Privacy Policy
Last updated: 17 October 2026
This Privacy Policy explains how On The Shelf Co., Ltd. (주식회사 온더쉘프), operator of Chapter Seoul (“we”, “us”), processes personal information when you visit thechapterseoul.com, contact us, apply to an event, subscribe to our communications or book a Service. For data subjects in Korea, this document constitutes our Personal Information Processing Policy (개인정보 처리방침) under the Personal Information Protection Act (PIPA).
1. Controller and privacy officer
On The Shelf Co., Ltd., 5F, 169 Yeoksam-ro, Gangnam-gu, Seoul, Republic of Korea · Business registration no. 582-81-03978 · contact@thechapterseoul.com · +82 10-8569-1707.
Privacy officer (개인정보 보호책임자): Laura Sarah Koeppler, Representative Director — contact@thechapterseoul.com.
2. Information we collect, purposes, legal bases and retention
| Activity | Information | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Booking and payment | Name, email, phone / WhatsApp, booking details and preferences, billing details (card data is handled by the payment provider, not by us) | Provide the Service, communicate with you, process payments and refunds | Performance of a contract | 5 years (records of contracts, payments and supply of services, Korean E-Commerce Act) |
| Enquiries (forms, email, WhatsApp) | Name, email, phone, company and role (professional requests), dates, message | Answer your request and prepare a proposal | Steps at your request before a contract; your consent | 3 years after our last exchange |
| Event applications and waitlists | Name, company, role, email, phone, website | Review applications, organise events, contact you about the event | Your consent; steps before a contract | 3 years after the event |
| Newsletter and invitations (optional) | Email, phone, language, interaction with our emails | Send news, invitations and offers | Your consent (withdrawable at any time) | Until you unsubscribe |
| Complaints and disputes | Correspondence and related records | Handle complaints and defend legal claims | Legal obligation; legitimate interests | 3 years |
| Website use | IP address, device and browser data, pages viewed, cookie identifiers | Operate and secure the website; with your consent, analytics and advertising | Necessity / legitimate interests; consent for non-essential cookies | Access logs 3 months; cookies as set out in section 9 |
Information that is mandatory for a booking is indicated in our forms; without it we cannot provide the Service. We do not use automated decision-making or profiling that produces legal or similarly significant effects.
3. Health and other sensitive information
Some experiences require us to know about allergies, skin sensitivities or health conditions, for your safety. We collect such information only when necessary, only with your separate, explicit consent (PIPA art. 23, GDPR art. 9(2)(a) and applicable US consumer health data laws), and we use it only to prepare and deliver your Service safely. It is never used for marketing, never sold and never placed in our marketing tools. It is deleted once the Service has been completed, unless you ask us to keep it for future bookings (at most 3 years). Please do not include health information in our website forms. US residents: see our Consumer Health Data Privacy Policy.
4. Provision of information to third parties
We do not sell your personal information. We provide it to third parties only in the following cases:
- Venues and providers you ask us to book (e.g. restaurants, spas, boutiques): only the information needed for the reservation, at your request.
- Authorities, where required by law.
We do not transmit your personal information to our medical-tourism partner (MTK Co., Ltd.) or to any hospital. If you choose to use medical services, the partner and the hospital collect the information they need directly from you, as independent controllers under their own privacy policies.
5. Processors and transfers outside Korea
We entrust processing to the service providers below. Their services involve transferring your information outside Korea, by electronic transmission over the network when it is collected or used, and storing it for the period stated. These transfers are necessary to provide the Service and are disclosed here in accordance with PIPA art. 28-8(1)(3); transfers for newsletters are based on your consent.
