Privacy policy
Effective September 13, 2026
PHILANDART STUDIO Inc. processes personal data in accordance with the Personal Information Protection Act that applies to it, and with this policy. This store runs on the platform of Shopify Inc., so providing the service requires some personal data to be transferred outside Korea; section 6 sets out the detail.
1. Purposes
We process personal data to complete and deliver orders, handle payments and refunds, operate accounts, respond to enquiries and complaints, operate the community wall, run purchase-linked events such as the video call draw, keep the service secure, and — with your separate consent — send marketing email.
2. What we collect
Orders and delivery (required) — name, email address, phone number, delivery address, order contents, payment record.
Account (required) — email address, display name.
Marketing email (optional) — email address. You may refuse; refusing does not affect your ability to order.
Community wall — the nickname and text you post, a hashed form of the PIN you set, and a one-way hashed form of your IP address. The hash is salted with a secret key and used only for rate limiting and abuse handling. We do not store your IP address in readable form and cannot recover it.
Video call event (winners) — the name and email address on the order, the messenger or platform ID needed to connect the call, and, where the winner is under the age of majority, written guardian consent. Used only to run the event and deleted once it is complete, except where law requires us to keep order records.
Collected automatically — access logs, cookies, browser and device information, service use records.
We do not collect resident registration numbers, and we do not knowingly collect data from anyone under 14. We do not use your data for automated decision-making or profiling.
3. Retention
We erase personal data without delay once its purpose is achieved, except where law requires us to keep it:
| Record | Period | Basis |
|---|---|---|
| Contracts and withdrawal | 5 years | Act on Consumer Protection in Electronic Commerce |
| Payment and supply of goods | 5 years | same |
| Consumer complaints and disputes | 3 years | same |
| Website visit records | 3 months | Protection of Communications Secrets Act |
Community posts are kept while the wall operates. Deleted posts are hidden immediately and purged on a rolling basis.
4. Disclosure to third parties
We do not disclose personal data to third parties except with your separate consent, where the law requires it, in an emergency affecting life, body or property where consent cannot be obtained, or where an investigative authority requests it under the procedures the law prescribes.
5. Processors
| Processor | What they do |
|---|---|
| Shopify Inc. | Store platform, checkout, order management |
| PayPal / card networks | Payment processing |
| Supabase Inc. | Community wall database and functions (hosted in the Seoul region, Republic of Korea) |
| Cloudflare Inc. | Domain registration and DNS |
| Google LLC | Business email |
| International postal and courier services | Delivery |
Each processes personal data only as needed to provide its service to us, under a contract that requires confidentiality and security.
6. International transfers
| Recipient | Country | Data | Purpose | Retention |
|---|---|---|---|---|
| Shopify Inc. | Canada, United States | Order, delivery, payment data | Store and checkout | While the store operates |
| PayPal | United States and others | Payment data | Payment processing | Per PayPal's policy |
| Cloudflare Inc. | United States and others | IP address, request data | Domain DNS resolution | Short-term, per Cloudflare's policy |
| Google LLC | United States | Email content, sender data | Business email | While the account exists |
Community wall data is held by Supabase Inc. in its Seoul region, within the Republic of Korea, and is not transferred abroad. The transfers in the table above are made at the time of order or of use, over an encrypted connection. You may refuse this transfer by contacting us — but payment, delivery and hosting all depend on these services, so refusing means we cannot complete an order.
Where we transfer the personal data of a data subject located in the European Economic Area or the United Kingdom outside that territory, we rely on a recognised transfer mechanism, such as the European Commission's Standard Contractual Clauses.
7. Destruction
Data whose retention period has expired or whose purpose has been achieved is destroyed within 5 days, under the approval of the person responsible for personal data protection. Electronic files are erased so that they cannot be recovered; printed material is shredded or incinerated.
8. Your rights
You may ask us to give you access to your data, correct it, delete it, stop processing it, transfer it, or explain and refuse an automated decision. Email manager@philandart.com. We act within 10 days. You may act through a representative with written authority. Where law requires us to keep transaction records, we keep those for the periods in section 3 even after a deletion request.
We do not discriminate against you for exercising any of these rights.
Marketing opt-out. You can stop marketing email at any time using the unsubscribe link at the foot of any such message. Opting out does not stop the messages we must send to perform the contract, such as order confirmations and shipping notices.
For personal data processed by Shopify Inc., and for how Shopify handles personal data, see Shopify's consumer privacy policy and Shopify's privacy portal.
9. Security
Administrative — internal plan, limited access, staff training. Technical — access control, encryption of credentials and of sensitive fields, access logging, security software. Physical — controlled access to systems and any physical records.
Community PINs are stored as a salted PBKDF2-SHA256 hash, never in plain text. IP addresses are stored only as a peppered one-way hash.
No transmission over the internet can be guaranteed completely secure. Please do not share your account credentials with anyone.
10. Cookies
We use cookies necessary for the store to work — cart, session, security. Analytics cookies are used only with your consent, and you may withdraw consent at any time in your browser settings. Blocking necessary cookies may prevent checkout from working.
Where your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt that browser and device out of targeted advertising.
11. Person responsible
Personal data protection officer: Shin Changkwon, Representative Director · manager@philandart.com
Requests are received and handled at manager@philandart.com.
12. Where to complain
Korea Internet & Security Agency Privacy Complaint Centre — 118, privacy.kisa.or.kr
Personal Information Protection Commission — pipc.go.kr
Supreme Prosecutors' Office Cybercrime — 1301, spo.go.kr
National Police Agency Cyber Bureau — 182, ecrm.police.go.kr
13. Changes
Any change is announced on this page at least 7 days before it takes effect, or 30 days where the change is unfavourable to you.