Privacy Policy

1. Who handles your information

Ships From Korea is the operator responsible for the processing described here. Representative: Yeonju SEONG. Business registration number: 695-17-01407. Mail-order business registration: 제2026-별내-0574호. Address: B-B2-0011,0012, 418, Sunhwagung-ro, Namyangju-si, Gyeonggi-do, Republic of Korea.

Privacy Officer: Yeonju SEONG, Representative. For privacy requests, contact support@shipsfromkorea.com or +82 10-3122-6663 and identify your request as a privacy matter. Our support team routes these requests to the Privacy Officer.

Requests from the European Union or the European Economic Area: you can send any privacy request, including a transfer query, an objection or a request for a copy of your information, to the Privacy Officer at the contact above, and we handle it within the response period that applies to your request. Ships From Korea is established in the Republic of Korea. We do not currently maintain an establishment or a representative in the EU/EEA. Where the law applicable to a request requires us to have a representative there, we will appoint one, publish its name and contact details in this policy and handle requests through it; until that is published, please use the Privacy Officer contact above.

2. Information, sources and purposes

• Account: name, email and authentication details provided at registration or by your sign-in provider, to create and secure your account.
• Orders: product links, options, quantities, messages and inspection photos from you or our warehouse staff, to purchase, receive and handle your goods.
• Delivery: recipient name, address and phone, plus customs or tax identifiers when required by the destination or carrier, to ship and clear your parcel. If you give us another recipient's information, make sure you are authorized to do so and tell them about this policy.
• Payments: transaction references, amounts, currency, payment status and refund or dispute records from you and the payment provider, for settlement, verification and dispute handling. Payment providers handle card details; we do not store full card numbers.
• Support and security: inquiries, replies, relevant transaction evidence, access records and filtered error information, to answer requests, protect accounts and investigate problems.
• Optional features: usage events after analytics consent, and address queries when you use address search. See the provider and cookie sections below.

We process information as needed to perform the service you request, meet legal obligations and protect the service where law permits. Processing that requires consent uses that consent. If required delivery or payment information is unavailable, we may be unable to complete that service. Declining optional analytics does not prevent shopping.

3. Service providers and other recipients

The provider used depends on your payment method, delivery service and enabled features. Information is shared for the purpose of the relevant service. A provider's role may be processing on our behalf or independently meeting its own payment, transport or legal obligations.

• PayPal: payment and transaction details needed for payment processing, verification, refunds and disputes.
• FedEx, UPS, YunExpress, Korea Post, SF Express and relevant customs authorities: recipient, parcel, declared value, customs and tracking details needed for delivery and clearance.
• Supabase: authentication, database and private photo storage. Vercel: website hosting. Spaceship Spacemail: recipient email and transactional message content. Sentry: error monitoring with sensitive-field filtering.
• Discord: staff operational order notifications. Google Analytics, Vercel Analytics and our own event store: optional usage analysis after consent.
• Google Places and OpenStreetMap Nominatim: address-search queries and selected place details when you use address search; the provider depends on the form and configuration. You can enter an address manually.

We do not sell personal information. We may provide relevant records when required by law or a valid authority request, or where law permits us to handle a payment dispute or protect against fraud. If the business is transferred, we will give the notices and choices required by law. This policy does not authorize unrestricted sharing with unrelated companies.

4. International processing

We operate in the Republic of Korea. Your information may also be processed by the providers above in other countries, including the destination and transit countries involved in your shipment. A provider's headquarters is not necessarily the country where it stores or processes your data.

International processing must use a legal basis permitted for the particular transfer, such as necessary contract-related processing with the required disclosures, or separate consent where required. Using this website is not an irrevocable waiver of these requirements.

Contact support for the providers and transfers relevant to your order or to raise a transfer objection. Refusing optional processing does not prevent shopping; a restriction on processing essential to payment or delivery may prevent us from completing that service. We will explain the available options.

5. Cookies and optional analytics

Essential cookies support login and checkout. Allow or reject optional analytics in Privacy settings at the bottom of public pages. You can withdraw consent there at any time. Your choice lasts up to 180 days. Withdrawal stops future analytics and removes analytics identifiers from this browser; it does not automatically erase records already lawfully collected.

Our event store records page categories, device class and limited workflow events. It excludes full URL queries, referrers and customer identifiers. Its session identifier expires after 30 minutes; raw events are retained for 90 days. Google manages its own identifiers and retention under its service settings and privacy policy. Our 90-day event-store period is not a promise about every external provider's retention.

Browser cookie controls can also limit storage, although blocking essential cookies may prevent login or checkout. Service emails about purchases, delivery, security and refunds are part of fulfilling your request; analytics consent is not marketing consent.

6. Retention and deletion

• Account and saved addresses: while you use the account, then removed through the account-deletion process unless a lawful retention obligation applies.
• Contracts, cancellation, payment and supply records: 5 years where Korean e-commerce record-retention requirements apply.
• Consumer complaints and disputes: 3 years. Records needed for an ongoing legal matter may be retained until the matter is resolved.
• Inspection photos: normally one year after order completion, then queued for deletion. A dispute or legal hold may require longer retention; photos may be removed sooner when no longer needed.
• Email-delivery payloads in our application: 30 days after successful delivery; unresolved or cancelled deliveries up to 90 days. Staff access logs: one year. Our raw analytics events: 90 days.

Before closing an account, resolve open orders, refunds, inquiries and any credit balance. Legally required records are separated with restricted access. Data no longer needed is deleted from active systems; account, photo and authentication cleanup can complete in separate steps and failed cleanup is retried. Provider copies and backups follow their applicable deletion processes, so removal is not necessarily immediate in every system.

Request account deletion. If the account flow cannot complete your request, contact support. Retention is limited to the records and purpose that justify it, rather than continuing ordinary account use.

7. Your rights and choices

You can update account and address details, change analytics preferences and request access, a copy, correction or deletion of your information. Where applicable, you may request restriction, object to processing or request data portability. A representative may contact us with evidence of authority. We may verify identity proportionately before disclosing or changing records.

We will respond within the period required by applicable law and explain any lawful limit on a request, such as a record we must retain for a transaction or legal matter. You may also complain to the relevant privacy supervisory authority or seek dispute mediation. Withdrawing consent does not affect processing that was lawful before withdrawal.

If information about a child was provided without guardian consent required by law, a parent or guardian should contact us so we can investigate, restrict processing and remove information as appropriate. Do not send identity documents or sensitive information unless they are necessary for a specific request and we have explained how to submit them.

8. Security and policy changes

We use encrypted connections, access controls, private inspection-photo storage and sensitive-field filtering in error monitoring. Warehouse access is separated from full administration. Staff must complete two-step verification; customers can enable it in account security settings. No system can guarantee complete security.

Data breach response. If we learn of a personal data breach, we investigate and contain it, then assess the risk to the people affected and the likelihood of harm. Where notification is required, we notify the competent supervisory authority without undue delay and within any deadline the applicable law sets, including the 72-hour period that applies under the EU GDPR. Because we are established outside the EU/EEA, more than one supervisory authority may be competent for the same incident, and we may have to notify each of them; we do not assume a single lead authority. If a breach is likely to result in a high risk to the people affected, we also inform them without undue delay, describing the nature of the breach, the likely consequences, the measures we have taken or propose to take, and how to reach the Privacy Officer. We keep an internal record of breaches, including incidents we conclude do not require notification.

We publish the revision date here and explain material changes, with advance notice or renewed consent where required. New uses of information must have an appropriate legal basis; updating this page alone does not create consent.