Upbit Privacy Policy

Dunamu Inc. (hereinafter referred to as the “Company”) considers the protection of the personal information of users very important and is doing its best to protect the personal information provided by users to the Company in order to use the Company's services (digital asset trading services and related services). The Company duly processes and safely manages users' personal information in accordance with the "Personal Information Protection Act" and other related laws and regulations.

The Company continuously makes this Privacy Policy available on the first screen of its website so that users can easily check the processing procedures and standards for personal information at any time.

This Privacy Policy may be changed in accordance with applicable laws and regulations and the Company's internal policies, and any changes will be managed through version control for easy reference.

The Company processes users’ personal information for the following purposes. The processed personal information is not used for purposes other than the following, and if the purpose of use is changed, necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act, will be taken.

1. Account Registration and Management

• -Verification and identification of users, customer verification (KYC), modification and management of user information, and delivery of various notifications and notices

2. Provision of Goods or Services

• -Confirmation of digital asset trading relationships
• -Management and provision of services, including setting, maintaining, and terminating digital asset trading relationships
• -Prevention of unauthorized use and provision of secure services
• -Usage statistics and analysis, provision of new and customized services

3. Provision of Digital Asset Airdrops and Physical-linked NFT

• -Verification of recipients for digital asset airdrops and execution of the airdrop process
• -Verification of recipients for physical-linked NFT rewards and distribution

4. Complaint Handling

• -Confirmation of the identity of complainants and the contents of complaints
• -Contact and notification for fact-finding, notification of processing results
• -Remedies for damages and handling of complaints

5. Provision of Events and Promotions

• -Provision of event and promotion details, benefits and opportunities for participation
• -Event participation, prize distribution and related guidance
• -Marketing activities based on demographic characteristics, user service usage records, and analysis

• ①The Company, with the consent of users pursuant to Article 15, Paragraph 1, Subparagraph 1 of the Personal Information Protection, collects and uses the minimum necessary personal information for the establishment, maintenance, execution, and management of digital asset transactions and the provision of services as follows:

