1. Who is the data controller?

Korean Glow Shop Ltd, a company registered in the Republic of Cyprus, is the data controller responsible for your personal data collected through koreanglow.shop.

You can reach us at privacy@koreanglow.shop for any question about this policy or your data.

2. What personal data we collect

• Account data: name, email address, password (hashed), phone number.
• Order data: billing and delivery address, order history, invoices.
• Payment data: processed by our PCI-DSS compliant payment provider. We never store full card numbers on our servers.
• Communication data: emails and support messages you send us.
• Usage data: pages visited, device type, approximate location, referrer.

3. Why we use your data (legal bases)

• Contract: to process your orders, deliver products and provide customer support.
• Legal obligation: to keep invoicing, VAT and accounting records as required by Cypriot law.
• Legitimate interest: to secure our site, prevent fraud and improve the shopping experience.
• Consent: for marketing emails, non-essential cookies and product recommendations. You can withdraw consent at any time.

4. Your GDPR rights

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erasure ("right to be forgotten") of your account and personal data.
• Restrict or object to certain types of processing.
• Portability: receive a copy of your data in a machine-readable format.
• Withdraw consent at any time where processing relies on consent.
• Lodge a complaint with the Office of the Commissioner for Personal Data Protection of Cyprus.

To exercise any of these rights, email privacy@koreanglow.shop. We respond within 30 days.

5. How long we keep your data

• Account data: while your account is active, plus 12 months.
• Order and invoicing data: 7 years, as required by Cypriot tax law.
• Marketing preferences: until you unsubscribe or withdraw consent.
• Support conversations: 3 years after the last exchange.
• Analytics: aggregated and pseudonymised after 14 months.

6. Who we share your data with

We only share personal data with processors that help us run the shop, under a written data-processing agreement. Current categories include:

• Payment processing (card and Apple/Google Pay).
• Delivery carriers within Cyprus.
• Cloud hosting and database infrastructure (EU region).
• Transactional email delivery.
• Web analytics with IP-anonymisation.

We do not sell your personal data. We never share it with third parties for their own marketing.

7. International data transfers

Our data is hosted in the European Union. When a subprocessor is based outside the EEA, transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

8. Cookies

We use strictly necessary cookies for cart, checkout and login. Optional analytics and marketing cookies only run if you accept them in the cookie banner. You can change your preferences at any time by clearing the cookie or contacting us.

9. Security

We use encryption in transit (HTTPS/TLS), hashed passwords, role-based access controls and regular backups. Access to personal data is limited to authorised staff on a need-to-know basis.

No online service can guarantee absolute security, so we ask you to choose a strong password and keep your account credentials confidential.

10. Children

The Site is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. The latest version is always available on this page with the "last updated" date above. Material changes will be communicated by email or in a banner on the Site.

12. Supervisory authority

Office of the Commissioner for Personal Data Protection
1 Iasonos Street, 1082 Nicosia, Cyprus
www.dataprotection.gov.cy

13. Contact

For any privacy question or to exercise your rights, email us at privacy@koreanglow.shop.