PRIVACY
Privacy Policy
How STEADFAST COFFEE & WORKS collects, uses, keeps and deletes personal information.
This policy is a draft written on . It will be replaced by a version reviewed by legal counsel. Effective date:
1. General provisions and scope
R12 Inc. (“the Company”, “we” or “us”) has established and publishes this Privacy Policy under Article 30 of the Personal Information Protection Act of the Republic of Korea, to protect the personal information of data subjects and to handle related concerns promptly and smoothly.
This policy is not limited to our website. It applies to all personal information we process in running STEADFAST COFFEE & WORKS, including the café, the Workers’ Lounge, the website and enquiries by phone or message.
- Controller
- R12 Inc.
- Brand
- STEADFAST COFFEE & WORKS
- Representative Director
- Jihong Shim
- Address
- B1 and 1F, 22 Pangyogongwon-ro 2-gil, Bundang-gu, Seongnam-si, Gyeonggi-do (Pangyo-dong), Republic of Korea
- Phone
- +82 507-1408-8384
2. Personal information we process, purposes and retention
We process only the minimum personal information needed for the purposes below. If a purpose changes, we take the steps required by Article 18 of the Personal Information Protection Act, such as obtaining separate consent.
| Activity | Information | Purpose | Retention |
|---|---|---|---|
| Workers’ Lounge memberships and passes (monthly, multi-visit and one-day passes) | Name, mobile phone number, pass type and validity period, access card identifier, entry and exit records, payment records | Issuing passes, confirming use, renewals, refunds and handling disputes | Deleted without delay once the pass ends (or once any refund or dispute is resolved); payment and similar records are kept for the statutory periods below |
| Toss Place prepaid (multi-visit) pass top-ups and deductions | Mobile phone number, top-up and deduction history, remaining visits | Managing multi-visit pass balances | Deleted without delay once all visits are used or refunded; payment records are kept for the statutory periods below |
| Enquiries (Instagram DM, phone, Naver TalkTalk) | Account name or calling number, content of the enquiry | Responding to enquiries | 1 year from collection |
| Reservations (meeting room, venue hire and reservation services, where offered) | Name, contact details, date and time, number of people, requests | Confirming reservations and providing visit information | Deleted without delay once the reservation is used or cancelled; any payment records are kept for the statutory periods below |
| Surveys, events and forms, where offered (e.g. visit-experience survey, first-visit coupon, business enquiries) | Responses, contact details (optional) | Improving our services, issuing coupons and replying to proposals | 1 year from collection |
| Marketing messages (optional consent, requested separately from consent to collection and use) | Contact details, date, time and channel of consent | Sending news and offers | Until consent is withdrawn; we reconfirm consent every two years under Article 50(8) of the Act on Promotion of Information and Communications Network Utilization and Information Protection and Article 62-3 of its Enforcement Decree |
Retention required by law
Despite the periods above, we keep the following records for the periods shown, under Article 6 of the Act on the Consumer Protection in Electronic Commerce and Article 6 of its Enforcement Decree (the same periods are applied to in-store transactions).
- Records of contracts or withdrawal of offers: 5 years
- Records of payments and the supply of goods or services: 5 years
- Records of consumer complaints and dispute resolution: 3 years
Children under 14
We do not collect personal information from children under the age of 14 without the consent of their legal guardian.
3. Outsourcing of processing
To run our business smoothly, we entrust the processing of personal information as follows.
| Processor | Outsourced task |
|---|---|
| Toss Place | POS payment processing and prepaid (multi-visit) pass management |
| NAVER Corp. | Smart Call call connection and call statistics (calling number, call duration) |
| Supabase, Inc. | Database hosting for the Workers’ Lounge membership and pass system |
| Cloudflare, Inc. | Website hosting and security (IP addresses, access logs) |
| Google LLC | Website analytics and tag management (Google Analytics 4, Google Tag Manager) |
| Meta Platforms, Inc. | Advertising performance measurement and personalised advertising (Meta Pixel) |
Under Article 26 of the Personal Information Protection Act, we set out in writing each processor’s responsibilities, including not processing personal information beyond the outsourced task, technical and managerial safeguards and restrictions on sub-processing, and we supervise how processors handle personal information. If the outsourced tasks or processors change, we will update this policy.
Processors outside Korea are described in 5. Transfers of personal information overseas.
4. Provision to third parties
We do not provide your personal information to third parties. The only exceptions are cases permitted by Articles 17 and 18 of the Personal Information Protection Act, such as where another law specifically provides for it or an investigative authority lawfully requests it under the law.
