Personal information processing policy full revision (draft)

 

Hyundai Department Store Duty Free Co., Ltd. (hereinafter referred to as "Hyundai Department Store Duty Free Shop") has enacted a personal information processing policy to thoroughly protect all personal information provided by customers, and by posting at the bottom of the first screen of Hyundai Department Store Duty Free's website, we disclose what measures are being taken to protect customers' personal information so that customers can always easily read and check it. In addition, Hyundai Department Store Duty Free's personal information processing policy may be changed due to reasons such as changes in related laws and policies, and in case of change, we will inform customers of all information including the date of change through notices and pop-up windows.

 

Article 1. Method of consent for collecting and using personal information, etc

Hyundai Department Store Duty Free acquires customer consent using one of the following methods..

① Method of posting consent information on the Internet homepage and allowing customers to indicate whether they agree or not.

② A method of issuing a document containing the consent (membership application form) directly to the customer, or delivering it by mail or facsimile, and having the customer sign and seal the consent before submitting it.

③ Method of sending an e-mail containing consent details and receiving an e-mail from the customer expressing consent.

④ Inform the customer of the consent details over the phone and obtain consent, or provide instructions on how to check the consent details, such as the Internet address, and obtain consent through a phone call again.

⑤ Provision from affiliates

⑥ Method through collection of information generated during PC and mobile use

 

Article 2. Purpose of processing personal information and items of personal information to be collected

① Purpose of collection and use of personal information
Hyundai Department Store Duty Free Shop collects and uses personal information necessary to purchase goods and provide various services to customers as follows.

Division	Purpose of use
Membership management	•       Identification according to the use of membership services •       Prevention of Unauthorized Use and Prevention of Unauthorized Use •       Preserving records for customer consultation, receipt and handling of customer complaints, and dispute settlement •       Notification delivery and age verification (confirmation under the age of 14) •       Where it is necessary for the settlement of the price following the transaction of goods, etc
Implementation of service provision	•       User identification and identity verification •       Content provision, information on event/prize winning results, product delivery, and response to inquiries •       Contract conclusion and performance (purchase, payment, refund, product delivery) •       Provision of points and discount benefits, compliance with information management obligations
Marketing and Advertising Utilization	•       Information on new services and events •       Use of materials and marketing to provide personal services •       Provision of services and posting of advertisements according to statistical characteristics •       Determination of web page access frequency and statistics on service use •       Sending periodicals, announcing new products or services •       Customer survey, service and product information

※ Unauthorized use : Re-enrollment after membership withdrawal, Repeated cancellation of purchase, etc. after purchasing the product, The act of receiving economic benefits such as event benefits and discount coupons by default or expediency, Acts prohibited by the terms and conditions of use, etc., Unlawful acts such as theft of another person's name, etc

 

② Personal Information Collection Items

The specific items, purpose, retention period, and collection method of personal information collected by Hyundai Department Store Duty Free are listed in the table below.

