Privacy Policy
1. Personal information controller and scope
EVA CODE (website https://evacode.co.kr, business registration number 209-28-95980, representative KIM VALENTINA, address 경기도 안산시 단원구 별망로 555, 4층 420호) processes personal information in accordance with applicable law for website visits, account management, orders, payments, domestic and international delivery, and customer support. Privacy inquiries: orders@evacode.co.kr, telephone +82 10-7652-8595.
This is the Korean seller's primary Privacy Policy. It does not exclude data protection laws that may apply to consumers outside Korea. Where EU/EEA, Russian or other regional legislation applies, additional notices and procedures will be provided.
2. Processing purposes and categories of personal information
| Purpose | Information that may be processed | Legal basis and notes |
|---|---|---|
| Account management | Login identifiers, email, information needed to verify passwords and contact details supplied at registration | Providing the account service and protecting account security |
| Orders and contract performance | Name, contacts, shipping address, country, postal code, products, quantity, amount and order status | Relevant basis under Article 15 of PIPA, including conclusion and performance of a contract |
| Payments and refunds | Payment method type, authorization status, transaction identifier, refund and dispute records | Payment reconciliation, contractual performance and legal duties |
| Delivery and customs | Recipient, contact details, delivery address, tracking number and legally required customs information | Shipping and contract performance; mandatory destination-country requirements |
| Support and returns | Inquiries, order details, reasons for returns, necessary product photographs and evidence | Contract performance, legal duty or another lawful basis |
| Security | IP addresses, access and authentication logs, error and incident logs, device or session identifiers | To maintain security where a proper legal basis exists |
| Marketing and analytics | Email, phone number, optional tracking identifiers and records of subscriptions and cookie preferences | Separate purpose-based notice and consent where required |
EVA CODE does not routinely require health information, date or place of birth, sex or identity documents as mandatory details for an ordinary cosmetics purchase without a separate lawful basis. If the customer submits information about an allergy or skin reaction, the Company processes it only when necessary, legally justified and subject to appropriate safeguards.
Internal business analysis and service improvement. Within lawful purposes, EVA CODE uses information on orders, sales, products and inventory, amounts and statuses of payments, deliveries, returns, customer inquiries, website errors and service operations for accounting, purchasing plans, customer service improvements, detecting repeat payment claims and fraud prevention. Aggregated or de-identified statistics are used where practicable. Identifiable information is processed only to the extent necessary, on a lawful basis and by authorized personnel. Such information is not sold to external organizations or made available to independent advertising companies for their own purposes without a proper lawful basis.
3. Retention and processing periods
Personal information is processed for the period necessary to fulfill the relevant purpose. Records subject to mandatory retention under South Korean e-commerce law are retained separately. The following periods apply to the listed record categories:
| Record type | Period |
|---|---|
| Records of contracts, orders and withdrawals | 5 years |
| Payments and supply of goods | 5 years |
| Consumer complaints and dispute resolution | 3 years |
| Advertising and advertisements | 6 months |
Account data, marketing preferences, cookies, security logs, delivery records and consent evidence are not all automatically retained for five years. Retention is limited to the applicable purpose, legal duties and properly justified needs to protect the parties’ rights.
4. Disclosure to independent third parties
The Company discloses only necessary personal information to third parties where supported by law, valid consent or another applicable condition. Whether a payment provider, carrier or customs agent is an independent controller or a contracted processor depends on its actual agreements and processing purposes.
Customer, order and sales information is used primarily to operate EVA CODE's business. The Company does not sell customer databases, purchase history or payment records, and it does not provide them to independent marketing companies for unrelated purposes without a proper lawful basis. This does not exclude disclosures necessary to fulfil orders to banks and payment providers, shipping and customs partners, or legally required disclosures to competent authorities. Each disclosure is subject to an appropriate lawful basis and data minimization.
5. Outsourcing of personal information processing
Where processing is entrusted to hosting, technical support or communications providers, the Company follows the statutory requirements for outsourcing, security and oversight.
