subject’s right to self-determination over personal information and strives to provide support and remedies for any infringement of personal information. For inquiries or reports related to personal information infringement, please contact our customer service center.

Department: Personal Information Protection Team

Phone: 1811-6688

Email: privacy_hddfs@hddfs.com

 

 

Article 8. Matters concerning the installation and operation of automatically collecting devices and their refusal

① Hyundai Duty Free installs and operates cookies*, and users can refuse them.

* A cookie is a temporary file that is automatically created when accessing a website. It is a very small text file that is sent to the user's browser by the server used to run the website and is stored on the user's computer hard disk.

② Users have a choice regarding cookies, and can choose to allow all cookies, confirm each time a cookie is saved, or block all cookies by setting the options of the web browser in the following manner. However, if the user refuses to store cookies, there may be restrictions on use, such as having to re-enter the user's login information when using some services that require login.

 Here's how to specify whether to allow cookies to be installed:

[WEB]

Division	Method
Edge web browser	[Settings] at the top right of the web browser > [Cookies and site permissions] > Manage and delete cookies and site data
Chrome web browser	[Settings] in the upper right corner of the web browser > [Privacy and Security] > Manage and delete third-party cookies

[APP]

Division	Method
Android	[Home]>[Settings]>[Google]>[Advertising]>Opt out of ad personalization
iPhone	[Home]>[Settings]>[Privacy & Security]>[Tracking]>Turn off Allow apps to request tracking

③ Hyundai Duty Free can read the contents of the cookie in the user's browser, find the user's additional information on the user's computer, and provide services without additional input such as name upon access.

④ Hyundai Duty Free analyzes users’ interests, interests, preferences, and inclinations based on advertising identifiers, etc. Related information is as follows:.

Division	Method
Collection Items	Service usage history and access logs (click, search history, etc.)
Collection Method	Automatic collection when using the service
Purpose of collection	Provide personalized services by analyzing users' interests Providing customer convenience
Retention and use period	Destruction after 1 year of storage
How to exercise control	- Edge: Manage and delete cookies and site data from Settings > Cookies and Site Permissions in the upper right corner of the web browser  - Chrome: Settings > Privacy and Security > Manage and delete third-party cookies in the upper right corner of the web browser  - Android: [Home] > [Settings] > [Google] > [Advertising] > Unselect Ad Customization - iPhone: [Home] > [Settings] > [Personal Protection and Security] > [Trace] > Allow apps to request tracking
Damage Relief Method	- Customer Service Center: 1811-6688 - Home page: Customer Center > 1:1 consultation inquiries

 

Article 9. Collection, Use, and Refusal of Behavioral Information

① Hyundai Department Store Duty Free collects behavioral information to provide customized services, benefits, and online personalized advertisements.
② The company also analyzes user interests and behavior patterns to enhance service quality and customer experience.

Category	Details
Collection Method	Automatically collected from users’ website or app visits and activities.
Purpose	Service improvement, statistics, and personalized advertising based on behavior analysis.
Retention Period	Up to 1 year and 3 months.
Inquiry / Complaints	Customer Service Center: 1811-6688 / Website Inquiry > 1:1 Inquiry.
Cookie & Tracking Settings	Users can change browser settings to limit or delete cookies. Some features may be restricted.
Main Browsers	Chrome, Safari, Edge, Android, iPhone – adjust settings to delete or block cookies.
Google Analytics	Opt-out available: https://tools.google.com/dlpage/gaoptout

 

③ Information on the Provision of Behavioral Information

User behavioral data is provided to analytics and advertising partners in a form that does not identify individuals. The operational details are as follows:

1) Recipients: Platio, Google Analytics

2) Items Provided: Advertising identifiers targeted to specific interest groups

3) Purpose of Use by Recipients: To deliver customized advertisements based on user interests

④ Advertising to Children Under 14

If customized advertisements are to be provided to children under the age of 14, the company obtains prior consent from their legal guardian. Aside from this, the company does not collect or use behavioral data from children for advertising purposes.

⑤ Scope and Limitation of Data Collection

Only the minimum behavioral information necessary for optimized personalized services, benefits, and online advertisements is collected. Sensitive behavioral data that may infringe on personal rights or privacy—such as political views, beliefs, education, or medical history—is not collected.

 

Article 11. Technical and Administrative Measures for the Protection of Personal Information

Hyundai Department Store Duty Free implements the following technical and administrative measures to ensure the safety of personal information and to prevent its loss, theft, leakage, falsification, or damage, in accordance with Article 29 of the Personal Information Protection Act.

① Minimization and Training of Personnel Handling Personal Information
Access to personal information is limited to designated employees, and regular training is provided to ensure safe management.

