Privacy Policy
Privacy Policy
Effective: January 1, 2024 · Last revised: January 1, 2026
Key Privacy Principles
Important: Due to the nature of cosmetic and beauty products, refunds for returned products that have been opened and used may be restricted for hygiene reasons. Please check the ingredient list carefully before purchase, and contact customer service with any questions.
11. Personal Information We Collect
UNIZ LAB Co., Ltd. (the "Company") collects the following personal information for membership registration, use of services, consultation, event applications and similar purposes. ■ Required items (at sign-up) - Email address, password, name (nickname) ■ Additional items for purchase and delivery - Recipient name, delivery address, phone number ■ Items collected automatically (while using the service) - IP address, cookies, service usage records, device information, browser information ■ Guest orders - Name, email, phone number, delivery address (for order lookup)
22. Purposes of Collection and Use
The Company uses the personal information it collects for the following purposes. ① Providing services and performing contracts - Providing content, purchases and payment, delivery of goods, sending invoices ② Member management - Identity verification and personal identification for members-only services - Preventing misuse by abusive members and confirming intent to join - Keeping records for dispute resolution ③ Developing new services and marketing (with prior consent) - Developing new services and providing personalised services - Providing event and advertising information (only to members who have given prior consent) ④ Customer service - Receiving and handling inquiries, handling complaints, resolving disputes
33. Retention and Use Period
In principle, personal information is destroyed without delay once the purpose of its collection and use has been achieved. However, where the law requires retention, it is kept for the periods below. ■ Act on the Consumer Protection in Electronic Commerce, etc. - Records of contracts or withdrawal of offers: kept for 5 years - Records of payment and supply of goods: kept for 5 years - Records of consumer complaints or dispute handling: kept for 3 years ■ Protection of Communications Secrets Act - Login records: kept for 3 months ■ On membership withdrawal - Personal information is deleted immediately on withdrawal (information the law requires us to keep is stored separately for the required period and then deleted)
44. Destruction Procedure and Method
① Destruction procedure Information entered by users is moved to a separate database once its purpose has been achieved, stored for a set period under internal policy and relevant laws, and then destroyed. Personal information moved to the separate database is not used for any other purpose unless required by law. ② Destruction method - Electronic files: deleted by technical means that make the records impossible to restore - Paper documents: shredded or incinerated
55. Provision of Personal Information to Third Parties
In principle, the Company does not provide users' personal information to outside parties. The following cases are exceptions. ① Where the user has given prior consent ② Where required by law, or where an investigative agency requests it for investigative purposes under the procedures and methods set by law ■ Outsourcing for delivery services (current operators) - Contractors: courier companies such as CJ Logistics and Lotte Global Logistics - Purpose: delivering products and delivery-related customer support - Information provided: recipient name, delivery address, contact number
66. Rights of Users
Users may view or correct their registered personal information at any time, and may withdraw consent by cancelling their membership. ① Viewing and correcting personal information: change it directly under My Page > Edit Profile ② Membership withdrawal (withdrawal of consent): My Page > Account Settings > Delete Account ③ Email inquiries: uniz@uniz.co.kr Users may exercise these rights in writing, by email or through customer service, and the Company will act on requests without delay.
77. Use of Cookies
① To provide personalised services, the Company uses "cookies", which store user information and retrieve it from time to time. ② Cookies are used for the following purposes. - Keeping you signed in - Temporarily storing shopping cart data - Analysing service usage statistics and improving the service ③ How to refuse cookies You can refuse cookie storage in your web browser settings. e.g. Chrome: Settings → Privacy and security → Cookies and other site data ④ If you refuse cookie storage, you may have difficulty using personalised services.
88. Overseas Transfer of Personal Information
To conclude and perform contracts with data subjects (member authentication, order processing, inquiry handling, AI consultation, etc.), the Company entrusts the processing of personal information to, and has it stored by, the operators below. In this process, personal information is transferred overseas or processed by overseas operators. The details for each recipient below are the matters required by each subparagraph of Article 28-8 (2) of the Personal Information Protection Act.
