Privacy policy

Effective from 2026-08-15

Humanly Inc. (the "Company") treats your personal data as important and complies with the Personal Information Protection Act (PIPA) of Korea and related legislation. This policy describes only the personal data the Company actually processes in this online store.

1. What we collect, how we collect it, and our legal basis

We collect only the items listed below, and we state the legal basis for each one. As required by Article 22(3) of PIPA, items we may process without your consent are shown separately from items we process on the basis of your consent.

① Orders and payment (required · performance of a contract — PIPA Article 15(1)4. No consent is needed, and without these items we cannot fulfil the contract, so an order cannot be placed)
· Orderer name and contact number
· Recipient name, contact number, address and postal code
· For international delivery: destination country, city, state/province and email address
· Product names, options, quantities, amount paid and shipping cost
· Delivery instructions you type in yourself
· Payment authorisation data (payment method, approval number, transaction ID). Card numbers and expiry dates are handled by our payment provider and are never stored by the Company.

② Registration and member services (performance of a contract and your consent)
· Required: email address, password (stored as a one-way hash; the original is never kept), name
· Optional: mobile number — you can register and order without giving it
· If you sign in with Kakao: your Kakao member number and the account identifiers Kakao provides
· Membership tier, points balance and the history of points earned, spent and reclaimed (including the reason and order number)

③ Optional features (consent · not using them has no effect on your order or delivery)
· Saved addresses: address label, recipient name and contact, country, postal code and address
· Your wishlist
· Product reviews: the display name shown with the review, the star rating and the review text
· Restock alerts: the email address or mobile number to notify
· Subscriptions: the billing key issued by our payment provider (not a card number) and the delivery address

④ Data generated automatically as you use the service (legitimate interest — PIPA Article 15(1)6. See section 9 for how to refuse it)
· Date of access and the page path requested
· A 16-character one-way hash of your IP address combined with a value that changes daily — the original IP address is never stored and cannot be recovered from the hash
· Device type (a mobile/desktop flag)
· The host name of the site you arrived from (internal navigation is excluded)
· Cookies that keep your session and your shopping cart

We do not collect sensitive data such as beliefs, health or sexual life, nor unique identifiers such as resident registration numbers. We do not operate a service aimed at children under 14 and do not collect personal data from children under 14.

How we collect it: you enter it yourself on the registration, checkout, review and restock-alert screens; our payment provider returns the result of a payment to us; and some data is generated automatically as you use the service.

2. Why we process it

We process personal data only for the purposes below. If a purpose changes, we take the steps required by PIPA Article 18, including obtaining separate consent.

· Accepting orders, processing payments, cancellations and refunds
· Shipping, customs clearance, tracking and delivery-related notices
· Providing member services such as registration, identity confirmation and sign-in
· Confirming your identity for guest order lookup by matching the order number against the recipient contact number
· Managing points earned, spent and reclaimed, and membership tiers
· Handling enquiries and complaints, and keeping records for dispute resolution
· Publishing and moderating product reviews
· Sending restock alerts
· Preventing misuse, analysing access statistics and improving the service

3. How long we keep it

Once the purpose of collection has been achieved we destroy personal data without delay after the periods below. Records that Korean law requires us to keep are stored separately from other personal data for the required period.

· Member data (email, name, mobile number, password, saved addresses, wishlist, points): until you close your account
· Records of contracts and withdrawals: 5 years (E-Commerce Act Article 6 and its Enforcement Decree Article 6)
· Records of payment and supply of goods: 5 years (same provision)
· Records of consumer complaints and disputes: 3 years (same provision)
· Product reviews: 3 years from posting, or until the author asks us to delete them
· Restock alert contact details: until the alert is sent, or 1 year from the request, whichever comes first
· Automatically generated access logs (hashed IP, path, device type, referring host): 1 year from collection

Access logs past their retention period are deleted automatically, without you having to ask.

4. Sharing with third parties

As a rule we do not provide your personal data to outside parties. We share the minimum items necessary only in the cases below.

· Domestic delivery carriers — items: recipient name, contact, address and postal code / purpose: delivering your order / retention: until the end of the carrier's own retention period after delivery
· International couriers and the customs authority of the destination country — items: recipient name, contact, address, country, product names and declared value / purpose: international carriage and export/import clearance / retention: for the period required by the customs law of each country (see the cross-border transfer notice in section 6)
· Payment provider (PortOne) — items: orderer name, contact, email, order number and amount / purpose: processing payments, cancellations and refunds, and preventing fraud / retention: for the period required by the Electronic Financial Transactions Act
· Investigative authorities — where there is a lawful request under Korean law

You may refuse this sharing. However, the transfers to carriers, customs and the payment provider above are strictly necessary to perform your order, so if you refuse we cannot ship or take payment for that order. If you would like an order that has already been placed cancelled, please contact customer service.

5. Processing entrusted to others

We entrust the processing work below. As required by PIPA Article 26, our written contracts prohibit processing for any other purpose, restrict sub-contracting, and set out security measures, supervision and liability for damages.

· Processor: PortOne — entrusted work: processing payments, authenticating payment methods, handling cancellations and refunds, managing subscription billing keys / retention: until the contract ends or for the period required by law
· Processor: our server hosting provider — entrusted work: operating and storing the servers and database that run this service / retention: until the contract ends

If the entrusted work or the processor changes, we will publish the change in this policy without delay.

6. Transfer of personal data outside Korea

If you request international delivery, your personal data is transferred out of Korea as set out below, so that your parcel can be carried internationally and cleared through customs in the destination country. The legal basis is PIPA Article 28-8(1)3 (transfer necessary to perform a contract, where the following items are disclosed). We give you this notice again on the order form and ask for your agreement before you pay.

