Privacy Policy

Who We Are (Controller)

KCOS (“we”, “us”, “our”) is the data controller for the personal data processed via this website and online store.

We operate this store to provide K-beauty products to customers in the EU, UK and internationally.

Scope

This Privacy Policy applies to personal data collected when you browse our website, create an account, place an order, contact support, or subscribe to our communications.

Personal Data We Collect

• Identity & contact: name, email, billing and shipping address, phone.
• Order & account: items purchased, order history, preferences, saved addresses.
• Payment: payment method, transaction details. We do not store full card numbers. Payments are processed securely by our payment providers.
• Device & usage: IP address, browser type, device identifiers, pages viewed, interactions (see Cookies).
• Communications: messages sent to customer support, forms, reviews.
• Marketing: your newsletter preferences and engagement metrics.

We collect data directly from you, automatically via your device, and from service providers (e.g., payment, fulfilment, analytics) who act on our instructions.

Legal Bases (GDPR / UK GDPR)

• Contract: to process and deliver your orders, manage your account.
• Legitimate interests: to prevent fraud, keep our Services secure, improve our site, and promote compatible offers (you can object at any time).
• Consent: for optional cookies/analytics/marketing emails. You may withdraw consent at any time.
• Legal obligation: to meet tax, accounting, and regulatory requirements.

How We Use Your Data

• Provide and improve our Services (ordering, shipping, customer support).
• Personalise your experience (recommendations, saved preferences).
• Communicate with you (order updates, responses to enquiries, marketing with consent).
• Ensure safety, prevent abuse/fraud, and comply with legal obligations.

Who We Share Data With

We share personal data with:

• Platform & hosting: Shopify (store infrastructure).
• Payments: Shopify Payments / Stripe / PayPal (as applicable).
• Fulfilment & logistics: carriers and warehousing partners.
• Analytics/marketing: tools we use with consent (see Cookies).
• Authorities: when required by law or to protect our rights.

Relationship with Shopify

Our store is hosted by Shopify Inc. Shopify generally acts as our processor. In certain cases (e.g., fraud prevention, platform diagnostics), Shopify may act as an independent controller. Learn more in Shopify’s Privacy Policy and manage rights via their Privacy Portal.

Cookies & Similar Technologies

We use essential cookies to run our site and, with your consent, analytics/advertising cookies to understand performance and show relevant offers.

• Essential: required for checkout, security, load balancing.
• Analytics: traffic and performance measurement (aggregated).
• Marketing: personalised offers and retargeting (where permitted).

You can manage your preferences at any time: Cookie Settings. For more detail, see our Cookie Policy.

International Transfers

Your data may be processed outside your country (including the Republic of Korea and other locations of our providers). We use appropriate safeguards such as adequacy decisions (where available), Standard Contractual Clauses (SCCs) and the UK IDTA to protect your data.

Data Retention

We keep personal data only as long as necessary for the purposes described above:

• Orders and invoices: typically 6–10 years (tax/accounting laws).
• Accounts: while active; we may anonymise after a reasonable inactivity period.
• Support messages: typically 24 months.
• Marketing consents: until you unsubscribe or withdraw consent.

We then delete or irreversibly anonymise data.

Your Rights

Subject to your location and applicable law, you may have the right to access, rectify, erase, restrict or object to processing, and to data portability. Where we rely on consent, you may withdraw it at any time.

To exercise rights, contact us at contact@k-cos.co.uk. You can also unsubscribe from marketing using the link in our emails.

You have the right to lodge a complaint with a supervisory authority:
• UK: Information Commissioner’s Office (ICO) — ico.org.uk
• EU: your local Data Protection Authority — EDPB list

Security

We apply industry-standard technical and organisational measures to protect your data. No system is 100% secure; please keep your credentials confidential and contact us if you suspect unauthorised activity.

Children

Our Services are not directed to minors. We do not knowingly collect data from children. If you believe a minor provided personal data, please contact us to delete it.

Changes to this Policy

We may update this Policy from time to time. We will post the new version here and update the “Last updated” date.

Contact

Questions or privacy requests: