Privacy policy
Last Updated: October 20, 2026
This Privacy Policy (hereinafter the "Policy") applies to the global commerce service "Piyonna" (hereinafter the "Service") operated by Kakaostyle Corp. (hereinafter referred to as the "Company," "we," "us," or "our").
The Service includes our website piyonna.com (hereinafter the "Site") and the Piyonna mobile application.
This Policy explains how we collect, use, store, transfer, and share personal information in the course of your use of the Service, and sets out your rights as a data subject.
The Company operates the Service on the Shopify platform. Shopify provides the technical infrastructure and data processing functions necessary for the operation of the Service.
In the event of a conflict between our Terms of Service and this Policy, this Policy shall prevail with respect to the processing of personal information.
By accessing or using any part of the Service, you acknowledge that you have read and understood this Policy. Where processing requires your consent, we shall obtain your separate, explicit consent.
1. Data Controller and Contact
1-1. Data Controller
- Company name : Kakaostyle Corp.
- Business Registration No. : 214-88-91525
- Address : 6F, 235, Pangyoyeok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do, Republic of Korea
- Email : privacy@piyonna.com
1-2. Data Protection Officer
- Email : dpo@piyonna.com
2. Definition of Personal Information
2-1. "Personal information" means any information that identifies, or can reasonably be used to identify, a specific individual, including the following:
- Name, email address, telephone number
- Billing and shipping addresses
- Payment information
- Account credentials (email address)
- Device and browser information
- IP address
3. Personal Information We Collect
3-1. Information You Provide Directly
- Account information : email address
- Order information : name, contact details, shipping and billing addresses, order history
- Payment information : payment method details, processed through secure payment service providers
- Communications : customer service inquiries, reviews, feedback
- Affiliate information, where you register as an affiliate partner : name, email, telephone number, address, bank account details, business registration number (optional), tax-related information
3-2. Information Collected Automatically
- Device information : browser type, operating system, device identifiers
- Usage information : pages visited, products viewed, search history, cart contents
- Location information : IP address, country and region settings
- Cookies and tracking technologies : please refer to our separate Cookie Policy
3-3. Information Received from Third Parties
- Social login providers (Google, Apple, etc.), where you link an account : email address, name
- Payment service providers : payment authorization results, transaction ID, payment method type, masked card information
- Shipping and logistics partners : delivery status, delivery completion date and time, recipient signature where applicable
3-4. Information We Do Not Collect
We do not knowingly collect any of the following:
- Biometric information
- Sensitive personal data, including health information, political opinions, and religious beliefs
- Information relating to users under the age of 18
- Full credit or debit card numbers, which are handled directly by our payment service providers
4. Purposes of Processing and Legal Bases
For users in the European Economic Area, we state below the legal basis on which we rely for each purpose, in accordance with Article 6 of the GDPR.
4-1. Performance of a Contract (Article 6(1)(b))
Processing necessary for the performance of our contract with you:
| Purpose | Data | Retention Period |
|---|---|---|
| Account creation and management | Email address | Until account deletion, plus 30 days |
| Order processing | Name, address, payment information | 5 years from order completion |
| Shipping and logistics | Name, delivery address, telephone number | 5 years from the delivery date |
| Customer service | Inquiry content, order information | 3 years from resolution |
| Returns and refunds | Order information, bank details | 5 years from the transaction date |
| Affiliate registration and management | Name, email, telephone number, address | Until termination of the agreement, plus 30 days |
| Affiliate commission settlement and payment | Bank name, account number, account holder name, business registration number where applicable, tax-related information | 5 years from payment, and 7 years for tax purposes |
| Affiliate activity tracking | Referral link clicks, conversion performance, commission records | 3 years following termination of the agreement |
4-2. Consent (Article 6(1)(a))
Processing based on your separate, explicit consent:
| Purpose | Data | How Consent Is Obtained | Retention Period |
|---|---|---|---|
| Marketing emails and newsletters | Email address | Opt-in at checkout or upon newsletter subscription | Until consent is withdrawn |
| Personalized product recommendations | Browsing and purchase history | Cookie consent banner | Until consent is withdrawn |
| Sharing with third-party advertising partners | Device identifiers, browsing data | Cookie consent banner | Until consent is withdrawn |
Your rights in relation to consent are as follows:
- You may withdraw your consent at any time.
