** This form is provided as a sample to help the operation of the shopping mall, and needs to be modified according to the operation type of the shopping mall. Before applying to the shopping mall, check the operation of the shopping mall, and find out the appropriate information Please use it as a reflection. **

HSF Privacy Policy
HSF Co., Ltd. establishes and discloses a personal information processing policy as follows in order to protect users' personal information pursuant to Article 30 of the Personal Information Protection Act and to promptly and smoothly deal with such grievances.

The personal information processing policy contains the following contents.
1. Purpose of processing personal information
2. Processing and retention period of personal information
3. Items and methods of collecting personal information processed
4. Matters concerning the processing of personal information of children under the age of 14
5. Matters concerning the provision of personal information to third parties
6. Matters concerning consignment of personal information processing
7. Procedure and method of destroying personal information
8. Matters concerning the rights and obligations of the data subject and legal representative and how to exercise them
9. Matters concerning measures to ensure the safety of personal information
10. Matters concerning the installation and operation of a device that automatically collects personal information and its refusal.
11. Matters concerning the person responsible for personal information protection
12. Remedy for infringement of rights and interests of data subjects
13. Change of Privacy Policy

1. Purpose of processing personal information
The company shall process personal information for the following purposes: The personal information being processed shall not be used for any purpose other than the following purposes, and where the purpose of use is changed, it shall be separately referred to in Article 18 of the Personal Information Protection Act We will take necessary measures, such as obtaining consent.
(1) Registering and managing membership on the website
Confirmation of membership intention, identification and certification according to the provision of membership services, maintenance and management of membership status, prevention of illegal use of services, confirmation of consent from legal representatives when processing personal information of children under the age of 14, and various types We process personal information for the purpose of notification, notification, and grievance.
(2) Providing goods or services
We process personal information for the purpose of providing content, purchasing and paying fees, shipping goods or bills, providing services, and providing customized services.
(3) Use in marketing and advertising
Personal information is processed for the purpose of providing event and advertising information and opportunities to participate, identifying access frequency, or statistics on members' service use.

2. Processing and retention period of personal information
(1) When collecting personal information from the data subject, the company processes and retains the personal information within the period of possession and use of the personal information agreed upon. If there is a request from the data subject to achieve the purpose of processing personal information and to terminate the service, without delay Destroy the personal information. The processing and retention period of each personal information is as follows.
① Membership registration and management on the website:
Until membership is withdrawn ② Provision of goods or services: Until the completion of supply of goods and services and payment and settlement of charges
(2) However, if it is necessary to preserve it in accordance with the provisions of the relevant laws and regulations, the company shall keep the member information for a certain period prescribed by the relevant laws and regulations as follows.
① Records of contract or subscription withdrawal, etc.
-Reasons for preservation: Act on consumer protection in e-commerce, etc.
-Preservation period: 5 years
② Record of payment and supply of goods, etc.
-Reasons for preservation: Act on consumer protection in e-commerce, etc.
-Preservation period: 5 years
③ Record of Consumer Complaints or Dispute Resolution
-Reasons for preservation: Act on consumer protection in e-commerce, etc.
- Preservation period: 3 years
④ Marking and advertising records
-Reasons for preservation: Act on consumer protection in e-commerce, etc.
- Preservation period: 6 months
⑤ Service Visit History
-Reason for preservation: Communications Secret Protection Act
- Preservation period: 3 months

3. Items and methods of collecting personal information processed
(1) Personal information items to process
① The company collects the following personal information for membership registration, consultation, and service applications.
- When registering as a regular member
Required items: ID, password, name, e-mail, mobile phone, date of birth, legal representative information
Selection: Gender
- When ordering product
Required items: Order information (name, e-mail, mobile phone), Shipping information (name, address, mobile phone), Order inquiry password
Selection: General Phone
- When logging in to Kakao Easy
Required: Name
- When logging in to Naver,
Required: ID, name, e-mail
Selection: Nickname, Birthday
② The following information can be generated and collected in the course of service use or business processing.
- Service usage records, access logs, cookies, access IP information, payment records, suspension records, defective usage records
(2) How to collect
- Homepages, written forms, bulletin boards, e-mail, event applications, delivery requests, phone calls, faxes, offers from affiliates, collection through generative information collection tools

