This Privacy Policy explains how CHOI&CHOI Gallery (초이앤초이 갤러리, “we”, “us”) processes personal data when you use our online store at https://choiandchoistore.com (the “Store”). It is written to meet the Korean Personal Information Protection Act (PIPA) and the EU General Data Protection Regulation (GDPR). The Korean version (개인정보처리방침) prevails for customers in Korea.
1. Controller
CHOI&CHOI Gallery (초이앤초이 갤러리)
Representative: 최진희
Business registration no.: 448-36-00540
Address: 서울특별시 서대문구 연희로11가길 48-10, B동 G.F층 2호(연희동, 파크먼트연희), Republic of Korea
Phone: +82 70 7739 8808
Email: info@choiandchoi.com
Privacy officer: 최진희 (contact as above)
2. Data we collect
- When you order: name, email address, phone number, shipping and billing address, order details.
- Payment data: card numbers and other payment-method details are entered in the payment provider’s own payment window and processed by that provider. We do not store them; we receive only the payment result (authorisation number, date, amount).
- When you contact us: name, email address, message.
- Newsletter (optional): name, email address.
- Customer account (optional): email address, name, password (stored encrypted).
- Automatically: IP address, cookies, access time, browser information, usage records.
3. Purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6(1)) |
|---|---|
| Processing your order, payment, delivery and refunds | (b) performance of a contract |
| Customer service and handling disputes | (b) contract; (f) legitimate interests |
| Keeping records required by law (tax, e-commerce) | (c) legal obligation |
| Security, fraud prevention, access logs | (f) legitimate interests in a secure store |
| Newsletter | (a) consent, which you can withdraw at any time |
4. Retention
- Contract, withdrawal, payment and delivery records: 5 years (Korean Act on Consumer Protection in Electronic Commerce).
- Consumer complaints and disputes: 3 years (same Act).
- Records of advertising: 6 months (same Act).
- Access logs: 3 months (Korean Protection of Communications Secrets Act).
- Newsletter: until you unsubscribe. Customer account: until you delete it.
After these periods, data is deleted in a way that cannot be restored.
5. Recipients
Delivery: DHL (DHL Korea and the DHL company in the destination country) receives the recipient’s name, phone number, email, delivery address and order contents to deliver your order and clear customs.
Service providers (processors):
- PortOne Inc. (Korea) — payment integration
- KG Inicis Co., Ltd. (Korea) — Korean card and wallet payments
- Eximbay Inc. (Korea) — payments with cards issued outside Korea
- PayPal Pte. Ltd. (Singapore) — PayPal payments
- Hostinger International Ltd. — website hosting, data storage and email sending (servers in Düsseldorf, Germany)
6. International transfers
We are based in the Republic of Korea. The European Commission has recognised Korea as providing an adequate level of data protection (adequacy decision of 17 December 2021), so personal data can be transferred from the EU to us. Our Store is hosted in Germany (EU). Payment and delivery data is transferred to the countries listed in section 5, to PayPal’s group servers, and to international card networks (Visa, Mastercard, JCB, American Express, UnionPay) when you pay with a foreign card. These transfers are necessary to perform your order (GDPR Art. 49(1)(b)) or are covered by the providers’ standard contractual clauses.
7. Your rights
You have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data deleted, unless we must keep it by law;
- restrict processing;
- data portability (receive your data in a machine-readable format);
- object to processing based on legitimate interests;
- withdraw consent at any time, without affecting earlier processing.
To exercise these rights, email info@choiandchoi.com. We respond within one month. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work. Customers in Korea can contact the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr) or the KISA Privacy Infringement Report Center (118, privacy.kisa.or.kr).
8. Cookies
We use only cookies needed for the Store to work: keeping your cart, keeping you logged in, and processing payments. We do not use advertising cookies or third-party analytics. You can block cookies in your browser settings, but the cart and checkout may then not work.
9. Security
The whole Store uses encrypted connections (HTTPS). Passwords are stored encrypted, payment-method details are never stored by us, administrator access is restricted, and data is backed up and software kept up to date.
10. Changes
This policy is effective from 8 October 2026. We announce changes on the Store at least 7 days before they take effect (30 days for significant changes to your rights).