Privacy policy

1. General provisions

Osmere (the "Company") complies with the Personal Information Protection Act and other relevant legislation in order to protect the freedom and rights of data subjects, and processes personal data lawfully and securely.

This Privacy Policy applies to the official domestic online store operated by the Company (kr.osmere.com) and to services incidental to it. The processing of personal data in connection with international delivery or international payment is governed by the separate policy published at osmere.com.


2. Purposes, items, legal basis and retention periods

The Company processes the minimum personal data necessary for the purposes set out below.

[Orders and order management]

  • Purpose and basis : order confirmation, performance of the contract, order enquiries, customer service / conclusion and performance of a contract
  • Items : name of the person ordering, mobile telephone number, email, delivery address details, order number, order history
  • Retention period : destroyed without delay once the purpose is achieved, subject to statutory retention periods

[Account registration and account management]

  • Purpose and basis : member identification, creation and maintenance of an account, notices, prevention of misuse / conclusion and performance of a contract, or consent
  • Items : name, email address, mobile telephone number, sign-in credentials (email-based account identifiers and one-time verification codes)
  • Retention period : until the member withdraws, save where a statutory retention period applies or retention is required to prevent misuse, for that period

[Payment and refunds]

  • Purpose and basis : payment authorisation, cancellation and refund, management of transaction records / conclusion and performance of a contract and statutory obligations
  • Items : payment method identifiers, payment authorisation and cancellation data, refund-related data, order data
  • Retention period : the retention period prescribed by the relevant legislation

[Delivery, exchanges and returns]

  • Purpose and basis : delivery of goods, collection, exchanges and returns, handling of delivery enquiries / conclusion and performance of a contract
  • Items : recipient name, contact details, delivery address, order number, delivery and return records
  • Retention period : destroyed without delay once the purpose is achieved, subject to statutory retention periods

[Order and delivery notifications]

  • Purpose and basis : sending notices concerning order confirmation, dispatch, cancellation and refunds / conclusion and performance of a contract
  • Items : name, mobile telephone number, order number, order and delivery data
  • Retention period : destroyed without delay once the purpose is achieved

[Customer enquiries and dispute handling]

  • Purpose and basis : responding to enquiries, handling complaints, responding to disputes / conclusion and performance of a contract and legitimate interests
  • Items : name, contact details, email, order data, content of the enquiry, attachments
  • Retention period : 3 years after the enquiry closes, or until the dispute is resolved

[Service use and security]

  • Purpose and basis : operation of the website, error analysis, security, prevention of misuse / legitimate interests or statutory obligations
  • Items : access IP address, cookies, access and usage records, browser and device information, error and security logs
  • Retention period : ordinarily 3 months after use of the service ends, save where legislation or incident response requires that period to be extended

[Marketing and events]

  • Purpose and basis : information about new products and collections, benefits and events / separate consent (including consent to receive messages given by adding the KakaoTalk channel)
  • Items : name, mobile telephone number, KakaoTalk channel friend status, record of marketing consent
  • Retention period : until consent is withdrawn, the channel is blocked or deleted, or the member withdraws

[Behavioural analytics and advertising]

  • Purpose and basis : visit analysis, analysis and improvement of website usability (heatmaps and session replay), measurement of advertising performance / consent or the scope permitted by legislation
  • Items : visit, click, search and purchase conversion records, records of interaction within a page such as mouse movement, clicks and scrolling and session replay data with typed input masked, online identifiers, cookies and advertising identifiers
  • Retention period : until consent is withdrawn, cookies are deleted, or the purpose is achieved

As a rule the Company does not collect sensitive data concerning beliefs, convictions or health, nor unique identifiers such as resident registration numbers.


3. Retention of personal data under the relevant legislation

The Company destroys personal data without delay once the purpose of processing has been achieved. Where retention is required under the relevant legislation, the data is stored separately from other personal data as follows.

