IKEA Korea Privacy Policy

Article 1  General Provisions

IKEA Korea Ltd. (“IKEA”) establishes and discloses this Privacy Policy as follows to protect personal information in accordance with Article 30 of the Personal Information Protection Act and to promptly and smoothly deal with any issues relating therefrom.

Article 2  Purpose of Processing Personal Information

IKEA processes personal information for the following purposes. Personal information processed will not be used for any purpose other than the following purposes, and in the event the purpose of use is changed, IKEA intends to perform all necessary measures such as obtaining separate consent in accordance with the relevant laws.

 

1. Subscription and Management of Members

Confirm intent to subscribe as member; identify and certify identity; maintain and manage membership qualifications; prevent unauthorized use of service; restrict subscription by children under 14 years; various notices and notifications; measures to restrict use by members who breached terms of use; sanction acts that may interrupt the smooth operation of services and acts of unauthorized use of services; restrict subscription and number of subscriptions; confirm intent to withdraw as member

2. Provide Goods or Services

Provide services, etc. (e.g., home furnishing service, Gift Registry, separate kitchen planning service) through web homepage, mobile homepage or application; provide troubleshooting relating to purchase, payment, delivery, assembly, exchange, return and other user related services such as member confirmation, etc.

3. Improve Services

Improve to make services through web homepage, mobile homepage or application (as defined under the terms and conditions of use) be provided in a method that is optimized for the user’s computer or other information and communications device; prepare statistics data relating to IKEA’s works such as service development and improvement

4. Customer Services

Confirm identity of complainant; confirm complaints; communicate and notify to confirm facts; notify results of customer services

5. Marketing Purpose

Only for those separately consented to the marketing purpose, (i) information related to services and other benefits provided by IKEA, (ii) newsletter provided by IKEA, (iii) notification of various events held by IKEA, (iv) various marketing held by IKEA to its customers (Optional)

6. IKEA Family Subscription, Management and Service (Applied when joining IKEA Family)

• Confirm intent to subscribe as member; identify and certify identity; maintain and manage membership qualifications; prevent unauthorized use of service; restrict subscription by children under 14 years; various notices and notifications; measures to restrict use by members who breached terms of use; sanction acts that may interrupt the smooth operation of services and acts of unauthorized use of services; restrict subscription and number of subscriptions; confirm intent to withdraw as member
• Provide troubleshooting relating to services such as IKEA Family registration, member confirmation, etc. and, membership service, discount, etc.
• Improve to make services through IKEA Family (as defined under the terms and conditions of use) be provided in a method that is optimized for the user’s computer or other information and communications device; prepare statistics data relating to IKEA’s works such as service development and improvement
• Only for those separately consented to the marketing purpose, information related to services and other benefits provided by IKEA, newsletter provided by IKEA, notification of various events held by IKEA, various marketing held by IKEA to its customer (Optional)

 

7. IKEA Business Network Subscription, Management and Service (Applied when joining IKEA Business Network)

• Confirm intent to subscribe as member; identify and certify identity; maintain and manage membership qualifications; prevent unauthorized use of service; various notices and notifications; measures to restrict use by members who breached terms of use; sanction acts that may interrupt the smooth operation of services and acts of unauthorized use of services; restrict subscription and number of subscriptions; confirm intent to withdraw as member
• Provide troubleshooting relating to services such as IKEA Business Network registration, member confirmation, etc. and, membership service, discount, etc.
• Improve to make services through IKEA Business Network (as defined under the terms and conditions of use) be provided in a method that is optimized for the user’s computer or other information and communications device; prepare statistics data relating to IKEA’s works such as service development and improvement

Article 3 Categories of Personal Information Processed and Method of Collection

IKEA collects and processes the following personal information.

1.  Member Subscription Information

• Home page member subscription
  
  • Required: name (first name, surname), date of birth, mobile phone number, e-mail address, password
• Mobile application member subscription
  
  • Required: name (first name, surname), date of birth, mobile phone number, e-mail address, password
  • Optional: profile image, activity history, geographic location information

2.  Provide Goods or Services

• Receiving, handling, responding to, resolving customer complaints or grievance
  
  • Required: name, address, telephone number, e-mail address, membership number, details of complaints or grievances, records and details of purchase and use, information concerning payment and delivery
• Product delivery and service performance
  
  • Required: name, delivery (assembly) address (road name address), postal code (region), information concerning eligibility for delivery (presence of elevators or loading ramps, residence floor number, etc.), mobile phone number
  • Optional: IKEA Family membership number
• Information generated during subscription and visit
  
  • IP address, MAC address, duplicate identification information (DI), connecting information (CI)Payment information
• Payment information
  
  • Information collected for purchase and payment of goods/services, e.g., name of the card company, card number, purchase information, etc.
• Information collected for newsletter, events, marketing information, delivery of prizes from events, etc.
  
