Privacy policy

PRIVACY POLICY

Last updated: August 26, 2026

Signature Legacy is a curated global commerce, commissioning, and editorial platform devoted to exceptional works created by Korean master artisans. The Services are operated by Signature Masterpiece Co., Ltd. (‘Signature Legacy,’ ‘we,’ ‘us,’ or ‘our’).

We recognize that a relationship with a collector may involve more than an ordinary retail transaction. A private commission may reveal personal aesthetic preferences, details regarding a residence or collection, the identity of a gift recipient, a meaningful inscription, delivery and security arrangements, or other information entrusted to us in confidence.

We approach that information with the discretion, restraint, and care appropriate to a distinguished collector relationship.

This Privacy Policy explains how we collect, use, disclose, transfer, retain, and otherwise process personal information when you visit, use, purchase from, commission a work through, or otherwise interact with our website, store, films, editorial content, collector services, and related offerings collectively referred to as the 'Services.‘

This Privacy Policy is a notice of our practices. Where applicable law requires consent for a particular activity, including certain marketing, optional cookies, sensitive information, or other processing, we will seek that consent separately.

For purposes of applicable data protection law, Signature Masterpiece Co., Ltd. generally acts as the controller or business responsible for personal information collected through the Services. Shopify, payment providers, logistics providers, artisans, and other parties may act as our processors, service providers, or independent controllers for particular activities, as described below and in their own privacy notices.

1. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to personal information collected through:

* signaturelegacy.co and associated domains or localized storefronts;
* our Shopify-hosted storefront, checkout, and customer account functions;
* private commission and reservation inquiries;
* Signature Legacy Concierge services;
* email, telephone, messaging, and customer support communications;
* authenticity, provenance, certification, conservation, and after-sales services;
* films, interviews, editorial materials, and product stories;
* optional recommendation, visualization, or digital certification functions;
* collector programs, memberships, invitations, and events; and
* other interactions that refer or link to this Privacy Policy.

This Policy does not govern a third party’s independent processing of personal information. Third parties, including PayPal, financial institutions, payment networks, shipping carriers, customs authorities, social media platforms, and certain Shopify services, may process information under their own privacy notices and legal responsibilities.

2. PERSONAL INFORMATION WE COLLECT

The information we collect depends on how you interact with Signature Legacy and which Services you choose to use.

A. Identity and Contact Information

We may collect:

* full name;
* preferred form of address;
* email address;
* telephone number;
* billing and shipping addresses;
* country or region;
* company, gallery, institution, or professional affiliation;
* recipient or authorized representative information; and
* other contact details you elect to provide.

B. Account and Collector Profile Information

We may collect:

* account credentials and authentication information;
* preferred language, currency, and market;
* wishlist and saved-item activity;
* preferred artisans, materials, motifs, techniques, and categories;
* collector service preferences;
* communication and marketing preferences;
* membership, allocation, loyalty, or store-credit status;
* saved addresses and delivery preferences; and
* account and relationship history.

We recommend using a unique password and not sharing account credentials with any other person.

C. Commission, Reservation, and Production Information

When you inquire about, reserve, or commission a work, we may collect:

* requested dimensions, materials, colors, finishes, motifs, inscriptions, and design preferences;
* intended use, placement, installation environment, or display conditions;
* personalization and dedication instructions;
* reference images, sketches, plans, room photographs, or other materials you choose to provide;
* approvals, revisions, production milestones, and correspondence;
* artisan allocation and production scheduling information;
* estimated completion and delivery requirements;
* gift-recipient information and requested presentation details;
* confidentiality or publication preferences; and
* records reasonably necessary to document what was commissioned, approved, created, certified, and delivered.

These records are particularly important in a made-to-order environment because they help establish the agreed specifications, protect the artisan’s authorship, support quality control, and preserve the provenance and service history of the work.

D. Order and Commercial Information

We may collect:

* products and works viewed, saved, reserved, commissioned, or purchased;
* order numbers and purchase history;
* deposits, installment schedules, balances, credits, and refunds;
* quotations and invoices;
* transaction dates and values;
* return, cancellation, repair, conservation, and warranty history;
* gift card, store credit, membership, or promotional activity;
* customs, duties, tax, and import information; and
* records of disputes, complaints, chargebacks, and resolutions.

E. Payment and Financial Information

We may collect or receive:

* billing name and address;
* selected payment method;
* transaction amount and currency;
* payment authorization and confirmation;
* partial payment or deposit status;
* payment-provider transaction identifiers;
* fraud, risk, or verification results; and
* limited information necessary to reconcile, refund, or investigate a transaction.

