Skip to content
NIAWORLDBeauty Academy
|
Privacy Policy

Privacy Policy

Last updated 2026.08.27

NIA BEAUTY (the "Company") establishes and publishes the following Privacy Policy pursuant to Article 30 of the Personal Information Protection Act (개인정보 보호법) in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.

1. Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Personal information processed is not used for purposes other than those below, and where the purpose of use changes the Company will take the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

  1. Registration and member management — identification and authentication in connection with membership services, maintenance and management of Member status, prevention of improper use, and delivery of notices
  2. Processing of course applications — confirming intake, managing capacity, providing course guidance and consultation, and managing completion
  3. Provision of the Services — managing academy membership tiers, operating the accrual and use of Points and the referral programme, and providing community boards and video content
  4. Handling of grievances — verifying the identity of the complainant, confirming the matter raised, and notifying the outcome
  5. Marketing and advertising — information on new courses and events (only for Members who have consented to receive it)

2. Personal Information Processed and Methods of Collection

a. Registration

  • Required: email address, password (where registering with a Google account: Google account identifier, email address, name)
  • Optional: name, nickname, mobile number, telephone number, date of birth, gender, profile image

b. Course applications (Members and Non-members alike)

  • Required: name, contact number
  • Optional: email address, enquiry note

c. Postings by Non-members

  • Required: name, posting password

d. Information generated and collected automatically in the course of using the Services

  • IP address, cookies, service usage records, access logs, device information, browser type

e. Methods of collection

  • Registration and entry of information through the website
  • Submission of course application forms and enquiries through the customer centre
  • Collection by automated collection tools in the course of using the Services

The Company does not collect sensitive information such as ideology or belief, political opinion, health or sex life, nor resident registration numbers.

3. Processing and Retention Periods

  1. The Company processes and retains personal information within the retention and use period prescribed by law, or within the retention and use period consented to by the data subject at the time of collection.
  2. The specific retention periods are as follows.
    • Member information: until withdrawal of membership. Where an investigation or inquiry is under way for a violation of applicable laws, until that procedure ends
    • Course application information: 3 years from the date of application (records on consumer complaints or dispute handling)
    • Postings by Non-members: until the Posting is deleted
  3. The following information is retained for the periods below in accordance with applicable laws.
    • Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
    • Records on payment and the supply of goods: 5 years (same Act)
    • Records on consumer complaints or dispute handling: 3 years (same Act)
    • Records on labelling and advertising: 6 months (same Act)
    • Access logs relating to use of the Services: 3 months (Protection of Communications Secrets Act, 통신비밀보호법)

4. Provision of Personal Information to Third Parties

The Company processes personal information only within the scope specified in section 1, and provides personal information to third parties only where Article 17 or 18 of the Personal Information Protection Act applies, such as with the data subject's consent or under a specific provision of law. The Company does not currently provide Users' personal information to any third party.

5. Outsourcing of Personal Information Processing

The Company outsources personal information processing as follows in order to provide the Services smoothly.

  • Clerk, Inc. — member authentication and account management (period: until withdrawal of membership or termination of the outsourcing agreement)
  • Supabase, Inc. — database operation and file storage (period: until withdrawal of membership or termination of the outsourcing agreement)
  • Vercel Inc. — website hosting and service operation (period: until termination of the outsourcing agreement)

When entering into an outsourcing agreement, the Company specifies in the contract, pursuant to Article 26 of the Personal Information Protection Act, the prohibition on processing personal information for purposes other than performing the outsourced work, technical and administrative safeguards, restrictions on sub-outsourcing, and supervision of the trustee, and supervises whether the trustee processes personal information safely. Where the content of the outsourced work or the trustee changes, the Company will disclose this through this Policy without delay.

6. Transfer of Personal Information Overseas

The Company transfers personal information overseas as follows in order to provide the Services.

  • Clerk, Inc. (United States)
    • Items transferred: email address, name, password (stored encrypted), Google account identifier, access records
    • Time and method of transfer: transmitted over the information and communications network at registration and login
    • Purpose of transfer: member authentication and account management
    • Retention and use period: until withdrawal of membership or termination of the outsourcing agreement
    • Contact: support@clerk.com
  • Supabase, Inc. (data stored in Sydney, Australia)
    • Items transferred: all items collected under section 2 of this Policy
    • Time and method of transfer: transmitted over the information and communications network when the Services are used
    • Purpose of transfer: database operation and file storage
    • Retention and use period: until withdrawal of membership or termination of the outsourcing agreement
    • Contact: privacy@supabase.io
  • Vercel Inc. (United States)
    • Items transferred: IP address, access logs, device information
    • Time and method of transfer: transmitted over the information and communications network when the Services are used
    • Purpose of transfer: website hosting and service operation
    • Retention and use period: until termination of the outsourcing agreement
    • Contact: privacy@vercel.com

Data subjects may refuse the overseas transfer of their personal information pursuant to Article 28-8(1) of the Personal Information Protection Act. Where the transfer is refused, however, registration and use of the Services may be restricted.

