Privacy Policy

Personal-information practices for koreanlashlift.com

Store	koreanlashlift.com
Seller	APC Commerce LLC
Effective	16 September 2026
Version	Final 1.0

Final merchant-protective version. Mandatory rights prevail only to the extent they cannot lawfully be excluded or limited.

1 Controller and scope

APC Commerce LLC, 3833 Powerline Road, Suite 301-M, Fort Lauderdale, Florida 33309, United States, is responsible for personal information processed through koreanlashlift.com unless a specific notice identifies another controller. Privacy contact: hello@koreanlashlift.com. This notice covers customers in the United States and applies to visitors, customers, course users, support contacts, return claimants, subscribers, affiliates and business contacts.

We apply applicable United States federal and state privacy, marketing and data-security laws to the extent it covers the person, information and processing. The corporate address is not a returns address.

2 Information collected

• • Identifiers and contact data, including name, email, telephone number, billing and delivery address, account identifiers, IP address and device identifiers.
• • Commercial and transaction data, including products viewed or purchased, price, tax, discount, payment status, delivery, subscriptions, returns, guarantees and support history.
• • Limited payment, authentication and fraud data, including payment method, provider token, transaction reference, address check, risk signal and chargeback record. Full card credentials are normally collected by the selected payment provider.
• • Account, course and professional data, including credentials, enrolment, lesson access, assessment and certificate status, salon, role, tax status, reseller, affiliate or professional-use information.
• • Communications and user content, including forms, emails, reviews, photographs, video, batch information, treatment details and troubleshooting material voluntarily submitted.
• • Technical, usage, marketing and inferred data, including pages, searches, clicks, cart events, referrer, approximate location, cookies, campaign attribution, preferences, consent, opt-out, engagement and likely product interests.

Please do not send medical or other sensitive information unless reasonably necessary for a safety request. A professional who supplies a client image, treatment record or other person’s information acts as an independent controller for that disclosure and confirms a lawful basis, necessary notice and authority.

3 Sources

We collect information directly from the person; automatically from the site, device, cookies, tags and security logs; and from payment, financing, fraud, fulfilment, carrier, course, communications, affiliate, review, analytics, advertising and social-media providers. For business contacts, we may use the represented organisation and public professional sources.

4 Purposes and legal authority

• • Operate the store, cart and checkout; process payment; accept and fulfil orders; arrange delivery; provide invoices; administer returns and answer pre-contract or support requests.
• • Create and secure accounts; deliver courses; record progress; issue certificates; enforce access and intellectual-property restrictions.
• • Authenticate transactions; detect fraud, credential sharing, malicious activity, chargeback abuse and violations; protect customers, systems and legal rights.
• • Maintain tax, accounting, consent, product-safety, traceability, complaint and legal records; conduct recalls; comply with binding requests; establish, exercise or defend claims.
• • Maintain, secure, troubleshoot, analyse and improve the site; measure campaigns; personalise content and advertising where applicable consent or opt-out rules permit.
• • Send service communications and, where lawful, direct marketing, back-in-stock and related product messages.

We may aggregate or de-identify information and use it for analytics, product planning, security and business operations. We do not attempt to re-identify information that law requires us to keep de-identified.

5 Lawful bases consent and choices

Where GDPR-style lawful bases apply, order, account and course processing relies on contract or requested pre-contract steps; tax, safety and regulatory records rely on legal obligation; fraud prevention, security, support consistency, claims, service improvement and limited business marketing rely on legitimate interests after balancing; optional advertising storage and marketing use consent where consent is required. Vital interests may apply in a genuine safety emergency.

Consent may be withdrawn for future processing without affecting earlier lawful processing. Refusal to provide information required for checkout, delivery, verification or course access may prevent the transaction. Optional marketing or advertising consent is not a condition of purchase.

6 Service providers and disclosures

Recipients may include hosting, WordPress/WooCommerce, checkout, security, backup and IT providers; payment, wallet, financing and fraud providers such as Stripe, PayPal, Klarna, Apple Pay and Google Pay where offered; JTL or other order-management systems; fulfilment operations and carriers; course, certificate, form, support, email and messaging providers; analytics, advertising, product-feed, social, review, affiliate, back-in-stock and invoice services; and professional advisers, insurers, banks, auditors, acquirers, courts, regulators and law enforcement.

We disclose only information reasonably relevant to the service, transaction, protection, transfer or legal duty. Providers may act as processors, service providers, independent controllers or joint controllers depending on the service and law. Their own notice applies to independent processing.

7 Advertising cookies and tracking

Essential technologies support security, fraud prevention, consent settings, cart, checkout, language or country routing, login and requested functions. Analytics and advertising technologies may measure visits, product interaction, purchases, attribution and audiences. Third parties may collect identifiers and activity over time and across services where their technology is enabled.

Non-essential storage or access is activated only after consent where required. A person may change consent through the site control and may also use provider or browser settings. Blocking essential technology can prevent checkout or account functions. Where applicable law requires recognition of a universal opt-out mechanism, we honour a valid signal for the browser or device sending it.