Full payment-card numbers and security codes are generally collected and processed directly by Shopify, PayPal, card networks, acquiring banks, or other authorized payment providers. Signature Legacy does not ordinarily receive or store complete card credentials.

Payment providers may process information as independent controllers to satisfy their own fraud-prevention, identity-verification, sanctions, financial-regulatory, know-your-customer, and anti-money-laundering obligations.

F. Identity, Authority, and Compliance Information

For high-value, unusual, international, insured, or otherwise higher-risk transactions, we or our authorized providers may request information reasonably necessary to:

* verify identity;
* confirm age or legal capacity;
* verify authority to act for a company, institution, principal, or recipient;
* prevent fraud, identity theft, unauthorized payments, and chargebacks;
* comply with sanctions, export-control, customs, tax, financial, or other legal requirements; or
* confirm eligibility to receive or collect a high-value work.

This may include a government-issued identification document, date of birth, nationality, business-registration information, authorized representative information, customs identifier, or beneficial-ownership information where reasonably necessary and permitted by law.

We seek to limit such collection to what is proportionate to the transaction. We do not request national identification numbers, passport copies, or similarly sensitive documentation as part of an ordinary purchase unless needed for a legitimate compliance, payment, customs, insurance, or delivery purpose.

G. Delivery, Customs, Insurance, and Installation Information

We may collect:

* delivery recipient and contact details;
* delivery address and access instructions;
* preferred delivery time;
* signature and proof-of-delivery records;
* building, elevator, loading, security, or installation requirements;
* customs-clearance identifiers and documentation;
* broker, carrier, insurer, or authorized representative information;
* delivery photographs or condition reports;
* collection and pickup authorization; and
* information required for specialist packing, international transport, insurance, white-glove delivery, installation, or claim administration.

Please avoid providing unnecessary details concerning residential security or access arrangements. Where such details are necessary, we restrict their use to the relevant delivery or installation purpose.

H. Communications and Concierge Information

We may collect information contained in:

* emails and contact forms;
* telephone or video calls;
* live chat or messaging;
* private appointment and consultation requests;
* surveys, reviews, and feedback;
* repair, conservation, authenticity, and after-sales inquiries; and
* other communications with Signature Legacy, artisans, or authorized partners.

Where legally permitted and appropriately disclosed, calls or communications may be recorded or preserved for quality assurance, training, security, dispute resolution, and documentation of commission instructions.

I. Photographs, Video, and Other Content

We may collect photographs, videos, audio, sketches, design files, room images, testimonials, reviews, or other content that you submit or authorize us to create.

We may photograph or film a commissioned work and aspects of its creation for:

* production documentation;
* specification and approval review;
* quality assurance;
* authenticity and provenance;
* condition reporting;
* artisan and brand archives;
* conservation and after-sales support;
* insurance or dispute resolution; and
* non-identifying editorial, educational, portfolio, or promotional use.

Unless otherwise agreed in writing, Signature Legacy may retain and use non-identifying images of a work and its making for these legitimate purposes. We will not intentionally publish a collector’s name, residential interior, private address, portrait, personal dedication, confidential design information, or other identifying detail in connection with a commission without authorization or another lawful basis.

J. Device, Network, and Usage Information

When you use the Services, we and our authorized providers may automatically collect:

* IP address;
* browser and device type;
* operating system;
* device and advertising identifiers;
* language and regional settings;
* approximate location derived from IP address;
* referring and exit pages;
* pages, works, films, and content viewed;
* searches, clicks, scrolling, and session activity;
* cart and checkout interactions;
* cookie and pixel identifiers;
* network, error, performance, and security logs; and
* interactions with emails and marketing communications.

K. Marketing and Event Information

Where applicable, we may collect:

* newsletter and invitation subscriptions;
* campaign engagement;
* event registration and attendance;
* preferred communication channels;
* opt-in, opt-out, and consent records;
* referral source; and
* interests inferred from interactions with our Services.

L. Digital Certificates, Wallets, and Blockchain Information

If we offer an optional blockchain-based authenticity, provenance, ownership, or educational certificate, we may collect:

* digital wallet address;
* token or certificate identifier;
* transaction hash;
* issuance, transfer, or verification information;
* work-related authenticity or provenance data; and
* limited account information necessary to associate the certificate with the applicable transaction.

Public blockchains are designed to preserve transactions permanently. Information written to a public blockchain may be visible to others and may not be capable of deletion or correction. We therefore seek to avoid placing names, addresses, contact information, identification documents, or other directly identifying information on a public blockchain.

