Privacy Policy

- At order (required): recipient's name, phone number, delivery address (including postal code)

- At order (optional): delivery request, preferred delivery date, gift card message, and cash receipt / tax invoice information (mobile phone number or business registration number for bank transfers)

- At payment: payment method details such as card numbers are entered and processed directly on the payment window of the payment agent (Toss Payments), and the Mall does not store them. The Mall only processes the payment approval result (order number, amount, whether approved).

- When requesting cancellation, return, or a claim (required): reason, attached photos

- When ordering live hairtail by bank transfer (required): bank, account holder and account number of the refund account (used only to return your payment if you cancel; the account number is stored encrypted)

- When writing a review (required): author name, rating, review content (available only for the relevant order)

- When requesting a consultation from a subscription manager (required): name, phone number, and consultation content; (optional): email

- When you send a corporate or group gift inquiry (required): company or organization name, contact name, phone number / (optional): email, estimated quantity, preferred timing, budget, message

- When you send an improvement or bug report (required): report type, report content; (optional): the screen or step where you had trouble (only signed-in members can submit, so the report is linked to your member account; to prevent abuse, your IP address is converted into a non-reversible value before it is stored)

- When using social login (required): email and name provided by the provider you choose among Kakao, Naver, Google, and Facebook (the Mall does not collect or store passwords)

- When saving a delivery address after signing in (optional): recipient's name, phone number, delivery address

- When consenting to marketing (optional): whether you agreed to text and email messages, and the date and time of consent or withdrawal

- When using the mobile app: device token for sending push notifications

- When using the chatbot or voice inquiry: your inquiry content (conversation text) and, for voice inquiries, the voice sent for recognition

- When using voice guidance (voice browsing, voice checkout): the recognised text of phrases the guide could not understand (to improve recognition quality; steps where you say your name, phone number, address or card message are not collected, digits are masked, no recordings are stored, and the address of the page where it was said, without query parameters, is saved with it)

- Automatically collected: randomly generated session identifier stored in your browser, pages visited, referral source (UTM, etc.), visit date and time, device and browser information, IP address

- Items stored automatically with an order to measure advertising performance: ad click identifiers (e.g. fbclid, gclid, n_media), advertising providers' cookie values (Meta's _fbp and _fbc), the referral source (UTM) of the first and latest visit, and the IP address and browser information at the time of the order. Name, phone number, address and email are not used for ad performance measurement.

You may use the service, including ordering and delivery, without agreeing to optional items (such as marketing consent).

Unless retention is required by law, we destroy personal information without delay once the purpose of processing is achieved. Under the Act on the Consumer Protection in Electronic Commerce, we retain the following records for the periods below and then destroy them.

- Records on contracts or withdrawal of purchase: 5 years

- Records on payment and supply of goods: 5 years

- Records on consumer complaints or dispute resolution (including consultation and inquiry content): 3 years

- Subscription consultation request records (name, phone number, email, and consultation content): 3 years after the request is handled

- Corporate and group gift inquiry records (company or organization name, contact name, phone number, email, message): 3 years after the inquiry is handled

- Improvement and bug report records (report content, reply, points granted): 3 years after the report is handled

- Refund account information (bank, account holder, account number): the account number and holder name are deleted as soon as the refund is complete (only the last 4 digits are kept with the transaction record for 5 years to match the transfer)

- Records on labeling and advertising: 6 months

- Member information (social login account information, saved delivery addresses): until you withdraw your membership. You can withdraw at any time in My Page and it is processed immediately. Transaction records that must be kept by law are stored separately for the periods above even after withdrawal.

- Marketing consent information: until consent is withdrawn

- App push device tokens: until they become invalid, such as through account withdrawal or app deletion

- Recognised text of phrases the voice guide could not understand, and the page address: kept while it is used to improve voice recognition (not linked to anything that identifies you, such as name, contact details or account; destroyed without delay once improvement ends or the service is discontinued)

- Automatically collected information such as session identifiers and referral sources: destroyed without delay after the statistical purpose is achieved

- IP address, browser information and ad cookie values (Meta's _fbp and _fbc) used for ad measurement: deleted as soon as they have been sent to the advertising provider; if they could not be sent, deleted within 7 days of the order at the latest.

- Ad click identifiers and referral source (UTM) linked to an order: kept for 5 years together with the order record, then destroyed.

The Mall processes personal information only within the purposes stated in Article 1, and provides it to third parties only with the data subject's consent or where Articles 17 and 18 of the Personal Information Protection Act otherwise apply, such as where a law specifically provides for it.

The businesses from which Charong originates are CHEONGJEONGHAE, (주)CHEONGJEONGHAE and 청해람, but no personal information of data subjects is shared or used between those businesses and Charong. Only the customer center phone number shown in the footer is presented together for smooth customer support.

To provide the service smoothly, the Mall outsources the processing of personal information as follows, and sets out and supervises the necessary matters in each contract so that personal information is managed safely. Transfers to overseas businesses are explained separately in Article 6.

To provide the service, the Mall transfers personal information overseas (outsourced processing and storage) as set out below (Article 28-8 of the Personal Information Protection Act). Transfers are made over the information network from time to time, at the moment you use the service. You may refuse overseas transfer, but if you do, you may be unable to use the relevant services (AI chatbot, voice features, app push, email, web access, etc.). To refuse or ask questions, please contact the Privacy Officer in Article 13.