  • Optional: Address, e-mail address, mobile phone number

3. IKEA Family (Applied when joining IKEA Family)

• IKEA Family membership subscription
  
  • Required: name, date of birth, e-mail address, password, mobile phone number, address, country information, purchase information, membership number
  • Optional: Gender, marital status, existence of children living together, number of children living together, age group of children living together, existence of pet living together
• Information generated during subscription and visit
  
  • IP address, MAC address, duplicate identification information (DI), connecting information (CI)
• Marketing information
  
  • Optional: Address, e-mail address, mobile phone number

 

4. IKEA Business Network (Applied when joining IKEA Business Network)

• IKEA Business Network membership subscription
  • Corporate Admin account
    • Required: Corporate name, name, e-mail address, password, address
    • Optional: Business registration number, preferred stores
  • Corporate User account
    • Required: Name, email, password, job title
    • Optional: Phone number, address, preferred stores

 

5. Non-membership for orders. Services

• Product Orders
  • Required: name, delivery (assembly) address (road name address), postal code (region), information concerning eligibility for delivery (presence of elevators or loading ramps, residence floor number, etc.), mobile phone number
• Spare parts
  • Required: name, email address, delivery address, mobile phone number
• Planning services
  • Required: name, delivery (assembly) address (road name address), postal code (region), mobile phone number, Email address

 

IKEA collects personal information in the following method:

• Collection through homepage member subscription, use of service, events participation, tools collecting generated information; change of member information; telephone; inquiries at the customer center; application for membership subscription

Article 4 Period of Retention and Use of Personal Information

IKEA processes and retains personal information in accordance with the laws or within the period consented by the subject of personal information at the time of collection of such personal information.

The period of retention and use of personal information is as follows:

1. Principle:

IKEA in principle discards personal information of a member without delay upon his/her withdrawal as member or upon achievement of the purpose of collection and use of such personal information.

2.Long-term inactive member:

If a member that subscribed as member via the web homepage, mobile homepage or application does not log-in for one (1) year or longer, IKEA stores and manages such member’s personal information separately from personal information of other members, and IKEA does not use such personal information except in case there is a special provision under the relevant laws.

• For IKEA Business Network, if a member does not log-in for one(1) year or longer, the member account will be deleted.

 

3. If provided by laws:

Notwithstanding the provisions of Paragraphs (i) and (ii), IKEA retains and uses personal information of members as provided by laws, as follows (even if not specified below, if the period of retention and use is stipulated in other laws, then IKEA complies with such laws)

• Act on the Consumer Protection in Electronic Commerce, Etc.: Records regarding cancellation of contracts or orders, Records regarding payments or provision of goods (5 years), Record regarding customer complaints or dispute resolutions (3 years)
• Protection of Communications Secrets Act: Log record data, communications confirmation data such as trace record of access location, etc. (3 months), Telecommunications confirmation data such as telecommunications date and time, commencement and end time of telecommunications, number of uses, etc. (12 months)

4. If consented by customers:

Until the end of the period consented by the customer

Article 5  Consignment of Processing of Personal Information

1. IKEA consigns the processing of personal information as follows for smooth processing of personal information.

• Fourstic Inc.: Management and maintenance of server that stores personal information related to the events held by IKEA, Confirmation of winner of events held by IKEA and delivery of prize 
• Inogis: Delivery of mails including IKEA catalogues for IKEA
• I4way: Management and maintenance of call center system 
• CJ Logistics Corporation: Product delivery
• Gwangmyeong Logistics: Product delivery and assembly
• Hyundai Globis: Kitchen planning / measurements and installation
• Cafe 24: Hosting, management and maintenance of system for customer survey 
• Kantar TNS Korea/Kantar Milward Brown Korea/Nielsen Korea/Ipsos Korea: Sending Email & text messages to ask for participating in survey and discussion 
• Leoburnett Korea: Providing relevant information / delivering products for IKEA FAMILY event if necessary 
• D’Strict: Sending e-mail and photo (e-mail address and photo will not be stored.)
• KG INICIS: Payment gateway service
• SELP Digital: IKEA Digital gift card service
• GS Caltex: Product Pick up Service
• MBI Solution(BizM): Kakao messaging service

 

When entering into a consignment agreement, IKEA manages, supervises and educates the consignee for the consignee to comply with the relevant laws, specifies matters related to the prohibition of processing personal information other than for the purpose of consigned work, technical and managerial protective measures, restriction of re-consignment, liability such as damages, etc. in the agreement or other written documents, and supervises whether the consignee safely processes personal information, in accordance with the Personal Information Protection Act.

