Hyunggon Shin (operating as Galaxy Whale™, Consultant Hugo, hereinafter "Service Provider") prioritizes the protection of the Client's personal data and complies with relevant laws, including the General Data Protection Regulation (GDPR). This Policy explains how the Service Provider collects, uses, stores, and destroys the Client's personal data.
Article 1. Purpose of Processing Personal Data
The Service Provider processes minimal personal data only for the following purposes. The personal data being processed will not be used for purposes other than the following, and if the purpose of use changes, necessary measures such as obtaining separate consent will be taken.
- Service Provision and Contract Fulfillment: Saju Myeongrihak analysis, creation and delivery of customized reports, consultation (via Email/Live session).
- Client Management: Identity verification, consultation reservation and scheduling, delivery of notices, response to Client inquiries (Q&A).
- Payment and Settlement: Confirmation of service fee payment, refund processing.
Article 2. Items of Personal Data Collected
The Service Provider collects only the information necessary for service provision via email and secure online forms (Tally.so).
Mandatory Items (For Analysis and Report)
- Year, Month, Date, and Time of birth (Solar/Lunar distinction)
- City of birth (for checking time zone and daylight saving time application)
- Gender (for Saju analysis and determining the direction of the 10-year fortune cycle)
- Name (or Nickname)
- Email address
Mandatory Items (For Payment and Refund)
- Payment confirmation information (Depositor's name, payment email, etc.)
- Refund account information (Account number, bank name, account holder, etc. — collected only if a refund occurs)
Optional Items
- Reasons for consultation and specific concerns
- Years of major past events (Collected only if verification of birth time is needed or to cross-check the accuracy of the fortune cycle)
- Messenger ID or contact number (when using live consultation option)
Article 3. Legal Basis for Processing Personal Data
The Service Provider processes personal data based on the following legal grounds in accordance with Article 6 of the GDPR (Lawfulness of processing).
- Performance of Contract / Pre-contractual Steps: Personal data may be processed where necessary to respond to inquiries, provide requested service information, arrange the service, and take steps at the Client's request prior to entering into a contract.
- Consent: Where consent is required as a legal basis, it will be obtained through a clear affirmative action for the specific processing purpose. The Client may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
- Compliance with Legal Obligation: Payment and accounting records may be retained where required by applicable tax or accounting laws.
Article 4. Retention and Use Period of Personal Data
In principle, the Service Provider destroys personal data without delay once the purpose of collection and use is achieved.
Data for Analysis (Date of birth, etc.)
- Principle: Retained for 2 weeks after report delivery (to allow sufficient time for Q&A) and then permanently destroyed.
- Extended Retention upon Client Request: If the Client requires additional time to review the delivered report and complete Q&A, the retention period may be extended by up to 4 additional weeks (maximum 6 weeks total from the date of report delivery), subject to the Client's explicit consent via email prior to the expiration of the initial 2-week period. Upon expiration of the maximum 6-week retention period, the relevant analysis data and reports shall be permanently deleted, unless retention is required by applicable law.
- No Archiving for Re-analysis: To ensure maximum privacy, the Service Provider does not retain the analysis report or personal data after the retention period. If the Client wishes to have a follow-up consultation in the future, the Client must provide the previously delivered report.
- Exception: If the Client requests immediate destruction after analysis completion, it will be destroyed immediately.
- Ongoing Services: In the case of recurring or ongoing services, such as periodic Saju readings, relevant data may be retained for the duration of the service relationship.
Payment and Contract Records
Personal data contained in accounting, payment, and contract records will be retained only for the period required by applicable tax, accounting, or other legal obligations.
Article 5. Procedures and Methods for Destruction of Personal Data
- Destruction Procedure: Information for which the retention period has expired or the purpose of processing has been achieved (service termination) is destroyed according to this Policy. It is not moved to a separate database or processed secondarily.
- Destruction Method: Electronic files and documents are securely deleted using appropriate methods designed to prevent unauthorized recovery.
Article 6. Provision of Personal Data to Third Parties and Use of AI
- Prohibition of Provision to Third Parties: The Service Provider does not sell or otherwise disclose personal data to third parties for their own independent purposes. Personal data may be processed by trusted service providers acting on the Service Provider's behalf where necessary to provide the Service or fulfill legal obligations, subject to appropriate data protection safeguards.
- Use of AI Tools and Pseudonymization: AI tools (LLM, etc.) may be used supplementarily to improve the accuracy of report drafting and translation. Protective Measures: Only the pseudonym and extracted Saju chart data are used during AI-assisted processing, while directly identifying information such as the Client's real name and specific date of birth is excluded.
Article 7. Processing of Personal Data of Minors
When processing personal data of children and adolescents under the age of 18, the consent of both the legal guardian (parent) and the minor themselves must be obtained. If proper consent is not verified, the information will not be collected and the service will not be provided.
Article 8. Rights of the Data Subject and How to Exercise Them
The Client (Data Subject) may exercise the following rights at any time and may request them via email (galaxywhale.lab@gmail.com). The Service Provider will take action without delay.
- Right of Access: The right to check the Client's personal data held by the Service Provider.
- Right to Rectification: The right to request correction of incorrect personal data.
- Right to Erasure (Right to be Forgotten): The right to request deletion of personal data.
- Right to Restriction of Processing: The right to request restriction of the processing of personal data in certain circumstances.
- Right to Object: The right to object to certain types of processing where applicable.
- Right to Data Portability: The right to receive personal data in a structured, commonly used, and machine-readable format where applicable.
- Right to Withdraw Consent: The right to withdraw consent at any time where processing is based on consent.
The Client also has the right to lodge a complaint with the competent data protection supervisory authority.
Article 9. Measures to Ensure Safety of Personal Data
- Administrative Measures: Compliance with this Policy, limiting access and processing to minimal information.
- Technical Measures: Setting passwords for files containing personal data, using secure cloud storage (Google Workspace, etc.), installing antivirus software and conducting periodic checks.
- Third-party Platform Security: The Service Provider uses third-party services in connection with the Service, including Tally (Tally BV, Belgium) for online forms, Google Workspace services for email and document storage, and Revolut for payment processing. Tally states that it operates within the GDPR framework, provides a Data Processing Agreement (DPA), and stores form data in Europe. AI tools such as ChatGPT and Gemini may also be used for supplementary drafting and translation, using pseudonymized information and extracted Saju chart data as described in Article 6.
Article 10. Remedies for Infringement of Rights
If you need to report or consult on personal data infringement, you may contact the Service Provider first or contact the Estonian Data Protection Inspectorate.
- Website: www.aki.ee
- Email: info@aki.ee
Article 11. Data Protection Contact
- Contact: Hyunggon Shin (operating as Galaxy Whale, Consultant Hugo)
- Email: galaxywhale.lab@gmail.com
Article 12. Language
This Policy is written in English. If there are any discrepancies in interpretation between a version translated into another language and the English original, the English version shall prevail.