Privacy Policy

Reservation (including as a guest): name, mobile number, pickup date, order contents, and any request you write.

Account: email address, password, name, mobile number. Optionally a nickname and a profile image.

Payment: the record of a payment and its refund. Card numbers and bank details are handled by the payment processor and are never stored by the shop.

Collected automatically: access IP address, session cookie, and records of use kept to detect abuse.

To take and confirm your reservation and to hand over your order; to verify that a mobile number is yours at sign-up and password reset; to take payment and make refunds; to answer enquiries; to prevent abuse of the booking and sign-in forms; and to keep the records the law requires.

Account data is kept until you close your account. Reservation and payment records are kept for the periods set by law, after which they are destroyed.

Contracts and withdrawal of subscription: 5 years. Payment and supply of goods: 5 years. Consumer complaints and disputes: 3 years. Advertising and labelling: 6 months. (Act on Consumer Protection in Electronic Commerce.) Access logs: 3 months (Protection of Communications Secrets Act).

Verification codes sent to a mobile number expire after 5 minutes and are discarded.

We do not provide personal data to third parties, except where a law requires it or an investigating authority requests it under proper procedure.

Hosting and data storage: Cloudflare, Inc. (United States). The database is located in the Asia-Pacific region, but Cloudflare is a US company and may access the data in the course of operating the service, so this is a transfer abroad. The data transferred is everything in sections 1; it is transferred over the network as the service runs, and is held for as long as this site uses Cloudflare.

Payment processing: the payment processor the shop contracts with, for taking payment and making refunds. Message delivery: the provider the shop contracts with, for verification codes and reservation notices. Each is named here once it is in use.

You may refuse a transfer abroad. Hosting is how the site runs, so refusing it means the service cannot be provided.

You may ask to see, correct, delete or suspend processing of your personal data at any time. Account holders can do much of this from My Page; otherwise contact us using the details in the footer. We act without delay.

This service is not aimed at children under 14, and sign-up does not ask for a date of birth, so we do not check. If we learn that an account belongs to a child under 14, we will either obtain a legal representative's consent or destroy the data. A legal representative may exercise these rights on the child's behalf.

Once the purpose is served or the retention period ends, data is destroyed without delay — electronic records by a method that cannot be recovered, printed records by shredding or incineration.

Passwords are stored as a one-way hash (PBKDF2) and cannot be read back, by us or by anyone. All traffic to this site is encrypted in transit (HTTPS). Administrative access is limited to named accounts, can require a second factor in addition to the password, and is locked out after repeated failures. What administrators do is recorded.

Names and mobile numbers are stored as entered, not encrypted; they are shown to staff in masked form where the full number is not needed.

We use one cookie, to keep you signed in. It carries no advertising or tracking purpose. You can refuse it in your browser settings; if you do, you will not be able to sign in, though you can still book as a guest.

Privacy Officer: Kim Tae-hun, proprietor. Reach the officer through the contact details in the footer.

If this policy changes, the change and the date it takes effect are posted on this page before it applies.

Personal Information Dispute Mediation Committee 1833-6972 (kopico.go.kr). Privacy Infringement Report Centre 118 (privacy.kisa.or.kr). Supreme Prosecutors' Office 1301. National Police Agency 182.