If any detail of the consigned work or the consignee is changed, IKEA will disclose such change without delay in this Privacy Policy.

Article 6  Third Party Transfer of Personal Information

1. IKEA does not use the collected personal information for any purpose other than the purpose for which personal information is collected or provide such information to a third party, unless such use or transfer is permissible under the Personal Information Protection Act or other applicable laws and regulations.
2. If third party transfer of personal information is necessary, IKEA may provide personal information to a third party with separate consent of the subject of personal information.  IKEA currently provides personal information to third parties with consent as follows.
   
   • Recipient: Shinhan Card
   • Purpose of Transfer: Issuing and managing credit cards with IKEA Family membership function
   • Categories subject to Transfer: IKEA Family membership number
   • Use and Retention Period: 5 years from the completion of transaction (refer to Article 6, Paragraph 1, Subparagraphs 2 and 3 of the Act on Protection of Consumers in E-Commerce Transactions)

Article 7  Rights and Obligations of the Subject of Personal Information and Method to Exercise Such Rights

1. A subject of personal information may exercise the following rights related to the protection of personal information at any time against IKEA and may exercise his/her rights as member through the member information change menu or member withdrawal procedure.
   
   • Right to request access to personal information;
   • Right to request correction of any error;
   • Right to request deletion of information;
   • Right to request discontinuance of personal information processing.
2. The rights under Paragraph 1 may be exercised by phone, e-mail or etc. to IKEA and IKEA will take necessary measures therefor without delay.
3. In case a subject of personal information requests to correct or delete any error, etc. in personal information, IKEA will not process the relevant personal information until the completion of the requested correction or deletion.
4. A subject of personal information must not infringe upon personal information or privacy of himself/herself or any third party in violation of the relevant laws.
5. IKEA does not collect any personal information of children under the age of 14 years. However, if it is necessary to collect personal information of children under the age of 14 years in special circumstance or for events, IKEA complies with the laws concerning the rights and obligations of legal representatives.

Article 8  Overseas Transfer of Personal Information

Your personal information is transferred overseas as follows.
IKEA Korea Ltd. takes necessary measures for your information transferred overseas to be safely protected in accordance with the laws of the Republic of Korea and internal policies of IKEA Korea Ltd. and IKEA Group.

Capgemini Sverige AB

• Country to which personal information is transferred: Sweden
• Contact detail: Ronnowsgatan 8, 252 25 Helsingborg, Sweden / [email protected]
• Time and method of transfer of personal information: Personal information is encrypted using a safe security server after collection and transferred to data server through information and communications network right away
• Categories of personal information transferred: E-mail address, password, name, date of birth, mobile phone number, address
• Purpose of use of personal information by the person receiving personal information: Storage and management of collected personal information of members
• Period of retention and use of personal information by the person receiving personal information: Retain until withdrawal as member (except where it is necessary to retain personal information under the relevant laws and regulations), but if it is necessary to use personal information after member withdrawal within the scope of the above purpose of collection and use such as handling occurred customer complaints, destroy without delay upon achievement of the relevant purpose

Capgemini Inc (USA)

• Country to which personal information is transferred: USA
• Contact detail: 620 West Germantown Pike, Suite 300, Plymouth Meeting, USA / [email protected]
• Time and method of transfer of personal information: Same as above
• Categories of personal information transferred: Same as above
• Purpose of use of personal information by the person receiving personal information: Same as above
• Period of retention and use of personal information by the person receiving personal information: Same as above

Capgemini India Private Limited (India)

• Country to which personal information is transferred: India
• Contact detail: CAMPUS 6 B, RMZ, ECOSPACE(OUTER RING RD), Bangalore 560 037, Karnataka, India / [email protected]
• Time and method of transfer of personal information: Same as above
• Categories of personal information transferred: Same as above
• Purpose of use of personal information by the person receiving personal information: Same as above
• Period of retention and use of personal information by the person receiving personal information: Same as above

INGKA HOLDING B.V.

