KOO Facilitation Group, Inc. (“KOOFA,” “we,” “us,” or “our“) respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy (“Policy“) explains how we collect, use, disclose, retain, and safeguard personal information when you visit koofa-global.com and use the services available through it (the “Site“), as well as your rights and choices regarding that information.

This Policy is designed to comply with applicable privacy laws including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA“), the EU General Data Protection Regulation (“GDPR“), the UK General Data Protection Regulation (“UK GDPR“), the Republic of Korea’s Personal Information Protection Act (“PIPA“), and comparable laws in other jurisdictions where our visitors reside.

1. Scope of This Policy

This Policy applies to personal information collected through the Site, through our contact and inquiry forms, through purchases made via the KOOFA Boutique, through newsletter subscriptions, through consultation bookings, and through other interactions you have with KOOFA online. It does not apply to the practices of any third party we do not control, including third-party websites linked from the Site.

2. Information We Collect

We collect the following categories of personal information:

a. Information you provide directly

• Contact and inquiry information, when you submit our contact form, request a consultation, or otherwise communicate with us: first name, last name, email address, country, company name, job title, the nature of your inquiry, and the content of your message.
• Booking information, when you book a consultation through the Site: name, email, organization, scheduling preferences, and any details you provide about your inquiry.
• Newsletter subscription information: email address and, where applicable, name.
• Purchase and transaction information, when you buy products through the KOOFA Boutique: billing and shipping addresses, payment card information (processed by our third-party payment processors), product selections, and order history.
• Other communications: information you provide in emails, telephone calls, or other correspondence with KOOFA.

b. Information collected automatically

When you visit the Site, we and our service providers may automatically collect certain information through cookies, web beacons, server logs, and similar technologies, including:

• Device and connection information: IP address, browser type and version, operating system, device type, screen resolution, and language preferences;
• Usage information: pages visited, time spent on pages, links clicked, referring URLs, search terms used to reach the Site, and date and time of access;
• Location information: approximate geographic location derived from your IP address;
• Identifiers: cookie identifiers and similar online identifiers.

See Section 7 (Cookies and Similar Technologies) below for further detail.

c. Information from third parties

We may receive information about you from third parties, including from social media platforms (when you interact with our content on those platforms), from event registration platforms, from analytics providers, and from referral partners.

3. How We Use Your Information

We use personal information for the following purposes:

• To respond to your inquiries and provide the services, information, products, or consultations you request;
• To process and fulfill orders placed through the KOOFA Boutique, including processing payments, arranging delivery, and providing customer support;
• To manage and operate the Site, including ensuring its security, integrity, and proper functioning;
• To send you communications that you have opted in to receive, including newsletters, event invitations, and updates about our services;
• To improve the Site and our services, including through analytics and user research;
• To personalize your experience on the Site, including by remembering your language and currency preferences;
• To comply with legal obligations, including responding to lawful requests from public authorities and exercising or defending legal claims;
• To protect our rights and interests, including detecting, preventing, and addressing fraud, security incidents, and violations of our Terms of Use.

4. Legal Bases for Processing (EU/UK/EEA Visitors)

If you are located in the European Union, the European Economic Area, or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR to process your personal information:

• Performance of a contract — when processing is necessary to provide a product, service, or response you have requested;
• Consent — when you have given clear consent for us to process your personal information for a specific purpose (for example, newsletter subscription or non-essential cookies);
• Legitimate interests — when processing is necessary for our legitimate business interests (such as responding to inquiries from prospective clients, improving the Site, and ensuring security), provided those interests are not overridden by your rights and freedoms;
• Legal obligation — when processing is necessary to comply with our legal obligations.

You have the right to withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

5. How We Share Personal Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising as those terms are defined under the CCPA. We disclose personal information only in the following circumstances:

• Service providers and processors: We share personal information with third-party vendors who perform services on our behalf, including website hosting, email delivery, payment processing, e-commerce platforms, analytics, customer support tools, and marketing infrastructure. These providers are contractually required to handle personal information in accordance with applicable law and our instructions.
• Affiliated entities: We may share personal information with our affiliated entities, including our parent organization in Korea, for the purposes described in this Policy.
• Legal and regulatory disclosures: We may disclose personal information when required by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, your safety, the safety of others, or to investigate fraud or respond to a government request.
• Business transfers: In the event of a merger, acquisition, reorganization, sale of all or part of our assets, or bankruptcy, personal information may be transferred to the successor entity, subject to the obligations of this Policy.
• With your consent: We may disclose personal information for any other purpose with your explicit consent.

