Privacy Policy

Last updated: July 2026

1. Who we are

Korean Beauty Supply, S.à r.l.-S is the data controller for personal data collected through this website.

Korean Beauty Supply, S.à r.l.-S 64, Rue Michel Rodange, L-9061 Ettelbruck, Luxembourg RCS Luxembourg B298289 · VAT LU36744250 Email: info.koreanbeautysupply@gmail.com Phone: +352 621 737 395

For any question about your data, or to exercise any of the rights described below, write to us at info.koreanbeautysupply@gmail.com.

2. What we collect, why, and on what legal basis

What we collect	Why	Legal basis
Name, email, delivery and billing address, phone number	To process and deliver your order, send confirmations, and handle returns	Performance of a contract (Art. 6(1)(b) GDPR)
Payment confirmation (we never see your full card number)	To take payment and prevent fraud	Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))
Order history, invoices, accounting records	To meet our bookkeeping and tax obligations	Legal obligation (Art. 6(1)(c))
Account details, if you create an account	To let you log in, view orders and save addresses	Contract (Art. 6(1)(b))
Emails and messages you send us	To answer your questions and keep a record of the exchange	Legitimate interest in supporting our customers (Art. 6(1)(f))
Email address, if you sign up to our newsletter	To send you marketing emails	Your consent (Art. 6(1)(a))
IP address, device and browser data, pages viewed, referring site	To keep the site secure and working, and to understand how it is used	Legitimate interest in a secure, functioning site (Art. 6(1)(f)), or your consent where cookies require it
Product reviews you choose to publish	To display reviews on the site	Your consent (Art. 6(1)(a))

We do not collect special category data (such as health data), and we ask that you do not send it to us. If you tell us about a skin condition when asking for advice, we use that only to answer your question and do not store it in a customer profile.

We do not use automated decision-making or profiling that produces legal effects for you.

3. Cookies

Our site uses cookies. Some are strictly necessary — they keep your cart working, let you log in and keep the site secure. These are set without consent because the site cannot function without them.

Other cookies are used for analytics and, where applicable, marketing. These are set only if you consent, and you can change or withdraw your choice at any time through the cookie settings on our site or through your browser.

Blocking non-essential cookies will not stop you shopping with us.

4. Who we share your data with

We share personal data only where necessary, with:

• Shopify International Limited (Ireland) — our e-commerce platform and website host
• Our payment providers — Shopify Payments, PayPal, and Apple Pay — to process your payment. They receive your payment details directly; we do not store card numbers.
• Our carrier — your name, address and phone number, to deliver your parcel
• Our email provider — where you have subscribed to marketing
• Our accountant and tax authorities — where required for bookkeeping and tax
• Legal or regulatory authorities — where we are legally obliged to disclose

We do not sell your personal data.

We do not currently run advertising trackers (such as Meta or Google ad pixels) on this site. If we introduce them in the future, we will update this policy, add the relevant providers to this section, and ask for your consent through our cookie settings before any such tracker is active.

5. Transfers outside the EU

Our providers may process data outside the European Economic Area, including in the United States. Where that happens, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses approved by the Commission.

You can ask us for details of the safeguards that apply to a particular transfer.

6. How long we keep it

Data	Retention
Order and invoice records	10 years, as required by Luxembourg accounting law
Customer account data	Until you ask us to delete your account
Customer service correspondence	3 years from the last contact
Newsletter subscription	Until you unsubscribe, then we keep a record of the unsubscribe so we do not contact you again
Analytics data	Up to 26 months

Where a retention period has passed, we delete the data or anonymise it so it can no longer identify you.

7. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy
• Rectification of data that is inaccurate or incomplete
• Erasure of your data, where we have no continuing legal reason to keep it
• Restriction of processing in certain circumstances
• Data portability — to receive data you gave us in a machine-readable format, or have it sent to another controller
• Object to processing based on our legitimate interests
• Withdraw consent at any time, where processing is based on consent. This does not affect processing carried out before you withdrew.

You can unsubscribe from marketing emails at any time using the link in every email, without contacting us.

To exercise any of these rights, email info.koreanbeautysupply@gmail.com. We will respond within one month. We may ask you to confirm your identity first, to make sure we are not disclosing your data to someone else.

8. Complaints

If you are unhappy with how we have handled your data, please tell us first — we would like the chance to put it right.

You also have the right to complain to a data protection authority. In Luxembourg this is:

Commission nationale pour la protection des données (CNPD) 15, Boulevard du Jazz, L-4370 Belvaux, Luxembourg www.cnpd.lu

You may also complain to the authority in your own country of residence.

9. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls, and providers who maintain recognised security standards.

No system is completely secure. If a data breach occurs that is likely to result in a high risk to your rights, we will notify you and the CNPD as required by law.

10. Children

Our site is not intended for people under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

11. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The current version is always published here with its "last updated" date. Where changes are significant, we will tell you directly.