• Country to which personal information is transferred: Netherlands
• Time and method of transfer of personal information: Personal information is encrypted using a safe security server after collection and transferred to data server through information and communications network right away
• Categories of personal information transferred: Name, e-mail address, gender
• Purpose of use of personal information by the person receiving personal information: Storage in MDB and management of personal information, Hosting and IT support, Business support – central support function for the relevant market, Global business analysis analysis of central support function at IKEA Group level (MDB data is analyzed on total sum basis)
• Period of retention and use of personal information by the person receiving personal information: Same as above

Auth0

• Country to which personal information is transferred: Australia
• Contact detail: 10900 NE 8th Street, Suite 700, Bellevue, WA 98003 USA / [email protected]
• Time and method of transfer of personal information: Personal information is encrypted using a safe security server after collection and transferred to data server through information and communications network right away
• Categories of personal information transferred: Name, e-mail address, passwords, phone number
• Purpose of use of personal information by the person receiving personal information: Storage and management of collected personal information of members
• Period of retention and use of personal information by the person receiving personal information: Same as above

BySide

• Country to which personal information is transferred: Portugal
• Contact detail: Rua Visconde Bóbeda, 70 r/c 4000-108 Porto, Portugal / [email protected]
• Time and method of transfer of personal information: Personal information is encrypted using a safe security server after collection and transferred to data server through information and communications network right away
• Categories of personal information transferred: Name, Surname, Address, Email Address, Telephone no., IP address, Behavioral data collected on IKEA.com or IKEA.kr
• Purpose of use of personal information by the person receiving personal information: Customer support service via chat service
• Period of retention and use of personal information by the person receiving personal information: 2 years

 

SELP Digital

• Country to which personal information is transferred: France
• Contact detail: 17 Rue de Surène, 75008 Paris / [email protected]
• Time and method of transfer of personal information: Personal information is encrypted using a safe security server after collection and transferred to data server through information and communications network right away
• Categories of personal information transferred: name, E-mail address, mobile phone number
• Purpose of use of personal information by the person receiving personal information: offer IKEA digital gift card service
• Period of retention and use of personal information by the person receiving personal information: 13 months

Article 9  Destruction of Personal Information

IKEA will destroy personal information without delay at the expiration of the retention period, the achievement of the purpose or other reasons for which such personal information is no longer necessary.

Notwithstanding the expiration of the retention period consented by the subject of personal information or the achievement of the purpose, in case where such personal information must be continued to be retained or used in accordance with other laws, such personal information will be transferred to a separate database or retained at a different place.

IKEA’s procedure and method of destroying personal information is as follows.

1. Destruction Procedure: IKEA will select personal information which has a cause for discard and discard such personal information with approval of its personal information protection manager.
2. Destruction Method: IKEA will destroy personal information printed on paper by shredding or incineration. For any personal information stored in electronic file format, IKEA will delete such personal information by using technical method that will not allow data recovery.

Article 10  Matters on Installation, Operation and Rejection of Tool for Automatic Collection of Personal Information

IKEA uses cookies on homepages.

Cookies are files that store the details of member’s usage at the time of access to homepages on computer and inform such details to IKEA. IKEA may through cookies identify members’ preferred contents on homepages, change its homepages based on members preferences and measure the level of use of homepages.

Once a member accesses the homepages, IKEA uses cookies to analyse the frequency of access, time of visit, etc., understand the member’s traffic flow and collects information related to the events participation, frequency of access, etc. and then provides selective marketing services or customized services that each member may be interested in.

A member has the right to choose whether to install cookies. The member may allow cookies, configure cookies or refuse cookies by setting web browser options. Please click here (Cookie Policy) for the details of IKEA’s cookies policy.

Article 11  Measures to Secure Stability of Personal Information

IKEA takes the following technical, managerial and physical measures to secure stability to prevent loss, theft, exposure, falsification or damage of the personal information in its processing of the members’ personal information.

1. Encryption of Password:

Members’ passwords are being stored and managed in an encrypted form, so only the member himself/herself knows the password, and only the member himself/herself who knows the password is allowed to confirm and change the personal information.

2. Countermeasures against hacking, etc.:

IKEA makes best efforts to prevent leakage or damage of the members’ personal information due to hacking or computer virus, etc. IKEA backs up data from time to time in preparation for any damage of the personal information and prevents leakage or damage of the members’ personal information and materials by using up-to-date vaccine program, and ensures safe transmission of the personal information through network encryption communications, etc.