Category		Collected and Used Items
Account Registration and Management	Registration	Upbit Nickname
	Upbit Login	Name, Mobile Phone Number, Date and Year of Birth, Gender, Resident/Non-resident Information, Telecommunication Company, Verification Information (CI, DI), Bank Name, Account Number, PIN Password
	Check for fraudulent Account re-Registration	Verification Information (CI)
Provision of Goods or Services	Mobile Phone Authentication	Name, Mobile Phone Number, Date and Year of Birth, Gender, Resident/Non-Resident Information, Telecommunication Company, Verification Information (CI, DI)
	If Using Biometric Authentication	[Optional] Fingerprint Information, Facial Information (**Only the result obtained by comparing the information with the data registered on the device is used, without being transmitted/stored on a separate server. Users can control the use of this feature with the on/off option.)
	Individual Customer Verification	[Basic Information] Name (English), Address, Nationality, Email
		[Required Information] Occupation, Workplace Information (Company Name, Address), Transaction Purpose, Source of Funds
		[Identification Card Verification] (Korean) Copy of Identification Card, Name, Resident Registration Number, Driver's License Number with Secured Serial Number, Valid through(expiration date) and Issuance Date (Foreigner) Copy of Identification Card, Name, Alien Registration Number, Issuance date, Expiration Date of Stay, Proof of Stay
		[Account Verification] Name of Financial Institution, Account Number
	KRW Deposits and Withdrawals	[Real-Name Deposit-Withdrawal Account Verification] Name of Financial Institution, Account Number
	Corporate Verification	[Representative Information] (Common) Name (Korean/English), Nationality, Date of Birth, Gender, Mobile Phone Number, Real-Name Verification Number, Address, Email, Occupation, Copy of Real-Name Verification Document, (for Foreigners) Certificate of Residence or Permanent Resident Card in Korea [Agent Information] Name (Korean/English), Verification Number, Copy of Identification Card, Nationality, Residence Status, Address, Phone Number, Mobile Phone Number, Email, Company Name, Occupation, Workplace Address, Relationship with the Transaction Party [OTP Receiving Device Owner Information] Name, Mobile phone Number, Proof of Mobile Phone Contract, Proof of Employment. [Login Information] ID (Email Address), Password ID (Email Address), Password [Security Settings] Security Password
	Digital Asset Transactions	Digital Asset Transactions Information, such as Trading Ddate, Quantity, Type, Asset Name, Deposit/Withdrawal Records, etc.
	Inheritance	Mobile Phone Number, Nickname, Proof of Family Relationship, Copy of Identification Card, Resident Registration Number, Death Certificate, Basic Certificate, Certificate of Registered Seal
	Transfer	Name, Date and Year of Birth, Mobile Phone Number, Account (Email), Nickname, Copy of Identification Card
	Issuance of Cash Receipt	Mobile Phone Number, Business Registration Number
	Processing Public charge and tax	Resident Registration Number
	Usage of NFT Service	Nickname, NFT Transaction History (**To verify transactions and activities within the service due to the nature of NFT digital assets)
	Registration of Personal Wallet Address	Personal Digital Asset Address
	IP Address registration for Open Api service	IP Address
	Upbit Major Trading League	Upbit Nickname, gender, Participation and operation information of Upbit Trading League(Investment Report & Portfolio of Digital Asset Transactions, Participating League information, League ranking& dashboard, Service statistics)
Provision of Event and Promotions	Participate in the event	[To participate in NFT event] Mobile Phone Number
	Conducting of Events and Promotions	[Optional] Name, Mobile phone number, Email, information for user statistics analysis (gender, residential area, age group), access logs and service usage records (KYC compliance status, linking of KRW deposit and withdrawal accounts, digital asset trading status, digital asset balances, period returns, trading types)
	Event Winning	Name, Mobile Phone Number [When providing physical prizes] Address [When Paying Taxes] Copy of Identification Card (**The items collected and used may vary depending on the event being held, and consent is obtained for the items collected and used for each event.)
Handling of Complaints	Inheritance	[Decedent] Name, Date of Birth, Address, Certificate of Family Relations, Death Certificate [Heir] Name, Date of Birth, Address, Contact Information, Relationship with the Decedent, Real Name Authentication Certificate, Unique Identification Number, Upbit Account Information (If a Representative is Appointed) Certificate of Personal Seal Impression (If the Heir is a Minor) Certificate of Identification
	Transfer	Name, Date and Year of Birth, Mobile Phone Number, Account(Email), Nickname, Copy of Identification Card
	Trading Support-Related Fraud Reporting	[Required] E-mail, Details of the Report [Optional] Name, Phone, Number, Attachments
	Abnormal Transaction Reporting	[Required] E-mail, Details of the Report, Attachments [Optional] Name, Phone, Number
