Last updated: 29 September 2026 · Draft for legal review
This policy explains how Pending confirmation (Pending confirmation) ("HotDeals Korea", "we") collects, uses, shares and protects personal information when you use hotdealskorea.com and our buy-for-me and ship-for-me services. We are based in the Republic of Korea and follow the Personal Information Protection Act (PIPA). Where they apply to you, we also follow the EU and UK General Data Protection Regulation (GDPR and UK GDPR) and US state privacy laws such as the California Consumer Privacy Act (CCPA, as amended by the CPRA).
1. Who is responsible
Pending confirmation (Pending confirmation), Pending confirmation, is responsible for your personal information (the "controller"). Our privacy officer is Pending confirmation, who can be contacted at privacy@hotdealskorea.com. For everything else, e-mail support@hotdealskorea.com.
2. What we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | name, display name, e-mail, password (stored only as a one-way hash), country, currency, suite code, marketing preference | you |
| Addresses and recipients | recipient name, phone number, delivery address; a tax or customs ID (such as a Brazilian CPF or Chilean RUT) where destination customs require it | you |
| Orders and parcels | item links and options, store order numbers, quotes, weights and sizes, contents and values for customs, tracking numbers, photos of parcels and contents | you, stores, our warehouse, carriers |
| Payments | amounts, exchange rate, PayPal transaction references, refund records. We never receive full card numbers: PayPal processes them. | you, PayPal |
| Support | messages, attachments and claim photos | you |
| Community | posts, comments, likes and your display name | you |
| Device and log data | IP address, browser type (user agent), pages requested, sign-in times, error logs | collected automatically |
| Business enquiries | company, contact name, e-mail, website, message | you |
Parcel photos can show labels with names and addresses. If you give us someone else's details, such as a recipient's, please make sure they know you're sharing them with us for delivery.
3. Why we use it
| Purpose | Information used | Legal basis |
|---|---|---|
| Create and run your account, sign you in | account, device | contract |
| Quote, buy, receive, store, pack and ship orders; handle claims | account, addresses, orders, payments | contract |
| Take payments and make refunds | payments, account | contract |
| Prevent fraud and payment abuse | payments, account, device | legitimate interests |
| Prepare customs declarations; keep records the law requires | addresses, orders, tax IDs, payments | legal obligation; contract |
| Answer support requests and resolve disputes | support, orders | contract; legal obligation |
| Run and moderate the community | community, account | contract; legitimate interests (a safe community) |
| Keep the site secure and working | device and log data | legitimate interests; legal obligation |
| Send service e-mails (order updates, storage reminders) | account, orders | contract |
| Send sale alerts and other marketing | e-mail, country | consent, which you can withdraw at any time |
Under PIPA, these bases correspond to Article 15(1): consent (item 1), legal obligations (item 2), a contract with you (item 4), and our legitimate interests where they clearly outweigh yours (item 6). We don't make decisions with legal or similarly significant effects on you solely by automated means.
4. Cookies
We use only the cookies needed to run the site. We don't use advertising or cross-site tracking cookies, and at launch we don't use analytics cookies.
| Cookie | What it does | Type | Duration |
|---|---|---|---|
hdk_session |
Keeps you signed in. Contains a random token that we store only in hashed form. | Strictly necessary; not readable by page scripts | 30 days, renewed while you use the site |
hdk_hint |
Tells the page you're probably signed in, so it shows the right menu. Contains only the value "1". | Functional; not sensitive | 30 days |
You can block or delete cookies in your browser settings. If you block hdk_session, you won't be able to sign in. If we ever add analytics or advertising cookies, we'll update this policy first and ask for your consent where required.
5. Who we share it with
We don't sell your personal information or share it for cross-context behavioural advertising. We share it only with:
- Carriers, including Korea Post, FedEx, our US line-haul and delivery partners, and delivery companies in your country: recipient details, contents and values, so they can deliver your shipment and clear customs.
- Customs authorities, in Korea and the destination country: declaration data, as the law requires.
- Korean stores: we buy in our own name and have goods delivered to our warehouse, so stores normally get our details, not yours. We share order details with a store only when needed to sort out a problem with your order.
- PayPal: to process payments and refunds and prevent fraud. PayPal acts as an independent controller under its own privacy statement.
- Service providers that process information on our behalf (수탁자): Cloudflare (website hosting and security, private file storage including parcel photos, and e-mail delivery) and Supabase (database). They may use it only to provide their services to us.
- Authorities and advisers: where the law requires, to protect rights and safety, or with our professional advisers under confidentiality.
- A buyer or successor if our business is transferred, with notice to you as PIPA requires.