Division		Required/Optional	Collection items	Purpose of collection and processing	Retention period	Collection method
Online member	Easy membership registration, Easy membership registration for offline customers, Foreign membership registration	Required	ID, name, date of birth, gender, mobile phone number, email, (foreign member) nationality ID, name, date of birth, gender, mobile phone number, email, (foreign member) nationality	User identification and verification of identity, delivery of notices and civil complaints processing, etc.	Upon withdrawal of membership or until the purpose of collection and use of personal information is achieved (however, if retention is required for a certain period of time according to the law, until the relevant period)	Home page, Mobile app
		Optional	Passport number, English name, passport expiration date	Identification of identity for provision of services and rights
	Integrated membership registration	Required	ID, name, date of birth, gender, mobile phone number, email, CI	User identification and verification of identity, delivery of notices and civil complaints processing, etc.	Upon withdrawal of membership or until the purpose of collection and use of personal information is achieved (however, if retention is required for a certain period of time according to the law, until the relevant period)	H.Point home page, Mobile app
		Optional	English name, passport number, nationality, passport expiration date, wedding anniversary	Personal identification, event and product information, etc. for service provision and management, customized marketing utilization
	Easy log in	Required	[Naver] Membership number email [Kakao] Membership number, email	Provides a easy login service and identifies users, delivery of notices, securing a seamless communication path	Upon withdrawal of membership or until the purpose of collection and use of personal information is achieved (however, if retention is required for a certain period of time according to the law, until the relevant period)	home page, mobile app
Branch membership registration	Branch membership registration	Required	Name, gender, date of birth, mobile phone number, email, English name, passport number, nationality, passport expiration date	User identification and identity verification, delivery of notices and civil complaints processing, confirmation of children under 14 years of age	Upon withdrawal of membership or until the purpose of collection and use of personal information is achieved (however, if retention is required for a certain period of time according to the law, until the relevant period)	Branches (Trade Center Branch, Dongdaemun Branch, Incheon Airport Branch)
		Optional	Address, (wedding) anniversary	Personal identification, event and product information, etc. for service provision and management, customized marketing utilization
Change membership and purchase information	Confirmation of Korean residents	Optional	Passport information (photo, English name, date of birth, passport number, passport expiration date)	Verification of identity and processing of business, Fulfillment of purchase contracts and compliance with relevant legal obligations	When withdrawing membership	Branch
	E-ticket confirmation	Optional	Name, passport number, flight number, departure date		5 years	Branch
	Cancellation power of attorney	Optional	Delegate Information: Name, date of birth, passport number, passport expiration date Agent Information: Copy of ID (photo, name, date of birth)		5 years	Branch
	Cargo flight number customer	Optional	Passport information (photo, English name, date of birth, passport number, passport expiration date), departure information		5 years	Branch
	Bank transfer refund	Optional	Account information (account holder, bank, refund account number)	Payment (deposit) refund processing	When withdrawing membership	Online
Product purchase (Online and branches)	Member/ Non-member orders	Required	Name, email, password, mobile phone number, date of birth, gender, English name, passport number, nationality, passport expiration date, departure information (departure date, departure and destination, flight number, direct/transit), payment information	User identification and identity verification, delivery of notices and civil complaints processing, fulfillment of purchase contracts, and compliance with obligations under relevant laws and regulations	Upon withdrawal of membership or until the purpose of collection and use of personal information is achieved (however, if retention is required for a certain period of time according to the law, until the relevant period)	home page, mobile app, branch
		Optional	Account information (deposit owner, bank, refund account number)	Payment (deposit) refund processing
Inquiry response	Member/non-member 1:1 inquiry	Required	Name, point of purchase, response notification method (email, contact information)	Customer identification, response measures, and result information to respond to inquiries	(Member) Until withdrawal of membership or until the purpose of collection and use of personal information is achieved. (Non-member) 3 years	Home page, Mobile app
		Optional	Passport number, order number, attached contents	Inquiry response
Event	Wedding shop	Required	Spouse information (name, ID), expected departure date, wedding date, wedding invitation	Payment of points and congratulatory coupons	Until membership withdrawal (however, wedding invitation images are deleted immediately after approval)	Home page, Mobile app
Marketing and Advertising Utilization		Optional	Name, email, mobile phone number	Product and event information information	6 months	Home page, Mobile app
Automatic collection of service usage process	Member access	Required	Service usage records, access logs, cookies, access information	Prevention of illegal/unauthorized use, provision of services such as shopping carts and recently viewed products, compliance with information management obligations under relevant laws and regulations	Until membership withdrawal (however, cookie information is kept until the internet browser is closed)	Home page, Mobile app
	Mobile app	Required	Terminal identification number, terminal OS information, terminal model name, PUSH reception status	Check event notifications and app errors, improve usability	Until app deletion or membership withdrawal	Mobile app

※ If you do not enter personal information in the required fields, you will not be able to sign up for membership or use the service. However, there are no restrictions on signing up for membership or using the service even if you do not enter personal information in the optional fields.

※ We do not collect sensitive personal information (race and ethnicity, ideology and creed, place of birth and domicile, political inclination, health status, sexual life, etc.) that may violate the customer's basic human rights.

③ Notification of collection sources, etc. of personal information collected from people other than the information subject

Hyundai Department Store Duty Free collects and uses personal information required by the companies listed below to use the SNS simple login service.

Collection source	Purpose of processing	How to stop processing personal information
Kakao	Providing SNS simple login service	Login > My Hyundai > SNS Easy Login Settings
Naver

※ When requesting suspension of personal information processing, we are in the process of withdrawing consent to process personal information, and we will destroy personal information without delay after withdrawing consent.