  • Records on labelling and advertising : 6 months (Act on Consumer Protection in Electronic Commerce)
  • Records on contracts and withdrawal of subscription : 5 years (Act on Consumer Protection in Electronic Commerce)
  • Records on payment and the supply of goods : 5 years (Act on Consumer Protection in Electronic Commerce)
  • Records on consumer complaints or dispute handling : 3 years (Act on Consumer Protection in Electronic Commerce)
  • Access records : 3 months (Protection of Communications Secrets Act)


4. Provision of personal data to third parties

The Company processes personal data within the scope of the purposes set out in this Policy, and does not provide it to third parties except with the separate consent of the data subject or on a statutory basis.

The parties listed in Article 5 process personal data in order to carry out the Company's business and are processors; they do not constitute third-party provision under this Article.

Information is passed to Meta Platforms, Inc. and to Microsoft Corporation only where the user has consented in the cookie banner to advertising cookies or analytics cookies respectively, and it stops immediately when consent is withdrawn.

The Company provides personal data to the following third party for the analysis of website usability.

[Website usage analytics — third-party provision]

  • Recipient : Microsoft Corporation (Microsoft Clarity)
  • Purpose : analysis and improvement of website usability (heatmaps and session replay). Microsoft is an independent controller that also processes the information it receives for its own purposes, including improving its products and services and Microsoft Advertising, under the Microsoft Privacy Statement.
  • Items provided : access IP address (used to estimate an approximate region), browser and device information, pages visited and records of interaction within a page such as mouse movement, clicks and scrolling, session replay data with typed input masked, cookie identifiers
  • Retention and use period : session replay data 30 days; click and heatmap aggregate data 9 months (Microsoft Clarity data retention policy). Collection stops once consent is withdrawn.
  • Right to refuse and consequences : you may decline analytics cookies in the cookie banner. Refusing does not restrict your use of essential services such as ordering, payment and delivery.


5. Delegation of personal data processing

  • Shopify Inc. and Shopify affiliates and sub-processors — online store platform, account and order management, hosting, security, technical support, service improvement and personalisation, and improving advertising performance — account, contact, order and delivery data, service usage and device data
  • Toss Payments Co., Ltd. — payment authorisation, cancellation and refund, and prevention of fraudulent transactions — payment method identifiers, payment authorisation and cancellation data, order data
  • CJ Logistics Corporation — delivery of goods, collection of returns and exchanges, delivery tracking — recipient name, contact details, delivery address, order and delivery data
  • Seoul Commerce — sending KakaoTalk notification and friend messages (order and delivery notices and marketing messages) — name, mobile telephone number, order and delivery data, KakaoTalk channel friend status
  • Meta Platforms, Inc. — measuring advertising performance and providing tailored advertising (only where the user has consented to advertising cookies) — online identifiers (cookies and advertising identifiers), visit, click and purchase conversion records, browser and device information, and the customer's name, email address and telephone number in hashed form

When concluding a delegation agreement, the Company sets out in writing the prohibition on processing for any other purpose, measures to ensure security, restrictions on sub-delegation, the return or destruction of personal data when the delegation ends, the management and supervision of the processor, and liability for damages. Where the delegated work or the processor changes, the Company discloses this through this Policy.

This store is hosted on the Shopify platform, and Shopify processes personal data when a user visits the store or places an order. That processing includes using records of the user's interactions with other Shopify merchants and with Shopify in order to improve service quality, personalisation and advertising performance. In the course of it, personal data may be passed to Shopify and to third parties that may be located outside Korea. This processing takes place only where the user has consented to advertising cookies, and consent may be withdrawn at any time from the cookie banner. Shopify's processing is described in Shopify's own privacy policy.


6. Transfer of personal data overseas

The Company transfers personal data overseas as set out below, in order to operate its online store, to measure advertising performance and to analyse website usage.

[Store operation — delegated processing and storage]

