Privacy Policy

Privacy Policy

This Privacy Policy explains how personal data is processed when you visit KPOPIMO, subscribe to the newsletter, contact us or interact with our social-media profiles. It also explains the services that are loaded from third parties and your rights under applicable data protection law.

Last updated: October 24, 2026

Controller

The controller responsible for the processing described in this Privacy Policy is:

Dae-Hyeon Kim
Glogauer Strasse 21
10999 Berlin
Germany

Email: hello@kpopimo.com

Hosting and Server Logs

KPOPIMO is hosted by dogado. When you access the website, the hosting infrastructure may process technical request and server-log data. This may include your IP address, the date and time of the request, the page or resource requested, the HTTP method and response status, the referrer if transmitted, browser and user-agent information, and other technical data required to deliver the requested content.

This processing is carried out to provide the website, maintain its stability, diagnose errors and protect it against misuse and attacks. The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are the secure, reliable and technically correct operation of the website. Log data is retained only for as long as needed for these purposes and any applicable legal obligations. The exact log-retention period for the current hosting plan has not yet been conclusively confirmed, so we do not state a fixed period here.

No KPOPIMO Analytics or Advertising Tracking

KPOPIMO does not currently use its own web-analytics or advertising-tracking tools on the public website. If you explicitly choose Light or Dark in the color-theme control, KPOPIMO stores the value “light” or “dark” under the key “kpopimo-theme” in your browser’s local storage so that the selected color appearance can be restored on later visits. If you choose System, no theme preference is stored and any existing “kpopimo-theme” value is removed. This value is stored locally in your browser, is not transmitted to KPOPIMO or third parties, and is not used for tracking or advertising. You can delete it by choosing System or by clearing your browser data. Third-party functions that involve separate processing are described below.

Newsletter and MailerLite

We use MailerLite to provide, send and manage our newsletter. If you subscribe, MailerLite processes the email address you enter and technical information associated with the signup. MailerLite acts as a service provider and processor for newsletter data where it processes that data on our behalf.

Newsletter registration uses a double-opt-in procedure. After submitting the form, you must confirm the subscription through a link sent to your email address before you are added as an active subscriber. The newsletter and the signup process are based on your consent under Article 6(1)(a) GDPR. Information needed to document the consent may also be retained so that we can demonstrate a valid signup as required by Article 7(1) GDPR. You can withdraw your consent at any time with effect for the future, for example by using the unsubscribe link in a newsletter or by contacting us.

MailerLite Local Storage: ml_guid

On pages containing the embedded MailerLite form, MailerLite loads its webforms.min.js script. During the normal loading of the form, this script generates a random identifier and stores it under ml_guid in your browser's local storage if no such value is already present. This can happen before you enter an email address, select Subscribe or complete a newsletter subscription.

In the client-side implementation examined by KPOPIMO, no automatic expiry date is assigned to this identifier. The value therefore remains in local storage until it is removed by the website or the user, the browser storage is cleared, or the browser otherwise deletes it. When the form is submitted, the identifier is transmitted to MailerLite as a guid parameter. We have not verified any further server-side use of this identifier for KPOPIMO's simple signup form, and our technical review did not establish that it is required for displaying the form or for the double-opt-in procedure.

We currently treat the loading of the embedded signup function and related basic form measurement as serving our legitimate interest in offering and operating a newsletter signup under Article 6(1)(f) GDPR. Separate rules governing access to or storage of information on a user's device may nevertheless require consent for ml_guid. This legal and technical question is not resolved merely by this Privacy Policy; where consent is legally required, the applicable basis is Article 6(1)(a) GDPR together with the relevant device-storage rules.

MailerLite Form Statistics and Email Tracking

MailerLite may process information about views of the embedded form, completed signups and resulting conversion statistics. The form-view request observed during our technical review did not contain the ml_guid. We therefore do not state that every form view is identified through that value.