7. Procedure and Method of Destruction

  1. Where personal information becomes unnecessary, for example because the retention period has elapsed or the purpose of processing has been achieved, the Company destroys it without delay (within 5 days, absent justifiable grounds).
  2. Where personal information must continue to be retained under other laws even though the retention period consented to by the data subject has elapsed, the Company moves it to a separate database or stores it in a different location.
  3. Method of destruction
    • Electronic files: permanently deleted by a method that makes recovery or reproduction impossible
    • Paper documents: shredded or incinerated

8. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

  1. Data subjects may at any time request the Company to access, correct, delete or suspend the processing of their personal information, and to withdraw consent.
  2. These rights may be exercised directly in My Page, or in writing, by telephone or by email, and the Company will act on the request without delay.
  3. These rights may be exercised through an agent such as a legal representative or a duly authorised person. In that case a power of attorney in the form of Annexed Form 11 of the Public Notice on Methods of Processing Personal Information must be submitted.
  4. A data subject's right to request access to, or suspension of the processing of, personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.
  5. A request for correction or deletion of personal information cannot be made where another law expressly specifies the personal information as subject to collection.
  6. Where a request for access, correction, deletion or suspension of processing is made, the Company verifies whether the person making the request is the data subject or a duly authorised agent.

9. Personal Information of Children under 14

The Company does not accept registration by children under 14 years of age and does not collect the personal information of children under 14. Where it is confirmed that such information has been collected, the Company destroys it without delay.

10. Installation and Operation of Automated Collection Devices, and How to Refuse Them

  1. The Company uses cookies, which store and retrieve usage information, in order to provide individually tailored services such as keeping Users logged in.
  2. A cookie is a small amount of information sent by the server operating the website to the User's browser and stored on the User's device.
  3. Purposes for which the Company uses cookies: maintaining login sessions and authenticating identity, and improving the Services by analysing usage patterns.
  4. Users may refuse the storage of cookies through their web browser settings. If cookie storage is refused, however, difficulties may arise in using services that require login.
    • Chrome: Settings > Privacy and security > Third-party cookies
    • Edge: Settings > Cookies and site permissions > Manage cookies and site data
    • Safari: Preferences > Privacy > Cookies and website data

11. Measures to Ensure the Safety of Personal Information

The Company takes the following measures to ensure the safety of personal information.

  1. Administrative measures: minimising and training personnel who handle personal information, establishing and implementing an internal management plan, and conducting regular self-inspections
  2. Technical measures: managing access rights to the personal information processing system, storing passwords encrypted, encrypting data in transit (HTTPS/TLS), retaining access logs, and installing and updating security software
  3. Physical measures: access control for systems where personal information is stored

12. Privacy Officer and Department Handling Access Requests

The Company designates the following Privacy Officer to take overall responsibility for personal information processing and to handle data subjects' complaints and remedy harm in relation to personal information processing.

  • Privacy Officer: Jae-wook Jung
  • Telephone: 010-7159-8884
  • Email: sov9993@hanmail.net
  • Address: 47-15 Janggunsan-ro, Seo-gu, Busan, Republic of Korea

Data subjects may contact the Privacy Officer with any enquiry, complaint or request for remedy relating to personal information protection arising while using the Services. The Company will respond and act without delay.

13. Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Privacy Infringement Report Centre and similar bodies in order to obtain relief for infringement of personal information. For other reports of and consultation on personal information infringement, please contact the bodies below.

A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in response to a request under Article 35 (access), Article 36 (correction or deletion) or Article 37 (suspension of processing) of the Personal Information Protection Act may request an administrative appeal under the Administrative Appeals Act.

14. Changes to this Privacy Policy

This Privacy Policy applies from September 5, 2026. Where content is added, deleted or amended due to changes in law, policy or security technology, the change will be announced on the Site's notice board from 7 days before it takes effect.

  • Announced on: August 26, 2026
  • Effective from: September 5, 2026

This English text is a translation provided for convenience. In the event of any discrepancy with the Korean original, the Korean text prevails.