- Withdrawing consent is as easy as providing it.
- Withdrawal shall not affect the lawfulness of any processing carried out prior to the withdrawal.
- You may withdraw consent through the unsubscribe link included in our emails, your cookie settings, the withdrawal option in My Page, or by contacting our Customer Service.
4-3. Legitimate Interests (Article 6(1)(f))
Processing necessary for our legitimate interests, balanced against your rights and freedoms:
| Purpose | Legitimate Interest | Data | Retention Period |
|---|---|---|---|
| Fraud prevention | Protection of our business and our customers | Transaction patterns, IP address | 2 years |
| Service security | Maintenance of a secure platform | Login records, device information | 1 year |
| Service improvement | Enhancement of the user experience | Aggregated usage data | 3 years |
| Business analysis | Understanding of service performance | Anonymized data | Indefinite |
4-4. Legal Obligation (Article 6(1)(c))
Processing required by applicable law:
| Purpose | Legal Basis | Data | Retention Period |
|---|---|---|---|
| Tax records | Tax law | Transaction records | 7 years |
| Accounting records | Commercial Act | Financial records | 10 years |
| Legal claims | Civil proceedings | Relevant records | Statutory limitation period |
5. Marketing Communications
5-1. Transactional Communications
The following communications are sent on the basis of the performance of our contract with you and do not require separate consent:
- Order confirmation emails
- Shipping and delivery updates
- Account security notifications
- Important service announcements
5-2. Marketing Communications
The following require your separate, explicit opt-in consent:
- Promotional offers and discounts
- New product announcements
- Newsletters and beauty tips
- Personalized product recommendations
- Invitations to join our affiliate program
5-3. How to Subscribe
- Consent checkbox during checkout
- Newsletter subscription form on the Site or on event sites
- Account settings
Entering and submitting your email address in a newsletter subscription field shall be deemed consent to receive marketing communications. Your subscription is always voluntary.
5-4. How to Unsubscribe
- Click the unsubscribe link included in any marketing email
- Contact us at privacy@piyonna.com, or contact our Customer Service by chat or email
Unsubscribe requests shall be processed within 72 hours.
6. Sharing and Disclosure of Personal Information
6-1. Processing Entrusted to Third Parties
The Company entrusts the processing of personal information to the following parties for the provision of the Service. The safeguards required by applicable law for the secure handling of personal information are stipulated in each entrustment agreement.
| Processor | Sub-processor | Scope of Work | Retention and Use Period |
|---|---|---|---|
| Shopify Inc. | - | E-commerce platform operation, including order management, payment integration, and customer data hosting | Until termination of the agreement. Where retention is required by applicable law, for the period so required |
| Croquis Global PTE. LTD. | Shopify Payments | Payment processing, settlement, and refund processing | Until termination of the agreement. Records of payment and supply of goods shall be retained for 5 years under the Act on Consumer Protection in Electronic Commerce |
| Hyundai Glovis Co., Ltd. | Local delivery carriers in each destination country | International logistics and delivery. Local delivery is sub-contracted to carriers in each destination country | Until termination of the agreement. Where retention is required by applicable law, for the period so required |
| DPD | - | Local parcel delivery in destination countries | Until termination of the agreement. Where retention is required by applicable law, for the period so required |
| Asendia | - | International mail and parcel delivery | Until termination of the agreement. Where retention is required by applicable law, for the period so required |
| FedEx (Federal Express) | - | International express delivery | Until termination of the agreement. Where retention is required by applicable law, for the period so required |
| Gorgias, Inc. | - | Customer support helpdesk, including receipt of and response to customer inquiries by email and live chat | Until termination of the agreement. Records of consumer complaints or dispute resolution shall be retained for 3 years |
| Klaviyo Inc. | - | Delivery of email marketing and analysis of marketing performance, where you have consented | Until termination of the agreement, or until consent is withdrawn |
| UpPromote (AfterShip) | - | Operation of our affiliate program, including partner registration, performance tracking, and commission settlement | Until termination of the agreement. Where retention is required by applicable law, for the period so required |
Processors shall not use personal information for any purpose beyond the entrusted purpose, shall not provide it to any third party, and shall obtain our prior consent before any sub-contracting.