	Support for Asset Withdrawals for Members unable to complete KYC Verification	Copy of Identification Card, Proof Photo to verify the Member's Identity, Mobile Phone Number, Email Address, Information about the Digital Asset to be withdrawn, Address of the Receiving Digital Asset and Proof of Ownership, Screenshot of the Receiving Exchange's Member Information Screen
	Releasing Suspension of Transactions Placed on Financial Fraud Accounts	- Name, Date of Birth, Address, Contact Information, Copy of Identification Card - Deposit/Withdrawal History that Confirms the Movement Path of the Affected Money (Transaction History with Financial Institutions, Account Number, Transaction History with other Digital Asset Exchanges) - Notice of Termination of Debt Extinction Proceedings or Confirmation of Facts related to Telecommunications Fraud - Evidence that can Prove the Source of the Affected Money (Objection Documents, Contracts, or Supporting Documentation such as Promissory Notes)/span> - Court Enforcement Documents or Incident Fact Confirmation Documents to Prove the Fact of Damage - (If Cancellation of Damage Relief is Needed) Certificate of Personal Signature, Application for Cancellation of Damage Relief - (If a Representative is Appointed) Name, Date of Birth, Address, Contact Information, Document Showing the Relationship, Copy of Identification Card, Personal Seal Certificate, and Personal Seal
	Change of Member Information/Naturalization	Name after changing member information, Documents such as Resident Registration Abstract which may confirm changes in member information, Nickname of the Existing Account
	Certificate of Loss of Nationality for Foreigners	Certificate of Loss of Nationality, Resident Registration Number Included in the Certificate of Loss of Nationality
	Proof of Purpose of Stay in Korea	Certificate of Employment or Certificate of Enrollment, Certificate of Alien Registration or Certificate of Domestic Residence, Entry and Exit Management Certificate, Unique Identification Information Included in Each Document
	Certificate of Alien Registration	Residency certificate or Certificate of Facts related to Entry and Exit
	Submission of Additional Documents for Customer Verification	- Purpose of Transaction, Source and Origin of Transaction Funds, Company Name, Address - The Following Documents Submitted by the User - Health Insurance Eligibility Confirmation or Entry and Exit Fact Confirmation - Confirmation of Resident Registration Card Issuance Application - Resident Registration Certificate, Overseas Business Trip Certificate, Short-Term Study Abroad Certificate - Passport Copy - Unique Identification Information (Resident Registration Number, Driver's License Number, Passport Number, Alien Registration Number) - Additional Documents Required for Customer Verification (Certificate of Enrollment or Employment, Document to Confirm the Purpose of the Transaction and the Source of Funds, Documents Related to Workplace Information)
	Verification of the Source of Funds	Deposit Date and Time, Type of Digital Assets deposited, Deposit TXID, Source of the Assets, Reason for the Deposit, Trading Plan for the deposited Digital Assets, Financial Institution Transaction Records, Records of Transactions on other Digital Asset Exchanges, Documents for proving Donation, Transfer, Inheritance, or other Relevant Transactions.
	Confirmation for measures to normalize abnormal deposit/withdrawal account activity	>Name, Date and Year of Birth, Mobile Phone Number, Photo Identification that can verify the Member's Identity.
	Submission of Supporting Documentation for Withdrawals	Proof of Withdrawal Destination, Reason for Withdrawal, Materials that Can Confirm the Withdrawal Destination
	Withdrawal Suspension Objection	Effective Date of the Withdrawal Suspension, Details of the Objection, Materials that Can Confirm the Withdrawal Destination and Reason for Withdrawal.
	Digital Asset Deposit Application	TXID, Proof of Withdrawal, Digital Asset Name and Quantity, Proof of Ownership of Digital Asset Address Used for Withdrawal, Return Digital Asset Address and Proof of Ownership
	Digital Asset Return Application·Incorrect Deposit	TXID, Proof of Withdrawal, Digital Asset Name and Quantity, Proof of Ownership of Digital Asset Address Used for Withdrawal, Return Digital Asset Address and Proof of Ownership [Fee Payment] Name of the Digital Asset, Fee Deposit Statement
	Submission of Supporting Documentation for Digital Asset Return	Return Digital Asset Address and Proof of Ownership
	For Lifting Self-Requested Withdrawal Suspension	Call Recording for Self-Verification
	Request for Access to Coporation Information	[Request of representative] Identification Card of representative, Certified copy of corporate registration [Request of Agent] Name, Birthdate, power of attorney , Business registration Number, Certificate of corporate seal
	Inquiries about NFT Collaboration	[Individual] Name, Website or SNS Address, Business manager’ Name, Business manager’ Email Address, Business manager’ Contact Information, Relationship with Original Copyright Holder [Corporation] Corporate Name, Website or SNS Address, Email Address, Contact Information, Relationship with Original Copyright Holder
Items Generated and Processed during the Service Usage Process	Service Usage	Device Information (OS, Model Name, Telecommunication Company, Device ID assigned by the Company, Language Information, ADID, IDFA, IDFV), IP Address, Service Usage Record, Cookie



