PRIVACY POLICY
Last updated: 11 Aug 2026
91 Views
Effective Date: 2026-01-13
Privacy Policy
Heart Locket Co., Ltd. (hereinafter referred to as the "Company") has established the following Privacy Policy in accordance with relevant laws and regulations to protect the personal information and rights of customers using the internet site operated by the Company (heartlocketofficial.com, hereinafter referred to as the "Heart Locket Brand Mall") and to facilitate the smooth handling of related grievances. The Company plans to announce any revisions to this Privacy Policy through a notice on the relevant website (or individual notification).
■ Purpose of Collection and Use of Personal Information
The Company collects personal information for the purposes set forth in the following subparagraphs. The collected personal information will not be used for purposes other than those listed below, and prior consent will be sought if the purpose of use changes.
**Purpose of Collection and Use of Personal Information** 1. Website Membership Registration and Management
Purposes include confirming intent to register, verifying identity for the provision of membership services, maintaining membership status, preventing fraudulent use of services, verifying consent from a legal representative when collecting personal information of children under the age of 14, providing various notices, handling grievances, and preserving records for dispute mediation.
2. Handling of Civil Complaints
Purposes include verifying the identity of the complainant, confirming the details of the complaint, notifying contact for fact-finding, and notifying the results of processing.
3. Provision of Goods or Services
Purposes include product delivery, provision of product return services, sending invoices, mileage payments, provision of content, provision of custom-made services, identity verification, age verification, payment settlement, debt collection, and other inputs.
4. Use for Marketing and Advertising
Purposes include developing new services (products) and providing customized services, providing event and advertising information and opportunities for participation, providing services and displaying advertisements based on demographic characteristics, verifying service effectiveness, identifying access frequency, or collecting statistics on members' service usage.
■ Items of Personal Information Collected and Collection Methods
① Items of Personal Information Collected
1. Membership Registration
[Required Items] ID, Password, Email, Name, Mobile Phone Number, Address, Identity Verification Information, Duplicate Registration Check Information
2. Product Delivery
[Required Items] Recipient's Name, Mobile Phone Number, Delivery Address, Email
3. Product Retrieval
[Required Items] Name, Mobile Phone Number, Address of Requestor and Recipient
[Optional Items] Landline Phone
4. Payment
[Required Items] Credit Card Information, Bank Account Information
5. Information Automatically Generated and Collected During Service Usage or Business Processing
[Required Items] Access IP Information, Cookie, Service Usage Records, Access Logs, Payment Records, Service Suspension Records
5. Refund Processing
[Required Items] Account Holder Name, Refund Account
6. 1:1 Inquiry
[Required Items] Inquiry Details
[Optional Items] Attached Image
7. Mobile Device Information
[Required Items] Device Name, OS, Device Identification Information
[Optional Items] Browser Information, Advertising Identifier
8. Others
ㆍWhen additional personal information not collected during membership registration is collected when using supplementary services or customized services, or during the event application process, the Company notifies users of the relevant items and obtains separate consent before processing the matter.
② Methods of Collecting Personal Information
ㆍCollection online, such as membership registration via the website or consultation board; collection offline, such as via telephone, fax, or written application forms within stores; collection via email, delivery requests, or entry into prize events.
ㆍProvision from identity verification agencies or affiliates, etc.
ㆍCollection through information generation tools.
■ Retention and Usage Period of Personal Information
① The Company retains and uses personal information within the period agreed upon at the time of collection from users. However, if preservation is necessary in accordance with the provisions of relevant laws, the information will be preserved in accordance with those laws. ② In the case of members, the retention and usage period of personal information is from the time of concluding the service usage contract (at the time of membership registration) until the termination of the service usage contract (including withdrawal requests and ex officio withdrawal). Unless a separate period is stipulated by other laws or there is a request from the customer, the Company destroys the personal information of members who have not re-used the service for the period defined by law (1 year) or stores and manages it separately by separating it from the personal information of other members. However, the Company shall notify the member of the fact that personal information is being destroyed or separated and stored/managed, the expiration date, and the items of the relevant personal information by email, written notice, fax, telephone, or any similar method at least 30 days prior to the expiration of the period.
③ The retention period for personal information pursuant to relevant laws is as follows:
o Records regarding contracts or withdrawal of subscription, etc.
- Reason for retention: Act on the Consumer Protection in Electronic Commerce, etc.