6. International Data Transfers

KOOFA is headquartered in the Republic of Korea, and your personal information may be transferred to and processed in Korea or in other countries where our service providers operate. These countries may have data protection laws that differ from those in your country of residence.
When we transfer personal information out of the European Economic Area, the United Kingdom, or other jurisdictions with comparable transfer restrictions, we use appropriate safeguards as required by applicable law, including the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum, or equivalent mechanisms. You may request a copy of the relevant safeguards by contacting us at the address in Section 17 below.

7. Cookies and Similar Technologies

We use cookies and similar tracking technologies to operate the Site, analyze usage, and improve your experience. A cookie is a small text file placed on your device when you visit a website.
We use the following categories of cookies:

• Strictly necessary cookies — required for the Site to function (for example, maintaining your shopping cart, recording your cookie preferences). These cannot be turned off in our systems.
• Functional cookies — remember your preferences (language, currency, region) to improve your experience on the Site.
• Analytics cookies — help us understand how visitors interact with the Site by collecting and reporting information anonymously. We use providers such as Google Analytics for this purpose.
• Marketing and advertising cookies — set by our advertising partners (where applicable, Meta Pixel, LinkedIn Insight Tag) to build a profile of your interests and show you relevant content on third-party sites.

You can manage cookies through your browser settings and, where applicable, through the cookie consent banner displayed on the Site. Disabling certain cookies may affect Site functionality.

For a more comprehensive overview of our cookie use, please visit our Cookie Policy page. 

For more information about how to manage cookies in common browsers, visit: www.allaboutcookies.org

8. Third-Party Services and Analytics

The Site uses third-party services that may collect personal information about you. These include but are not limited to:

• Website hosting and content delivery — Siteground, WordPress;
• Analytics — Google Analytics;
• Payment processing — WooCommerce, WooCommerce PayPal Payments, Visa Acceptance Solutions;
• Email and marketing infrastructure — BookingPress, WordPress;
• Social media and embedded content — Facebook, Instagram, YouTube, LinkedIn (when their content is embedded or you click their links);
• Customer support and forms — BookingPress.

Each of these third parties processes data according to its own privacy practices. We encourage you to review their privacy notices.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to comply with our legal, accounting, or reporting obligations, and to resolve disputes. Specific retention periods include:

• Contact form and inquiry submissions — retained for up to 3 years following the last contact, unless a longer period is required by law or you request earlier deletion;
• Newsletter subscriptions — retained for the duration of your subscription and for a reasonable period thereafter;
• Transaction and purchase records — retained for the period required by applicable tax, commercial, and consumer protection laws (typically 5–10 years depending on jurisdiction);
• Website analytics and log data — typically retained for 14 months in aggregated form;
• Marketing communications opt-out records — retained indefinitely to honor your opt-out preference.

When personal information is no longer needed, we securely delete or anonymize it.

10. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Administrative measures: internal data protection policies, employee training, and access controls limiting personal information access to authorized personnel on a need-to-know basis;
• Technical measures: encryption of personal information in transit (TLS/SSL) and, where appropriate, at rest; access controls; firewalls; intrusion detection; regular security updates; and secure development practices;
• Physical measures: restricted access to facilities and equipment used to process personal information.

No method of transmission over the internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.

11. Your Privacy Rights

Subject to the laws applicable to your jurisdiction, you may have the following rights regarding your personal information:

• Right to know and access — to request information about the personal information we hold about you and obtain a copy of it;
• Right to correct — to request correction of personal information that is inaccurate or incomplete;
• Right to delete — to request deletion of personal information we hold about you, subject to certain legal exceptions;
• Right to restrict or object to processing — to limit or object to certain uses of your personal information;
• Right to data portability — to receive your personal information in a structured, commonly used, machine-readable format;
• Right to withdraw consent — where processing is based on your consent, to withdraw consent at any time;
• Right to opt out of marketing communications — to unsubscribe from newsletters and marketing emails at any time through the unsubscribe link in those emails or by contacting us;
• Right to non-discrimination — KOOFA will not discriminate against you for exercising any of your privacy rights.