② Regular Internal Audits
Regular self-audits are conducted to ensure the secure handling of personal information.

③ Establishment and Implementation of Internal Management Plans
Internal management plans are established and regularly reviewed for the safe handling of personal data.

④ Technical Measures Against Hacking and Unauthorized Access
Security programs are installed and regularly updated to prevent hacking, computer viruses, and data loss. Systems are continuously monitored, and access to personal information is strictly controlled.

⑤ Encryption of Personal Information
Important personal data is encrypted during storage and transmission to ensure secure protection.

⑥ Access Control for Unauthorized Persons
Facilities containing personal information are physically separated and access is strictly limited. Unauthorized access attempts are monitored and controlled through access control systems.

⑦ Access Rights Management
Access rights to personal information processing systems are granted and revoked promptly to minimize risks.

⑧ Retention and Protection of Access Records
Records of access to the personal information processing system are retained and managed for at least two years. Security measures are implemented to prevent any alteration, theft, or loss of access logs.

⑨ Use of Locking Devices for Document Security
Documents and storage media containing personal information are kept in secure locations equipped with locking devices.

⑩ Access Control for Unauthorized Persons
Physical storage areas containing personal information are separately designated, and access control procedures are established and operated to prevent unauthorized entry.

 

Article 11. Linked Sites

① Hyundai Department Store Duty Free may provide links to other websites for user convenience. However, we are not responsible for the privacy practices or content of the linked sites.

② When users are redirected to other websites via these links, they should review the privacy policies of those sites, as they may differ from ours. 

 

Article 12 Management and Responsibility for Posts

① Hyundai Department Store Duty Free values customers’ posts and strives to protect them from modification, deletion, or damage.

However, posts may be temporarily suspended or permanently deleted in the following cases:
·  Posts that defame others or damage their reputation.

·  Posts containing false information or content that infringes on copyrights or other rights of third parties.

·  Posts considered spam (advertisements, links, or repeated promotional content).

·  Posts containing other unlawful or inappropriate content.

② Responsibility for all posts lies with the individual who created them.

Please review your posts carefully before publishing, as publicly disclosed information may be difficult to retract later.

Article 13. Personal Information Protection Department

① Hyundai Department Store Duty Free designates the following department and Personal Information Protection Officer to handle customer opinions and complaints regarding personal information protection.

·         Personal Information Protection Officer: Hyungchul Ban

·         Department: Information Security Team

·         Position: CPO

·         Phone: 1811-6688

·         Email: privacy_hddfs@hddfs.com

Article 14. Remedies for Rights Infringement

① Customers may contact the following organizations for consultation or dispute resolution regarding personal information infringement.

• Personal Information Infringement Report Center: (National) 118 (https://privacy.kisa.or.kr)
• Personal Information Dispute Mediation Committee: 1833-6972 (https://www.kopico.go.kr)
• Supreme Prosecutors’ Office Cyber Investigation Division: (National) 1301 (https://www.spo.go.kr)
• National Police Agency Cyber Bureau: (National) 182 (https://ecrm.police.go.kr)

Article 15. Protection of Personal Information of Children Under 14

Hyundai Department Store Duty Free does not, in principle, collect personal information from children under the age of 14. If it becomes necessary to collect such information, the company will obtain consent from the legal guardian and comply with all applicable legal requirements.

 

Article 16. Collection and Protection of Personal Information from Non-Members

① Non-members may purchase goods or use services.
 Hyundai Department Store Duty Free collects only the personal information necessary for payment and product delivery when a non-member places an order.

② In the case of non-member purchases, the payment and recipient information entered by the customer is used solely for payment processing and product delivery, and not for any other purpose.

 

③ Non-members’ personal information is protected in the same manner as that of members.

 

Article 17. Obligation to notify personal information processing policy

①    Hyundai Department Store Duty Free does not send any advertising information for commercial purposes without the customer’s prior consent (including cases of withdrawal of consent).

② When the customer agrees to receive marketing information such as event announcements or newsletters, advertising information may be sent in the following manner:
 • Advertising emails clearly state “Advertisement” in the subject line.
 • The sender’s name, contact details, email address, and method for opting out are clearly indicated.

③   However, prior consent is not required when the company sends advertising information for commercial purposes to promote goods or services of the same type, within six months from the completion of a transaction, using contact information directly collected from the recipient through that transaction.

 

Article 18. Obligation to Notify of Changes to the Privacy Policy

① In the event of any addition, deletion, or modification to this Privacy Policy due to government policy or Hyundai Department Store Duty Free’s internal policy, such changes will be announced through the “Notices” section on the website.

② This Privacy Policy shall take effect from November 14, 2025.