Privacy Policy
Santa Here (business name: Nadle (나들), hereinafter the "Company") values your personal information and complies with the Personal Information Protection Act and related laws.
1. Purposes of processing personal information
The Company processes personal information for the following purposes, and will obtain your prior consent if the purpose changes:
- Receiving and processing orders, and payment
- Purchasing, inspecting, packaging, and internationally shipping products
- Customs declaration in the destination country
- Providing shipping status updates
- Receiving and responding to inquiries
- Processing order cancellations and refunds
- Sending news about new products and discounts, only where you have consented
2. Personal information collected
The Company collects the following items.
When ordering (required) Name, email address, phone number, shipping address, order lookup PIN
When making an inquiry (required) Email address, inquiry content
Information automatically generated and collected Access logs, browser type, language setting
The Company does not require account registration and does not collect resident registration numbers or equivalent national ID numbers.
Payment method information (such as card numbers) is processed directly by the payment provider and is not retained by the Company.
3. Retention and use period of personal information
The Company retains personal information for the following periods:
- Order information: 5 years after the transaction ends
- Inquiry content: 3 years after the inquiry is resolved
- Marketing consent information: until consent is withdrawn
- Access logs: 3 months
However, where applicable law requires a longer retention period, the information is retained for that period:
- Records relating to contracts or withdrawal of subscription: 5 years
- Records relating to payment and supply of goods: 5 years
- Records relating to consumer complaints or dispute resolution: 3 years
4. Provision of personal information to third parties
The Company provides personal information to third parties only with your consent or where there is a legal basis to do so.
Recipient — the Korea-based seller from which the ordered product is purchased, and the logistics warehouse responsible for packaging and dispatch Purpose of provision — purchasing the product, verifying authenticity, packaging, and dispatch Items provided — recipient's name, phone number, shipping address Retention period — until delivery is completed
5. Outsourcing of personal information processing
The Company outsources personal information processing as follows to provide its services:
| Recipient of outsourcing | Outsourced task |
|---|---|
| PayPal | Payment processing |
| Google Cloud | System management for service operation |
| Automatic translation of inquiry and chat content |
The Company sets out the necessary matters in its outsourcing agreements to ensure personal information is managed securely, and will notify you through this Policy if the outsourced task or the recipient of outsourcing changes.
6. Overseas transfer of personal information
The Company transfers personal information overseas as follows in order to ship products internationally.
Recipient of transfer — international courier companies, and the customs authority and local delivery company of the destination country Country of transfer — the destination country you entered Items transferred — recipient's name, phone number, shipping address Purpose of transfer — international transport, customs declaration, local delivery Method of transfer — electronic transmission via shipping labels and customs documents Retention period — the period set by the customs-related laws of the destination country
In addition, under Article 5, some of the Company's outsourcing recipients are located overseas, and personal information is processed overseas to the extent necessary to perform that work.
You may refuse the overseas transfer of your personal information. However, in that case international shipping is not possible and your order cannot be completed.
7. Destruction of personal information
The Company destroys personal information without delay once the retention period has passed or the processing purpose has been achieved.
Personal information stored in electronic file form is deleted using a method that prevents recovery, and personal information printed on paper is shredded or incinerated.
Personal information that must be retained under applicable law is stored separately from other personal information.
8. Data subject rights and how to exercise them
You may exercise the following rights at any time:
- Request to access your personal information
- Request to correct inaccurate information
- Request for deletion
- Request to suspend processing
- Withdrawal of consent
You can check order information directly on your order detail page using your order number and order lookup PIN. For other rights requests, please contact the Data Protection Officer below.
The Company will take action and inform you of the outcome within 10 days of receiving your request.
However, the Company cannot comply with a deletion request for personal information that applicable law requires it to retain, and will inform you of the reason in that case.
Where the laws of your country of residence recognize broader rights than those above, those laws govern.
9. Automatic data collection devices
The Company uses cookies to the extent necessary for the operation of the service.
- Cookies to keep the products you have added to your cart
- Cookies to remember your selected language
- Cookies to continue your order lookup and inquiry/chat sessions
- If you arrive via a promotional partner's link, a cookie recording which partner referred you
You may refuse cookies through your browser settings. However, if you do so, you will not be able to use the cart and order lookup features.
10. Measures to secure the safety of personal information
The Company takes the following measures to secure personal information:
- Minimizing the number of personnel with access to personal information
- Encryption of personal information in transit
- Retention of access logs
- Access control over systems that process personal information
11. Data Protection Officer
The Company has designated a Data Protection Officer who oversees personal information processing and handles your inquiries and complaints.
Data Protection Officer — Kang Tae-su (강태수) Email — 88santahere@gmail.com Address — (TBD) Phone — (TBD)
You may direct inquiries, complaints, and requests for remedy relating to personal information to the contact above, and the Company will respond without delay.
12. Remedies for infringement of rights
If you wish to seek remedy for damage caused by a personal information infringement, you may request dispute resolution or consultation from the following organizations:
- Personal Information Dispute Mediation Committee (privacy.go.kr, 1833-6972 domestically)
- Personal Information Infringement Report Center (privacy.kisa.or.kr, 118 domestically)
- Supreme Prosecutors' Office Cyber Investigation Division (spo.go.kr, 1301 domestically)
- National Police Agency Cyber Investigation Bureau (ecrm.police.go.kr, 182 domestically)
You may also report to the personal information supervisory authority of the country in which you reside.
13. Changes to this Privacy Policy
If the Company changes this Policy, it will announce the change and its effective date on the site in advance.
Announcement date — (TBD) Effective date — (TBD)