M. Preferences and Inferences

We may derive reasonable inferences from information described above, including interests in particular artisans, works, materials, price ranges, styles, regions, or editorial subjects. We may use these inferences to curate the Services and provide relevant collector assistance, subject to applicable law and your available choices.

N. Sensitive Personal Information

We do not seek to collect sensitive personal information unless it is reasonably necessary for a specific transaction, compliance obligation, accessibility request, or service you have requested.

We do not use sensitive personal information to infer health, ethnicity, religion, political opinion, sexual orientation, immigration status, or other highly personal characteristics for advertising purposes.

Signature Legacy does not collect biometric identifiers from customers through the ordinary operation of the Services. If a future feature involves biometric authentication or another legally sensitive technology, we will provide a separate notice and obtain any consent required by law before collection.

3. SOURCES OF PERSONAL INFORMATION

We may obtain personal information:

* directly from you;
* from a purchaser, gift giver, recipient, authorized representative, company, gallery, institution, designer, architect, or other person acting with appropriate authority;
* automatically through the Services, cookies, pixels, software development kits, server logs, and similar technologies;
* from Shopify and Shopify-enabled services;
* from payment processors, financial institutions, fraud-prevention providers, and card networks;
* from artisans, studios, certification partners, fulfillment providers, carriers, insurers, customs brokers, and installation partners;
* from analytics, advertising, communications, and technology providers;
* from publicly available records or lawful compliance databases;
* from social media or third-party platforms when you interact with us through those services; and
* from business partners, subject to applicable law.

If you provide personal information about another person, you represent that you are authorized to provide it for the relevant purpose and that you have given that person any notice required by law.

4. HOW WE USE PERSONAL INFORMATION

We may use personal information to:

A. Provide and Administer the Services

* create and maintain accounts;
* display and localize the storefront;
* remember preferences;
* provide wishlist, membership, reservation, and collector functions;
* operate films, editorial content, and product stories;
* provide technical support; and
* maintain the availability, integrity, and performance of the Services.

B. Manage Commissions and Collector Relationships

* respond to inquiries;
* understand preferences and intended use;
* prepare quotations and commission proposals;
* confirm specifications and approvals;
* reserve an artisan’s production schedule;
* coordinate materials, production, finishing, certification, and documentation;
* provide appropriate production updates;
* preserve records of agreed specifications;
* manage limited allocations and collector programs;
* offer relevant works or services; and
* provide repair, conservation, authenticity, warranty, and after-sales assistance.

C. Process Transactions

* process orders, reservations, deposits, installment payments, balances, credits, refunds, and chargebacks;
* issue invoices, receipts, and transaction records;
* verify payment status;
* coordinate taxes, customs, insurance, and delivery; and
* maintain legally required records.

D. Fulfill and Protect High-Value Deliveries

* arrange specialist packing, crating, shipping, insurance, collection, and installation;
* confirm recipient identity and delivery authority;
* process customs and export documentation;
* investigate loss or damage;
* administer carrier and insurance claims; and
* protect the security of collectors, works, artisans, and delivery personnel.

E. Preserve Authenticity and Provenance

* prepare and verify certificates;
* maintain records of authorship, materials, production, inspection, and delivery;
* protect against counterfeiting, substitution, misrepresentation, and unauthorized reproduction;
* support future conservation, warranty, or authenticity inquiries; and
* preserve non-identifying historical records concerning the work.

F. Personalize and Improve the Services

* remember preferences;
* recommend relevant works, artisans, content, or services;
* measure performance and engagement;
* understand market and collector interests;
* improve navigation, presentation, search, editorial content, and customer service;
* develop new products and services; and
* create aggregated or de-identified analytics.

G. Communicate With You

* send order, payment, production, delivery, security, and service communications;
* respond to questions and requests;
* provide important policy or operational updates;
* send editorial, collection, event, or marketing communications where permitted; and
* administer communication preferences.

You may unsubscribe from marketing communications at any time. Even if you opt out of marketing, we may continue to send transactional, security, legal, and service-related communications.

H. Protect Signature Legacy and Others

* authenticate users;
* prevent fraud, abuse, counterfeiting, cyberattacks, unauthorized transactions, and policy violations;
* investigate suspicious activity;
* enforce our terms, policies, and contractual rights;
* establish, exercise, or defend legal claims;
* protect the rights, safety, property, confidentiality, and security of Signature Legacy, artisans, collectors, partners, and others; and
* maintain business continuity and internal governance.