• ②The Company may collect and use personal information within the scope of the collection purpose if it falls under any of the following subparagraphs pursuant to Article 15 (Collection and Use of Personal Information) of the Personal Information Protection Act.
• 1.When special provisions are stipulated by law or it is necessary to comply with legal obligations
• -In accordance with laws concerning tax collection and payment such as the Income Tax Act, Corporate Tax Act, and National Tax Collection Act, the processing of resident registration numbers and copies of identification cards for the reporting and payment of taxes and dues
• 2.When it is necessary to perform an agreement entered into with an information subject or to implement measures pursuant to a request of users in the course of entering into an agreement
• 3.When it is recognized as being unambiguously necessary for imminent interest of the life, body or property of a user or a third party
• 4.When it is necessary to achieve the legitimate interest of the Company and unambiguously overrides the rights of the user. In this case, it shall be limited to a case wherein it is substantially related to the legitimate interest of the personal information handler and does not exceed a reasonable scope.
• 5.When it is urgently necessary for the safety and well-being of the public, such as public health

Article 3 (Processing and Retention Period of Personal Information)

• ①The Company shall process and retain personal information within the period of time required by law for personal information processing and retention or within the period of processing and holding personal information agreed upon when collecting personal information from users.


• ②The period of time for processing and retention of each personal information is as follows:

1. Account Registration and Management :

• -Deleted upon the withdrawal of membership. However, information that is required to be retained according to applicable laws will be preserved under Article 3, Paragraph 1.

2. Provision of Goods or Services :

• -Retained 5 years after the withdrawal of membership. However, information that is required to be retained according to applicable laws will be preserved under Article 3, Paragraph 1.

3. Provision of Event : until the end of the relevant event

4. Complaint Handling : Retained 5 years after the withdrawal of membership. However, information that is required to be retained according to applicable laws will be preserved under Article 3, Paragraph 1.

• ③The Company processes and retains personal information until the end of the relevant reasons in the case of the following Subparagraphs to fulfill statutory obligations. However, if the processing and retention periods specified in Paragraph 2 and this Paragraph are different, the longest period will be applied.

1. For the items in the following categories, until the end of the relevant period

Record	Relevant Laws	Retention Period
Digital asset transaction records View details	Act On The Protection Of Virtual Asset Users	15 years
Record of Customer Verification (KYC)	Act on Reporting and Using Specified Financial Transaction Information	5 years
Record of Contract or Subscription Withdrawal	Act on Consumer Protection in Electronic Commerce, etc.	5 years
Record of Payment Settlement and Supply of Goods		5 years
Record of Consumer Complaints or Dispute Resolution		3 years
Login Record	Act on Protection of Communications Secrets	More than 3 months
Record of Payment of Taxes and Public Dues	Acts related to the collection and payment of taxes, such as the Income Tax Act, Corporate Tax Act, and National Tax Collection Act	5 years
Record of Processing Cash Receipts		5 years

2. If an investigation is ongoing due to a violation of applicable laws and regulations, the personal information will be stored until the end of the relevant investigation is concluded

3. If there is an outstanding debt or credit relationship arising out of use of the service, the personal information will be stored until the debt is settled

4. If there is an ongoing legal dispute between the user and the Company, the personal information will be stored until the dispute is officially resolved

Article 4 (Destruction of Personal Information)

• ①When personal information becomes unnecessary due to the passage of the retention period or the accomplishment of the processing purpose, the Company shall promptly destroy such personal information.


• ②In the case of personal information that must be retained under applicable laws despite the expiration of the retention period for personal information or the achievement of the processing purpose, the Company will move such personal information to a separate database or store it in a different location. Detailed information on the personal information retained according to applicable laws can be found in Article 3 (Processing and Retention Period of Personal Information).


• ③The Company securely manages the personal information of a user who has been processed as a dormant user in accordance with the old Personal Information Protection Act.


• ④The personal information for which a reason for destruction has occurred due to the passage of the retention period or the accomplishment of the processing purpose, shall be destroyed upon approval of the personal information protection manager or through automatic deletion by the system.


• ⑤The method of personal information destruction is as follows.
• 1.Personal information stored in electronic form is permanently deleted to prevent playback of the record.
• 2.Personal information recorded or stored on paper documents is shredded or incinerated.

Article 5 (Provision of Personal Information to Third Parties)

• ①The Company handles users' personal information only within the scope specified in Article 1 of the Privacy Policy (Purpose for Processing Personal Information), and the Company provides personal information to the third parties only if it falls under Articles 17 (Provision of Personal Information) and 18 (Restrictions on the Use and Provision of Personal Information other than the Purpose) of the Personal Information Protection Act, such as consent of the information subject, special provisions of the law, or inevitable to comply with legal obligations.


• ②The Company provides the following personal information to third parties with prior consent from users. The recipient may be changed without any notice depending on the nature of the partnered service and the contract.


• View details on the provision of personal information to third parties
• ③In accordance with Article 18, Paragraph 2, Subparagraph 2 of the Personal Information Protection Act, the Company may provide personal information to relevant agencies in order to fulfill statutory obligations as follows, according to the procedures and methods prescribed by such statutes. In such cases, the Company requests that the recipient agencies establish necessary measures under the Personal Information Protection Act.


• View details on the provision of personal information to third parties according to law

Article 6 (Criteria for additional use or provision)

• ①In the process of providing services, the company may use or provide personal information without the user's consent pursuant to Article 15 (3) and Article 17 (4) of the Personal Information Protection Act.