| (1) Personal information items transferred | · Member authentication (Firebase): email address, encrypted password · Order and member data (Firestore): order information, member information · Inquiry and order notification emails (Gmail): recipient email address, email body |
|---|---|
| (2) Country, time and method of transfer | · Member authentication (Firebase): the United States and other countries where Google data centers are located (no official storage region is published) · at sign-up and login · encrypted transmission over the internet (HTTPS) · Order and member data (Firestore): stored in the Seoul region of the Republic of Korea (asia-northeast3), so it is not stored overseas; however, the processor is Google LLC. · Inquiry and order notification emails (Gmail): the United States and other countries where Google data centers are located · when an email is sent · encrypted transmission over the internet (HTTPS) |
| (3) Recipient | Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, USA · privacy@google.com) |
| (4) Purpose of use and retention and use period | · Purpose of use: member authentication, storage of order and member data, sending of inquiry and order notification emails · Retention and use period: deleted without delay upon withdrawal of membership or deletion of the user; Firebase authentication data is deleted within 180 days after deletion, including backups. Retention periods required by law follow the section above, "3. Retention and Use Period of Personal Information". |
| (5) How to refuse the transfer, procedure and effect of refusal | You may request that the transfer be stopped by contacting the Company (uniz@uniz.co.kr). If you refuse the transfer, the relevant services, such as member authentication, orders and inquiry notification emails, will be restricted, and you will not be able to sign up or place orders. |
| (1) Personal information items transferred | Service access records (IP address, request information) |
|---|---|
| (2) Country, time and method of transfer | The United States (where Vercel Inc. is located) and regions along Vercel's global delivery network · when the service is accessed · encrypted transmission over the internet (HTTPS) Server functions run in the Seoul region of the Republic of Korea (icn1), but access records may pass through the global delivery network. |
| (3) Recipient | Vercel Inc. (United States · privacy@vercel.com) |
| (4) Purpose of use and retention and use period | Purpose of use: website hosting and execution of server functions · Retention period: until the end of the service agreement (access logs are deleted under Vercel's retention policy) |
| (5) How to refuse the transfer, procedure and effect of refusal | You may request that the transfer be stopped by contacting the Company (uniz@uniz.co.kr). If you refuse the transfer, the relevant services (website use, membership, orders, consultation) will be restricted. |
| (1) Personal information items transferred | Question text entered in the AI consultation and formulation explanation features |
|---|---|
| (2) Country, time and method of transfer | The United States (where Anthropic PBC is located) · when an AI consultation or formulation explanation is requested · encrypted transmission over the internet (HTTPS) |
| (3) Recipient | Anthropic PBC (United States · privacy@anthropic.com) |
| (4) Purpose of use and retention and use period | · Purpose of use: generating AI consultation answers and formulation explanations · Retention and use period: inputs and outputs are automatically deleted within 30 days (up to 2 years if classified as a policy violation). |
| (5) How to refuse the transfer, procedure and effect of refusal | You may request that the transfer be stopped by contacting the Company (uniz@uniz.co.kr). If you refuse the transfer, the relevant services (AI consultation and formulation explanations) will be restricted. |
| (1) Personal information items transferred | Business partner contact person's name, company name, department, job title, business email address, business phone number, company address, and the subject, body and attachments of business emails exchanged with the business partner |
|---|---|
| (2) Country, time and method of transfer | The United States and other countries where Google data centers are located · when a contact person is registered or edited, and at the regular synchronization every day at 04:00 · encrypted transmission over the internet (HTTPS, Google People API, Gmail API) |
| (3) Recipient | Google LLC (1600 Amphitheatre Parkway, Mountain View, CA, USA · privacy@google.com) |
| (4) Purpose of use and retention and use period | · Purpose of use: keeping the Company's contact ledger and synchronizing it to employees' work devices (sales contact); keeping the Company's business mailbox · Retention and use period: deleted together when the business partner contact's information is deleted (reflected in the next regular synchronization) · until the entrustment contract ends |
| (5) How to refuse the transfer, procedure and effect of refusal | If the contact person requests the Company (uniz@uniz.co.kr), the Company removes that person's information from the ledger and deletes the copy held by Google. If you refuse, sales contact may be limited. |
Legal basis for the overseas transfer: Article 28-8 (1) 3 (a) of the Personal Information Protection Act and Article 29-8 of its Enforcement Decree
99. Personal Information Protection Officer
The Company designates the following personal information protection officer to oversee personal information processing and to handle user complaints and remedies for damage. ■ Personal information protection officer - Organisation: UNIZ LAB Co., Ltd. - Email: uniz@uniz.co.kr - Phone: 82-70-4109-6722 - Hours: weekdays 09:00–18:00 ■ Agencies for reporting and counselling on privacy violations - Personal Information Infringement Report Center: privacy.kisa.or.kr · Tel. 118 - Supreme Prosecutors' Office Cyber Investigation Division: spo.go.kr · Tel. 1301 - Korean National Police Agency Cyber Crime Reporting System: ecrm.cyber.go.kr · Tel. 182
10Addendum
This Privacy Policy takes effect on January 1, 2024. Last revised: January 1, 2026 Previous versions of this Privacy Policy are available through customer service.
Privacy inquiries: uniz@uniz.co.kr
View Terms of UsePrivacy Violation Reporting Agencies
Personal Information Infringement Report Center
privacy.kisa.or.kr
☎ 118
Supreme Prosecutors' Office Cyber Investigation Division
spo.go.kr
☎ 1301
Korean National Police Agency Cyber Crime Report
ecrm.cyber.go.kr
☎ 182