I. Comply With Law

* comply with consumer, privacy, tax, accounting, customs, export-control, sanctions, recordkeeping, financial, court, and regulatory obligations;
* respond to lawful requests from authorities;
* conduct legally required verification; and
* assist with investigations where required or permitted by law.

J. Corporate Transactions

We may use and disclose information as reasonably necessary to evaluate or complete a merger, acquisition, financing, investment, reorganization, insolvency proceeding, sale of assets, or similar corporate transaction, subject to appropriate confidentiality and legal protections.

5. LEGAL BASES FOR PROCESSING

Where applicable law requires us to identify a legal basis, we may rely on:

* Contract: processing necessary to enter into or perform a contract with you, including responding to a commission request, confirming specifications, processing payment, producing the work, delivering it, and providing after-sales services.
* Legal obligation: processing necessary to comply with tax, accounting, consumer-protection, customs, sanctions, export, recordkeeping, court, or regulatory requirements.
* Legitimate interests: processing necessary for proportionate business interests, including operating and improving the Services, preserving commission and provenance records, securing the platform, preventing fraud, protecting legal rights, managing collector relationships, and conducting measured direct marketing where permitted.
* Consent: processing based on your freely given consent, including certain marketing, optional cookies, room-image or visualization functions, publication of identifiable content, or other activities for which consent is required.
* Other lawful grounds: another legal basis available under the law applicable to the particular processing.

Where we rely on legitimate interests, we consider the nature of the information, the reasonable expectations of the individual, the necessity of the processing, and the potential effect on individual rights.

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing already lawfully completed or processing based on another lawful ground.

6. MADE-TO-ORDER COMMISSIONS AND ARTISAN COLLABORATION

To fulfill a commission, we may provide the assigned artisan or studio with the minimum information reasonably necessary to create the work. This may include:

* confirmed dimensions and materials;
* motifs, colors, finishes, or design references;
* personalization or inscription instructions;
* required completion period;
* necessary approval communications; and
* limited collector or recipient information when essential to the commission.

Artisans do not ordinarily receive your complete payment-card information, unrelated account history, or residential details unless the information is genuinely necessary for an authorized service.

An artisan, certification body, conservator, installer, or other specialist may act as our service provider or, in certain circumstances, as an independent party responsible for its own processing.

We may maintain a lasting record of the work’s specifications, authorship, production, certification, condition, and service history. Where possible, records retained for historical, authenticity, research, or archival purposes will be separated from direct collector identifiers or maintained in a de-identified form.

A collector’s identity will not be presented publicly as part of a work’s provenance without authorization or another lawful basis.

7. SHOPIFY AND PAYMENT SERVICES

Our store and certain commerce features are hosted or enabled by Shopify.

Depending on the Shopify services we use, Shopify may process information to provide:

* storefront hosting;
* checkout and customer accounts;
* order and inventory management;
* fraud and security services;
* privacy and consent-management tools;
* analytics and performance services;
* payment-related functions;
* localization and Shopify Markets; and
* other enhanced commerce services selected by Signature Legacy.

For many core services, Signature Legacy acts as controller and Shopify acts as processor or service provider. For certain enhanced services, fraud-prevention functions, payment activities, or network-based services, Shopify or an applicable payment provider may act as a separate controller or business under its own privacy notice.

Payments may be processed through PayPal or other payment providers made available at checkout. Those providers may independently collect and use payment, device, identity, compliance, and transaction information.

Please review the privacy notices presented by the applicable payment provider before completing the transaction.

8. COOKIES AND SIMILAR TECHNOLOGIES

We and our authorized providers may use:

* essential cookies;
* preference and functionality cookies;
* analytics and performance cookies;
* security and fraud-prevention technologies;
* pixels, tags, local storage, and similar identifiers; and
* advertising or personalization technologies where enabled.

Essential technologies are used to provide functions such as account access, cart operation, checkout, security, fraud prevention, network management, and privacy preferences.

Where required by law, we will request consent before placing non-essential analytics, personalization, or advertising technologies.

You may manage available choices through:

* our cookie banner;
* the 'Cookie Preferences‘ link;
* the 'Your Privacy Choices‘ or data-sharing opt-out page;
* your browser or device settings;
* an unsubscribe mechanism; or
* another privacy tool made available through the Services.

Disabling certain technologies may affect functionality, language, saved preferences, checkout, or personalization.

9. TARGETED ADVERTISING, SALE, SHARING, AND GLOBAL PRIVACY CONTROL

Signature Legacy does not sell personal information in exchange for money.