• ②When the company uses or provides personal information without the user's consent pursuant to paragraph 1, it shall be processed in consideration of the following matters:

1. Whether it is reasonably related to the original purpose for which the personal information was collected;

2. Whether additional use or provision of personal information is foreseeable in light of the circumstances under which the personal information was collected and processing practices;

3. Whether additional use or provision of personal information does not unfairly infringe on the interests of the data subject;

4. Whether the measures required to ensure safety such as pseudonymization or encryption have been taken.

Article 7 (Outsourcing of Personal Information Processing)

• ①The Company outsources some of the necessary work for providing services to external companies. When the outsourced companies process personal information while performing the delegated tasks, management and supervision are implemented to ensure that personal information is processed safely in accordance with Article 26 of the Personal Information Protection Act.


• ②The personal information processing tasks that the Company has outsourced to external companies are as follows.

1. List of Personal Information Processing Consignment Company (Domestic)

Consignment Company		Content of consignment
	Reconsignment Company
DunamuCX Inc.		Customer consultation related to Upbit services
	HYOSUNGITX Co.,Ltd
Amazon Web Services, Inc.		Storage of data for the provision of services and operation of services
Coocon Co., Ltd.		Verification of authenticity of identification cards, account ownership certification, issuance of cash receipts
Bonanza Factory Co., Ltd.		KRW deposit/withdrawal and account ownership certification, Transaction safety management
	Kakao Corp., Naver Corp., KEB Hana Bank	Two-channel additional authentication and identity verification
	Coocon Co., Ltd.	ARS phone authentication
Linkhub Co., Ltd.		Issuance of cash receipts and tax invoices
NICE Information Service Co., Ltd.		Real-name verification, Mobile Phone Authentication, Account Ownership Certification
Naver Cloud Corp.		Non-face-to-face ID authentication
Bonanza Factory Co., Ltd.		KRW deposit/withdrawal, Account Ownership Certification
Danal Co., Ltd.		Mobile Phone Authentication
FutureWiz Co., Ltd.		Two-channel additional authentication and verification
	Kakao Corp.
Naver Corp., KEB Hana Bank		Two-channel Additional Authentication, Verification
BizTalk Co., Ltd., LG CNS Co., Ltd.		Agent for sending KakaoTalk message
KT Corp., LG Uplus Corp.		Sending SMS
Kakao Corp.		Personal Information Processing and Gift Sending through KakaoTalk Plus Channel
Lambda256 Corp. (recommissioned by VerifyVASP Pte. Ltd.)		Linked data transfer in relation to digital asset deposit and withdrawal.
Opensurvey Inc.		Use of survey service platform

Article 8 (Transfer of Personal Information to Overseas Parties)

The Company transfers personal information overseas as follows.

1. Personal Information Processing Overseas Consignment Company

The Company, under Article 28-8, Paragraph 1, Subparagraph 3, Item a of the Personal Information Protection Act, entrusts the processing of and stores personal information duties through contracts with overseas companies to provide the services, and manages and supervises the foregoing so that the entrusted personal information for processing can be processed securely. Users may refuse the transfer of personal information through the customer center, but users who refuse may not use the services.

Consignment Company	Amazon Web Services, Inc.	Twilio Inc.	Amplitude, Inc.	Appsflyer Ltd.	VerifyVASP Pte. Ltd.
Purpose of Consignment	Data backup (storage) for uninterrupted service provision even in the event of disasters and accidents	Sending notification mails	Collecting behavioral logs and performing statistical analysis	Collecting behavioral logs and performing statistical analysis	Linked data transfer in relation to digital asset deposit and withdrawal
Consignment Items	Minimum data for service recovery (such as Account registration and management information, Customer verification information, KRW deposits and withdrawals information, Digital asset transactions information)	Email, Nickname, Attachment	Member ID, Device Information (OS, Model Name, Language Information, IP Address, ADID, IDFA, IDFV, Telecommunication Company)	Device Information (OS, Model Name, Language Information, Connection Network Type, IP Address, ADID, IDFA	Sender/Recipient Name, Date of birth and Digital Asset Address
Country of Consignment, Contact	United States, Go to Contract	United States, privacy @twilio.com	United States, privacy @amplitude.com	Ireland, Belgium, privacy@appsflyer.com	Singapore, corporate @verifyvasp.com
Date and Method of Consignment	When using services, data is transferred over the network	When sending emails, data is transferred over the network	When using services, data is transferred over the network	When using services, data is transferred over the network	When making deposits or withdrawals of digital assets, the information is transmitted over the network
Retention and Use Period	15 years after withdrawal from membership	30 Days after email delivery	15 years after withdrawal from membership	2 years	5 years

