Privacy Policy

This Privacy Policy explains how Hanahreum — a brand operated by LOMF, an individual business registered in Seoul, Republic of Korea (business registration no. 774-14-01878) (“Hanahreum,” “we,” “us,” or “our”) — collects, uses, shares, and protects personal information through the website rug.hanahreum.asia (the “Site”). We have written it to reflect the requirements of the privacy laws of the jurisdictions our visitors come from, including the Republic of Korea, the United States, Australia, Canada, and the United Arab Emirates.

1. Who we are

The controller responsible for your personal information is:

• Business: LOMF — an individual business (sole proprietorship) registered in the Republic of Korea
• Business registration no.: 774-14-01878
• Brand: Hanahreum
• Address: 599, Achasan-ro, Gwangjin-gu, Seoul 04968, Republic of Korea
• Privacy contact / Personal Information Protection Officer: Nick Yie — nicknicksmart@gmail.com · +82 10-7683-9905

2. Scope of this policy

This policy applies only to the Site (rug.hanahreum.asia), which is a brand and business-partnership website. It does not apply to purchases of our products made through third-party marketplaces such as Amazon. When you buy a Hanahreum product on Amazon or any other marketplace, that platform's own privacy policy governs the personal information you provide to it (such as payment, shipping, and order details). We never receive your payment card details through this Site.

3. Information we collect

Information you provide to us

When you submit our partnership / contact form, we collect the full name, company name (optional), email address, area of interest, and the message you choose to send. The form is processed using Google Forms (a service of Google LLC), so the information you enter is transmitted to and stored by Google on our behalf.

Information collected automatically

When you visit the Site, certain information is collected automatically:

• Usage and device data via Google Analytics 4 — including your IP address (typically truncated/anonymized by Google), device and browser type, pages viewed, referring pages, approximate location, and interactions, collected through cookies and similar technologies.
• Advertising and remarketing data via Google's advertising services (Google Ads / Google Signals) — used to measure campaigns and to show you Hanahreum advertising on other websites and apps (cross-context behavioral advertising).
• Server and security logs — the Site is hosted on GitHub Pages (GitHub, Inc.), which may record standard technical information such as IP address and request details for delivery and security.

We use a Naver Search site-verification meta tag to verify ownership of the Site with the Naver search engine. It does not collect personal information about you.

We do not intentionally collect special categories of sensitive personal information (such as health, religion, precise geolocation, or government identifiers) through this Site, and we ask that you do not include such information in the free-text message field.

4. How we use information

We use personal information for the following purposes:

• To respond to your inquiry and to evaluate, establish, and manage a potential business or partnership relationship with you.
• To measure and improve the performance, content, and user experience of the Site (analytics).
• To market our brand, including advertising and remarketing on third-party platforms.
• To operate and secure the Site, prevent abuse, and maintain technical reliability.
• To comply with applicable laws and respond to lawful requests or to establish, exercise, or defend legal claims.

5. Legal bases for processing

Where the law requires us to identify a legal basis, we rely on:

• Your consent — for non-essential cookies, analytics, and advertising / remarketing. You can withdraw consent at any time (see Section 6).
• Performance of, or steps toward, a contract — to respond to your partnership inquiry at your request.
• Legitimate interests — to keep the Site secure and functioning, and to understand how it is used, balanced against your rights.
• Legal obligation — where we must process information to meet a legal requirement.

6. Cookies, analytics & advertising

The Site uses cookies and similar technologies through Google Analytics 4 and Google's advertising services (Google Ads / Google Signals). These technologies can identify your browser or device, analyze your activity, and build an interest profile used for targeted (cross-context behavioral) advertising.

How to control or deactivate these technologies

You can refuse or disable these technologies at any time using the following tools — they take effect on your browser or Google account without needing to contact us:

• Browser settings — block or delete cookies in your browser's privacy settings.
• Google Analytics Opt-out Browser Add-on — tools.google.com/dlpage/gaoptout.
• Google Ad settings (My Ad Center) — turn off personalized advertising at myadcenter.google.com and adssettings.google.com.
• Global Privacy Control (GPC) — you may use a browser or extension that sends a GPC signal; where required by law we treat it as a request to opt out of the “sharing” of your personal information for advertising.
• Contact us — email nicknicksmart@gmail.com and we will act on your request to stop analytics or advertising processing associated with you.

For more on how Google processes data, see How Google uses information from sites that use its services and the Google Privacy Policy.

7. How we share information

We do not sell your personal information for money. We share personal information only with the service providers that operate the Site on our behalf, and only as needed:

• Google LLC (United States) — Google Forms (contact-form submissions), Google Analytics 4 (usage data), and Google advertising services (advertising / remarketing).
• GitHub, Inc. (United States) — website hosting (GitHub Pages) and associated server logs.

Because the Site shares online identifiers with Google for cross-context behavioral advertising, this activity may be considered a “sale” or “share” under certain U.S. state laws even though no money is exchanged. See Section 12 for how to opt out. We may also disclose information where required by law or to protect our legal rights.

8. International data transfers

We are based in the Republic of Korea, and our service providers (Google and GitHub) are based in the United States and may process your information in the United States and other countries where they operate. As a result, your personal information may be transferred outside your country of residence — including outside Korea, the EEA/UK, Australia, Canada, and the UAE — to countries whose data-protection laws may differ from your own, and where government authorities may, under local law, be able to access it.

Where such transfers occur, we rely on the safeguards and contractual data-protection terms offered by Google and GitHub, and, where required, on your consent or on the necessity of the transfer to provide the service you requested.

9. Data retention

• Contact-form submissions are kept for as long as necessary to handle your inquiry and any resulting relationship, and are then deleted, unless a longer period is required by law.
• Analytics and advertising data are retained according to the retention controls configured in Google Analytics (by default between 2 and 14 months) and in line with Google's policies.
• Server logs are retained for a limited period for security and operational purposes.