Depending on the analytics, advertising, social media, or Shopify services enabled on the storefront, certain disclosures of identifiers, cookie data, device information, or internet activity may be considered a 'sale,‘ 'sharing,‘ or use for 'targeted advertising‘ under certain United States privacy laws, even where no money is exchanged.

Where such laws apply, you may opt out through our 'Your Privacy Choices‘ link or other mechanism provided through the Services.

Where required, we recognize eligible browser-based opt-out preference signals, including Global Privacy Control, as a request to opt out of sale, sharing, or targeted advertising for the browser or device transmitting the signal.

We do not knowingly sell or share the personal information of individuals under 16 years of age for targeted advertising.

At the time this Policy was last updated, Signature Legacy did not use sensitive personal information to infer characteristics about consumers for advertising purposes.

10. AI, RECOMMENDATION, AND AR VISUALIZATION FUNCTIONS

We may offer optional functions that recommend works based on aesthetic preferences, cultural interests, browsing activity, or images voluntarily provided by you.

If you choose to submit a photograph of a room, interior, collection, or intended installation space, we may process the image to:

* evaluate scale, proportion, color, material, and placement;
* generate recommendations or visual simulations;
* respond to your consultation request;
* improve the accuracy of the requested service; and
* maintain a limited service record where necessary.

Please do not upload photographs containing people, identification documents, financial information, security systems, access codes, confidential documents, or other information not necessary for the recommendation.

We do not use submitted room images to identify individuals. We will not use identifiable room images or private commission materials to train a general-purpose artificial intelligence model without a separate notice and any consent required by law.

We may use aggregated or appropriately de-identified interaction data to evaluate and improve recommendation quality.

Fraud, payment, security, and recommendation providers may use automated tools to produce risk scores or suggestions. Where applicable law provides a right concerning a decision based solely on automated processing that produces a legal or similarly significant effect, you may request information or appropriate human review.

11. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to:

A. Service Providers

Providers supporting:

* Shopify hosting and commerce;
* cloud infrastructure and content delivery;
* cybersecurity and fraud prevention;
* payment processing;
* analytics and consent management;
* email, communications, and customer service;
* accounting, legal, compliance, and professional services;
* document and certificate preparation;
* translation and localization; and
* other operational requirements.

B. Artisans and Production Partners

Assigned artisans, studios, material specialists, conservators, certificate providers, photographers, documentation partners, and other parties involved in producing, inspecting, documenting, authenticating, repairing, or preserving a work.

C. Fulfillment and Delivery Partners

Packing and crating specialists, carriers, freight forwarders, customs brokers, insurers, warehouse providers, installation professionals, collection agents, and delivery partners.

D. Payment and Financial Parties

Shopify, PayPal, banks, payment gateways, card networks, acquiring institutions, fraud-prevention services, financial institutions, and payment partners.

E. Analytics, Advertising, and Social Media Partners

Analytics, advertising, social media, and marketing providers where enabled and permitted by law, subject to available consent and opt-out requirements.

F. Authorities and Professional Advisers

Courts, regulators, tax and customs authorities, law-enforcement bodies, insurers, auditors, attorneys, accountants, and advisers where disclosure is required or reasonably necessary for a lawful purpose.

G. Corporate Transaction Parties

Potential investors, lenders, purchasers, successors, advisers, and other parties involved in a financing, restructuring, merger, acquisition, insolvency, or sale of business or assets, subject to appropriate protections.

H. Parties Chosen by You

A recipient, representative, designer, architect, gallery, institution, installer, adviser, wallet provider, or other person you direct or authorize us to involve.

We require service providers to handle personal information under appropriate contractual, confidentiality, security, and use restrictions where required by law.

12. INTERNATIONAL TRANSFERS

Signature Legacy is established in the Republic of Korea and serves collectors internationally.

Personal information may be transferred to, accessed from, stored in, or otherwise processed in the Republic of Korea and in countries where Shopify, PayPal, Amazon Web Services, payment providers, artisans, carriers, insurers, technology providers, or other authorized partners operate.

Privacy and government-access laws in those countries may differ from those in your country of residence.

Where required, we use recognized safeguards, which may include:

* adequacy decisions;
* standard contractual clauses;
* the United Kingdom International Data Transfer Addendum or Agreement;
* binding corporate rules;
* data-processing agreements;
* contractual confidentiality and security obligations;
* consent where legally appropriate; and
* another lawful transfer mechanism.

Additional information regarding significant international transfers appears in the International Transfer Schedule below or may be provided at the time of a particular transaction.