2. Overseas companies receiving personal information

The Company provides the following personal information to third parties overseas with the prior consent of users in accordance with Article 28-8, Paragraph 1, Subparagraph 1 of the Personal Information Protection Act. In order to provide the services requested by the user, personal information must be necessarily transferred to overseas companies. If users do not want their personal information to be provided to an overseas company, they can refuse it through the customer center and, in this case, such users may not use the services. Overseas companies to which the transfer has been made may be changed without prior notice, depending on the characteristics of the partnered services and the contract.

View details on the receiving of personal information to the overseas

Article 9 (Measures for Ensuring the Security of Personal Information)

The Company has implemented the following administrative, technical, and physical measures necessary for ensuring the security of personal information, in accordance with Article 29 of the Personal Information Protection Act.

1. Administrative measures

• -Establishment of an internal management plan : The Company has established and implemented an internal management plan to ensure the secure management of personal information.


• -Minimization and education of personal information handlers : The Company limits personal information handlers to the minimum necessary for job performance, and educates them on the importance of personal information protection.
• -Operation of a dedicated personal information protection organization: The Company continuously performs tasks of inspecting the implementation status of measures to ensure the security of personal information in the personal information processing system through the operation of a dedicated personal information protection organization.

2. Technical measures

• -Management of access rights to personal information processing systems: The Company grants, modifies, and revokes access rights to personal information processing systems to control access to personal information. The Company also uses intrusion prevention systems to control unauthorized access from external sources to the personal information processing systems.


• -Encryption of personal information: The Company stores and manages personal information after encryption thereof, such as the user's unique identification information and bank account number, which are subject to encryption under the Personal Information Protection Act, using a secure encryption algorithm.


• -Technical measures to prepare for hacking: The Company is doing its best to prevent the leakage or damage of user's personal information due to hacking, computer viruses, or other means. It backs up data in anticipation of damage to personal information, uses up-to-date virus protection software to prevent the leakage or damage of personal information or data, and uses encrypted communication to safely transmit personal information over the network.

3. Physical measures

• -To prevent the leakage or damage of personal information, the Company installs personal information processing systems in areas that are secured against external access and has established and operates access control procedures.

Article 10 (Installation, Operation, and Rejection of Automatic Collection Devices for Personal Information)

• ①The Company uses ‘cookie,’ which store and retrieve user information, in order to provide more convenient services to users.


• ②Cookie is small amounts of information that websites send to customers' computer browsers.

1. Purpose of using cookies

Cookies are used to store user preferences and other information to provide a faster web environment and to improve services for more convenient use. This allows users to use services more easily.

2. Installation, operation, and refusal of cookies

Users have the option to refuse or delete the installation of cookies at any time.

3. How to refuse cookie setting

Users have the option to refuse or delete the installation of cookies at any time.

• -Microsoft Edge : Settings > Cookies and site permissions > Cookie level settings
• -Chrome : Select Settings menu > Privacy and security > Delete Internet usage history/Third party Cookies > Cookie level settings
• -Safari : Select Settings menu > Advanced tab > Privacy > Block Cookies settings

Article 11 (Management of Behavioral Information)

• ①Behavioral information refers to online user activity information, such as website browsing history, purchase and search history, interests, preferences, and tendencies.


• ②The Company processes behavioral information for product and service development, customer analysis, and service provision based on user behavior.

1. The types of behavioral information collected

Information collected includes user activity information, such as web/app service browsing history, search/click usage history, device information, IP address, etc.

2. Methods of collection

The information is collected automatically using log analysis tools during service use.

3. Purpose of collection

The information is used for the purposes of developing products and services, statistics and customer analysis, improving service speed and status, and providing other services based on user behavioral information.

4. Retention and usage period

Information is retained for a maximum of 26 months from the date of collection and will be promptly deleted upon expiration of the retention period.

5. Methods for users to exercise control over their information

Users can refuse the use of cookies and manage their information through browser settings.

