Privacy Policy

We collect information you provide directly to us when you use our Contact form, apply for a buyer account, or sign in.

• Identification and contact details such as name, business email address, and company name.
• Inquiries and messages you submit through the Contact form or partnership channels.
• Buyer-application details such as company information, market territory, buyer type, contact-person details, phone number, and notes. Contact-person, phone, and notes fields are processed when submitted but are not currently retained in the application database record.
• Authentication identifiers from Google OAuth (your verified email and profile name) or magic-link email sign-in.

We also collect limited technical information automatically. Our Contact form stores a salted hash of the requester's IP address solely to enforce per-IP rate limits; we do not retain the raw IP address.

Where you consent to analytics or marketing cookies, the provider concerned may collect page addresses, referral source, browser and device information, IP address or approximate location derived from it, cookie or daily visitor identifiers, and page-view or performance measurements. This information is not necessarily anonymous. No analytics or marketing request is sent before the relevant consent, and none is sent on shared links, invitation links, or the signed-in admin, buyer, and account areas, regardless of consent.

Your cookie consent decision itself is stored in a cookie in your browser. It records only whether each category was granted, the notice version in force at the time, and the time of the decision; it contains no information identifying you. Our Cookie Policy sets this out in detail.

We use the information we collect to operate our website and buyer-account services, respond to inquiries, and meet legal obligations.

1. Respond to Contact form, partnership, and press inquiries you send to us.
2. Review buyer-account applications and communicate decisions to applicants.
3. Authenticate buyer-account holders and operate signed-in features.
4. Detect, prevent, and respond to abuse, fraud, and security incidents.
5. Comply with legal and regulatory obligations applicable to Cosmedi Global.

Where the General Data Protection Regulation (GDPR) applies, our lawful bases for processing include the performance of a contract with you, our legitimate interests in operating our wholesale business and website, your consent where required, and compliance with legal obligations.

Where the Republic of Korea Personal Information Protection Act (PIPA) applies, processing is carried out under the lawful bases recognized by PIPA, including performance of contract, consent, and legitimate business necessity.

We do not sell personal information. We share information with service providers acting on our behalf and only to the extent necessary for them to provide their services to us.

• Email delivery: Resend, for authentication, invitations, and buyer-application status messages.
• Database hosting: Neon Postgres, for storage of application and inquiry records.
• Application hosting: Vercel, for compute and edge delivery of the website.
• Authentication: Google, where buyers choose to sign in via Google OAuth.
• Usage analytics: where you consent to analytics cookies, Google, for measurement of website usage statistics through Google Analytics 4, and Vercel, for measurement of traffic and performance through Vercel Web Analytics and Speed Insights.
• Marketing measurement: where you consent to marketing cookies, Meta, for measurement of marketing campaign performance through Meta Pixel.

We may disclose information when required by law, court order, or regulatory request, or to protect the rights, property, or safety of Cosmedi Global, our buyers, or others.

Cosmedi Global is established in the Republic of Korea, and the service providers listed in section 4 operate infrastructure in jurisdictions outside Korea, including the European Economic Area and the United States. Those transfers are made to the extent necessary for us to provide the services to you.

In addition, where you consent to analytics or marketing cookies, information about your use of the website is transferred to the following overseas recipients. Transfers are made by transmission over the network, at the time you use the website after having consented to the category concerned.

• Google LLC (United States) — Items transferred: cookie identifiers, the addresses of the pages you view, referral source, browser and device information, and approximate location derived from your IP address. Purpose of use: measurement of website usage statistics through Google Analytics 4. Retention and period of use: event-level data is retained for 14 months. The retention period for user-level data resets upon new activity and may therefore last for up to 14 months after the user's most recent activity. These data-retention periods are separate from the expiry of cookies stored in the user's browser.
• Meta — Cosmedi has not independently verified which Meta legal entity receives data for its business account or every country in which that entity processes it. Items transferred after marketing consent: cookie identifiers, page addresses, browser and device information, IP address, and PageView events. Transfer timing and method: over the network when an eligible public page is viewed after consent. Purpose of use: measurement of marketing campaign performance through Meta Pixel. Meta's public Business Tools Terms allow Event Data to be retained for up to two years; account-specific cookie lifetimes may vary.
• Vercel Inc. (United States) — Items transferred after analytics consent: page paths, referrer, browser and device information, approximate location, and performance metrics. Transfer timing and method: over the network when an eligible public page is viewed after consent. Purpose of use: aggregated traffic and performance measurement through Vercel Web Analytics and Speed Insights. Vercel states that Web Analytics uses no cookies and discards its visitor hash/session after 24 hours. Speed Insights transmits browser performance data points; Cosmedi has not independently verified an account-specific retention period for those data points.

You may decline these overseas transfers, and declining does not restrict your use of the website. Even if you have consented, you can withdraw at any time through 'Cookie settings' at the bottom of the website, and the transfers concerned then stop.

International transfers are limited to the purposes and consent choices described above and remain subject to applicable law. This notice does not assert that a particular standard contractual clause or data-processing agreement applies where Cosmedi has not independently verified that account-specific fact.

We retain personal information only for as long as necessary to fulfill the purposes described in this Policy, comply with our legal obligations, resolve disputes, and enforce agreements.

• Contact inquiries, including the salted IP hash used for rate limiting, are retained while needed to respond to the inquiry and manage any resulting active business relationship, then deleted when that purpose and any related legal or dispute need end.
• Buyer-application database records are retained during review and, if approved, for the account and business relationship. Rejected or withdrawn application records are deleted when review, follow-up, legal, and dispute-handling needs end.
• Account and authentication records are retained while the account is active and afterward only where needed for security, legal compliance, or dispute handling.

When information is no longer required, the owner or authorized privacy operator confirms that the purpose and any mandatory preservation need have ended and authorizes destruction without undue delay. Electronic records are deleted from active systems through the database or provider deletion controls so that they are no longer available in ordinary use; residual backup copies, if any, are isolated from use until overwritten or expired under the provider's backup lifecycle. Paper records, if created, are cross-cut shredded or securely destroyed.

If applicable law requires preservation, the affected information is separated or access-restricted, used only for that preservation purpose, and destroyed when the required period ends.

Subject to applicable law, you may have rights to access, correct, delete, restrict, or object to processing of your personal information, and to data portability.

To exercise any of these rights, contact us at privacy@cosmediglobal.com. We may need to verify your identity before responding. You also have the right to lodge a complaint with your local supervisory authority.

We maintain technical and organizational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Access to production systems is restricted to authorized personnel, and database tables enforce row-level security so that unauthenticated callers cannot read inquiry records.

Cosmedi Global is a business-to-business wholesaler and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided information to us, please contact us so we can take appropriate action.