To exercise any of these rights, please contact us using the details in Section 17 below. We will respond to verifiable requests within the timeframes required by applicable law (typically 30 days under the GDPR; 45 days under the CCPA, extendable by 45 additional days when reasonably necessary).
We may need to verify your identity before processing your request, and we may decline requests where permitted by law (for example, where granting the request would violate the privacy rights of another person or where we have a legal obligation to retain the information).

If you believe we have not complied with applicable privacy law, you have the right to lodge a complaint with the data protection authority in your jurisdiction.

12. Notice to California Residents (CCPA / CPRA)

This section supplements the information above and applies specifically to residents of California whose personal information we collect, in compliance with the CCPA as amended by the CPRA.
Categories of personal information collected

In the preceding 12 months, we have collected the following categories of personal information from California residents, as defined under California Civil Code § 1798.140:

We have not collected the following categories: biometric information, characteristics of protected classifications under California or federal law, audio/electronic/visual information (other than via contact you initiate), genetic data, or precise geolocation.

Sources of collection, purposes, and disclosures

• Sources: directly from you (forms, purchases, communications), automatically through the Site (cookies, analytics), and from third parties (referral partners, social media platforms).
• Business purposes: see Section 3 above.
• Disclosures: see Section 5 above. We have not sold or shared personal information for cross-context behavioral advertising in the preceding 12 months.

Your California rights

You have the right to:

• Know what personal information we have collected, used, disclosed, or sold about you;
• Delete personal information we have collected about you, subject to certain exceptions;
• Correct inaccurate personal information we maintain about you;
• Opt out of sale or sharing of your personal information (as noted, we do not sell or share for behavioral advertising, but you may still submit a request);
• Limit use and disclosure of sensitive personal information to that necessary to provide the requested services;
• Non-discrimination — we will not discriminate against you for exercising your CCPA rights.

To submit a verifiable consumer request, contact us at contact@koofa-global.com with “California Privacy Request” in the subject line. We may need additional information to verify your identity before processing your request. You may also designate an authorized agent to submit a request on your behalf with proof of authorization.
If we deny your request, you may appeal by replying to our response with your request for appeal.

13. Notice to Other US State Residents

Residents of Colorado, Connecticut, Virginia, Utah, Indiana, Iowa, Tennessee, Texas, Montana, Oregon, Delaware, New Hampshire, New Jersey, Minnesota, Maryland, Kentucky, Rhode Island, and other US states with comprehensive privacy laws may have rights similar to those described above for California residents. We honor verifiable requests from residents of these states in accordance with applicable law. To submit a request, contact us using the details in Section 17 below.

14. Children’s Privacy

The Site is not directed to children under 13 (or under 16 in jurisdictions where that higher threshold applies), and we do not knowingly collect personal information from children under that age. If you become aware that a child has provided us with personal information without parental consent, please contact us so we can take appropriate steps to delete it.
In compliance with the US Children’s Online Privacy Protection Act (COPPA), if we become aware that personal information of a child under 13 has been provided to us, we will delete it as soon as practicable.

15. Do Not Track

Some browsers signal “Do Not Track” preferences. There is no consistent industry standard for responding to such signals at this time, and we do not currently respond to Do Not Track signals. We do honor opt-outs submitted through other applicable mechanisms (for example, the Global Privacy Control signal where required by law).

16. Changes to This Privacy Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last Updated” date at the top of this Policy and, where appropriate, provide additional notice (for example, by email, through a notice on the Site, or through other reasonable means). We encourage you to review this Policy periodically to stay informed about how we are protecting your personal information.

17. Contact Information

If you have any questions, concerns, or requests regarding this Policy or our privacy practices, please contact us:
KOO Facilitation Group, Inc.
Attn: Privacy Officer
7th & 9th Floor, Areumdaun Building, 9, Teheran-ro 22-gil, Gangnam-gu, Seoul, South Korea

Email: contact@koofa-global.com

Phone: +82 02-562-8220

For inquiries specifically related to:

• CCPA / California privacy rights: subject line “California Privacy Request”
• GDPR / EU privacy rights: subject line “GDPR Request”
• PIPA / Korea privacy rights: subject line “PIPA Request”
• Other privacy concerns: subject line “Privacy Inquiry”

EU/EEA visitors also have the right to lodge a complaint with the data protection authority of the EU member state where they reside or work. UK visitors may contact the Information Commissioner’s Office (ICO) at ico.org.uk. California residents may file a complaint with the California Privacy Protection Agency at cppa.ca.gov or with the California Attorney General. Korea residents may contact the Personal Information Protection Commission at pipc.go.kr.