Updated: 15 October 2026. This policy covers the SEOUL REBEL store, orders, customer service and communications.
Data controller
SEOUL REBEL is operated by MY KOREAN BEAUTY SECRET – MKBS, a French SAS with share capital of €1,000, registered in Paris under number 940 404 791, at 6 rue d’Armaillé, 75017 Paris, France. For questions about your data or to exercise your rights, contact contact@seoul-rebel.com.
Data we process
Depending on how you use our services, we process contact details, billing and delivery addresses, account information, ordered products and variants, amounts, payment status, order and delivery history, return requests, customer-service correspondence and communication preferences. Payment providers process the details required for transactions; in the normal operation of the store, we do not receive your full card number or security code.
Technical data may include your IP address, browser, device, language, viewed pages, interactions and session identifiers. Statistics and advertising involving optional trackers depend on your consent choices. You do not need to provide sensitive personal data to buy clothing.
Sources of data
Data comes from information you enter, correspondence with us, purchases and returns, and technical events needed to run the store. Payment and delivery providers supply relevant status information. Optional analytics and advertising events depend on your choices. If you already joined the SEOUL REBEL waiting list, transferring data to the store’s tools preserves its purpose and your communication preferences.
Purposes and legal bases
- Orders, embroidery, payments, delivery and returns: performance of a contract and pre-contractual steps; contact details, order, variants, address and payment status.
- Purchase-related enquiries: performance of the contract; correspondence, relevant evidence and order number.
- Other enquiries: our legitimate interest in providing customer service; contact details and your message.
- Invoicing, accounting and legal duties: compliance with legal obligations; invoice information and supporting records.
- Security, fraud prevention and defence of rights: legitimate interests, subject to your rights; relevant technical and transaction data.
- Newsletters, offers and permitted marketing reminders: consent, or the applicable exception for existing customers concerning similar products, with an opportunity to opt out; email, consent and relevant selections or purchase history.
- Optional analytics and personalised advertising: prior consent; browsing events, identifiers and campaign parameters.
Order notifications do not require a marketing subscription. Cookie consent does not subscribe you to a newsletter. You can purchase without accepting optional trackers.
Recipients and providers
Data is available to authorised MKBS personnel and providers needed to operate the store: Shopify for hosting and merchant tools, payment providers selected at checkout, Caspar/Grafko-Caspar for embroidery and order fulfilment, and carriers for delivery. We share information needed for their task, not your entire profile with every recipient.
If the relevant features are enabled and you consent, Google and TikTok may receive analytics or advertising events. See Google’s privacy policy and TikTok’s privacy policy. Enabling these features does not subscribe you to our newsletter.
Shopify processes data as a processor and, for some platform features, as a separate controller. See its consumer privacy policy, privacy portal and privacy information. Social-media links take you to services with their own policies; an image linking to a social network is not an embedded social player.
We do not sell customer lists for partners’ marketing. Data may be disclosed to authorities or professional advisers where necessary and lawful.
Order tracking, returns and reviews
We use a management register in Google Sheets, supplied by Shopify Flow, to track orders, fulfilment, return requests and returned stock. Access is restricted to authorised people. This supports orders and returns and does not subscribe you to marketing. We limit entries to necessary information and do not store full card details there.
Where a provider creates a return label, only the data needed for routing and tracking is shared with that provider and the carrier. If you publish a review, its content and your displayed name or nickname may be public; your email address is not published with it. Do not include private contact details in a public comment.
Location and international transfers
Shopify, Google or TikTok services may involve processing or access outside the European Economic Area. Relevant transfers rely on GDPR mechanisms, including an adequacy decision or standard contractual clauses, depending on the recipient. Ask contact@seoul-rebel.com for details of applicable safeguards.
Retention
Data is retained only as long as needed for each purpose. Purchase information is kept during the customer relationship and warranty management; necessary records are subsequently archived with restricted access for legal obligations and legal claims. Accounting records are retained for ten years. Contract evidence is kept according to applicable limitation and archiving rules, including those for electronic contracts of at least €120.
Marketing data is kept until you withdraw consent or object and, without further relevant contact, for no more than three years after collection or the prospect’s last contact; for customers, three years after the relationship ends. A limited suppression list records opt-outs. Merely opening an email does not restart this period. Actual tracker lifetimes are described in the cookie module and inventory.
Your rights
Subject to legal conditions, you may request access, correction, erasure, restriction and portability, object to certain processing, and withdraw consent without affecting earlier lawful processing. French law also allows you to give instructions about your personal data after death.
Write to contact@seoul-rebel.com, describing your request and providing enough information to identify your account or order. Identity evidence is requested only where necessary and proportionate. We normally reply within one month; the GDPR allows a further two months in certain cases, with an explanation. Erasure may be limited by legal duties or the need to retain evidence.
You may complain to the CNIL or your country’s competent authority. Marketing messages include an unsubscribe option. Cookie consent can be withdrawn through the site’s cookie preferences.
Security and required information
We use appropriate technical and organisational measures and restrict access. No system guarantees absolute security. Required order fields are identified; without them, payment, delivery or processing your request may be impossible. Advertising preferences and newsletter subscriptions are optional. We do not make decisions producing legal effects on you solely through automated advertising profiling.
Policy changes
The update date appears at the top. We inform you of substantial changes to purposes and obtain fresh consent where required.
Analytics and advertising services
Google Analytics 4 is used for optional audience measurement. The Meta pixel (Facebook and Instagram) may send browsing and purchase events to measure advertising, only when your advertising choice permits it. Our current Meta sharing setting is “Conservative”, with no advanced matching or Conversions API. These choices do not subscribe you to marketing emails. You can change them in the cookie preferences. See Meta’s privacy policy. These services may involve transfers outside the EEA, subject to the applicable GDPR safeguards described above.