Privacy Policy

HERA ESTHÉ processes personal data for the purposes below. Personal data is not used for any purpose other than those stated, and if a purpose changes, prior consent will be obtained.

1. Booking and confirmation: verifying the person making the booking, providing booking details, and notifying confirmation, changes or cancellation

2. Treatment consultation: responding to enquiries and following up on them

3. Payment and refunds: processing treatment payments and refunds, and retaining transaction records

4. Marketing messages: sending event and offer emails only to those who have given separate consent

5. Stable operation of the service: preventing abuse and blocking abnormal requests

1. When booking (required): name, phone number, email address, language, booking and payment records, and the time at which the refund policy was accepted

2. When booking (optional): consent to receive marketing messages

3. When making an enquiry (required): name, email address, enquiry content

4. When making an enquiry or booking (optional): phone number (enquiry), and the AI consultation conversation immediately preceding the enquiry or booking

5. When using the AI consultation: the conversation content entered by the customer

6. Data generated automatically during use of the service: access IP address (to prevent abuse and limit the number of requests)

7. When you allow reply notifications for an enquiry (optional): the notification address (the push address and encryption keys created by your browser)

HERA ESTHÉ does not collect resident registration numbers, and does not collect sensitive data such as health or genetic information through this website.

HERA ESTHÉ processes and retains personal data within the retention period required by law or the period consented to by the data subject.

1. Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)

2. Records on payment and supply of goods or services: 5 years (Act on Consumer Protection in Electronic Commerce)

3. Records on consumer complaints or dispute resolution: 3 years (Act on Consumer Protection in Electronic Commerce)

4. Website enquiry content: 3 years from the date of receipt

5. AI consultation conversation content: 6 months from the date of collection

6. Marketing consent information: until consent is withdrawn or the customer record is deleted

7. Notification address for enquiry replies: 6 months from the date the enquiry was received

Personal data whose retention period has expired is destroyed without delay.

HERA ESTHÉ processes personal data only within the scope stated in Section 1, and does not provide it to third parties without the data subject's consent or a specific provision of law.

However, personal data may be provided in the following cases in accordance with the law.

1. Where the data subject has given separate prior consent

2. Where there is a special provision of law, or where an investigative authority requests it in accordance with the procedures and methods prescribed by law

HERA ESTHÉ outsources personal data processing tasks as follows in order to provide the service smoothly.

1. Google LLC: service operation and data storage (cloud infrastructure). Data is stored in the Seoul region of the Republic of Korea.

2. Google LLC: generation of AI consultation responses and multilingual translation

3. Resend, Inc.: sending booking confirmation and notification emails

4. Payment gateway provider: authorisation and refund of card and other payment methods

When concluding an outsourcing agreement, HERA ESTHÉ specifies in writing the matters concerning the safe management of personal data and supervises whether the contractor processes personal data safely. If the content of the outsourced work or the contractor changes, this will be disclosed through this Policy.

HERA ESTHÉ transfers personal data overseas as follows in order to provide the service.

1. Recipient: Google LLC (United States) / Items transferred: AI consultation conversation content, enquiry content and replies requiring translation / Purpose: generating AI consultation responses and multilingual translation / Method: transmitted over the network at the time of use / Retention: until the purpose of processing is achieved Note: Google may use the content it receives to improve its services.

2. Recipient: Resend, Inc. (United States) / Items transferred: email address, booking details included in the email (booking number, treatment, booking date and time, amount paid, payment method, cancellation date and time), and enquiry content and replies / Purpose: sending booking confirmation and notification emails / Method: transmitted over the network at the time of sending / Retention: until the purpose of sending is achieved

3. Recipient: the operator of your browser's push notification service (Google LLC, Apple Inc., Mozilla Corporation or Microsoft Corporation, as applicable — United States) / Items transferred: notification address and an encrypted notification (a notice that a reply has arrived — the reply itself is not included) / Purpose: delivering enquiry reply notifications / Method: transmitted over the network at the time of the reply / Retention: until the purpose of delivery is achieved

Data subjects may refuse the overseas transfer of their personal data. Please note that in that case, some services such as the AI consultation, multilingual guidance and email booking confirmation may be restricted. To refuse, please contact the Data Protection Officer below.

Data subjects may exercise the following rights in relation to HERA ESTHÉ at any time.