4. Matters concerning the processing of personal information of children under the age of 14
(1) When collecting personal information for children under the age of 14, the company collects the minimum amount of personal information necessary to perform the service with the consent of its legal representative.
- Mandatory items: [Personal information collected through legal representative consent form]
(2) When collecting personal information of children under the age of 14, the company may request the child to have the minimum information, such as the name and contact information of the legal representative, and a legal representative may Make sure you agree.
- How to make the legal representative indicate his or her consent on the Internet site that posted the consent, and inform the legal representative's mobile phone text message that the personal information controller has confirmed the consent indication - How to have a legal representative indicate his or her consent on the Internet site that posted the consent and receive card information such as credit card and debit card from the legal representative.
- How to have a legal representative indicate his or her consent on the Internet site that posted the consent and check his or her identity through the personal authentication of the legal representative's mobile phone.
- A method of issuing a document with consent directly to a legal representative, delivering it by mail or fax, and requiring the legal representative to submit the consent after signing and sealing it.
- How to send an e-mail with the contents of consent and receive an e-mail with an expression of consent from a legal representative.
- How to inform the legal representative of the consent through the phone and how to obtain consent or check the consent such as Internet address, and obtain consent through the phone call again.
- Other methods of informing the legal representative of the contents of consent in the same way as above and confirming the expression of consent.

5. Matters concerning the provision of personal information to third parties
(1) The company shall process personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information), and only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as the consent of the data subject and special provisions of the Act Provide personal information to third parties.
(2) The company provides personal information to third parties as follows.
Personal information items provided for the purpose of providing the third party name to be provided Hold and use period of the recipient [Third party name received] [Purpose of provision] [Personal information item provided] [Preservation and use period of the recipient]
(3) In accordance with the 「Personal Information Processing and Protection Rules in Emergency Situations」 jointly announced by relevant government ministries, the company should consider emergency situations such as disasters, infectious diseases, events and accidents that cause urgent life and physical danger, and urgent loss of property Personal information can be provided to the relevant agencies without the consent of the data subject if it occurs.
Click here* for more information.

6. Matters concerning consignment of personal information processing
(1) The company entrusts the processing of personal information as follows for smooth processing of personal information.
Entrusted company consignment
Providing, maintaining, and maintaining systems for Cafe 24 Shopping Mall Hosting Services
[Delivery name] [Consignment details]
[Name of PG company] [Consignment content of PG company]
#supply_list# [Consignment details]
(2) In accordance with Article 26 of the Personal Information Protection Act, a company shall prohibit the processing of personal information other than the purpose of performing entrusted affairs, take technical and administrative protective measures, restrictions on re-entrustment, manage and supervise the trustee, compensate for damages, etc The matters are specified in documents such as contracts, and the trustee is supervising whether personal information is handled safely.
(3) If the contents of the consignment work or the trustee is changed, we will disclose it through this personal information processing policy without delay.

7. Procedure and method of destroying personal information
When personal information becomes unnecessary, such as the expiration of the personal information retention period and the achievement of the processing purpose, the company will destroy it without delay.
(1) Destruction procedure
① Where it is necessary to continue preserving personal information pursuant to other Acts and subordinate statutes despite the expiration of the period of personal information agreed upon by the data subject or the purpose of processing has been achieved, the relevant personal information shall be separately preserved Move to database (DB) or save in different storage locations.
② Personal information transferred to a separate DB will not be used for any other purpose except by law.
(2) How to destroy
① Information in the form of electronic files uses a technical method in which records cannot be played.
② The personal information printed on the paper is shredded with a grinder or destroyed by incineration.