13. RETENTION OF PERSONAL INFORMATION

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including contract performance, collector service, authenticity and provenance, security, fraud prevention, legal compliance, dispute resolution, and protection of our rights.

Retention periods may include:

* Website display and advertising records: 6 months where required under Korean electronic-commerce law.
* Contract, order, cancellation, and withdrawal records: 5 years where required under Korean electronic-commerce law.
* Payment and supply records: 5 years where required under Korean electronic-commerce law.
* Consumer complaint and dispute records: 3 years where required under Korean electronic-commerce law.
* Tax, customs, accounting, and corporate records: for the period required by applicable law.
* Account information: for the duration of the account and a reasonable period thereafter, unless earlier deletion is required or a longer period is justified.
* Marketing records: until consent is withdrawn, you opt out, or the information is no longer needed, subject to retention of a limited suppression record so that we can respect the opt-out.
* Commission and production records: for as long as reasonably necessary to document specifications, performance, authenticity, provenance, quality, warranty, conservation, dispute history, or the legitimate historical record of the work.
* Identity-verification information: only for as long as necessary for the relevant verification, legal, fraud-prevention, or claims purpose.
* Security and technical logs: ordinarily for a limited period proportionate to security, troubleshooting, and legal requirements, with longer retention where connected to an investigation or claim.
* Public blockchain records: potentially permanent by the nature of the relevant blockchain.

Where historical, authenticity, statistical, or archival value can be preserved without identifying the collector, we may de-identify the relevant information and retain the de-identified record.

When personal information is no longer required, we delete, destroy, anonymize, or securely isolate it in accordance with applicable law. Electronic records are deleted using methods designed to prevent reasonable restoration, and physical records are shredded or otherwise securely destroyed.

Backup copies may remain for a limited period until overwritten through ordinary backup cycles, subject to access restrictions.

14. SECURITY AND CONFIDENTIALITY

We use reasonable administrative, organizational, physical, and technical measures designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, loss, destruction, misuse, and unlawful processing.

These measures may include:

* access controls based on business need;
* authentication and password controls;
* encryption in transit and, where appropriate, at rest;
* payment tokenization through authorized providers;
* network and application security;
* logging and monitoring;
* malware and fraud prevention;
* employee and contractor confidentiality obligations;
* service-provider assessment and contractual protection;
* backup and recovery measures; and
* incident-response procedures.

No internet transmission, electronic storage system, or security measure can be guaranteed to be entirely secure. You are responsible for protecting your password, devices, email account, and payment credentials and for notifying us promptly of suspected unauthorized account activity.

Please remember that ordinary email may not be appropriate for sending passports, identity documents, payment-card details, access codes, or other highly sensitive information. We may provide an alternative secure method where such information is genuinely required.

15. YOUR PRIVACY RIGHTS AND CHOICES

Depending on your location and the law applicable to our processing, you may have the right to:

* request confirmation of whether we process your personal information;
* access personal information we hold about you;
* correct inaccurate information;
* request deletion;
* request restriction of processing;
* object to certain processing;
* receive a portable copy of certain information;
* withdraw consent;
* opt out of marketing;
* opt out of sale, sharing, or targeted advertising;
* limit certain uses of sensitive personal information;
* request review of certain automated decisions;
* appeal the denial of a privacy request where applicable;
* authorize an agent to submit a request; and
* lodge a complaint with an applicable privacy or data-protection authority.

These rights are not absolute. We may retain or continue processing information where permitted or required for contract performance, payment reconciliation, legal compliance, fraud prevention, security, authenticity and provenance, disputes, legal claims, or the rights of another person.

We may request information reasonably necessary to verify your identity, authority, residence, or relationship to the information. We will not require you to create an account solely to exercise a right where prohibited by law.

We will not unlawfully discriminate against you for exercising a privacy right.

To submit a request, contact 
[concierge@signaturelegacy.co](mailto:concierge@signaturelegacy.co) with the subject line 'Privacy Request.‘

16. UNITED STATES PRIVACY NOTICE

This Section supplements the remainder of this Policy for residents of United States jurisdictions with applicable comprehensive privacy laws.

Depending on your interactions, during the preceding 12 months we may have collected the following categories of personal information:

* identifiers;
* contact and customer-record information;
* commercial and transaction information;
* internet and network activity;
* approximate geolocation;
* audio, visual, or similar information;
* professional or organizational information;
* payment, account-access, identity-verification, or other sensitive information where necessary;
* user-provided content; and
* inferences concerning preferences or interests.