6-2. Other Disclosures
- Where lawfully requested by government or judicial authorities in accordance with applicable law
- Where you have given separate consent
7. International Transfers of Personal Information
7-1. Countries of Transfer
(1) Republic of Korea : Kakaostyle Corp., Hyundai Glovis Co., Ltd.
| Recipient | Kakaostyle Corp. (service operation), Hyundai Glovis Co., Ltd. (logistics) |
| Country | Republic of Korea |
| Date and method of transfer | Transmitted over the network from time to time in the course of your use of the Service |
| Data transferred | Name, email address, contact details, shipping and billing addresses, order history, payment information, customer inquiry content |
| Purpose | Overall service operation, order processing, international logistics and delivery, customer service, payment settlement |
| Retention and use period | Until termination of the service agreement. Where retention is required by applicable law, for the period so required, including 5 years for transaction records under the Act on Consumer Protection in Electronic Commerce and 7 years under tax law |
| Contact | privacy@piyonna.com |
| Legal basis | Articles 44 to 50 of the GDPR. Standard Contractual Clauses concluded |
(2) United States : Shopify Inc., Gorgias, Inc., Federal Express Corporation
| Recipient | Shopify Inc. (e-commerce platform), Gorgias, Inc. (customer support helpdesk), Federal Express Corporation and its affiliates (international express delivery) |
| Country | United States |
| Date and method of transfer | Transmitted over the network, including cloud infrastructure, from time to time in the course of your use of the Service |
| Data transferred | Name, email address, contact details, shipping and billing addresses, order history, payment information, device information, usage records, customer inquiry content |
| Purpose | E-commerce platform operation, including data hosting, order management, payment integration, and analytics; customer support helpdesk, including receipt of and response to inquiries; international express delivery, customs clearance and delivery tracking |
| Retention and use period | Until termination of the agreement. Where retention is required by applicable law, for the period so required |
| Contact | shopify.com/legal/privacy, gorgias.com/legal/privacy, fedex.com/en-us/trust-center.html |
| Legal basis | Articles 44 to 50 of the GDPR. Standard Contractual Clauses concluded with Shopify and Gorgias. FedEx Binding Corporate Rules for FedEx |
(3) Canada : Shopify Inc. head office
| Recipient | Shopify Inc. (head office) |
| Country | Canada |
| Date and method of transfer | Transmitted over the network from time to time in the course of your use of the Service |
| Data transferred | Customer inquiry content, order information, account information |
| Purpose | Customer service support, technical support |
| Retention and use period | Until termination of the agreement. Where retention is required by applicable law, for the period so required |
| Contact | shopify.com/legal/privacy |
| Legal basis | Articles 44 to 50 of the GDPR. Standard Contractual Clauses concluded. Canada is covered by an adequacy decision of the European Commission |
7-2. Transfer Safeguards
For transfers outside the European Economic Area, we apply the appropriate safeguards required under the GDPR, including the following:
- Standard Contractual Clauses approved by the European Commission
- Adequacy decisions, where applicable
- Supplementary measures, where necessary
- The safeguards required under Article 28-2 of the Personal Information Protection Act of the Republic of Korea and its Enforcement Decree
8. Data Retention
8-1. Retention Periods by Purpose
| Data | Retention Period | Basis |
|---|---|---|
| Account information | Until deletion is requested, plus 30 days | Contract |
| Order and transaction records | 5 years from the transaction date | Legal obligation |
| Tax records | 7 years | Tax law |
| Customer service records | 3 years from resolution | Legitimate interest |
| Marketing consent records | Duration of consent, plus 3 years | Accountability |
| Cookie data | Up to 13 months for our own cookies | CNIL guidelines |
| Web logs | 1 year | Security |
Our own cookies shall not be stored for longer than 13 months, in accordance with CNIL guidance. Retention periods for third-party cookies may differ in accordance with each provider's own policy.