8. Matters concerning the rights and obligations of the data subject and legal representative and how to exercise them
(1) The data subject may exercise his/her rights to the company at any time, such as access, correction, deletion, and suspension of processing.
(2) For the inquiry and correction of the personal information of the data subject, "change of personal information" (or "modification of member information", etc.) For the termination of subscription (withdrawal of consent), click "withdrawal of members" and go through the identification process, and directly read and correct it Alternatively, you can leave.
(3) Alternatively, if you contact the person responsible for personal information protection in writing, by phone or by e-mail, we will take action without delay.
(4) The exercise of rights under paragraph (1) may be carried out through the legal representative of the data subject or the delegated person, etc., and in such cases, attached Form 11 of the "Notification on how to process personal information (No. 2020-7)" You must submit a power of attorney in the form.
(5) Requests for suspension of access and processing of personal information may restrict the rights of the data subject pursuant to Articles 35 (4) and 37 (2) of the Personal Information Protection Act, and requests for correction and deletion of personal information shall be made by other Acts and subordinate statutes If personal information is specified as a collection target, it cannot be requested to be deleted.
(6) The company checks whether it is the person who made the request for reading, correction or deletion, or suspension of processing in accordance with the data subject's rights, or whether it is the person who made the request.

9. Matters concerning measures to ensure the safety of personal information
The company is taking the following measures to ensure the safety of personal information.
(1) Management measures: Establishment and implementation of internal management plans, operation of dedicated organizations, regular employee training
(2) Technical measures: Management of access rights such as personal information processing system, installation of access control system, encryption of personal information, installation and update of security program
(3) Physical measures: Control access to computer rooms, data storage rooms, etc.

10. Matters concerning the installation and operation of a device that automatically collects personal information and its refusal.
To provide individual customized services to users, companies use "cookies" that store usage information and call it up from time to time. A cookie is a user's computer by the server used to run the website It is a small amount of information that is sent to your browser and is sometimes stored on a hard disk in your PC computer.
(1) Purpose of using cookies
It is used to provide optimized information to users by identifying the types of visits and use of each service and website visited by users, popular search terms, security access, etc.
(2) Installation, operation, and denial of cookies
You can deny saving cookies by setting options on the Tools > Internet Options > Privacy menu at the top of your web browser.
However, refusing to save cookies may cause difficulties in using customized services.

11. Matters concerning the person responsible for personal information protection
(1) The company is in charge of handling personal information processing, and designates a person responsible for personal information protection as follows for the handling of complaints and damage relief of data subjects related to personal information processing.
o Personal Information Protection Officer
Name: OOO
Belonging to: OOO
Phone number: OO-OOO-OOO
Email:
o Personal Information Protection Officer
Name: OOO
Belonging to: OOO
Phone number: OO-OOO-OOO
Email:
(2) The data subject may contact the person responsible for personal information protection and the person in charge for all personal information protection inquiries, complaint handling, damage relief, etc. that have occurred while using the company's services. The company may contact the data subject's We will respond and process your inquiry without delay.

12. Remedy for infringement of rights and interests of data subjects
(1) In order to receive relief for personal information infringement, you can apply for dispute resolution or counseling at the Personal Information Dispute Mediation Committee, the Personal Information Infringement Reporting Center of the Korea Internet Promotion Agency, etc. Other reports of personal information infringement, For consultation, please contact the following institutions:
Personal Information Dispute Mediation Committee: (without national code) 1833-6972 (privacy.go.kr )
Personal Information Infringement Reporting Center: (without national code) 118 (privacy.kisa.or.kr )
Supreme Prosecutors' Office: (without national code) 1301 (www.spo.go.kr )
Police Department: (without national code) 182 (ecrm.cyber.go.kr )
(2) Due to the disposition or omission made by the head of a public institution in response to the request under Article 35 (view of personal information), Article 36 (correction and deletion of personal information), and Article 37 (suspension of processing of personal information, etc.) of the Personal Information Protection Act A person who has been infringed on his or her rights or interests may request an administrative trial as prescribed by the Administrative Trial Act.
※ For more information on administrative trials, please visit the website of the Central Administrative Appeals Commission (www.simpan.go.kr ).

13. Change of Privacy Policy
This privacy policy will be effective from OOO year OO.