6. International transfers
To deliver abroad and run the site, we transfer information outside Korea. These are the details required by PIPA Article 28-8:
| Recipient | Country | Information | Purpose | When and how | Kept by recipient |
|---|---|---|---|---|---|
| Korea Post, and postal operators in the destination | Korea, then destination | recipient name, address, phone, contents, values, weight, tax ID where required | delivery and customs clearance | when a shipment is dispatched; electronically and on the label | under their own policies and customs law |
| FedEx and its destination partners | United States, then destination | as above | delivery and customs clearance | when a shipment is dispatched; electronically and on the label | under FedEx's policy and customs law |
| Delivery companies in the destination, including our US line-haul and last-mile partners | destination country | as above | delivery | when a shipment is dispatched; electronically | under their own policies |
| Customs authorities of the destination | destination country | contents, values, recipient details, tax ID | import clearance | before arrival, through the carrier | as destination law requires |
| PayPal group | Singapore, United States | name, e-mail, amount, order reference, device data | payments, refunds, fraud prevention | at checkout, through PayPal's secure connection | under PayPal's privacy statement |
| Cloudflare, Inc. | United States (company); requests are handled in its global network, usually at the data centre nearest to you | all website traffic, including account and order data, and logs; parcel photos; name, e-mail address and e-mail content | hosting, security, file storage, and sending service e-mails (and marketing e-mails if you opt in) | continuously, over encrypted connections; each time we send you an e-mail | until we delete it or our contract ends; logs and delivery records for a short period |
| Supabase Inc. | United States (company); your data is stored in its Seoul, Korea data centre | account, address, order, payment reference, support and community data | database | continuously, over encrypted connections | until we delete it or our contract ends |
For EU and UK customers: Korea has adequacy decisions from the EU and UK. For onward transfers to US providers, we rely on the EU–US Data Privacy Framework (and UK extension) where the provider is certified, or on standard contractual clauses. Transfers to carriers and customs are necessary to perform the contract you ask for.
How to refuse. You can refuse these transfers by contacting our privacy officer or closing your account. Carriers, customs and PayPal are needed to deliver and pay for orders, and our hosting providers are needed to run the site, so if you refuse, we can't provide the service.
7. How long we keep it
| Information | Kept for | Reason |
|---|---|---|
| Account details | until you close your account | contract |
| Records of contracts and cancellations | 5 years | Act on Consumer Protection in Electronic Commerce (전자상거래법), Enforcement Decree art. 6 |
| Records of payments and supply of goods and services | 5 years | same |
| Records of complaints and disputes, including support messages | 3 years | same |
| Records of advertising and product displays | 6 months | same |
| Tax records (invoices, receipts) | 5 years | Framework Act on National Taxes |
| Website access logs (IP address, visit records) | 3 months | Protection of Communications Secrets Act (통신비밀보호법) |
| Saved addresses | until you delete them or close your account | contract |
| Parcel photos | as long as the related order record | contract; claims |
| Community posts | until you or we delete them, or you close your account | contract |
| Marketing consent | until you withdraw it | consent |
Periods run from the end of the transaction or event concerned. When you close your account, we delete your profile, addresses and community posts, and keep only the records the law requires, stored separately and used only for those legal purposes.
8. How we delete it
When a retention period ends or we no longer need the information, we delete it without delay, normally within 5 days. Electronic records are deleted so they can't be recovered, and paper records are shredded. Deleted information may stay in encrypted backups for a short time until they're overwritten.
9. Your rights
Depending on where you live, you have the right to:
- access your information and get a copy;
- correct inaccurate information;
- have it deleted, subject to the legal retention duties above;
- receive it in a portable format, or have it sent to another company;
- object to, or ask us to suspend or restrict, processing, and to opt out of direct marketing at any time;
- withdraw consent at any time, without affecting what we did before;
- ask for an explanation of, or object to, automated decisions;
- complain to a data protection authority.
10. How to use your rights and complain
You can update most details in your account settings. To close your account, open a support ticket. To stop marketing e-mails, use the unsubscribe link in any of them or change your preference in account settings. For any other request, e-mail privacy@hotdealskorea.com or support@hotdealskorea.com. We may need to confirm your identity, and you can act through an authorised representative. We respond within 10 days, or tell you within that time why we need longer, within the limits the law allows.
You can complain to:
- Korea: the Personal Information Protection Commission (www.pipc.go.kr); the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972); the KISA Privacy Infringement Report Center (privacy.kisa.or.kr, 118); the Supreme Prosecutors' Office (www.spo.go.kr, 1301); or the Korean National Police Agency cyber bureau (ecrm.police.go.kr, 182).
- EU or EEA: the data protection authority in your country.
- UK: the Information Commissioner's Office (ico.org.uk).
11. Notice for US residents
In the last 12 months we have collected identifiers (name, e-mail, address, IP address), customer records, commercial information (orders and payments), internet activity (logs), photos of parcels, and, where you provide them, account log-in credentials and tax IDs (sensitive personal information). We collect them from the sources and for the purposes in sections 2 and 3, keep them as described in section 7, and disclose them only to the recipients in section 5. We use sensitive personal information only to provide the service and as the law permits.
We don't sell or share personal information, so there is nothing to opt out of. You can ask to know, correct or delete your information, and we won't treat you differently for doing so. You can use an authorised agent. We respond within 45 days.
12. Children
Our services aren't for anyone under 16, and we don't knowingly collect children's information. Under PIPA, collecting information from children under 14 needs a legal guardian's consent, and we don't accept such accounts. If you think a child has given us information, contact us and we'll delete it.
13. How we protect it
- Encrypted connections (HTTPS) across the site.
- Passwords stored only as one-way hashes; session tokens stored in hashed form.
- Parcel photos kept in private storage, available only to your account and authorised staff.
- Staff access limited to what each role needs; administrative actions are logged.
- Card data handled by PayPal; we never see full card numbers.
- An internal privacy management plan and staff training, as PIPA requires.
No system is completely secure. If a breach affects your information, we'll notify you and the relevant authorities as the law requires, which under PIPA is within 72 hours of becoming aware of it.
14. Changes to this policy
We'll post any update here with a new date. For significant changes, we'll e-mail you before they take effect, and we'll ask for your consent where the law requires it.
15. Contact
- Privacy officer: Pending confirmation, privacy@hotdealskorea.com
- Company: Pending confirmation (Pending confirmation), Pending confirmation
- Support: support@hotdealskorea.com