Privacy policy

McQueens Flowers Privacy Policy

Paul & Sandra Co., Ltd. ("the Company") operates the McQueens Flowers website (kr.mcqueensflowers.com, "the Website"). In accordance with Article 30 of the Korean Personal Information Protection Act, the Company has drawn up and publishes this privacy policy to protect the personal information of data subjects and to deal with related complaints quickly and smoothly.

Effective date: 14 October 2026

Article 1 (Purposes of processing personal information)
The Company processes personal information for the following purposes and does not use it for any other purpose. If a purpose changes, the Company takes the necessary steps, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.
1. Processing orders and flower school course bookings: performing the contract, payment, delivery and course information
2. Answering enquiries about classes, weddings, events, flower orders and similar
3. Sending notifications you have asked for: back-in-stock alerts and the newsletter
4. Member management: identity checks and account management when you create an account
5. Website analytics and service improvement, security and prevention of misuse
6. Marketing and advertising information (only where you have separately agreed)

Article 2 (Personal information processed)
1. Orders: name, email, mobile number, delivery address, order and payment history
2. Course bookings: name, email, mobile number, course history
3. Enquiries: name, email, phone number (optional), the content of the enquiry and, for wedding and event enquiries, the event date and venue
4. Back-in-stock alerts: mobile number or email, and the product requested
5. Newsletter: email
6. Information created and collected automatically: access records, IP address, cookies, device and browser information, pages visited and usage records (clicks, scrolling, mouse movements) (see Article 10)
The Company does not collect resident registration numbers, credit information or card numbers.

Article 3 (Processing and retention periods)
(1) The Company destroys personal information without delay once the purpose of processing has been achieved. Retention periods by type:
1. Order and course information: until the contract has been performed (the legal retention periods in (2) apply)
2. Enquiries: 1 year after we have replied
3. Back-in-stock alert requests: until the alert has been sent or the request is cancelled
4. Newsletter subscription: until you unsubscribe
5. Member information: until you close your account
6. Website analytics (Microsoft Clarity): session recordings 30 days, heatmaps and statistics 9 months
(2) Where the law requires, the following are kept for these periods:
- Records of contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce)
- Records of payment and supply of goods: 5 years (same Act)
- Records of consumer complaints or dispute handling: 3 years (same Act)
- Records of labelling and advertising: 6 months (same Act)
- Website visit records: 3 months (Protection of Communications Secrets Act)
(3) Personal information kept under the law is stored and managed separately from other personal information.

Article 4 (Provision of personal information to third parties)
(1) The Company processes personal information only within the purposes in Article 1, and provides it to third parties only where Articles 17 and 18 of the Personal Information Protection Act allow, such as with the data subject's consent or under a special provision of law.
(2) The Company provides personal information to third parties as follows:
1. Microsoft Corporation (USA): Microsoft Clarity, Microsoft Advertising
- Purpose: website analytics and improvement, security, measuring advertising
- Information provided: cookie identifiers, device and browser information, IP address, pages visited and usage records (clicks, scrolling, mouse movements). Anything you type into form fields (name, contact details, email and so on) is not provided.
- Retention: session recordings 30 days, heatmaps and statistics 9 months
- Basis: the data subject's consent through the cookie settings banner. If you do not consent, you can still use the website without restriction.
2. Shopify Inc. and its affiliates (Canada, USA and others)
- In addition to the tasks entrusted to it under Article 5, Shopify may process personal information for its own purposes, such as fraud prevention and service improvement, under the Shopify Consumer Privacy Policy.
- Details: https://www.shopify.com/legal/privacy/app-users / exercising your rights: https://privacy.shopify.com/en

Article 5 (Entrusting the processing of personal information)
(1) To run its business smoothly, the Company entrusts the processing of personal information as follows:
- Shopify Inc. and its affiliates: running and hosting the website (online shop), storing order and customer information, sending order notifications
- Microsoft Corporation (Microsoft 365): receiving and storing email (including enquiry emails)
- Appikon Software Pvt Ltd (Subscribe It app): receiving and sending back-in-stock alerts
(2) When entering into entrustment contracts, the Company sets out in the contract or other documents, under Article 26 of the Personal Information Protection Act, the ban on processing personal information beyond the entrusted tasks, technical and managerial safeguards, restrictions on re-entrustment, management and supervision of the processor, and liability for damages, and it supervises whether processors handle personal information securely.
(3) If the entrusted tasks or the processors change, the Company publishes the change in this privacy policy without delay.

Article 6 (Transfer of personal information abroad)
(1) The Company transfers personal information abroad as follows (including storage abroad, entrusted processing and provision to third parties). Transfers take place over the network whenever the service is used.