8-2. Following Expiry of the Retention Period
Personal information shall be either:
- securely deleted, or
- anonymized such that you can no longer be identified.
9. Your Rights
9-1. As a data subject, you have the following rights under Articles 15 to 22 of the GDPR:
- Right of access : you may request a copy of the personal information we hold about you.
- Right to rectification : you may request the correction of inaccurate or incomplete information.
- Right to erasure : you may request the deletion of your personal information, except where we are under a legal obligation to retain it.
- Right to restriction of processing : you may request the restriction of processing in certain circumstances.
- Right to data portability : you may receive your personal information in a machine-readable format.
- Right to object : you may object to processing for marketing purposes or processing based on legitimate interests.
- Right to withdraw consent : you may withdraw your consent at any time where processing is based on consent.
9-2. To exercise any of these rights, please contact us at privacy@piyonna.com.
9-3. We may verify your identity before processing your request, as permitted or required under applicable law. We shall respond to your request within 30 days of receipt. Where the request is complex or where a number of requests have been received, this period may be extended, and we shall notify you of the extension and the reasons therefor within the initial 30 days.
10. Right to Lodge a Complaint
10-1. You have the right to lodge a complaint with a supervisory authority if you believe that your data protection rights have been infringed.
10-2. Residents of the European Union may contact their local data protection authority.
10-3. Residents of France may contact the CNIL (Commission Nationale de l'Informatique et des Libertés):
- Website : https://www.cnil.fr
- Address : 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France
11. Age Restriction
11-1. The Service is intended for users who are 18 years of age or older.
11-2. We do not knowingly collect personal information from users under the age of 18. If we become aware that we have collected personal information from a minor, we shall take steps to delete it without delay.
11-3. Parents and guardians who believe that their child has provided us with personal information may contact us at privacy@piyonna.com.
12. Data Security
12-1. We implement appropriate technical and organizational measures to protect your personal information, including the following:
- Encryption of data in transit (TLS/SSL)
- Secure payment processing through PCI-DSS compliant providers
- Access controls and authentication
- Regular security assessments
- Staff training on data protection
12-2. No method of transmission over the internet is entirely secure, and we cannot guarantee absolute security.
13. Cookies and Tracking Technologies
13-1. We use cookies and similar technologies in the operation of the Service.
13-2. Details of the types of cookies we use, the purpose of each cookie, how to manage your cookie preferences, and third-party cookies are set out in our separate Cookie Policy, which is incorporated herein by reference.
14. Modifications to This Privacy Policy
14-1. We reserve the right to update or modify this Policy at any time.
14-2. Changes will be posted on this page with an updated "Last Updated" date.
14-3. We will provide reasonable notice of material changes by email or Site announcement.
14-4. Your continued use of the Service following the posting of changes constitutes your acceptance of the revised Policy.
15. Contact Information
For inquiries regarding this Privacy Policy or to exercise your rights, please contact us at:
Privacy-Related Inquiries:
- Email : privacy@piyonna.com
- Data Protection Officer : dpo@piyonna.com
Service and Usage Inquiries (Customer Service):
- Email : support@piyonna.com
- Chat : Chat support button located at the bottom right of the Site
- Customer service hours : Weekdays 9:00 AM - 6:00 PM (KST)
Partnership and Collaboration Inquiries:
- Email : partner@piyonna.com