We collect these categories from the sources described in Section 3, use them for the purposes described in Section 4, and disclose them for business purposes to the parties described in Section 11.

We do not sell personal information for monetary consideration. Certain advertising, analytics, or cross-context behavioral advertising activities, if enabled, may constitute 'sharing,‘ 'sale,‘ or 'targeted advertising‘ under applicable state law.

Eligible residents may have rights to know, access, correct, delete, obtain a portable copy, opt out of sale or sharing, opt out of targeted advertising, limit certain uses of sensitive information, and appeal certain request decisions.

Requests to opt out may be submitted through the 'Your Privacy Choices‘ link. Eligible Global Privacy Control signals will be recognized where required.

If we offer a membership, loyalty, store-credit, or collector-benefit program that constitutes a financial incentive under applicable law, we will provide any separate notice required before enrollment.

17. CANADIAN RESIDENTS

For individuals in Canada, we seek to collect, use, and disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

Where consent is required, we seek meaningful consent in a form appropriate to the sensitivity of the information and the reasonable expectations of the individual.

Personal information may be processed outside Canada, including in the Republic of Korea, Singapore, the United States, Ireland, and other countries where our providers operate. It may therefore be accessible to courts, regulators, law-enforcement bodies, or other authorities under the laws of those jurisdictions.

You may request access to or correction of your personal information and may withdraw consent, subject to legal and contractual restrictions and reasonable notice.

Canadian residents may contact the Office of the Privacy Commissioner of Canada or the applicable provincial privacy authority if they have an unresolved concern. Québec residents may also have additional rights under Québec privacy law, including rights relating to access, correction, withdrawal of consent, cessation of dissemination, de-indexation in applicable circumstances, and certain automated decisions.

18. EUROPEAN ECONOMIC AREA, UNITED KINGDOM, AND SWITZERLAND

Where the GDPR, UK GDPR, Swiss data-protection law, or related legislation applies, Signature Masterpiece Co., Ltd. is generally the controller of personal information processed for the purposes described in this Policy.

Our principal legal bases are described in Section 5.

Eligible individuals may have rights of access, rectification, erasure, restriction, objection, portability, withdrawal of consent, and protection concerning certain solely automated decisions.

You have an unconditional right to object to processing of your personal information for direct marketing.

International transfers may be supported by adequacy decisions, standard contractual clauses, approved binding corporate rules, the UK International Data Transfer Addendum or Agreement, or another permitted mechanism.

You may lodge a complaint with the data-protection authority in the country where you live, work, or believe an infringement occurred. UK residents may contact the Information Commissioner’s Office.

19. REPUBLIC OF KOREA PRIVACY NOTICE

For individuals whose personal information is subject to the Personal Information Protection Act of the Republic of Korea, Signature Masterpiece Co., Ltd. processes personal information for the purposes and periods described in this Policy.

Individuals or their authorized representatives may request access, correction, deletion, suspension of processing, withdrawal of consent, or other action available under Korean law.

A request may be limited where retention or processing is required by law, necessary to perform an existing contract, required to protect another person’s rights, or otherwise permitted under applicable law.

We may entrust processing to Shopify, cloud-service providers, payment providers, delivery providers, and other service providers described in this Policy. We supervise entrusted processing as required by applicable law.

Where personal information is transferred internationally, we provide the information and use a legal basis required under Korean law, including contract performance, statutory grounds, separate consent, or another permitted basis as applicable.

20. CHILDREN AND MINORS

The Services are intended for adults and are not directed to children.

We do not knowingly collect personal information from children under 14 in the Republic of Korea or under 13 in the United States without legally valid parental or guardian authorization. We do not knowingly permit a minor who lacks legal capacity to enter into a high-value commission without the involvement of an authorized parent or guardian.

If you believe a child has provided personal information improperly, please contact us so that we may investigate and take appropriate action.

21. PUBLIC BLOCKCHAINS AND DIGITAL PROVENANCE

Where you elect to receive a blockchain-based certificate, information written to the relevant blockchain may be publicly visible, permanent, and outside the exclusive control of Signature Legacy.

A request to delete information from our own systems may not remove information already recorded on a decentralized public ledger.

We seek to minimize this risk by avoiding the placement of directly identifying information on a public blockchain and by using limited token, transaction, or verification information where appropriate.

You are responsible for safeguarding any private key, seed phrase, or wallet credential. Signature Legacy will never ask you to disclose a wallet seed phrase or private key.