Open tracking and Google Analytics tracking are disabled for our MailerLite campaigns and automations. We therefore do not use MailerLite tracking pixels to evaluate whether a subscriber opened a newsletter. MailerLite may, however, record ordinary clicks on links in newsletters and associate those clicks with the relevant subscriber. This allows click activity to appear in newsletter reports. This processing supports the operation and evaluation of the newsletter. Where it is based on consent, Article 6(1)(a) GDPR applies; where applicable law permits reliance on legitimate interests, Article 6(1)(f) GDPR may apply, subject to the subscriber's rights and the required balancing of interests.

Google Fonts

KPOPIMO currently loads the Manrope typeface from Google Fonts rather than hosting it locally. When a page is loaded, your browser requests the stylesheet and font files from Google servers. In doing so, your IP address and technical browser and request information may be transmitted to Google. Our audit did not identify cookies or local-storage entries created by Google Fonts on KPOPIMO.

We currently rely on Article 6(1)(f) GDPR for this processing, based on our interest in a consistent and efficient presentation of the website. This statement does not prejudge whether consent may be required under applicable law in a particular case; the external loading of the font remains a technical and legal point that should be reviewed separately.

Contact by Email

If you contact us by email, we process the information required to respond to your message. Depending on what you provide, this may include your name, email address, the content of your message and other information you submit voluntarily. General enquiries are processed on the basis of Article 6(1)(f) GDPR, reflecting our legitimate interest in communicating with users. If your request concerns steps before entering into a contract or an existing contractual relationship, Article 6(1)(b) GDPR applies. We retain correspondence only for as long as needed to handle the request and meet any applicable legal obligations; no universal fixed retention period has been set for all enquiries.

External Links and Affiliate Links

KPOPIMO contains ordinary links to external websites, including social-media and other third-party services. Our current public pages do not embed Instagram, TikTok, Pinterest, YouTube, Spotify or Apple Music content. Those providers are therefore not contacted merely because you load a KPOPIMO page. If you choose an external link, your browser connects to the external provider and that provider's own privacy terms apply. Our operation of Facebook and Instagram profiles is described separately below.

KPOPIMO does not currently load active affiliate-tracking scripts. The existing “Choose Your Retailer” buttons are not currently active affiliate destinations, so no affiliate tracking is triggered through them at present. If affiliate functions or other services are activated in the future and introduce additional processing, this Privacy Policy will be updated accordingly.

Social Media: Facebook & Instagram

KPOPIMO operates a Facebook business Page and an Instagram business account. The accounts are connected, and content published through the Instagram account may also be published on the Facebook Page. The KPOPIMO website does not currently embed Facebook or Instagram content or load Meta tracking code merely because you visit a KPOPIMO page. If you follow a link to one of our profiles or use Facebook or Instagram directly, you leave the KPOPIMO website and use a service provided by Meta.

For users in the European Region, the platform provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Meta processes personal data under its own responsibility for purposes determined by Meta, including providing and securing its services, personalising content and advertising, measuring use, and creating platform statistics. Depending on how you use Facebook or Instagram, this may include account and profile information, device and browser data, usage and interaction data, cookie or similar-technology data, and information inferred by Meta. KPOPIMO does not determine or have full access to this processing. Details are available in the Meta Privacy Policy.

When you visit or interact with a KPOPIMO profile, Meta may make information available to us. This may include your profile name or other account identifier, public profile information, follows, reactions, shares, comments, mentions, and the content and metadata of messages or other enquiries you send to us. Public comments and other public interactions can be visible to other platform users. Please do not send sensitive personal data through a public comment or direct message unless it is necessary for your request.

We process information that you provide directly through Facebook or Instagram in order to operate and moderate our profiles, respond to comments and messages, communicate with our community, and handle enquiries. The legal basis for general communication, community management and moderation is Article 6(1)(f) GDPR. Our legitimate interests are public communication about KPOPIMO, maintaining our profiles and responding to users. If a message concerns steps before entering into a contract or an existing contractual relationship, Article 6(1)(b) GDPR applies. Article 6(1)(c) GDPR applies where processing is necessary to comply with a legal obligation.