④ Measures when entering false information

Customers must ensure the accuracy, truthfulness and legality of their personal information. If you violate this and enter false information in various ways, such as stealing other people's information or entering fictitious information, Hyundai Department Store Duty Free Shop may report the customer in accordance with relevant laws and may also proceed with procedures to restrict service use, such as forced withdrawal.

Article 3. Entrustment of personal information processing for service provision

①     Hyundai Department Store Duty Free Shop entrusts some tasks to external parties to fulfill contracts and improve services.    The details of the entrusted tasks and the trustees are as follows.

Consignment company	Consignment work details
Hyosung ITX	Customer consultation and operation of the customer center
Humuson	SMS, MMS, app push notification service, identity verification
KICC	Credit card payment processing
KRP	Payment agency (PG company)
KSNET	Credit card payment processing
KG Mobilians	Cell phone micropayment
LG CNS	Easy payment service
Hyundai IT&E	Computer system maintenance and development
Hyundai Department Store	Integrated membership registration operation
GS Mbiz	Sending event prize mobile coupons
S-Tech System	Branch operation and CCTV security operation management
Unies, Introman	Branch, integrated logistics center warehouse operation
pentacom	Advertising agency/media operation and event prize distribution
Korea Duty Free Shop Association (UNIS)	Delivery center operation
Joeun System, Samkyung Trading	Branch sales

② Information shared with the trustee is limited to the minimum information necessary to achieve the purpose, and personal information is selectively provided to the relevant company according to the customer's service request.

③ In the case of a consignment contract, the purpose and scope of the consignment work, the prohibition of processing personal information other than the purpose of the consignment work, technical and administrative protection measures, whether to restrict re-consignment, and supervision of the status of personal information management shall be clearly defined, and the contents of the contract shall be kept in writing or electronically.

④ When the details of the trustee or consignment work are changed, the fact is notified on the website's personal information processing policy screen.

 

Article 4. Provision of personal information to third parties

①       Hyundai Department Store Duty Free processes customers' personal information within the scope notified in the "Purpose of Collection and Use of Personal Information", and provides personal information to a third party only if the customer's consent or the law provides it.

Recipient	What we offer	Purpose of provision	Recipient retention period
·         Korea Customs Service	Name, nationality, date of birth, passport number, departure information, India information	Customs report (Article 289 of the Enforcement Decree of the Customs Act, etc.)	Semi-permanent
Hyundai Department Store	ID, password, CI, name, customer number, date of birth, gender, mobile phone number, email, purchase information, payment information (limited to H.Point accumulated items)	H.Point membership registration, website login, H.Point accumulation and use, other H.Point membership, and related services provided ※ ‘H.Point Service’ refers to a system that allows users to log in to services operated by Hyundai Department Store Duty Free Shop and affiliates of Hyundai Department Store Group with a unified ID and password, and integrates accumulated points for each service.  When signing up, members can choose whether to integrate H.Point. If they choose to use H.Point integration, they will separately go through a consent process regarding the provision of personal information to a third party.	Until membership withdrawal or until the purpose of collecting and using personal information is achieved (However, if it must be retained for a certain period of time according to the law, until that period)
Korean Air	SKYPASS membership number, English name	Korean Air mileage accumulation	Until Korean Air mileage withdrawal

②      In the following cases, it is possible to provide personal information without the customer's consent in accordance with the provisions of relevant laws and regulations.

n   When complying with obligations under relevant laws, such as the Act on Consumer Protection in Electronic Commerce, etc., or when an investigative agency requests the provision of personal information for investigation purposes in accordance with the procedures and methods set forth in relevant laws

n   When providing the minimum user information (name, address, phone number) required for delivery to the delivery company for delivery purposes.

n   When necessary for payment settlement due to transactions of goods, etc.

n   When identity verification is required to prevent theft

n   Where the information subject or his/her legal representative is unable to express his/her intention or cannot obtain prior consent due to unknown address, etc., and is clearly deemed necessary for the urgent benefit of the life, body, or property of the information subject or a third party

③ When providing or sharing customer information through partnership, the person receiving or sharing it, the purpose of providing or sharing personal information and the purpose of providing it, the retention period, the fact that there is a right to refuse consent, and if there is a disadvantage due to refusal of consent, the customer shall be informed of the disadvantage in advance and consent shall be obtained.  If there is a change or termination in the partnership, we will notify you without delay through a notice on the initial screen of the online homepage, and if necessary, notify you individually at least once via email.