5. Transfers of personal information overseas
To operate our website and our advertising, we transfer personal information overseas as follows. Under Article 28-8 of the Personal Information Protection Act, we disclose these transfers and the details below in this policy; whether separate consent is required will be settled in the legal review.
| Recipient (country) | Contact details | Information transferred | When and how | Purpose and retention | How to refuse, and the effect of refusing |
|---|---|---|---|---|---|
| Google LLC (United States) | Address: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA Enquiries: Google privacy enquiry form (support.google.com/policies/contact/general_privacy_form) | Cookie identifiers, device and browser information, access logs and usage behaviour | Sent over the network when you use the website | Website analytics and advertising performance measurement. Event-level data is kept for up to 14 months under our Google Analytics retention setting, and aggregated statistics may remain in reports after that. | Block cookies in your browser or install the Google Analytics opt-out browser add-on (see section 8). If you refuse, only analytics collection stops; your use of the website is not restricted. |
| Cloudflare, Inc. (United States and edge servers worldwide) | Address: 101 Townsend Street, San Francisco, CA 94107, USA Enquiries: privacyquestions@cloudflare.com | IP address, request logs | Sent over the network when you access the website | Website hosting and security; kept briefly under the processor’s log retention policy | Required to provide the website, so it can be refused only by not using the website. Visiting us or calling us is not affected. |
| Meta Platforms, Inc. (United States; Meta Platforms Ireland Ltd., Ireland, for EEA residents) | Address: 1601 Willow Road, Menlo Park, CA 94025, USA Enquiries: Meta Privacy Center (www.facebook.com/privacy/center/) | Access logs, device and browser information, cookie identifiers (_fbp, and _fbc if you arrived by clicking an ad), ad click ID (fbclid), pages visited, button-click events | Sent over the network when you use the website from a region where advertising cookies are allowed (see section 8) | Advertising performance measurement and personalised advertising. The _fbp and _fbc cookies are kept for 90 days; Meta keeps the information it receives under its own privacy policy. | Block or delete cookies in your browser, or turn off personalised ads in Meta Ad Preferences at www.facebook.com/adpreferences (see section 8). Refusing does not restrict your use of the website. |
Instagram (operated by Meta) and Naver TalkTalk (operated by NAVER Corp.), which we use for enquiries, are external services. Messages exchanged by Instagram Direct Message or Naver TalkTalk are also governed by the operating company’s own privacy policy, separately from the transfers listed above.
6. Your rights and how to exercise them
You may at any time ask us for access to your personal information, ask us to correct or delete it or to suspend its processing, or withdraw your consent. You can exercise these rights by any of the following means.
- Phone: +82 507-1408-8384
- Instagram DM: @steadfast_coffeenworks
- In person at our café, in writing
We will act on your request and tell you the outcome within 10 days of receiving it. We check that the person making a request is the data subject or their lawful representative.
You may also exercise your rights through a representative, such as a legal guardian or a person you have authorised. In that case, a power of attorney must be submitted.
Requests for access or suspension may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act, and you cannot request deletion of personal information that another law specifies must be collected.
7. How we destroy personal information
We destroy personal information without delay once it is no longer needed, for example when its retention period has expired or its purpose has been achieved. Personal information that another law requires us to keep is moved to a separate database or stored in a separate location.
Electronic files are deleted in a way that prevents recovery or reproduction. Printed records are shredded or incinerated.
9. Behavioural information
We run the Meta Pixel on our website. Through it, behavioural information such as the pages you visit and the buttons you click is sent to Meta Platforms, Inc. and may be used to measure advertising performance and for personalised advertising, including remarketing, on Meta platforms such as Facebook and Instagram.
- Collected by
- Meta Platforms, Inc.
- Information collected
- Pages visited, button-click events, cookie identifiers (
_fbp,_fbc), ad click ID (fbclid) - How it is collected
- Automatically, through cookies and the Meta Pixel, when you use the website
- Purpose
- Advertising performance measurement, personalised advertising on Meta platforms
- Retention
- 90 days, based on the cookies; Meta keeps the information it receives under its own privacy policy.
- How to refuse
- As described in 8. Cookies and other automatic collection tools; you can also turn off personalised ads in Meta Ad Preferences (www.facebook.com/adpreferences).
We use Google tags only for analytics and advertising performance measurement, not for personalised advertising. If the behavioural information we collect or the way we use it changes, we will revise this section and let you know.
10. Security measures
Under Article 29 of the Personal Information Protection Act, we take the following measures to keep personal information secure.
- Administrative: access to personal information is kept to a minimum (only staff who need it)
- Technical: encrypted transmission over HTTPS on the website and access control for administrator screens
- Physical: locked storage for paper documents containing personal information
11. Privacy officer
We have designated the following privacy officer, who oversees our handling of personal information and deals with complaints and remedies. You can also send requests for access to your personal information to the privacy officer.
- Name
- Jihong Shim
- Position
- Representative Director
- Phone
- +82 507-1408-8384
- Instagram DM
- @steadfast_coffeenworks
- Department receiving requests for access, correction, deletion or suspension
- The Representative Director (contact above)
12. Remedies
To seek a remedy for an infringement of your personal information, you can apply for dispute resolution or advice to the Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center of the Korea Internet & Security Agency (KISA). For other reports or advice about infringements, contact the organisations below.
- Personal Information Infringement Report Center (KISA)
- 118 (no area code) · privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee
- 1833-6972 · www.kopico.go.kr
- Cyber Investigation Division, Supreme Prosecutors’ Office
- 1301 (no area code) · www.spo.go.kr
- Cyber Bureau, Korean National Police Agency
- 182 (no area code) · ecrm.police.go.kr
13. Changes to this policy
This Privacy Policy takes effect on .
If we change this policy, we will post the changes and their effective date on the website at least 7 days before they take effect, or at least 30 days before for changes that materially affect your rights.
Revision history
- : first adopted