Privacy Notice · 개인정보처리방침

This Privacy Notice applies to the "BLF" application (the "App") — the BLF influencer seeding platform, comprising its web application, installable Progressive Web App, and its Instagram (Meta) and TikTok integrations.

BLF MENA General Trading L.L.C (License No. 1444089, issued by Dubai Department of Economic Development, United Arab Emirates) is the data controller responsible for the personal data described in this notice.

BLF MENA operates the platform, including its Meta/Instagram and TikTok integrations, runs the seeding campaigns on it, and determines how the personal data is processed.

We process your personal data in two stages.

From your application until approval, we process your data on the basis of your consent. During this period you may withdraw your consent by contacting us (Section 11), and we will delete your application data within 30 days.

After your application is approved, we process your data on the basis of contract performance, to the extent necessary to carry out the seeding transaction you participate in (product shipment and campaign fulfilment). After approval, withdrawing consent alone does not delete your data. If you wish to have it deleted, you may submit a deletion request under Section 7, and deletion is carried out within the scope set out in Section 5.

Applicable provisions — consent: UAE Personal Data Protection Law (Federal Decree-Law No. 45/2021) Art. 6, GDPR Art. 6(1)(a) and Art. 7(3), and Korea PIPA Art. 15(1)1 and Art. 37; contract performance: UAE PDPL Art. 4(9), GDPR Art. 6(1)(b), and Korea PIPA Art. 15(1)4; together with the notice obligations of KSA PDPL, Nigerian NDPA 2023, South Africa POPIA and Kenya DPA 2019.

Name, SNS handle, shipping address, contact details (email and phone number), and seeding shipment history (product name and shipment date).

For transaction settlement and campaign records, where you provided them: year of birth, gender, photo, identification/license number and bank account details.

SNS account linking data, where you authorize it: Instagram (via Instagram Login OAuth) profile information, follower count and access token; and, once introduced, TikTok (via TikTok Login Kit) equivalent data. TikTok-sourced data is handled under the TikTok Developer Data Sharing Agreement (effective 22 Jan 2026), under which BLF MENA acts as an independent controller; transfers of EU/UK data incorporate Standard Contractual Clauses.

Fulfilment of K-beauty seeding transactions: shipping products to you and measuring seeding campaign effectiveness.

We retain your contact and transaction details (name, address, phone number, banking information, identification number, email) for 36 months from your last seeding shipment. After 36 months of inactivity, a 30-day advance notice is sent where contact details are available, and the above details are then deleted unless a new transaction occurs.

Your public SNS profile information (handle, profile URL, follower statistics, campaign performance) is retained as a record of our business engagement and partner pool. Shipment history is preserved with personal identifiers removed.

If you request deletion of your data, the same deletion is performed after a 30-day grace period during which the request can be withdrawn.

Phone verification records (the number being verified and the verification timestamps) are retained for 24 hours from the moment they are created, whether or not the verification succeeded, and are then erased by an automated clean-up that runs once a day; a record is therefore deleted no later than 48 hours after it was created. The verified number itself is retained with your contact details under the period stated above.

Courier companies (e.g. DHL, FedEx, EMS) receive your name, address and contact details solely for product delivery. We do not sell your personal data or share it with any other third party for their own purposes.

We use the following service providers (processors) acting on our instructions: Supabase (data hosting, India — AWS ap-south-1 region), Resend (email delivery, United States), AfterShip (shipment tracking), and Meta Platforms (WhatsApp Business Cloud API, United States) which receives your phone number solely to deliver one-time verification codes. International transfers to processors are limited to what is necessary to provide the service.

You may at any time exercise the rights of access, correction and deletion through the Privacy section of your portal Settings. Restriction of processing and any other requests can be exercised by contacting us (Section 11). Requests are processed within 30 days (UAE PDPL Art. 13, GDPR Art. 15–18, Korea PIPA Art. 35–37).

How to delete your data: see our Data Deletion page at https://app.blfcorporation.com/legal/data-deletion — it covers in-portal deletion, removing Instagram-linked data, and email requests for users without an account.

To detect abnormal logins and protect your account, we compute a device identifier from your browser's user agent, screen size, timezone and a canvas hash. It is used solely for login security. You may delete stored device identifiers at any time in portal Settings (active opt-out); doing so does not lock you out of your account.

Your data is stored in India (Supabase, AWS ap-south-1 region — Mumbai).

When this notice is updated we will notify you by email and display the updated version on the registration page. The version identifier at the top of this page reflects the effective date.

Data protection inquiries: info@blfcorporation.com — BLF MENA General Trading L.L.C, Office 102, Dubai, United Arab Emirates.