④ If it is necessary to transfer customers' personal information due to reasons such as sales, mergers and acquisitions, or business transfers, Hyundai Department Store Duty Free shall notify the members in advance of the transfer of personal information in accordance with the procedures and methods prescribed by the relevant laws, such as the Personal Information Protection Act, and grant members the right to withdraw their consent for the transfer of personal information.

 

Article 5. Retention and use period of personal information

① Hyundai Department Store Duty Free will destroy the personal information without delay when the purpose of collecting and using the customer's personal information is achieved, when the customer withdraws membership, or when the customer withdraws consent to provide personal information. (However, if a member is expelled due to illegal or unauthorized use, it will be stored and used for 6 months and then destroyed)

② If storage is necessary to fulfill legal obligations, it is stored separately in a DB or table separate from the operating DB according to the standards below.

Division		Retention period
Article 6 of the Act on Consumer Protection in Electronic Commerce, etc.	Records of contracts or subscription cancellations	5 years
	Records of payment and supply of goods, etc.	5 years
	Records of handling consumer complaints or disputes	3 years
	Records of labeling and advertising	6 months
Article 33 of the Commercial Act	Important documents related to business, such as contracts, applications, and invoices	10 years
Article 15-2 of the Communications Secrets Protection Act	Website visit records (logs), access tracking data	3 months
Article 12 of the 「Customs Act」, Article 3 of the Enforcement Decree of the same Act, and Article 30 of the Notice on the Operation of Bonded Stores	Purchase history	2 years
	Delivery details	3 years

Article 6. Procedures and methods for destroying personal information

Hyundai Department Store Duty Free will destroy the personal information without delay after the purpose of processing personal information has been achieved or the retention and use period has elapsed. The specific destruction procedures and methods are as follows.

①       Destruction Procedure

n  The information you enter for membership registration, etc. is stored for a certain period of time and then destroyed according to the reasons for information storage according to internal policies and other related laws (see retention and use period) after the purpose is achieved.

n   Personal information will not be used for any purpose other than storage purposes in accordance with applicable laws.

② Destruction method

n   Personal information printed on paper is destroyed by shredding or incineration.

n   Personal information stored in electronic file format is deleted using technical methods that render the records unrecoverable.

 

Article 7. The rights and obligations of the data subject and the method of exercising them

① Customers may view, correct, delete, or stop processing their registered personal information at any time. Customers can click on the ‘Basic Information Management’ item on the website to view, correct, or delete information directly, or contact the personal information protection manager or person in charge in writing, by phone, or e-mail, and we will take action without delay through a verification process.

n   PC (homepage): After logging in, people icon in the upper right corner → Information tab → “Basic information management” → Enter password → “Proceed to edit member information and withdraw”

n   Mobile (app): After logging in, the person icon at the bottom right → Information tab at the bottom of the screen → 4th from the bottom, “Basic information management” → Enter password → “Proceed to edit membership information and withdraw”

② If a customer requests correction of an error in personal information, the personal information will not be used or provided to a third party until the correction is completed. In addition, if incorrect personal information has already been provided to a third party, we will notify the third party of the result of the correction without delay and take action to correct it.

③ Even if a customer using the Hyundai Department Store Duty Free Shop app deletes the app from their mobile device, if information remains in Hyundai Department Store Duty Free Shop, a separate request, such as membership withdrawal, is required.

④ Customers are requested to prevent unexpected accidents by entering their personal information accurately and up-to-date. The customer is responsible for any accidents that occur due to inaccurate information entered by the customer. Membership may be lost if false information is entered, such as theft of another person's information.

⑤ Customers have the right to have their personal information protected, as well as the obligation to protect themselves and not to infringe on the information of others. Please be careful not to leak your personal information, including your password, and be careful not to damage other people's personal information, including posts.

⑥ If the customer fails to fulfill this responsibility and damages the information or dignity of others, he or she may be punished under the Personal Information Protection Act, etc.