• -Web browser (Example): Settings > Site Permissions > Cookies and Site Data > Cookie Level Settings
• -Smartphone (Example / It may be slightly different depending on the OS version.)
• •Android Phone : Settings > Privacy > Advertising > Ads Personalization on or off
• •iPhone : Settings > Privacy > Tracking > Allow or disable apps to request tracking
• -Guide to disabling Google Analytics

6. How to apply for user damage relief

• -Contact : 1588-5682 (Support Center)
• -Email : cs@upbit.com

Article 12 (Rights and Obligations of Users and Legal Representatives and Their Exercise Methods)

• ①Users have the right to access, correct, delete, or request the suspension of processing of their personal information or withdraw their consent to personal information processing from the Company at any time.
  However, such rights may be limited in accordance with the provisions of relevant laws, including Article 35, Paragraph 4, Article 36, Paragraph 1, and Article 37, Paragraph 2 and 3 of the Personal Information Protection Act.


• ②Users can exercise their rights by submitting a written request, email, fax, etc. as stipulated in Article 41, Paragraph1 of the Enforcement Regulations of the Personal Information Protection Act, and the Company will take appropriate measures without a delay.


• ③Users who appeal against a company’s response to their request for access, correction, deletion, or suspension of processing, or withdrawal of consent can raise an objection by the method referred to in Paragraph 2 within 10 days from the date of action.


• ④Users may exercise their rights under Paragraph 1 through their legal representatives or authorized agents. In this case, they must submit a power of attorney in accordance with the form of Annex 11 of the “Regulation on Personal Information Processing Methods."


• ⑤If the personal information is designated as a collection target in other laws, the deletion of such information cannot be requested.


• ⑥The Company confirms whether the requester for access, correction, deletion, or suspension of processing, or withdrawal of consent is the user or a legitimate representative of the user, before providing access or taking any requested actions.
• ⑦Users can exercise their rights under this Article in reference to Article 14 (Department for Processing Requests for Access to Personal Information). The Company will strive to ensure that the exercise of users’ rights is processed promptly.

Article 13 (Personal Information Protection Manager and Department in Charge)

• ①The Company designates the following department and personal information protection manager to protect user's personal information and handle complaints related to personal information.

▶ Personal Information Protection Person-In-Charge

• -Name : Jaeyong Jeong
• -Position : Personal Information Protection Person-In-Charge
• -Contact : 1588-5682 (Support Center))
• -Email : cs@upbit.com
• -Department in charge : Personal Information Protection Team

▶ Personal Information Protection Manager

• -Name : Taesung Park
• -Position : Personal Information Protection Manager
• -Contact : 1588-5682 (Support Center)
• -Email : cs@upbit.com
• -Department in charge : Personal Information Protection Team


• ②Any complaints related to the protection of personal information that arise while using the Company's services can be directed to the personal information protection person-in-charge or the relevant department. The Company will respond and handle the user's inquiry in a timely manner.

Article 14 (Department for Processing Requests for Access to Personal Information)

▶ Department for Processing Requests for Access to Personal Information

• -Department in charge : Operation Support Team
• -Contact : 1588-5682 (Support Center)
• -Email : cs@upbit.com

Article 15 (Remedies for Infringement of Rights)

If you need help with remedies or consultation regarding personal information infringement, you may contact the following organizations.

▶ Personal Information Infringement Report Center (operated by Korea Internet & Security Agency)

• -Website : privacy.kisa.or.kr
• -Contact : 118 (without area code)

▶ Personal Information Dispute Mediation Committee

• -Website : www.kopico.go.kr
• -Contact : 1833-6972 (without area code)

▶ The Supreme Public Prosecutors Office

• -Website : www.spo.go.kr
• -Contact : 1301 (without area code)

▶ The Cyberbureau

• -Website : ecrm.cyber.go.kr
• -Contact : 182 (without area code)

Article 16 (Responsibility for Linked Sites)

The Company may provide links to external sites for users. In this case, the Company cannot guarantee or be responsible for the usefulness, truthfulness, or legality of the services or information provided by the external sites, as the Company has no control over them. The privacy policies of linked external sites are not related to the Company, so please check the policies of the relevant external site.

Article 17 (Changes to the Privacy Policy)

In the event that the Company changes its Privacy Policy, it will continually disclose the timing of the change and the changed contents, and will make the changed contents easily accessible to users by comparing the contents before and after the change.

<Supplementary Provisions>

This Privacy Policy V2.40 is effective as of January 2, 2025.
The previous Privacy Policy can be found below.

