Haebal Coffee Roasters (“we” or the “roastery”) maintains this privacy policy to protect users’ personal information under the Korean Personal Information Protection Act (PIPA) and to handle related complaints promptly.
This policy applies to the personal information we process for orders, the roast-day subscription, returns, and customer service in the store. We do not have a membership program.
1. Purposes of processing
#We process personal information only for the purposes below. If a purpose changes, we tell you in advance and ask again for any consent that is required.
- Receiving orders, confirming payment, and delivering products
- Charging and shipping roast-day subscription deliveries, and sending notices of upcoming charges
- Handling withdrawals of orders, returns, and refunds
- Responding to inquiries and complaints
- Site security checks (access logs)
2. Personal information we process
#Because we have no membership program, we collect only the recipient’s details on the checkout form. We do not collect resident registration numbers or sensitive information, and we do not accept orders from children under 14.
We process the “Required” items below without consent because they are necessary to perform the contract of taking and shipping your order (Article 15(1)4 of PIPA). We use the “Optional” items for the same purposes only if you fill them in. We process no items on the basis of consent.
| Category | Required | Optional |
|---|---|---|
| Orders | Recipient’s name, phone number, and address (including postal code and detailed address) | Delivery note, gift message card |
| Payment | Payment method type, payment approval number, amount paid (card numbers are handled by the payment service provider, and we do not receive them) | None |
| Roast-day subscription | Recipient’s details, subscription contents and frequency, a payment identifier for automatic billing (a value issued by the payment service provider, not a card number) | None |
| Returns and inquiries | Name, phone number or email address, order number, details of the request | Photos of the product |
| Automatically generated information | IP address, access time, browser information (access logs) | None |
3. Processing and retention periods
#We destroy personal information without delay once its purpose has been fulfilled. However, records that the law requires us to keep are stored separately for the periods below.
- Roast-day subscription information: until you cancel (payment and supply records after cancellation are kept for 5 years, as above)
| Record | Retention period | Legal basis |
|---|---|---|
| Records on contracts or withdrawals of orders | 5 years | Article 6 of the Enforcement Decree of the Korean E-Commerce Act |
| Records on payment and the supply of goods | 5 years | Article 6 of the Enforcement Decree of the Korean E-Commerce Act |
| Records on consumer complaints or dispute handling | 3 years | Article 6 of the Enforcement Decree of the Korean E-Commerce Act |
| Records on labeling and advertising | 6 months | Article 6 of the Enforcement Decree of the Korean E-Commerce Act |
| Access logs | 3 months | Korean Protection of Communications Secrets Act |
4. Provision to third parties
#We do not provide your personal information to third parties. The only exceptions are cases where a law specifically provides for it or an investigative agency requests it through a procedure set by law.
5. Outsourcing of processing
#To process orders smoothly, we outsource the tasks below. Our outsourcing contracts state that personal information may not be used beyond the outsourced task and include security measures and limits on further outsourcing, and we check that each contractor complies.
| Contractor | Outsourced task |
|---|---|
| Payment service provider | Payment processing, automatic billing for the roast-day subscription |
| Parcel delivery company | Product delivery |
| Notification service provider | Sending text messages about shipping and upcoming charges |
| Cloudflare, Inc. | Site hosting and security (access logs). See section 6 for overseas transfer |
As a demo store, we have not listed the real names of the payment service provider, parcel delivery company, or notification service provider.
6. Overseas transfer and overseas collection
#We do not transfer order or subscription information outside Korea.
However, because Cloudflare, the contractor listed in section 5, delivers the site through servers in many countries, the access logs created when you visit may be processed on servers outside Korea. This is outsourced processing necessary to perform the contract of showing you the site, and we disclose the details below in this policy accordingly (Article 28-8(1)3 of PIPA). Cloudflare processes this information only within the scope of the tasks we have entrusted to it.
We do not directly collect personal information of users in Korea from outside Korea.
| Item | Details |
|---|---|
| Recipient | Cloudflare, Inc. (contact: the privacy contact listed in the privacy policy on cloudflare.com) |
| Destination countries | The United States and other countries where Cloudflare has servers |
| Time and method of transfer | Sent over the network each time you visit the site |
| Information transferred | IP address, access time, browser information (access logs) |
| Purpose of use | Delivering and securing the site |
| Retention and use period | 3 months (the retention period for access logs in section 3) |
| How to refuse, and the consequences | You can refuse by not visiting the site. Without this transfer, we cannot show you the site. If you refuse, you cannot use the site. |
7. Destruction procedures and methods
#We destroy personal information within 5 days after its retention period ends or its purpose has been fulfilled. We delete electronic files by a method that makes them unrecoverable, and we shred paper documents such as shipping labels.
Records we keep as required by law are stored separately from other information and destroyed in the same way when their period ends.
8. Sensitive and pseudonymized information
#We do not collect sensitive information, and we do not process pseudonymized information.
9. Your rights and how to exercise them
#- You may at any time access your personal information, request its correction, deletion, or suspension of processing, and withdraw your consent.
- If you make a request by phone, email, or in writing, we handle it within 10 days and tell you the result.
- Your legal representative or a person you have authorized may also make a request. In that case, we ask for a letter of authorization.
- You cannot request deletion of records that other laws require us to keep, for as long as they must be kept.
10. Security measures
#- Administrative measures: we set up an internal management plan, and we keep the number of people who handle personal information to a minimum and train them.
- Technical measures: we manage access rights, control access, and encrypt data when storing and transmitting it (HTTPS across the whole site).
- Physical measures: we keep shipping labels and documents in a place with a lock.
11. Automatic collection tools (cookies)
#We do not use cookies. Your cart, demo subscription, and “Reduce motion” setting stay in this browser’s storage (localStorage). The demo time, the record of the grind consent you gave in the cart, the gift message you wrote on the message card of a drip bag or gift page, the order confirmation screen (including the gift message card), and the color used when moving between pages stay only in this tab’s storage (sessionStorage). None of this is sent to a server.
Values in sessionStorage are deleted when you close the tab, and values in localStorage are deleted when you clear site data in your browser settings.
12. Privacy officer
#Because we are a small business, our founder serves as our privacy officer. For inquiries, complaints, or remedies for harm related to personal information, please contact the person below.
- Name: Yeo Do-han (founder)
- Phone: +82-2-0123-1800 (in Korea, 02-0123-1800), weekdays 10:00–17:00 KST
- Email: hello@example.com
13. Remedies for infringement
#If you need to report an infringement of your personal information or get advice about one, you can contact the organizations below.
- Personal Information Dispute Mediation Committee, 1833-6972
- Personal Information Infringement Report Center (Korea Internet & Security Agency), 118 (no area code)
- Supreme Prosecutors’ Office, 1301 (no area code)
- Korean National Police Agency, 182 (no area code)
14. Changes to this policy
#This policy applies from November 1, 2026. If we change it, we announce the change in the store starting 7 days before it takes effect.