  • Recipient : Shopify Inc. (151 O'Connor Street, Ground floor, Ottawa, Ontario K2P 2L8, Canada / privacy@shopify.com) and Shopify affiliates and sub-processors
  • Countries of transfer : the United States (storage) and the countries in which Shopify affiliates and sub-processors are located, including Canada
  • Basis of transfer : delegation of processing and storage for the conclusion and performance of a contract under Article 28-8(1)3 of the Personal Information Protection Act. Matters relating to the overseas transfer are disclosed through this Policy.
  • Items transferred : account, contact, order and delivery data, customer enquiries, access and usage records, browser and device information
  • Purpose, timing and method of transfer : store operation, hosting, account and order management, security and technical support / transferred as required over the information and communications network at the time of registration, ordering or use of the service
  • Additional purpose of transfer : service improvement and personalisation, and improving advertising performance, using records of the user's interactions with other Shopify merchants and with Shopify. Transfers for this purpose are made on the basis of the data subject's separate consent under Article 28-8(1)1 of the Personal Information Protection Act, and consent may be declined or withdrawn at any time from the cookie banner.
  • Retention period : until the member withdraws, the purpose of processing is achieved, or the delegation agreement ends; statutory records are retained for the applicable retention period
  • Sub-processors : the current list is available in the "Subprocessors" document in the Shopify Help Center.
  • Refusal and its effect : this overseas transfer is a delegation of processing and storage necessary to operate the store and fulfil orders. If you refuse it, use of some services, including account creation, ordering, payment and delivery, may be restricted.

[Advertising measurement and tailored advertising]

  • Recipient : Meta Platforms, Inc. (1601 Willow Road, Menlo Park, CA 94025, USA)
  • Country of transfer : the United States
  • Basis of transfer : the data subject's separate consent under Article 28-8(1)1 of the Personal Information Protection Act
  • Items transferred : online identifiers (cookies and advertising identifiers), visit, click and purchase conversion records, browser and device information, and the customer's name, email address and telephone number in hashed form
  • Purpose, timing and method of transfer : measuring advertising performance and providing tailored advertising / transferred as required over the information and communications network while a consenting user is using the service
  • Retention period : until consent is withdrawn, or for the period set out in the recipient's own privacy policy
  • Refusal and its effect : you may decline advertising cookies in the cookie banner, or withdraw your consent at any time. You may also refuse through your browser's cookie settings, or by resetting your advertising identifier. Refusing does not restrict your use of essential services such as ordering, payment and delivery.

[Website usage analytics]

  • Recipient : Microsoft Corporation (One Microsoft Way, Redmond, Washington 98052, USA / privacy enquiries : Microsoft Privacy at the address above, or the enquiry form in the Microsoft Privacy Statement / Clarity enquiries : clarityms@microsoft.com)
  • Country of transfer : the United States (Microsoft Azure cloud). Under the Microsoft Privacy Statement the data may also be processed in other countries where Microsoft or its affiliates operate facilities.
  • Basis of transfer : the data subject's separate consent under Article 28-8(1)1 of the Personal Information Protection Act
  • Items transferred : access IP address (used to estimate an approximate region), browser and device information, pages visited and records of interaction within a page such as mouse movement, clicks and scrolling, session replay data with typed input masked, cookie identifiers
  • Purpose, timing and method of transfer : analysis and improvement of website usability (heatmaps and session replay) / transferred as required over the information and communications network while a user who has consented to analytics cookies is using the service
  • Retention period : session replay data 30 days; click and heatmap aggregate data 9 months (Microsoft Clarity data retention policy). Collection stops once consent is withdrawn, and information already transferred is deleted when those periods expire.
  • Refusal and its effect : you may decline analytics cookies in the cookie banner, or withdraw your consent at any time. Refusing does not restrict your use of essential services such as ordering, payment and delivery.


7. Destruction of personal data

Personal data is destroyed without delay once the retention period has elapsed or the purpose of processing has been achieved. Electronic files are deleted by a method that makes recovery or reproduction impossible, and paper documents are shredded or incinerated.


8. Rights of data subjects and how to exercise them

A data subject may at any time exercise the right to access, correct or delete their personal data, to suspend its processing, to withdraw consent, and any other right provided for by legislation. Members may amend some of their information directly, or withdraw consent to receive messages, on their account page.

Rights may be exercised by making a request in writing or by email to the Personal Information Protection Officer named in Article 12, and the Company will act on it without delay once it has verified the requester's identity. Where legislation restricts the request, the Company will explain the reason.

The Company does not carry out processing that has a significant effect on a data subject on the basis of a wholly automated decision.