| Recipient (contact) | Country | Information | Purpose | Retention |
|---|---|---|---|---|
| Shopify Inc. and affiliates (shopify.com/legal/privacy) | Canada, USA and other locations of Shopify’s infrastructure | Booking, contact and payment data, website data | Website hosting, forms, orders and checkout | Duration of the service or legal retention period |
| Payment providers offered at checkout, e.g. PayPal, Stripe (paypal.com/privacy, stripe.com/privacy) | USA and other countries | Payment and billing data | Payment processing, fraud prevention, refunds | As required by financial regulations |
| Klaviyo, Inc. (klaviyo.com/legal/privacy) | USA | Name, email, phone, company and role, event applications, marketing preferences | Event applications, waitlists and, with consent, newsletters | Until you unsubscribe or ask for deletion |
| Meta Platforms / WhatsApp (whatsapp.com/legal/privacy-policy) | USA, Ireland | Phone number and messages | Messaging, when you choose to contact us via WhatsApp | As set by WhatsApp; our copies follow section 2 |
You can refuse these transfers by not using our online services and contacting us by other means; we may then be unable to take online bookings or send newsletters. For data from the European Economic Area, transfers to Korea rely on the European Commission’s adequacy decision for the Republic of Korea, and onward transfers to our providers rely on their standard contractual clauses or other approved safeguards.
6. Destruction
When the retention period ends or the purpose is achieved, personal information is destroyed without delay: electronic files are permanently deleted using methods that prevent recovery, and paper records are shredded. Information kept to meet a legal obligation is stored separately and used only for that purpose.
7. Your rights
Subject to applicable law, you may request access to, correction, deletion, restriction or suspension of processing of your personal information, object to processing, request a copy in a portable format, and withdraw any consent at any time (without affecting prior processing). Write to contact@thechapterseoul.com; we may need to verify your identity. We reply within 10 days for requests under Korean law and within one month elsewhere. A legal representative or authorised agent may act on your behalf. If we refuse a request, we will tell you why and how to appeal; you may appeal by replying to our decision.
8. Marketing communications
We send newsletters and invitations only with your prior consent, which is always optional and separate from bookings. Every message identifies us and contains a free way to unsubscribe. Advertising messages sent to recipients in Korea are marked “(광고)”, are not sent by text or messaging app between 21:00 and 08:00 without separate consent, and your consent is reconfirmed every two years.
9. Cookies
We use strictly necessary cookies to run the website, the cart and security. With your consent we may also use analytics and advertising cookies (e.g. Shopify analytics, Klaviyo, Meta). Visitors from regions that require it are asked for consent through our cookie banner, where “Accept” and “Decline” are equally available; you can change your choice at any time via “Your Privacy Choices”. We honour Global Privacy Control signals where supported. You can also block or delete cookies in your browser settings (Chrome: Settings › Privacy and security; Safari: Settings › Privacy; Edge: Settings › Cookies and site permissions); some features may then not work. Cookies are kept for at most 13 months.
10. Security
We protect personal information with administrative, technical and physical measures: access limited to authorised staff, strong passwords and two-factor authentication, encrypted connections (HTTPS), reputable providers with security certifications, and secure storage of any paper records.
11. Children
Our services are intended for adults. We do not knowingly collect personal information from children under 14 (Korea) or under 16 (elsewhere). If you believe a child has provided us with information, please contact us so we can delete it.
12. Region-specific information
European Economic Area, United Kingdom and Switzerland
We process your data on the legal bases indicated in section 2 (GDPR art. 6) and, for health data, on your explicit consent (art. 9(2)(a)). You have the right to lodge a complaint with your local supervisory authority (in France: CNIL, cnil.fr).
United States
In the last 12 months we have collected the categories of information described in section 2: identifiers, commercial information, internet activity, professional information and, with consent, consumer health data. We do not sell personal information. We share information for targeted advertising only with your consent where required, and you can opt out at any time via “Your Privacy Choices” or a Global Privacy Control signal. Residents of states with consumer privacy laws may exercise the rights in section 7, including an appeal. Health-related information is covered by our Consumer Health Data Privacy Policy.
United Arab Emirates
Residents of the UAE have the rights provided by Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, which can be exercised as described in section 7.
Republic of Korea
To seek remedies for an infringement, you may contact: Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), Personal Information Infringement Report Center (privacy.kisa.or.kr, 118), Supreme Prosecutors’ Office (spo.go.kr, 1301), Korean National Police Agency (ecrm.police.go.kr, 182).
13. Changes
We will announce any changes to this policy on this page at least 7 days before they take effect (30 days for changes that significantly affect your rights). Previous versions are available on request.