 

Article 8. Matters concerning the installation and operation of automatically collecting devices and their refusal

① Hyundai Department Store Duty Free Shop installs and operates cookies*, and users can refuse them.

* A cookie is a temporary file that is automatically created when accessing a website. It is a very small text file that is sent to the user's browser by the server used to run the website and is stored on the user's computer hard disk.

② Users have a choice regarding cookies, and can choose to allow all cookies, confirm each time a cookie is saved, or block all cookies by setting the options of the web browser in the following manner. However, if the user refuses to store cookies, there may be restrictions on use, such as having to re-enter the user's login information when using some services that require login.

n   Here's how to specify whether to allow cookies to be installed:

[WEB]

Division	Method
Edge web browser	[Settings] at the top right of the web browser > [Cookies and site permissions] > Manage and delete cookies and site data
Chrome web browser	[Settings] in the upper right corner of the web browser > [Privacy and Security] > Manage and delete third-party cookies

[APP]

Division	Method
Android	[Home]>[Settings]>[Google]>[Advertising]>Opt out of ad personalization
iPhone	[Home]>[Settings]>[Privacy & Security]>[Tracking]>Turn off Allow apps to request tracking

③       Hyundai Department Store Duty Free Shop can read the contents of the cookie in the user's browser, find the user's additional information on the user's computer, and provide services without additional input such as name upon access.

④       Hyundai Department Store Duty Free Shop analyzes users’ interests, interests, preferences, and inclinations based on advertising identifiers, etc. Related information is as follows:.

Division	Method
Collection Items	Service usage history and access logs (click, search history, etc.)
Collection Method	Automatic collection when using the service
Purpose of collection	Provide personalized services by analyzing users' interests
Retention and use period	Destruction after 1 year of storage
How to exercise control	- Edge: Manage and delete cookies and site data from Settings > Cookies and Site Permissions in the upper right corner of the web browser  - Chrome: Settings > Privacy and Security > Manage and delete third-party cookies in the upper right corner of the web browser  - Android: [Home] > [Settings] > [Google] > [Advertising] > Unselect Ad Customization - iPhone: [Home] > [Settings] > [Personal Protection and Security] > [Trace] > Allow apps to request tracking
Damage Relief Method	- Customer Service Center: 1811-6688 - Home page: Customer Center > 1:1 consultation inquiries

 

Article 9. Technical and managerial measures for personal information protection

Hyundai Department Store Duty Free Shop is taking the following technical, managerial and physical measures necessary to ensure safety in accordance with Article 29 of the Personal Information Protection Act to prevent personal information from being lost, stolen, leaked, forged, altered or damaged.

①    Minimization and training of personal information processing staff
The number of employees who handle personal information is set to a minimum, and training is provided on a regular basis to ensure safe processing of personal information.

②      Conduct regular self-audit
We conduct regular self-audits to ensure safety regarding the processing of personal information.

③      Trustee management and training
When entrusting personal information processing tasks, we regularly provide management and training to the trustee.

④      Establishment and implementation of internal management plan
To ensure safe processing of personal information, we have established and implemented an internal management plan.

⑤      Encryption of personal information
Among the user's personal information, unique identification information (passport number) and password are stored and managed in encrypted form, and separate security functions such as encryption or transmission section encryption are used for important data.

⑥      Technical measures against hacking, etc.
Hyundai Department Store Duty Free installs security programs, periodically updates/checks, and technically/physically monitors and blocks systems in areas where access from outside is controlled to prevent leakage, infringement, and damage of personal information by hacking or computer viruses.

⑦      Restriction of access to personal information
We record the authorization, change, and expiration of the database system that processes personal information, manage the records for five years, and use an intrusion prevention system to control unauthorized access from outside to limit unauthorized access.

⑧      Storage of access records and prevention of forgery and falsification
We store and manage access records to the personal information processing system for at least two years, and take security measures to prevent access records from being forged, altered, stolen, or lost.

⑨      Use a locking device for document security
Documents and auxiliary storage media containing personal information are stored in a safe place with a lock.

⑩      Access control for unauthorized persons
We have a separate physical storage location where personal information is stored and have established and operated access control procedures for it.