9. Cookies, behavioural data and tailored advertising

The Company may use cookies and other automatic collection devices to provide convenience of use, security, visit analysis and service improvement. Essential cookies are used to provide the service, including sign-in, the cart and security. Analytics and advertising cookies are used after consent has been obtained where legislation requires consent.

Where you have consented to advertising cookies, the Company collects the following information through the Meta Pixel and transmits it to Meta Platforms, Inc.

  • pages visited, time spent, and the path by which you arrived
  • conversion actions such as adding to cart and completing a purchase
  • browser and device information, and approximate regional information
  • online identifiers such as cookies and advertising identifiers
  • your name, email address and telephone number, in hashed form, so that Meta can match you to an existing account without receiving these details in readable form

The information collected is used only to measure advertising performance and to provide tailored advertising. You may refuse or withdraw in any of the following ways.

  • decline advertising cookies in the cookie banner, or withdraw your consent
  • block third-party cookies in your browser settings
  • limit tailored advertising in your Meta account's ad preferences

Where you have consented to analytics cookies, the Company collects the following information through Microsoft Clarity, in order to understand how visitors use the store (heatmaps and session replay), and transmits it to Microsoft Corporation.

  • pages visited, time spent, and the path by which you arrived
  • records of interaction within a page, such as mouse movement, clicks and scrolling, and a replay of the screen built from them
  • browser and device information, and approximate regional information estimated from your IP address
  • cookie identifiers set by Clarity : _clck and _clsk (on our domain); CLID, MUID, MR, SM and ANONCHK (on Microsoft domains)

Anything you type into a form, such as your name, address or payment details, is masked and is not collected, and the Company applies the setting that masks on-page text as well. The Company uses this information only to analyse and improve website usability. Microsoft, however, may also use the information collected for its own purposes, including improving its products and services and Microsoft Advertising, under the Microsoft Privacy Statement; MUID is a cookie Microsoft also uses for advertising. You may refuse or withdraw in any of the following ways.

  • decline analytics cookies in the cookie banner, or withdraw your consent
  • block third-party cookies in your browser settings
  • limit personalised advertising in Microsoft's ad settings (account.microsoft.com/privacy/ad-settings)

You may refuse or delete non-essential cookies in your browser settings. If you do, you can still use the store in the ordinary way, but some functions, such as staying signed in and the cart, may be limited.

  • Chrome : Settings > Privacy and security > Third-party cookies
  • Safari : Settings > Privacy > Cookies and website data
  • Edge : Settings > Cookies and site permissions


10. Measures to secure personal data

  • Establishment of an internal management plan and training of staff who handle personal data
  • Minimisation and periodic review of access rights, and access control
  • Encryption in transit (SSL) and protection of credentials
  • Retention and inspection of access records
  • Contractual protective measures for processors, and their management and supervision


11. Personal data of children under the age of 14

The Company's services are not directed at children under the age of 14. Where it is necessary to process the personal data of a child under 14, the Company follows the procedures required by the relevant legislation, including obtaining the consent of a legal representative.


12. Personal Information Protection Officer and complaints

  • Personal Information Protection Officer : Seongchan An
  • Receipt and handling of access requests : Customer Support
  • Email : contact@osmere.com
  • Telephone : +82-2-6352-1028
  • Address : 11F, Unit 1125, 264 Eulji-ro, Jung-gu, Seoul 04561, Republic of Korea

Enquiries about personal data, complaints and requests for redress may be submitted to the contact details above, and the Company will respond and act without delay.


13. Remedies for infringement of rights

  • Personal Information Infringement Report Centre : privacy.kisa.or.kr / 118 (no area code)
  • Personal Information Dispute Mediation Committee : kopico.go.kr / 1833-6972
  • Supreme Prosecutors' Office : spo.go.kr / 1301 (no area code)
  • National Police Agency : ecrm.police.go.kr / 182 (no area code)


14. Changes to this Privacy Policy

The Company may amend this Policy in line with changes to the relevant legislation, to the service, or to the way personal data is processed. Where a material change is made, notice is given at least 30 days before the effective date; for other changes, at least 7 days before, through a store notice or a separate announcement.

This Privacy Policy takes effect on 15 September 2026.


This English text is a translation provided for convenience. The Korean version is the binding text; in the event of any discrepancy, the Korean version prevails.