3. Minimizing Number of Employees Authorized to Handle Personal Information and Education:

IKEA restricts the employees that may handle personal information to the person in charge, and assigns separate passwords therefor and renews such passwords regularly, and IKEA makes best efforts to comply with IKEA’s Privacy Policy by providing education from time to time to the persons in charge.

4. Operation of Exclusive Organization for the Protection of Personal Information:

IKEA operates an in-house exclusive organization for the protection of personal information to make best efforts to confirm the performance of IKEA’s Privacy Policy and compliance of the person in charge and to immediately change or respond to any problem that is detected; provided that to the extent IKEA performs the obligations to protect personal information, IKEA will not be responsible for any damages that are not attributable to IKEA, such as negligence of any member or of himself/herself or accidents outside the scope of management by IKEA.

Article 12  Personal Information Protection Manager

IKEA is responsible for all works in relation to the processing of personal information and has designated the following personal information protection manager for the handling of request for inspection of personal information of the subject of such personal information, complaints or providing relief for damages in relation to the processing of personal information.

 

Chief Privacy Officer

• Name: Hye-Young Lee
• E-mail: [email protected]

Article 13  Remedy for Infringement on Rights and Interests

If a member otherwise needs to report or consult in relation to infringement of personal information, the member may inquire at the following institutions and seek remedy.

• Personal Information Dispute Mediation Committee (https://www.kopico.go.kr / 1833-6972 without area code)
• Personal Information Protection Center (https://privacy.kisa.or.kr / 118 without area code)
• Cyber Division, the Ministry of Scientific Investigation at the Supreme Prosecutors’ Office (https://www.spo.go.kr / 1301 without area code)
• Cyber Bureau at the National Police Agency (https://ecrm.cyber.go.kr/ / 182 without area code)

Article 14  Installation and Operation of Image Date Processing Equipment

IKEA installs and operates image data processing equipment as follows:

• Grounds and purpose of installation of image data processing equipment: Provide security for IKEA’s facilities and fire prevention
• Location of equipment installed; scope of recording: installation of equipment in principal facilities including the inside and outside of the stores, all floors of the parking lots; the entire space of the principal facilities
• Manager, department and person authorized to have access to image data: Each store’s safety and security manager
• Recording hours: 24 hours
• Storage period: 30 days from the recording time (however, if necessary for criminal investigation such as suspicion of criminal activity or request by a victim of a crime, etc., the storage period may be extended to the reasonable minimum period necessary)
• Storage place and management: Recording information is stored in and managed by the image data processing equipment
• Method and location for access to image data: Make a request to the manager (safety and security team)
• Measures to deal with the request of the subject of information for inspection of image data: A form of request for inspecting or confirming the existence of image data must be submitted, in which case an inspection of image data may be allowed only if the person requesting it has been recorded as the subject of such recording or it is deemed obviously necessary for his/her physical safety or property interests.
• Technical, managerial and physical measures to protect image data: Establish an internal management plan, restrict the access authority, keep image data safely, apply transmission technology, retain processing records and take measures to prevent falsification and forgery, get storage facilities and install locks, etc.

Article15  Change in the Privacy Policy

In case of any addition, deletion or revision of this Privacy Policy, IKEA will notify thereof on the web homepage, mobile homepage or application, or by e-mail, etc. registered with IKEA by members.

Supplementary Provision

Article 1

This Privacy Policy shall be effective from July 16, 2021

Article 2

The prior versions of the Privacy Policy of IKEA may be confirmed below:

- Privacy Policy applicable between December 14, 2015 and June 2, 2016 (Click)

- Privacy Policy applicable between June 3, 2016 and November 30, 2017 (Click)

- Privacy Policy applicable between November 31, 2017 and February 23, 2018 (Click)

- Privacy Policy applicable between February 24, 2018 and July 15, 2018 (Click)

- Privacy Policy applicable between July 16, 2018 and December 2, 2018 (Click)

- Privacy Policy applicable between December 3, 2018 and March 20, 2019 (Click)

- Privacy Policy applicable between March 21, 2019 and December 11, 2019 (Click)

- Privacy Policy applicable between December 12, 2019 and February 9, 2019 (Click)

- Privacy Policy applicable between February 10, 2019 and May 31, 2020 (Click)

- Privacy Policy applicable between June 1, 2020 and July 15, 2021 (Click)