10. Security

We take reasonable technical and organizational measures designed to protect personal information against unauthorized access, loss, alteration, or disclosure, and we rely on the security measures of the established providers (Google, GitHub) we use. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Your privacy rights

Depending on where you live, you may have some or all of the following rights regarding your personal information:

• Access the personal information we hold about you
• Correct / rectify inaccurate or incomplete information
• Delete / erase your personal information
• Restrict or object to, or request that we stop, certain processing
• Withdraw consent at any time, without affecting prior processing
• Data portability — receive your data in a portable format
• Opt out of the sale or sharing of personal information and of targeted advertising
• Not be discriminated against for exercising your rights
• Lodge a complaint with your data-protection authority

To exercise any of these rights, email us at nicknicksmart@gmail.com. We will respond within the time required by applicable law. We may need to verify your identity before acting on a request. You may also use an authorized agent where the law permits.

12. Do Not Sell or Share My Personal Information (United States)

We do not sell your personal information for money. However, our use of Google advertising / remarketing may be treated as “sharing” (or a “sale”) for cross-context behavioral advertising under U.S. state privacy laws such as the California Consumer Privacy Act (as amended by the CPRA). You can opt out of this activity by:

• Turning off personalized advertising in Google My Ad Center and using the Google Analytics Opt-out Add-on;
• Enabling a Global Privacy Control (GPC) signal in your browser, which we honor as an opt-out where required by law; or
• Emailing nicknicksmart@gmail.com with the subject “Do Not Sell or Share My Personal Information.”

As a business that operates exclusively online, we accept these requests by email and do not maintain a toll-free number. We will not discriminate against you for exercising this right.

13. Children's privacy

The Site is intended for businesses and adults and is not directed to children. We do not knowingly collect personal information from children under 13 (or under 14 where Korean law applies). If you believe a child has provided us personal information, contact us and we will delete it.

14. Region-specific notices

Republic of Korea (PIPA)

We process personal information in accordance with the Personal Information Protection Act (PIPA). Our Personal Information Protection Officer is Nick Yie (nicknicksmart@gmail.com). Your personal information is transferred overseas to Google LLC and GitHub, Inc. (United States) for the purposes, items, and retention periods described above; by using the contact form and the Site you are informed of this overseas transfer. You may access, correct, delete, or suspend the processing of your personal information, and withdraw consent, at any time. You may report concerns to the Korea Internet & Security Agency Privacy Infringement Report Center (call 118 / privacy.kisa.or.kr), the Personal Information Dispute Mediation Committee (kopico.go.kr), or the Personal Information Protection Commission (pipc.go.kr).

United States — California & other states

California residents have rights under the CCPA/CPRA to know, access, delete, and correct their personal information, and to opt out of its sale or sharing (see Section 12). The categories of personal information we collect are identifiers (name, email), commercial / professional information (company), and internet/network activity (usage and device data); the sources, purposes, and recipients are described in Sections 3, 4, and 7. We do not use sensitive personal information to infer characteristics. Residents of other U.S. states with comprehensive privacy laws have comparable rights, which you may exercise using the contact details above. You may complain to the California Privacy Protection Agency (cppa.ca.gov), the California Attorney General (oag.ca.gov), or your state attorney general.

Australia (Privacy Act & APPs)

We handle personal information consistent with the Australian Privacy Principles. The kinds of personal information we collect, and how we collect, hold, use, and disclose it, are described above. We are likely to disclose personal information to overseas recipients located in the United States (Google LLC and GitHub, Inc.). You may request access to or correction of your personal information, and opt out of direct marketing, by contacting us. If you have a complaint, please contact us first; if you are not satisfied, you may contact the Office of the Australian Information Commissioner (oaic.gov.au · 1300 363 992).

Canada (PIPEDA) & Quebec (Law 25)

We handle personal information in the course of commercial activity in accordance with PIPEDA and, for individuals located in Quebec, the Act respecting the protection of personal information in the private sector (Law 25). The person accountable for our personal-information practices, and to whom access requests and complaints may be sent, is Nick Yie (nicknicksmart@gmail.com). Your personal information is processed and stored outside Canada, in the United States (Google LLC, GitHub, Inc.), where it may be accessible to foreign authorities under local law. As noted in Section 6, we use technologies (Google Analytics, Google advertising / Signals) that can identify, locate, or profile you for analytics and advertising; you can deactivate them using the tools listed there. Quebec residents also have rights of access, rectification, erasure / de-indexing, data portability, and withdrawal of consent. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or, for Quebec, the Commission d'accès à l'information du Québec (cai.gouv.qc.ca).

United Arab Emirates (PDPL)

To the extent UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (and its forthcoming Executive Regulations) applies to our processing of UAE residents' personal data, we honor the rights it grants — including access, rectification, erasure, restriction, data portability, objection to automated processing/profiling, and withdrawal of consent. Transfers of your data to Google LLC and GitHub, Inc. (United States) are made on the basis of your consent and the contractual safeguards of those providers. UAE residents may raise concerns with the UAE Data Office (see the UAE government data-protection portal at u.ae; the Telecommunications and Digital Government Regulatory Authority, tdra.gov.ae, currently acts as a point of contact).

15. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page, and material changes will be reflected here. Your continued use of the Site after an update means you accept the revised policy.

16. How to contact us

For any question or request regarding this Privacy Policy or your personal information, contact our Privacy Officer:

• Email: nicknicksmart@gmail.com
• Phone: +82 10-7683-9905
• Post: Hanahreum (LOMF), 599, Achasan-ro, Gwangjin-gu, Seoul 04968, Republic of Korea