- Retention period: 5 years
o Records regarding payment settlement and supply of goods, etc.
- Reason for retention: Act on the Consumer Protection in Electronic Commerce, etc.
- Retention period: 5 years
o Records regarding consumer complaints or dispute resolution
- Reason for retention: Act on the Consumer Protection in Electronic Commerce, etc.
- Retention period: 3 years
o Log records
- Reason for retention: Protection of Communications Secrets Act
- Retention period: 3 months
■ Provision of Personal Information to Third Parties
In principle, the Company does not provide users' personal information to external parties. However, exceptions apply in the following cases:
① When users have given prior consent
② When required by the provisions of laws and regulations, or when there is a request from an investigative agency for investigative purposes in accordance with the procedures and methods prescribed by law
■ Notice on Entrustment of Personal Information Processing
① The Company entrusts operations to external professional companies as follows to fulfill the service.
o Consignee: Kerry Express Logistics
o Consignment Work: Product delivery
o Consignee: Thai Post
o Consignment Work: Product delivery
o Consignee: Flash Express
o Consignment Work: Product delivery
■ Marketing Information Consent to Receive
In accordance with Article 50, Paragraph 1 of the Information and Communications Network Act, you may use the service even if you do not provide information regarding optional items.
① Use for Marketing and Advertising
Personal information is processed for the purposes of developing new services (products) and providing custom services, providing event and advertising information and opportunities for participation, providing services and displaying advertisements based on demographic characteristics, verifying the effectiveness of services, identifying access frequency, or compiling statistics on members' service usage.
② In operating the service, various information may be provided to site members via service screens, KakaoTalk, telephone, e-mail, SMS, postal mail, etc. Informational content that must be provided mandatorily will be provided regardless of whether consent to receive is obtained.
③ Items of Personal Information Collected
Name, date of birth, shipping address, email address, mobile phone number, app device ID
④ Retention Period of Collected Personal Information
Until the withdrawal of consent for the relevant service
■ Rights of Users and Legal Representatives and How to Exercise Them
o Users may view or modify their registered personal information at any time and may also request account termination. o To view or modify your personal information, please click "Change Personal Information" (or "Edit Member Information," etc.). To cancel your membership (withdraw consent), please click "Withdraw Membership." After completing the identity verification process, you can directly view, correct, or withdraw your information.
o Alternatively, if you contact the Chief Privacy Officer in writing, by phone, or by email, we will take action without delay.
o If you request a correction regarding errors in your personal information, we will not use or provide the relevant personal information until the correction is completed. Furthermore, if incorrect personal information has already been provided to a third party, we will notify the third party of the correction results without delay to ensure that the correction is made.
o The Company processes personal information that has been terminated or deleted at the user's request in accordance with the "Retention and Usage Period of Personal Information Collected by the Company" and ensures that it cannot be viewed or used for any other purpose.
■ Procedures and Methods for Destruction of Personal Information
The Company destroys personal information when the purpose of its collection and use is achieved or the retention period expires. The procedures and methods for destruction are as follows. However, exceptions apply if the relevant personal information must be preserved under other laws. ① Destruction Procedure
Information entered by users is transferred to a separate database (or separate documents in the case of paper records) after the purpose is achieved. It is stored for a certain period in accordance with internal policies and other relevant laws and regulations, and then destroyed immediately. At this time, personal information transferred to the database will not be used for any other purpose unless required by law.
② Destruction Deadline
Users' personal information is destroyed within 5 business days from the end of the retention period if the retention period has expired. If the personal information becomes unnecessary due to the achievement of the purpose of processing, the discontinuation of the relevant service, or the termination of the business, it is destroyed within 5 business days from the date it is deemed unnecessary to process. In the case of children under the age of 14, if a legal representative refuses or consent cannot be confirmed, the relevant personal information is destroyed within 5 business days from the date of collection.
③ Method of Destruction
Information in the form of electronic files is destroyed using technical methods that prevent the records from being reproduced. Personal information printed on paper is destroyed by shredding or incineration.
■ Measures to Ensure the Safety of Personal Information
Heart Locket takes the following measures to ensure the safety of personal information:
◦ Administrative Measures: Establishment and implementation of internal management plans, regular training for employees and staff, etc.
◦ Technical Measures: Access control management, such as setting passwords for personal information processing systems (or computers where personal information is stored), installation of security programs such as antivirus software, encryption of files containing personal information
◦ Physical Measures: Locking of locations where personal information is stored, access control, etc.