1. Request access to personal data

2. Request correction where there are errors

3. Request deletion

4. Request suspension of processing

These rights may be exercised by telephone or through the enquiry form on this website, and HERA ESTHÉ will act without delay. Where a data subject requests correction of an error in their personal data, HERA ESTHÉ will not use or provide that personal data until the correction is complete.

HERA ESTHÉ does not collect personal data from children under the age of 14 without the consent of their legal representative.

If you have consented to receive marketing messages, you may withdraw that consent at any time via the unsubscribe link at the bottom of every email sent.

HERA ESTHÉ destroys personal data without delay once the retention period has expired or the purpose of processing has been achieved.

Where personal data must continue to be retained under other laws, it is transferred to a separate database or stored in a different location.

1. Destruction procedure: personal data for which grounds for destruction have arisen is selected and destroyed with the approval of the Data Protection Officer.

2. Destruction method: information in electronic file form is deleted using technical methods that make recovery impossible, and paper documents are shredded or incinerated.

HERA ESTHÉ takes the following measures to ensure the security of personal data.

1. Administrative measures: the number of staff handling personal data is kept to a minimum, and access rights are granted separately according to each role.

2. Technical measures: the administration screens can only be accessed by authenticated users, and the items that can be viewed are restricted according to permission level. All communication between this website and the server is encrypted (HTTPS).

3. Physical measures: the servers on which personal data is stored are located in access-controlled data centres operated by the cloud provider.

The HERA ESTHÉ website does not use cookies. The display language is set by the web address (e.g. /ko/, /en/), and the site uses only the browser storage described below, to the minimum extent necessary for its use.

1. Storage erased when you close the window (session storage): used to keep the AI consultation conversation and its language when you return, to confirm your payment progress when you come back from the payment window, and to mark the switch from a browser inside a messenger app to your default browser.

2. Storage kept after you close the window (local storage): stores your AI consultation session number (a randomly generated number that is saved with your enquiry or booking when you submit one) and whether you dismissed a notice banner. It is erased when you delete the site data in your browser.

3. If you send an enquiry: the enquiry number and chat key are saved in local storage so that you can reopen the chat on this device, and if you allow reply notifications, your browser installs a notification receiver (service worker). Turning off this site's notifications or deleting the site data in your browser settings removes them.

HERA ESTHÉ does not use behavioural advertising trackers or third-party analytics tools.

If you do not want browser storage to be used, you may delete site data or block storage in your browser settings. Please note that in that case some functions, such as continuing your AI consultation conversation, may not work correctly.

HERA ESTHÉ has designated a Data Protection Officer as set out below, who is responsible for overseeing personal data processing and for handling complaints and remedying damage in relation to personal data processing.

[Myeongdong] Data Protection Officer: Kim Byung-hee (Representative) · Contact: 010-6740-4061 · Email: hera15223360@gmail.com

Address: 6F, With Building, 5 Myeongdong 3-gil, Jung-gu, Seoul

[Incheon Airport] Data Protection Officer: Na Jae-seon (Representative) · Contact: 1522-3660 · Email: hera15223360@gmail.com

Address: #304, Blue Square, 6 Yeongjong-daero 162beon-gil, Yeongjong-gu, Incheon

Data subjects may contact the Data Protection Officer with any enquiries, complaints or requests for remedy relating to personal data protection that arise while using the service. HERA ESTHÉ will respond and act without delay.

Data subjects may apply to the following bodies for dispute resolution or consultation in order to obtain remedy for personal data infringement.

1. Personal Information Infringement Report Centre: 118 (privacy.kisa.or.kr)

2. Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)

3. Supreme Prosecutors' Office Cyber Investigation Division: 1301 (spo.go.kr)

4. National Police Agency Cyber Bureau: 182 (ecrm.police.go.kr)

A person whose rights or interests have been infringed by a disposition or omission by the head of a public institution in response to a request under Articles 35 (access to personal data), 36 (correction or deletion of personal data) or 37 (suspension of processing of personal data) of the Personal Information Protection Act may request an administrative appeal as provided by the Administrative Appeals Act.

This Privacy Policy applies from the effective date.

Where content is added, deleted or amended in response to changes in law or in the service, the change will be announced on this website at least 7 days before it takes effect. Where a change materially affects the rights of data subjects, it will be announced at least 30 days in advance.