· Who receives it: the international courier assigned to your order and the customs or postal authority of the destination country. The name and contact details of the confirmed courier are shown below.
· Items transferred: recipient name, contact number, email address, delivery address, city, state, postal code and country, order number, product names, quantities and declared value
· Country of transfer: the destination country you select on the order form, and any country the shipment transits
· When and how: at the moment your parcel is dispatched, through the courier's waybill system and the electronic customs systems of the countries involved, over encrypted connections
· Why the recipient uses it: international carriage, export and import clearance, tracking and delivery-related contact
· How long the recipient keeps it: until the end of the period required by the customs law of the destination country after clearance

· We have not yet finalised a contract with a specific international courier. As soon as we do, we will name the processor and its contact details in this policy and announce the change. Until then, we will tell you which courier has been assigned before your international order is dispatched.

You may refuse this cross-border transfer. If you refuse, international carriage and customs clearance cannot take place, so an international order is not possible; ordering to a delivery address inside Korea is not restricted in any way. If you have already paid for an international order and wish to refuse the transfer, contact customer service before dispatch and we will cancel the order and refund you in full.

7. How and when we destroy personal data

When a retention period expires or the purpose of processing has been achieved and the data is no longer needed, we destroy it without delay.

· Procedure: we identify the data that is due for destruction and destroy it with the approval of our data protection officer. Data we must retain under Korean law is moved to a separate database or storage location and is not used for any other purpose until its retention period ends.
· Data held electronically: database records are deleted and the storage is overwritten or reinitialised so that the data cannot be recovered.
· Data printed on paper: shredded or incinerated.
· Automatically generated access logs: records past their retention period (1 year from collection) are deleted automatically every day.

8. Your rights, and how to exercise them

You may exercise the following rights over your personal data at any time. The legal guardian of a child under 14 may exercise the same rights on that child's behalf.

· Access — view your data yourself in My page. As a guest you can view your order on the order lookup screen using your order number and the recipient contact number.
· Correction and deletion — edit or delete your data yourself under Account and Addresses in My page. Transaction records that Korean law requires us to keep cannot be deleted.
· Suspension of processing and withdrawal of consent — contact us at the address below and we will act on it. Closing your account withdraws all consent.
· Closing your account — ask customer service and we will do it once we have confirmed your identity.

You may exercise these rights in writing, by email or by telephone. We will act on your request and tell you the outcome within 10 days of receiving it. If you act through a representative, please submit the letter of authority in Form 11 of the Korean Notice on Methods of Processing Personal Data. We never treat anyone less favourably for having made a request to access, correct, delete or suspend processing.

9. Automatic collection devices, and how to refuse them

We operate the automatic collection devices below to tailor the service to you and to analyse how it is used.

· Session cookies — keep you signed in and keep your cart. They disappear when you close the browser. If you block them you cannot sign in or place an order.
· Browser local storage — stores your recently viewed products in your browser only. This is never sent to our servers.
· Access statistics — the items listed in section 1 ④ are stored on our servers.
· Third-party analytics and advertising tools — only if we have configured them, Google Analytics 4, Google Tag Manager, the Meta Pixel and Naver Analytics scripts may run. Each is governed by that provider's own privacy policy.

How to refuse: use your browser settings to block cookies or to be asked each time one is stored (for example, in Chrome: Settings › Privacy and security › Third-party cookies). Third-party analytics can be refused with your browser's tracking protection or with the opt-out tools each provider offers. Note that blocking essential cookies will stop sign-in, the cart and checkout from working.

10. How we keep your data secure

As required by PIPA Article 29 and Article 30 of its Enforcement Decree, we take the following measures.

· Organisational: we keep the number of staff who handle personal data to a minimum and limit their access to what their work requires. Access is revoked as soon as someone's role changes.
· Technical: member passwords are stored using a one-way function that cannot be reversed. Administrative screens require separate authentication. IP addresses are never stored in their original form — only a one-way hash that changes daily. Screens that handle personal data and the payment flow are transmitted over encrypted connections (HTTPS).
· No payment data stored: card numbers, expiry dates and card passwords are handled by our payment provider and are never stored on our servers.
· Physical: the database runs on an internal network segment that cannot be reached directly from the internet.
· Breach response: if we become aware of a personal data breach we notify affected individuals and report it to the Korean authorities without delay, as required by PIPA Article 34.

11. Data protection officer and where to send access requests

The Company has designated the following person to oversee personal data processing and to handle complaints and remedies. Requests to access your personal data are received at the same contact point.

Email: info@bok-mall.com

You can find how to reach us on the Customer service page.

12. Where to go if your rights are infringed

If you need advice or redress about a personal data infringement, you can contact the bodies below. They are independent of the Company; use them if you are not satisfied with how we have handled your request or if you need further help.

· Personal Information Dispute Mediation Committee — +82 1833-6972 (www.kopico.go.kr)
· Privacy Infringement Report Centre — 118 within Korea (privacy.kisa.or.kr)
· Cybercrime Investigation Division, Supreme Prosecutors' Office — 1301 within Korea (www.spo.go.kr)
· National Police Agency Cyber Bureau — 182 within Korea (ecrm.police.go.kr)

If your rights are infringed by a decision we make, or by our failure to act, on a request under PIPA Article 35 (access), Article 36 (correction and deletion) or Article 37 (suspension of processing), you may file an administrative appeal under the Korean Administrative Appeals Act.

13. Changes to this policy

This policy applies from the effective date shown above. If we change it because the law, our policies or the service change, we will announce the change on this page at least 7 days before it takes effect. Changes that materially affect your rights — adding collected items, changing the purpose of use, adding a third party we share with — will be announced at least 30 days in advance, and we will ask for your consent again where that is required.

If you would like an earlier version of this policy, ask customer service and we will send it to you.