■ [Illegible]
Privacy Policy
Heart Locket Co., Ltd. (hereinafter referred to as the "Company") has established the following Privacy Policy in accordance with relevant laws and regulations to protect the personal information and rights of customers using the internet site operated by the Company (heartlocketofficial.com, hereinafter referred to as the "Heart Locket Brand Mall") and to facilitate the smooth handling of related grievances. The Company plans to announce any revisions to this Privacy Policy through a notice on the relevant website (or individual notification).
■ Purpose of Collection and Use of Personal Information
The Company collects personal information for the purposes set forth in the following subparagraphs. The collected personal information will not be used for purposes other than those listed below, and prior consent will be sought if the purpose of use changes.
**Purpose of Collection and Use of Personal Information** 1. Website Membership Registration and Management
Purposes include confirming intent to register, verifying identity for the provision of membership services, maintaining membership status, preventing fraudulent use of services, verifying consent from a legal representative when collecting personal information of children under the age of 14, providing various notices, handling grievances, and preserving records for dispute mediation.
2. Handling of Civil Complaints
Purposes include verifying the identity of the complainant, confirming the details of the complaint, notifying contact for fact-finding, and notifying the results of processing.
3. Provision of Goods or Services
Purposes include product delivery, provision of product return services, sending invoices, mileage payments, provision of content, provision of custom-made services, identity verification, age verification, payment settlement, debt collection, and other inputs.
4. Use for Marketing and Advertising
Purposes include developing new services (products) and providing customized services, providing event and advertising information and opportunities for participation, providing services and displaying advertisements based on demographic characteristics, verifying service effectiveness, identifying access frequency, or collecting statistics on members' service usage.
■ Items of Personal Information Collected and Collection Methods
① Items of Personal Information Collected
1. Membership Registration
[Required Items] ID, Password, Email, Name, Mobile Phone Number, Address, Identity Verification Information, Duplicate Registration Check Information
2. Product Delivery
[Required Items] Recipient's Name, Mobile Phone Number, Delivery Address, Email
3. Product Retrieval
[Required Items] Name, Mobile Phone Number, Address of Requestor and Recipient
[Optional Items] Landline Phone
4. Payment
[Required Items] Credit Card Information, Bank Account Information
5. Information Automatically Generated and Collected During Service Usage or Business Processing
[Required Items] Access IP Information, Cookie, Service Usage Records, Access Logs, Payment Records, Service Suspension Records
5. Refund Processing
[Required Items] Account Holder Name, Refund Account
6. 1:1 Inquiry
[Required Items] Inquiry Details
[Optional Items] Attached Image
7. Mobile Device Information
[Required Items] Device Name, OS, Device Identification Information
[Optional Items] Browser Information, Advertising Identifier
8. Others
ㆍWhen additional personal information not collected during membership registration is collected when using supplementary services or customized services, or during the event application process, the Company notifies users of the relevant items and obtains separate consent before processing the matter.
② Methods of Collecting Personal Information
ㆍCollection online, such as membership registration via the website or consultation board; collection offline, such as via telephone, fax, or written application forms within stores; collection via email, delivery requests, or entry into prize events.
ㆍProvision from identity verification agencies or affiliates, etc.
ㆍCollection through information generation tools.
■ Retention and Usage Period of Personal Information
① The Company retains and uses personal information within the period agreed upon at the time of collection from users. However, if preservation is necessary in accordance with the provisions of relevant laws, the information will be preserved in accordance with those laws. ② In the case of members, the retention and usage period of personal information is from the time of concluding the service usage contract (at the time of membership registration) until the termination of the service usage contract (including withdrawal requests and ex officio withdrawal). Unless a separate period is stipulated by other laws or there is a request from the customer, the Company destroys the personal information of members who have not re-used the service for the period defined by law (1 year) or stores and manages it separately by separating it from the personal information of other members. However, the Company shall notify the member of the fact that personal information is being destroyed or separated and stored/managed, the expiration date, and the items of the relevant personal information by email, written notice, fax, telephone, or any similar method at least 30 days prior to the expiration of the period.
③ The retention period for personal information pursuant to relevant laws is as follows:
o Records regarding contracts or withdrawal of subscription, etc.
- Reason for retention: Act on the Consumer Protection in Electronic Commerce, etc.
- Retention period: 5 years
o Records regarding payment settlement and supply of goods, etc.
