Shopping Seller Privacy Policy
SKIPIKS ("Company") complies with the Personal Information Protection Act and other applicable laws and processes sellers' personal and business information as follows.
| Type | Items |
|---|---|
| Sign-up (required) | Contact email (login ID), password (stored encrypted), seller (brand) name, shop address, country |
| Sign-up (optional) | Contact phone number, company (legal) name |
| Eligibility confirmation | Whether the Seller confirmed that it is a business (sole proprietor or corporation) or aged 19 or over, and when |
| Onboarding review | Copy of the business registration certificate (including the representative's name, business address and other details on it), business registration number, company (legal) name, method and time of shop-domain ownership verification |
| Orders and payment | Order history (pass type, quantity, amount, time), depositor name for direct bank deposits, information the payment gateway returns as the payment result (payment method, card issuer or bank, partly masked card number, approval number, time and amount of payment and cancellation — the full card number, expiry date and password are not received) |
| Refunds | Refund requests (pass concerned, reason and note, time requested) and their outcome; where a refund is sent to an account (payments by direct bank deposit, or where a payment cannot be cancelled), the bank, account number and account holder |
| Tax invoices and cash receipts | Business registration number, company name, representative's name, email to receive tax invoices (contact email), and the number the Seller provides for cash receipts (such as a mobile number) |
| Automatic | Console IP/logs, product exposure and click records, pass usage records |
| Automatic | Time you agreed to the Terms at sign-up and the Terms version |
| On request | Account change and withdrawal requests (type, new value, reason) — console Account tab |
1. The Company processes the personal information above without the data subject's consent on the following bases, and discloses the items and bases separately as required by Article 22(3) of the Personal Information Protection Act.
| Legal basis | Items |
|---|---|
| Concluding and performing the agreement (Article 15(1)4 of the same Act) | Sign-up, eligibility confirmation, onboarding review, order, payment and refund information; automatically collected information; account requests |
| Compliance with legal obligations (Article 15(1)2 of the same Act) | Information for issuing tax invoices and cash receipts (the VAT Act and related laws); keeping records of contracts, withdrawals, payments and dispute handling (the Act on the Consumer Protection in Electronic Commerce) |
2. The Company does not carry out any processing of personal information that requires the Seller's consent. If it ever does, it will state the items and purposes and obtain separate consent.
1. When a Seller withdraws or the agreement ends, the account is deactivated immediately, and the following information is kept for the periods set by law and then destroyed.
2. On withdrawal or the end of the agreement, sign-in details, contact details and other information are destroyed without delay. However, while a pending order, refund request or account request is being handled, we keep the information needed to handle it, and if paid passes that can still be refunded remain, we keep the account for 90 days from the end of the agreement so that the Seller can request the refund in the Seller Console. Destruction takes place within 5 days of the day nothing remains to be handled (or that period ends).
3. Method: the account email and password, contact name and details, internal notes, domain verification data, integration addresses and tokens and the copy of the business registration certificate are deleted or replaced with values that cannot be restored, and recipient addresses are removed from email sending records. Information kept under paragraph 1 (business name and registration number, order, payment and refund records, depositor names, refund accounts, etc.) is deleted in the same way 6 years after the end of the agreement.
Personal information is stored in Cloudflare D1 (database) and R2 (file storage); transmission is encrypted via HTTPS/TLS. Authentication is verified via JWT (kind=seller). Copies of business registration certificates are stored in a private location that is not served at any public address. Refund account numbers are stored encrypted; the Seller Console does not display them, and staff decrypt them only to send a refund. Card numbers and other payment details are processed by the payment gateway and are not stored in the Company's systems.
| Processor | Task |
|---|---|
| Cloudflare, Inc. | Data storage & hosting (cross-border transfer — see below) |
| Toss Payments Co., Ltd. | Electronic payment processing for passes (processing card, easy-payment and quick-account-transfer payments and their cancellation and refund), issuing cash receipts on the Company's behalf, prevention of payment fraud (entrusted from the time the checkout window goes live; until then no personal data is sent to this processor) |
| Resend, Inc. | Sending emails (sign-up verification and notices about payments, refunds, changes to the Terms, etc.) (cross-border transfer — see below) |
Card numbers, expiry dates, passwords and other payment details are received from the Seller and processed directly by Toss Payments in its checkout window (Toss Payments' privacy policy applies); the Company does not receive or store them. The Company receives and keeps only the order and payment information listed under "Collected Data" as the payment result.
In its processing agreements the Company prohibits processing beyond the entrusted purpose and sets out technical and administrative safeguards, restrictions on sub-processing, supervision of the processor and liability for damages, and it supervises whether processors handle personal information safely.
Information for issuing tax invoices and cash receipts is transmitted to the National Tax Service as required by the VAT Act and related laws. Otherwise, personal information is not provided externally absent a lawful request.
Cross-border transfer of personal information — under Article 28-8(1)3(a) of the Personal Information Protection Act, the Company discloses the following in this policy and transfers personal information abroad for the processing and storage necessary to conclude and perform the service agreement.
You may refuse the cross-border transfer by writing to contact@skipiks.ai; because storage and email delivery are essential to the service, service use is restricted if you refuse.
The Company does not make decisions affecting a Seller's rights or obligations by fully automated systems that process the Seller's personal information. Onboarding reviews and termination of the agreement are decided by staff. Automatic handling at the product level, such as checking for broken product links or tidying up matches, uses product information only.
김규태 (대표) · contact@skipiks.ai
Privacy infringement reports: Korea's Personal Information Protection Commission (privacy.go.kr, 182 from within Korea)