Service providers performing technical maintenance, data hosting, order processing or other delegated functions may access personal information only within the scope of a documented engagement. They are not authorized to use customers' personal information for their own independent purposes. EVA CODE applies contractual obligations concerning confidentiality, security and oversight of subcontractors as required by applicable law.
6. International data storage and processing
EVA CODE uses data-processing and storage infrastructure located partly outside the Republic of Korea, including the Russian Federation. This infrastructure processes information needed for account administration, orders, payment status, delivery and customer inquiries. For personal information collected in Korea, this involves overseas storage and, depending on the actual service arrangements, outsourced processing abroad.
EVA CODE handles international disclosure, outsourced processing and storage of personal information in accordance with Article 28-8 of PIPA. Where overseas outsourcing or storage is necessary to perform a contract, the Company relies on an applicable statutory basis and provides the required notice. Transfers requiring a separate consent are subject to that separate consent. Sharing information with an independent overseas recipient requires its own lawful basis.
A notice about overseas processing or acceptance of general terms does not constitute blanket consent for every international data transfer. Additional international transfers to payment processors or couriers must also be disclosed separately where applicable.
Protection of the Company's lawful interests. EVA CODE processes information relating to specific orders, payment confirmations and transaction identifiers, packing, dispatch, delivery evidence, returns, customer communications and documented disputed transactions to verify contractual performance, identify repeated use of payment evidence, prevent improper refunds and chargebacks, resolve complaints and establish or defend claims. Such processing requires a lawful basis under Article 15 of PIPA or other applicable law, is limited to what is necessary and is retained only for a justified period. Case-specific dispute records are kept separate from marketing use. Necessary evidence may be disclosed to banks, payment providers, delivery partners, authorities and courts where there is a proper lawful basis.
7. Destruction procedures and methods
When a processing purpose has been fulfilled or a retention period expires, information no longer required by law is promptly destroyed. Electronic records are securely deleted in a manner that makes recovery difficult, while paper records are destroyed by shredding or other appropriate methods. Records of transactions and disputes that must be retained are separated from marketing and access is restricted.
8. Rights of data subjects and legal representatives
Subject to applicable law, individuals may request access, correction, deletion, suspension of processing, withdrawal of consent and other statutory rights. The rights of legal representatives are governed by applicable law. Send requests to orders@evacode.co.kr. Proportionate identity verification may be performed where necessary. If specific information must be retained under a legal duty or another lawful basis, the Company explains the relevant limits. Withdrawing optional marketing consent does not automatically stop processing needed to fulfill an outstanding order.
9. Security measures
EVA CODE applies risk-appropriate safeguards for personal information, including access controls, account protection, secure transfer and storage, access logging, backup and recovery, incident response, and contractor oversight.
10. Cookies, analytics and personalized advertising
EVA CODE uses cookies needed for cart functions, sign-in and security. Where analytics, advertising or profiling technologies are used, the Company discloses their providers, data categories, purposes, processing countries, retention periods and available opt-out methods, and obtains separate prior consent when required by law.
11. Privacy inquiries and contact details
- Name displayed on the Website: EVA CODE
- Business registration number: 209-28-95980
- Representative: KIM VALENTINA
- Address: 경기도 안산시 단원구 별망로 555, 4층 420호
- Privacy inquiries: orders@evacode.co.kr
- Telephone: +82 10-7652-8595
- Contact for personal information inquiries and complaints: EVA CODE Customer Support (orders@evacode.co.kr, +82 10-7652-8595)
Individuals may seek remedies or dispute resolution through the competent bodies designated by applicable law.
12. Changes to the Policy and effective date
The effective date and any revisions are published on the Website. Where purposes, recipients or legal bases change materially, the Company provides required notices or obtains new consent when necessary. Historical versions and lawfully retained consent and withdrawal records are kept to the extent necessary.
- Effective from the date of publication on the Website.
- Related documents: Optional Consent Notice · Terms of Sale and Use · Business Details