1. Shopify Inc. and its affiliates
- Countries: Canada, the USA and other countries where Shopify has data centres
- Information: the order, course booking, enquiry and newsletter information in Article 2, and automatically collected information
- Purpose and retention: running the website and storing information / the retention periods in Article 3
- Contact: privacy@shopify.com

2. Microsoft Corporation (Microsoft 365)
- Countries: the UK or EU countries (Microsoft data centres)
- Information: the name, contact details and content of enquiry emails
- Purpose and retention: receiving and storing email / 1 year after we have replied
- Contact: https://aka.ms/privacyresponse

3. Microsoft Corporation (Microsoft Clarity, Microsoft Advertising)
- Country: USA
- Information: cookie identifiers, device and browser information, IP address, pages visited and usage records
- Purpose and retention: website analytics and improvement, security, measuring advertising / session recordings 30 days, heatmaps and statistics 9 months
- Contact: https://aka.ms/privacyresponse

4. Appikon Software Pvt Ltd (Subscribe It app)
- Country: USA
- Information: mobile number or email, and the product requested
- Purpose and retention: sending back-in-stock alerts / until the alert has been sent or the request is cancelled
- Contact: https://appikon.com/contact

(2) Legal basis
- 1, 2 and 4: entrustment and storage needed to conclude and perform a contract with the data subject, disclosed in this privacy policy (Article 28-8(1)(3) of the Personal Information Protection Act)
- 3: the data subject's consent through the cookie settings banner (Article 28-8(1)(1))
(3) How to refuse, and the consequences
- If you refuse transfers 1, 2 and 4, we cannot provide the services concerned, such as orders, replies to enquiries and back-in-stock alerts.
- You can refuse transfer 3 in the cookie settings banner or in your browser settings (Article 10); refusing does not restrict your use of the website.

Article 7 (Procedure and method of destruction)
(1) The Company destroys personal information without delay when the retention period has passed or the purpose has been achieved.
(2) Personal information that must be kept under the law is moved to a separate database or stored in a separate place.
(3) Electronic files are permanently deleted so that they cannot be recovered; paper documents are shredded or incinerated.

Article 8 (Rights and obligations of data subjects and legal representatives, and how to exercise them)
(1) Data subjects may at any time ask the Company to let them see, correct or delete their personal information, to stop processing it, to withdraw consent, to transmit their personal information, and to refuse or explain automated decisions.
(2) You can exercise these rights by email (info.kr@mcqueensflowers.com) or by phone (02-6447-6276), and the Company will act without delay.
(3) You can exercise these rights through a representative, such as a legal representative or a person you have authorised; in that case, a power of attorney must be submitted.
(4) Where consent is needed to process the personal information of a child under 14, the Company obtains the consent of the legal representative.

Article 9 (Measures to keep personal information secure)
Under Article 29 of the Personal Information Protection Act, the Company takes the following security measures:
1. Managerial measures: keeping the number of staff who handle personal information to a minimum, and training them
2. Technical measures: access rights management, access control, encryption in transit (HTTPS), keeping and checking access records, security software

Article 10 (Installation, operation and refusal of devices that collect personal information automatically)
(1) The Company uses cookies and browser storage to provide the website's basic functions and to analyse how it is used so that it can be improved. A cookie is a small text file that a website sends to your browser.
(2) Types and purposes of cookies
1. Essential cookies (Shopify): the website's basic functions, such as the bag, checkout, security and language and country settings
2. Analytics cookies (Shopify; Microsoft Clarity's _clck, _clsk and others): visit statistics and usage analysis, improving the website through heatmaps and session recordings
3. Advertising cookies (Shopify, Microsoft Advertising): measuring advertising
4. Browser storage: your saved favourites and language choice are stored only in your browser and are not sent to the Company.
(3) Collection of behavioural information: through Microsoft Clarity, the Company automatically collects records of how you use the website (behavioural information), such as pages visited, clicks, scrolling and mouse movements, and uses them to improve the website and to measure advertising. Session recordings are kept for 30 days, heatmaps and statistics for 9 months. Anything you type into form fields is not collected.
(4) How to refuse: you can choose whether to accept cookies. You can decline analytics and advertising cookies in the cookie settings banner shown when you visit the website, and you can refuse or delete cookies in the cookie (privacy) menu of your web browser's settings. If you refuse essential cookies, some functions, such as the bag and checkout, may not work.

Article 11 (Data protection officer and complaints)
(1) The Company has appointed the following data protection officer to oversee the processing of personal information and to handle related complaints and remedies:
- Data protection officer: Bong Mi Park (박봉미)
- Contact: 02-6447-6276, info.kr@mcqueensflowers.com
(2) You can contact the data protection officer with any question, complaint or request for remedy about personal information, and the Company will reply and act without delay.

Article 12 (Remedies for infringement of rights)
To seek a remedy for an infringement of your personal information, you can apply for dispute resolution or advice to the following bodies:
- Personal Information Dispute Mediation Committee: 1833-6972 (no area code), www.kopico.go.kr
- Personal Information Infringement Report Center: 118 (no area code), privacy.kisa.or.kr
- Supreme Prosecutors' Office: 1301 (no area code), www.spo.go.kr
- Korean National Police Agency: 182 (no area code), ecrm.police.go.kr

Article 13 (Changes to this privacy policy)
This privacy policy applies from 14 October 2026. If it changes, we will announce the change on the website at least 7 days before it takes effect. You can ask for the previous privacy policy (published on 9 July 2026) at info.kr@mcqueensflowers.com.

This English version is a translation provided for convenience. If it differs from the Korean version, the Korean version applies.