※ This English version of the Upbit Privacy Policy is a translation based on the original Korean version of the Upbit Privacy Policy . If there is any conflict between the original Korean version and this English version, the original Korean version of the Upbit Privacy Policy shall prevail.

• -Link to Privacy Policy Policy V2.40 (2024.10.21~2025.01.01)
• -Link to Privacy Policy Policy V2.39 (2024.10.14~2024.10.20)
• -Link to Privacy Policy Policy V2.38 (2024.09.25~2024.10.13)
• -Link to Privacy Policy Policy V2.37 (2024.07.19~2024.09.24)
• -Link to Privacy Policy Policy V2.36 (2024.07.05~2024.07.18)
• -Link to Privacy Policy Policy V2.35 (2024.06.24~2024.07.04)
• -Link to Privacy Policy Policy V2.34 (2024.06.03~2024.06.23)
• -Link to Privacy Policy Policy V2.33 (2024.04.29~2024.06.02)
• -Link to Privacy Policy Policy V2.32 (2024.03.25~2024.04.28)
• -Link to Privacy Policy Policy V2.31 (2024.02.01~2024.03.24)
• -Link to Privacy Policy Policy V2.30 (2023.12.18~2024.01.31)
• -Link to Privacy Policy Policy V2.29 (2023.11.20~2023.12.17)
• -Link to Privacy Policy Policy V2.28 (2023.10.26~2023.11.19)
• -Link to Privacy Policy Policy V2.27 (2023.09.08~2023.10.25)
• -Link to Privacy Policy Policy V2.26 (2023.06.12~2023.09.07)
• -Link to Privacy Policy Policy V2.25 (2023.03.17~2023.06.11)
• -Link to Privacy Policy Policy V2.24 (2023.01.01~2023.03.16)
• -Link to Privacy Policy Policy V2.23 (2022.11.21~2022.12.31)
• -Link to Privacy Policy Policy V2.22 (2022.10.31~2022.11.20)
• -Link to Privacy Policy Policy V2.21 (2022.09.05~2022.10.30)
• -Link to Privacy Policy Policy V2.20 (2022.08.12~2022.09.04)
• -Link to Privacy Policy Policy V2.19 (2022.07.05~2022.08.11)
• -Link to Privacy Policy Policy V2.18 (2022.04.06~2022.07.04)
• -Link to Privacy Policy Policy V2.17 (2022.03.25~2022.04.05)
• -Link to Privacy Policy Policy V2.16 (2022.02.25~2022.03.24)
• -Link to Privacy Policy Policy V2.15 (2022.01.04~2022.02.24)
• -Link to Privacy Policy Policy V2.14 (2021.12.01~2022.01.03)
• -Link to Privacy Policy Policy V2.13 (2021.10.06~2021.11.30)
• -Link to Privacy Policy Policy V2.12 (2021.07.28~2021.10.05)
• -Link to Privacy Policy Policy V2.11 (2021.07.02~2021.07.27)
• -Link to Privacy Policy Policy V2.10 (2021.02.03~2021.07.01)
• -Link to Privacy Policy Policy V2.9 (2020.10.13~2021.02.02)
• -Link to Privacy Policy Policy V2.8 (2020.08.06~2020.10.12)
• -Link to Privacy Policy Policy V2.7 (2020.06.29~2020.08.05)
• -Link to Privacy Policy Policy V2.6 (2020.03.23~2020.06.28)
• -Link to Privacy Policy Policy V2.5 (2019.11.01~2020.03.22)
• -Link to Privacy Policy Policy V2.4 (2019.04.24~2019.10.31)
• -Link to Privacy Policy Policy V2.3 (2018.11.15~2019.04.23)
• -Link to Privacy Policy Policy V2.2 (2018.09.21~2018.11.14)
• -Link to Privacy Policy Policy V2.1 (2018.08.14~2018.09.20)
• -Link to Privacy Policy Policy V2.0 (2018.07.19~2018.08.13)
• -Link to Privacy Policy Policy V1.4 (2018.01.30~2018.07.18)
• -Link to Privacy Policy Policy V1.3 (2017.10.23~2018.01.29)
• -Link to Privacy Policy Policy V1.2 (2017.08.18~2017.10.22)
• -Link to Privacy Policy Policy V1.1 (2017.04.21~2017.08.17)
• -Link to Privacy Policy Policy V1.0 (2014.01.13~2017.04.20)