 

Article 10. Link Site

Hyundai Department Store Duty Free may provide customers with links to other companies’ websites or materials. In this case, Hyundai Department Store Duty Free Shop has no control over external sites and materials and therefore cannot be held responsible for or guarantee the usefulness of the services or materials provided from them. If you click on a link included in Hyundai Department Store Duty Free Shop and move to a page on another site, the privacy policy of that site is unrelated to Hyundai Department Store Duty Free Shop, so please check the policy of the newly visited site.

 

Article 11. Post Management and Responsibility

① Hyundai Department Store Duty Free Shop values customer posts and does its best to protect them from being altered, damaged, or deleted. However, in the following cases, deletion may be taken after an explicit or individual warning..

i. Writing that defames others by spreading false information for the purpose of slandering others

ii. Disclosure of another person's personal information without the consent of the information subject, content that infringes upon the rights of Hyundai Department Store Duty Free Shop or a third party's copyright, or other content that is different from the topic of the bulletin board.

iii. Spam posts (e.g. advertisements for specific sites, advertisements for specific products, etc.)

iv. Posts that may violate other laws

② Fundamentally, all rights and responsibilities related to posts belong to the individual author. Additionally, it is difficult to protect information voluntarily disclosed through posts, so please consider carefully before disclosing information.

 

Article 12 The department in charge of personal information protection

Hyundai Department Store Duty Free has designated relevant departments and personal information protection officers as follows in order to protect customers' personal information and to collect opinions on personal information and handle complaints.

Director of Privacy: Ban Hyung-chul
Affiliated: Information Protection Officer
Position: CPO
Phone number: 1811-6688
Email: privacy_hddfs@hddfs.com

Article 13. How to remedy infringement of rights and interests

 

Customers can apply for dispute resolution or counseling in order to receive relief for personal information infringement. For reports and counseling of personal information infringement, please contact the following institutions.

Personal Information Infringement Reporting Center: (without area code) 118 (https://privacy.kisa.or.kr)

Personal Information Dispute Mediation Committee: 1833-6972 (https://www.kopico.go.kr)

Supreme Prosecutors' Office Cyber Investigation Division: (without area code) 1301 (https://www.spo.go.kr)

National Police Agency Cyber Security Bureau: (without area code) 182 (https://ecrm.cyber.go.kr)

 

Article 14. Protection of personal information of children under 14 years of age

In principle, Hyundai Department Store Duty Free Shop does not collect personal information from children under 14 years of age. However, if it is necessary to collect personal information of children under the age of 14, we will obtain the consent of the legal representative and comply with other standards required by law.

Article 15. Collection and protection of personal information of non-member customers

① Non-member customers can also purchase goods or services. For non-member orders, Hyundai Department Store Duty Free collects only the personal information absolutely necessary for payment and product delivery.

② If a purchase is made as a non-member, the payer and recipient information entered by the non-member customer will not be used for any purpose other than payment and product delivery.

①       Non-members’ personal information is protected in the same way as members.

Article 16. Restrictions on transmission of advertising information

① In principle, Hyundai Department Store Duty Free Shop does not transmit advertising information for commercial purposes without the customer’s prior consent (when unsubscribing or withdrawing prior consent).

② If the customer agrees to receive advertising information for marketing information such as event information guidance and newsletter reception, the information will be sent according to the following measures.

i. Subject part of e-mail: The phrase (Advertisement) appears in the subject line.

ii. Body part of the e-mail: Specify the name, contact information, e-mail address, and address of the sender through which the customer can express his/her intention to refuse to receive it, and specify how the customer can easily express his/her intention to refuse to receive it or withdraw his/her consent to receive it.

③ However, prior consent will not be obtained in the following cases.

If a person who has collected contact information directly from the recipient through a transaction relationship for goods, etc. intends to transmit for-profit advertising information about goods of the same type as those processed and transacted with the recipient within 6 months from the end of the transaction for the goods, etc.

Article 17. Obligation to notify personal information processing policy

① If there are additions, deletions or modifications to the contents of this personal information processing policy in accordance with government policy or Hyundai Department Store Duty Free Shop policy, notification will be made through the ‘Notice’ section of the website 7 days prior to the implementation of the change.

②      This personal information processing policy is effective from January 25, 2024.