- Reason for retention: Act on the Consumer Protection in Electronic Commerce, etc.
- Retention period: 5 years
o Records regarding consumer complaints or dispute resolution
- Reason for retention: Act on the Consumer Protection in Electronic Commerce, etc.
- Retention period: 3 years
o Log records
- Reason for retention: Protection of Communications Secrets Act
- Retention period: 3 months
■ Provision of Personal Information to Third Parties
In principle, the Company does not provide users' personal information to external parties. However, exceptions apply in the following cases:
① When users have given prior consent
② When required by the provisions of laws and regulations, or when there is a request from an investigative agency for investigative purposes in accordance with the procedures and methods prescribed by law
■ Notice on Entrustment of Personal Information Processing
① The Company entrusts operations to external professional companies as follows to fulfill the service.
o Consignee: Kerry Express Logistics
o Consignment Work: Product delivery
o Consignee: Thai Post
o Consignment Work: Product delivery
o Consignee: Flash Express
o Consignment Work: Product delivery
■ Marketing Information Consent to Receive
In accordance with Article 50, Paragraph 1 of the Information and Communications Network Act, you may use the service even if you do not provide information regarding optional items.
① Use for Marketing and Advertising
Personal information is processed for the purposes of developing new services (products) and providing custom services, providing event and advertising information and opportunities for participation, providing services and displaying advertisements based on demographic characteristics, verifying the effectiveness of services, identifying access frequency, or compiling statistics on members' service usage.
② In operating the service, various information may be provided to site members via service screens, KakaoTalk, telephone, e-mail, SMS, postal mail, etc. Informational content that must be provided mandatorily will be provided regardless of whether consent to receive is obtained.
③ Items of Personal Information Collected
Name, date of birth, shipping address, email address, mobile phone number, app device ID
④ Retention Period of Collected Personal Information
Until the withdrawal of consent for the relevant service
■ Rights of Users and Legal Representatives and How to Exercise Them
o Users may view or modify their registered personal information at any time and may also request account termination. o To view or modify your personal information, please click "Change Personal Information" (or "Edit Member Information," etc.). To cancel your membership (withdraw consent), please click "Withdraw Membership." After completing the identity verification process, you can directly view, correct, or withdraw your information.
o Alternatively, if you contact the Chief Privacy Officer in writing, by phone, or by email, we will take action without delay.
o If you request a correction regarding errors in your personal information, we will not use or provide the relevant personal information until the correction is completed. Furthermore, if incorrect personal information has already been provided to a third party, we will notify the third party of the correction results without delay to ensure that the correction is made.
o The Company processes personal information that has been terminated or deleted at the user's request in accordance with the "Retention and Usage Period of Personal Information Collected by the Company" and ensures that it cannot be viewed or used for any other purpose.
■ Procedures and Methods for Destruction of Personal Information
The Company destroys personal information when the purpose of its collection and use is achieved or the retention period expires. The procedures and methods for destruction are as follows. However, exceptions apply if the relevant personal information must be preserved under other laws. ① Destruction Procedure
Information entered by users is transferred to a separate database (or separate documents in the case of paper records) after the purpose is achieved. It is stored for a certain period in accordance with internal policies and other relevant laws and regulations, and then destroyed immediately. At this time, personal information transferred to the database will not be used for any other purpose unless required by law.
② Destruction Deadline
Users' personal information is destroyed within 5 business days from the end of the retention period if the retention period has expired. If the personal information becomes unnecessary due to the achievement of the purpose of processing, the discontinuation of the relevant service, or the termination of the business, it is destroyed within 5 business days from the date it is deemed unnecessary to process. In the case of children under the age of 14, if a legal representative refuses or consent cannot be confirmed, the relevant personal information is destroyed within 5 business days from the date of collection.
③ Method of Destruction
Information in the form of electronic files is destroyed using technical methods that prevent the records from being reproduced. Personal information printed on paper is destroyed by shredding or incineration.
■ Measures to Ensure the Safety of Personal Information
Heart Locket takes the following measures to ensure the safety of personal information:
◦ Administrative Measures: Establishment and implementation of internal management plans, regular training for employees and staff, etc.
◦ Technical Measures: Access control management, such as setting passwords for personal information processing systems (or computers where personal information is stored), installation of security programs such as antivirus software, encryption of files containing personal information
◦ Physical Measures: Locking of locations where personal information is stored, access control, etc.
■ [Illegible]