Meta provides us with Insights and comparable aggregated statistics about visits to and interactions with our Facebook Page, Instagram account and content. We use these statistics to understand the reach and use of our profiles and to improve our communications. Our legal basis is Article 6(1)(f) GDPR, based on our legitimate interest in evaluating and improving our public communications. For the processing of Facebook Page Insights Data covered by Meta's Page Insights Controller Addendum, KPOPIMO and Meta are joint controllers within the meaning of Article 26 GDPR. Under that Addendum, Meta Ireland takes primary responsibility under the GDPR for processing Insights Data and for complying with the applicable GDPR obligations relating to that processing, including the information duties under Articles 12 and 13 and data-subject rights under Articles 15 to 21 GDPR. More information is available in Meta's Information about Page Insights Data.

We generally retain information received directly through comments, messages or other interactions only for as long as needed to respond, manage the interaction or profile, document the communication, establish or defend legal claims, or comply with legal obligations. Public interactions may remain visible on the platform until they are deleted by you, KPOPIMO or Meta. Messages may remain in the relevant account until they are deleted, subject to any legal retention requirements. Meta determines the retention periods for processing carried out independently by Meta.

You may exercise your rights regarding processing for which KPOPIMO is responsible by contacting hello@kpopimo.com. You may also contact Meta or use the privacy and account tools provided by Facebook and Instagram for processing carried out by Meta or covered by joint controllership. A request submitted to either joint controller is not excluded merely because responsibilities have been allocated between KPOPIMO and Meta. Your right to lodge a complaint with a competent supervisory authority remains unaffected.

Recipients and Service Providers

Personal data may be received by dogado as our hosting provider, MailerLite in connection with the newsletter and embedded signup form, and Google when the externally hosted Manrope font is requested. Meta Platforms Ireland Limited may receive and make data available in connection with our Facebook and Instagram profiles and Insights, as described above. Where a provider processes data on our behalf, access is limited to what is necessary for the respective service. Meta also processes data independently for its own platform purposes. We do not disclose personal data to other recipients unless this is necessary for a stated purpose, required by law or covered by your consent.

International Data Transfers

Depending on a provider's infrastructure and subprocessors, personal data may be processed outside the European Union or European Economic Area. We do not claim that all processing remains in the EU. MailerLite's published data-processing terms include the European Commission's Standard Contractual Clauses for relevant third-country transfers. Meta's Privacy Policy describes the international transfers that may occur when Facebook and Instagram are used and the safeguards Meta relies on. Other transfers must be based on an applicable adequacy decision or appropriate safeguards under Chapter V GDPR, as relevant to the particular provider and processing. You may contact us for further information about safeguards applicable to your data.

Retention

We keep personal data only for as long as necessary for the purpose for which it was collected, including the management of a newsletter subscription or an enquiry, and for as long as legal retention, documentation or defence requirements apply. Newsletter data is generally processed while the subscription remains active. After withdrawal or unsubscription, limited information may still be retained where necessary to document the withdrawal, prevent further mailings or comply with legal obligations. Specific storage details for server logs and ml_guid are described above.

Providing Personal Data

Providing an email address for the newsletter is voluntary, but we cannot send the newsletter without it. Providing information in an email enquiry is also voluntary, although we may be unable to answer without sufficient contact details and information about the request. Technical request data is transmitted automatically by your browser and is necessary to deliver the website.

Your Rights

Subject to the legal requirements, you have the right to request access to your personal data (Article 15 GDPR), correction of inaccurate data (Article 16), erasure (Article 17), restriction of processing (Article 18), and data portability where applicable (Article 20). You also have the right to object to processing based on Article 6(1)(f) GDPR in accordance with Article 21 GDPR. If processing is based on consent, you may withdraw that consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

You also have the right to lodge a complaint with a competent data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.

Automated Decision-Making

KPOPIMO does not use automated decision-making, including profiling, that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR. MailerLite's regular newsletter click reporting is not used by KPOPIMO for such automated decisions.

Data Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or destruction. No method of electronic transmission or storage can guarantee absolute security.

Changes to this Privacy Policy

We may update this Privacy Policy when our website, services or legal requirements change. The current version and its update date will be published on this page.

Contact

If you have questions about this Privacy Policy or wish to exercise your data-protection rights, please contact:

hello@kpopimo.com