22. THIRD-PARTY WEBSITES AND SERVICES

The Services may contain links to artisan websites, social media platforms, video services, payment providers, carriers, or other third-party services.

We are not responsible for the privacy, security, content, or practices of a third party acting independently. We encourage you to review the third party’s privacy notice before providing information.

23. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes in our Services, technology, service providers, business operations, or legal obligations.

When we make changes, we will update the 'Last updated‘ date and publish the revised Policy. If a change materially affects how we use personal information already collected, we will provide additional notice or obtain consent where required by law.

Continued use of the Services does not by itself constitute consent to a new processing activity where applicable law requires separate consent.

24. CONTACT US

If you have questions, concerns, complaints, or requests concerning this Privacy Policy or our handling of personal information, please contact:

Signature Masterpiece Co., Ltd.
Brand: Signature Legacy
Privacy Contact: Signature Legacy Privacy & Concierge Team
Email: [concierge@signaturelegacy.co](mailto:concierge@signaturelegacy.co)
Phone: 080-371-6600
Address: 204, Dolgoji-ro 22-gil, Seongbuk-gu, Seoul 02784, Republic of Korea

Please use the email subject line 'Privacy Request‘ when exercising a privacy right.

We will endeavor to respond with the discretion and care appropriate to the nature of your request.

INTERNATIONAL TRANSFER AND SERVICE PROVIDER SCHEDULE

The following schedule describes significant providers currently known to support the Services. Actual processing may vary according to the customer’s location, chosen payment method, delivery destination, and services enabled at the time of the transaction.

1. Shopify Group

Recipients may include Shopify Inc., Shopify International Ltd., Shopify Commerce Singapore Pte. Ltd., and authorized Shopify affiliates and subprocessors.

Principal countries may include Canada, Ireland, Singapore, the United States, and other locations identified by Shopify.

Information may include account, contact, order, transaction, device, usage, checkout, security, consent, and limited payment-related information.

Purposes include storefront hosting, checkout, account services, order administration, localization, analytics, security, fraud prevention, privacy tools, and other selected Shopify services.

Information is transferred electronically when you access or use Shopify-enabled features and is retained for the period necessary to provide the relevant services, satisfy legal obligations, resolve disputes, maintain security, and complete provider backup and deletion cycles.

2. PayPal

The principal recipient for services provided to South Korean merchants or users may include PayPal Pte. Ltd. in Singapore, together with PayPal affiliates, financial institutions, card networks, fraud-prevention providers, and service providers in other jurisdictions relevant to the transaction.

Information may include identity, contact, billing, transaction, device, payment, fraud, compliance, and dispute information.

Purposes include payment authorization, settlement, currency conversion, refunds, dispute administration, fraud prevention, regulatory compliance, and customer support.

Information is transferred electronically when PayPal is selected or used and is retained under PayPal’s applicable privacy notice and legal obligations.

3. Amazon Web Services

Recipients may include Amazon Web Services entities and subprocessors supporting the selected AWS region and global content-delivery network.

Principal processing locations may include the Republic of Korea, the United States, and global edge locations used to deliver or secure content.

Information may include IP address, device and request information, content-access logs, security records, and content or files hosted through an AWS service.

Purposes include cloud hosting, media delivery, performance, backup, monitoring, and security.

Information is transferred electronically when the relevant hosted content or function is accessed and retained according to our configuration, AWS service terms, security requirements, and applicable law.

4. Artisans and Production Partners

Recipients may include the assigned master artisan, studio, certification provider, conservator, production specialist, or documentation partner, principally in the Republic of Korea.

Information is limited to commission specifications, approval records, production requirements, requested personalization, schedule, and other details necessary to create, authenticate, document, repair, or preserve the work.

Payment-card credentials and unrelated customer records are not ordinarily provided.

Information is transferred when required for the commission or service and retained only for the relevant production, contractual, provenance, warranty, archival, or legal period.

5. Carriers, Customs Brokers, Insurers, and Delivery Partners

Recipients and processing countries vary according to the destination, transit route, carrier, insurer, and customs jurisdiction.

Information may include name, contact information, delivery address, customs identifiers, invoice and item description, declared value, delivery instructions, identification or authority information, and insurance or claim documentation.

Purposes include export, import, customs clearance, shipping, tracking, delivery, installation, insurance, loss prevention, and claims administration.

Information is transferred when a shipment, delivery, collection, installation, or claim is arranged and is retained according to the provider’s legal and operational requirements.

Where practicable, information concerning the specific carrier, payment provider, or other material recipient will be presented during checkout, payment, fulfillment, or another relevant interaction.