8 Marketing and service communications

Order, payment, security, delivery, recall, course-access and direct support messages are service communications. Marketing is sent only with consent or another permission recognised by applicable law. Every required marketing message identifies the sender and provides a working unsubscribe method. We keep a minimal suppression record after opt-out so the address is not improperly re-added.

If optional marketing texts are offered, consent is not a condition of purchase. Message and data rates may apply. The disclosed STOP or equivalent method withdraws consent. Unsubscribing from marketing does not stop necessary service or safety communications.

9 Fraud checks and automated processing

Payment, security and fraud providers may automatically assess device, identity, address, transaction and behavioural signals. A provider may decline or hold a payment under its own terms. We may use risk scores to request verification, hold an order or route it to human review.

We do not intend to make a solely automated decision producing a legal or similarly significant effect unless law permits it and required safeguards apply. Contact us if an order or account appears wrongly restricted; we may request proportionate verification.

10 International processing and corporate transactions

Information may be processed where the seller, fulfilment operation or provider operates. Where a restricted-transfer regime applies, we use an adequacy decision, recognised contractual clauses, approved addendum, certification or another lawful mechanism and supplementary measures where appropriate.

We may disclose relevant information during a proposed or completed merger, financing, reorganisation, asset sale, insolvency or transfer of the store, subject to confidentiality and applicable notice or consent requirements. The recipient may use it only consistently with applicable law and the notice governing the transfer.

11 Retention

• • Orders, invoices, tax, payment status and delivery records: normally the statutory accounting period and any longer live claim or legal hold.
• • Accounts: while active and normally up to two years after closure, except linked transaction, security, suppression, certificate or claim records.
• • Course access, assessment and completion: for the access period and normally up to six years afterwards for certificate verification, licence enforcement and claims.
• • Support, return, safety, guarantee and complaint files: normally up to six years after closure, or longer for product safety, limitation, recall or legal hold.
• • Marketing consent and interaction: during the purpose and afterwards as needed to prove compliance; suppression records as long as needed to honour opt-out.
• • Technical and security logs: ordinarily up to 12 months, extended where an incident, fraud pattern or claim requires investigation.

We delete, anonymise or isolate information when no longer required. Backups may retain information for a limited rolling period before secure overwrite. Anonymised information may be kept without a fixed period.

12 Security and customer responsibility

We use proportionate measures designed to protect information, including access restriction, authentication, encryption in transit where supported, provider controls, updates, logging, backups and incident procedures. No internet system is completely secure and we do not promise absolute security.

Users must protect credentials, use accurate contact details and report suspected compromise promptly. We investigate incidents and provide notices when applicable law requires.

13 Rights requests and exceptions

Depending on applicable law, a person may request access, correction, deletion, restriction, portability, withdrawal of consent, objection to legitimate-interest processing, opt-out of direct marketing, and safeguards concerning qualifying automated decisions. Rights are not absolute.

We may retain or withhold information where an exemption applies, including transaction completion, another person’s rights, legal privilege, fraud prevention, security, tax, product safety, recall, suppression, records required by law and establishment or defence of claims. We may verify identity proportionately, clarify scope and reject manifestly unfounded, excessive or unauthorised requests where law permits.

14 United States state privacy disclosures

We do not sell personal information for money. Disclosing identifiers, device or activity data to advertising partners may be treated as sale, sharing or targeted advertising under some state laws. Where a covered law applies, residents may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale, sharing, targeted advertising or specified profiling, limit certain sensitive-data use, appeal a denial and receive non-discriminatory treatment.

Submit a request to the privacy email with US Privacy Request, state of residence and account or order email. For an advertising opt-out, state Opt Out of Targeted Advertising. We verify proportionately. An authorised agent must show legally sufficient authority. A valid Global Privacy Control signal is treated as an opt-out where required.

During the preceding 12 months, the categories in Section 2 may have been collected and disclosed to the recipient categories in Section 6 for the purposes in Section 4. Depending on enabled advertising technology, identifiers and internet activity may have been shared for cross-context or targeted advertising. We do not knowingly sell or share personal information of persons under 16 for that purpose. California rights apply only if statutory thresholds and scope are met.

15 Children

The store, professional products and courses are intended for adults and are not directed to children. We do not knowingly collect a child’s information contrary to applicable consent rules. Contact us for review if a child submitted information without proper authority.

16 Complaints changes and contact

Send privacy questions and rights requests to hello@koreanlashlift.com. A person may complain to the regulator or attorney general with jurisdiction over the request where it has jurisdiction. We may update this notice for service, provider, legal or operational changes. Material new uses receive additional notice or consent where required; a new notice does not retroactively authorise an unrelated unlawful use.

Privacy contact: APC Commerce LLC, 3833 Powerline Road, Suite 301-M, Fort Lauderdale, Florida 33309, United States, hello@koreanlashlift.com.