Privacy policy

Iluka ("we") runs the Gaia Iluka online store (gaiailuka.com). We publish this policy under Korea's Personal Information Protection Act to protect your personal information and handle any concern quickly.

1. Why we process personal information

1. Orders: confirmation, payment, delivery, exchanges, returns and refunds.
2. Customer enquiries: reading and answering your messages and complaints.
3. The Gaia Iluka Letter: emails with harvest news, new releases and other promotional content, for people who subscribe.
4. Product reviews: asking for, collecting and showing reviews of products you bought.
5. Partner programme: tracking purchases made through a partner's or creator's link so we can pay their commission.
6. Running the site: security, fraud prevention and visit statistics.

2. What we collect

1. When you order (required): name, email address, phone number, delivery address and order details.
2. Payment: handled by our payment provider; we do not store card numbers.
3. When you contact us: name, email address and your message (optional: phone number). If you chat with us on KakaoTalk: your KakaoTalk profile name and the conversation.
4. When you subscribe to the Letter: email address.
5. When you write a review (optional): name, email address, rating, review text and any photos.
6. Automatically when you use the site: IP address, device and browser information, cookies, visit history and the referral link you arrived through.

3. How long we keep it
We delete personal information as soon as its purpose is fulfilled, except where the law requires us to keep it:

• records of advertising and labelling: 6 months
• records of contracts and withdrawals: 5 years
• records of payment and delivery: 5 years
• records of complaints and disputes: 3 years

(under article 6 of the E-Commerce Consumer Protection Act and article 6 of its Enforcement Decree)

• Letter subscription: until you unsubscribe
• Published reviews: until you ask us to remove them

4. How we delete it
Electronic files are deleted so they cannot be recovered; paper is shredded or burned. Records we must keep by law are stored separately.

5. Sharing with third parties
We do not give your personal information to anyone beyond the purposes in section 1, unless you agree or the law specifically requires it.

6. Service providers

Provider	Task
Shopify Inc. and affiliates (Shopify)	Online store hosting, order processing and customer data storage
Toss Payments Co., Ltd.	Payment processing and purchase-safety (escrow) service
CJ Logistics Corporation (CJ대한통운)	Parcel delivery and returns
Judge.me Ltd	Sending review requests and showing product reviews
Junip, Inc.	Collecting and showing product reviews
Secomapp (UpPromote)	Tracking partner referrals and calculating commission

7. Transfers abroad
To conclude and perform our contract with you, we transfer personal information abroad as follows, disclosed under article 28-8(1)(3) of the Personal Information Protection Act. Each transfer happens over the internet whenever you use the site, order, contact us, subscribe or write a review.

Recipient and contact	Country	Information	Purpose	Retention
Shopify Inc. and affiliates (shopify.com/legal/privacy)	Canada, the United States and other countries where Shopify runs data centres	Order and contact details (name, email, phone, address), order history, connection data	Running the store, processing orders, storing data	As in section 3, or until the service contract ends
Meta Platforms, Inc. (facebook.com/privacy/policy)	United States and others	Cookies, visit, product view and purchase events, device and browser data	Measuring advertising	Under the company's policy
Metricool Software, S.L. (metricool.com/privacy-policy)	Spain	Cookies, visit history, device and browser data	Visit statistics	Under the company's policy
Google LLC (policies.google.com/privacy)	United States and other countries where Google runs data centres	Cookies, visit history, pages and products viewed, add-to-cart and purchase events, device and browser data, approximate location from IP address	Visit statistics (Google Analytics) and measuring advertising and product listings (Google Merchant Center)	Google Analytics: up to 14 months; otherwise under the company's policy
Judge.me Ltd (judge.me/privacy)	United Kingdom, United States	Name, email address, products ordered, reviews you write	Review requests and showing reviews	Until the service contract ends or you ask us to remove your review
Junip, Inc. (junip.co)	United States	Name, email address, products ordered, reviews you write	Collecting and showing reviews	Until the service contract ends or you ask us to remove your review
Secomapp, UpPromote (uppromote.com)	United States	Order details (customer ID, name, email, phone, address), referral cookie	Partner referral tracking and commission	Until the service contract ends

You may ask us not to transfer your information abroad. Because Shopify is needed to process orders, refusing that transfer means you cannot order online. You can refuse the Meta, Metricool, Google and UpPromote transfers through your browser's cookie settings, and the review transfers by not writing a review and asking us not to send review requests.

8. Your rights
You can ask at any time to see, correct, delete or stop the processing of your personal information, and withdraw your consent. Email or call us and we will act without delay. You may also act through a representative. You can unsubscribe from the Letter at any time with the link at the bottom of each email.

9. Cookies
We use cookies to keep your cart, keep you signed in, count visits, measure advertising and recognise partner referrals. You can refuse or delete cookies in your browser settings; some features, such as the cart, may then not work.

10. Security
We limit access to personal information to the people who need it, encrypt all connections (HTTPS) and process payments only through our payment provider.

11. Privacy officer

• Name: 여효진 (Yeo Hyo-jin), representative
• Contact: Info@gaiailuka.com · 063-252-2244

12. Where to get help

• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, 118
• Personal Information Dispute Mediation Committee: www.kopico.go.kr, 1833-6972
• Supreme Prosecutors' Office: www.spo.go.kr, 1301
• Korean National Police Agency: ecrm.police.go.kr, 182

13. Children
We do not collect personal information from children under 14.

14. Changes
This policy applies from 27 October 2026. We announce changes on this page at least 7 days before they take effect. Previous version: 19 to 26 October 2026.