Data subjects may at any time request access, correction, deletion, suspension of processing, and withdrawal of consent regarding their personal information. If you sign in with social login, you can view, edit, and delete your order history and delivery addresses, withdraw marketing consent, and withdraw your membership yourself in My Page (processed immediately). For other requests, including orders placed without signing in, contact the Privacy Officer in writing, by phone, or by email and we will act without delay.

When personal information becomes unnecessary, such as when the retention period has passed or the purpose of processing has been achieved, the Mall destroys it without delay. Where retention is required by law, it is stored and managed separately from other personal information. Personal information stored as electronic files is deleted securely so that it cannot be recovered or reproduced.

Access to personal information is limited to the minimum number of staff, and security technology such as encryption (HTTPS) is applied to communications that contain personal information. Payment method details such as card numbers are processed directly by the payment agent and are not stored on the Mall's servers. Security measures will continue to be improved as the service operates.

The Mall uses automatic collection tools for visit statistics and marketing performance analysis as follows.

- Google Analytics 4: Google's visit analysis tool, which collects page views and usage behavior (uses cookies).

- Advertising pixels: Meta Pixel, TikTok Pixel, Kakao Pixel, Naver conversion tracking (wcs) and Google Ads conversion tracking (Google tag). They send visits, product views, add-to-cart, checkout start and order completion, together with order amounts and product information, to each advertising provider to measure ad performance and show personalised ads to people who have visited (uses cookies). We do not send information that directly identifies you, such as name, phone number, address or email. Only the providers the operator has decided to use are active.

- In-house page view tracking: stores a randomly generated session identifier in your browser's local storage to compile visit statistics.

- Referral source (UTM) storage: stores the referral source at your first visit (for example youtube, instagram, UTM parameters) to analyze marketing performance.

- Server-side ad measurement: when payment for an order is confirmed, the Mall's server sends the purchase (payment amount, purchased products, order identifier) together with the IP address, browser information and Meta cookie values directly to the Meta Conversions API. This is to measure ad performance accurately even when the pixel cannot send a purchase because the browser blocks cookies. Name, phone number, address and email are not sent. Personalised ads can be turned off in Meta Accounts Center > Ad preferences; for any other refusal or inquiry, contact the privacy officer in Article 13.

This information is not combined with information that identifies a specific individual, such as name or contact details.

How to refuse: block cookies or delete site data in your browser settings (for example in Chrome: Settings > Privacy and security > Cookies and other site data); deleting site data also deletes the identifier in local storage. You can refuse Google Analytics collection by installing the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). Advertising pixels can be limited by blocking browser cookies or by turning off personalised ads in each provider's ad settings (Meta: Accounts Center > Ad preferences; TikTok: Settings > Ad personalisation; Google: Ad settings (adssettings.google.com); Kakao and Naver: personalised-ad or ad-preference settings of each service). Refusing collection does not affect your use of ordering, payment, or other services.

- YouTube cooking videos: "Watch cooking videos" on a product page finds videos through YouTube API Services (the Mall's server sends only product-related search keywords, not user information) and plays them in the YouTube embedded player. When you open the cooking-video window and preview images load, or when you play a video, your IP address and device/browser information are sent to Google LLC (YouTube), and playing may set cookies and collect viewing data, governed by Google's Privacy Policy (https://policies.google.com/privacy) and the YouTube Terms of Service (https://www.youtube.com/t/terms). The Mall does not store or use this viewing data. Each video belongs to its creator and is unrelated to the Mall. If you do not wish this, do not open the cooking-video window; you can block cookies in your browser settings.

- Consent items: consent to text messages (SMS) and to email are each optional, and you can use the service, including order and delivery notices, without agreeing. Marketing sent by mobile app push is sent only to devices of members who agreed to marketing (text or email). Allowing notification permission in the app alone is not treated as consent to marketing.

- How to withdraw: you can withdraw consent at any time in My Page, or refuse further messages using the method stated in the email or text message.

- Sending rules: marketing messages are marked '(광고)' (meaning 'advertisement') at the start of the subject or body, and are not sent at night (9 PM to 8 AM Korea time). Transaction-related notices such as orders, delivery, and payment are not marketing and are sent regardless of consent.

The Mall's AI chatbot and voice features use external AI and voice services (Anthropic, Google Gemini, Google Speech-to-Text and Text-to-Speech), and the inquiry content you enter (for voice inquiries, the voice for recognition) is sent to and processed by those providers (see Articles 5 and 6). Do not enter sensitive personal information such as resident registration numbers, card numbers, or passwords in AI consultation. What the AI tells you is for reference; please confirm important matters such as orders and refunds with the customer center.

Privacy Officer: Han Aegyeong

Contact: 064-727-1006 (064-727-1008)

Email: help@charong.co.kr

Address: 30 Dodubong 2-gil, Jeju-si, Jeju Special Self-Governing Province, Republic of Korea (CHEONGJEONGHAE)

Data subjects may direct any personal-information-related inquiry arising from their use of the Mall's services to the Privacy Officer above.

If you need to report or consult about a violation of your personal information, you may contact the following organizations (Korean-language services).

- Personal Information Dispute Mediation Committee: privacy.go.kr / 1833-6972 (no area code needed)

- Personal Information Infringement Report Center: privacy.go.kr / 118 (no area code needed)

- Supreme Prosecutors' Office Cyber Investigation Division: spo.go.kr / 1301 (no area code needed)

- National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182 (no area code needed)

This Privacy Policy takes effect from its effective date. Where content is added, removed, or amended, we will announce the change at least 7 days before it takes effect. However, for important changes affecting data subjects' rights, such as the items collected, purposes of use, provision to third parties, outsourcing, or overseas transfer, we will announce at least 30 days in advance.