Dunamu Inc. (hereinafter referred to as the “Company”) considers the protection of the personal information of users very important and is doing its best to protect the personal information provided by users to the Company in order to use the Company's services (digital asset trading services and related services, hereinafter referred to as the “Service”). The Company duly processes and safely manages users' personal information in accordance with the "Personal Information Protection Act" and other related laws and regulations. Accordingly, pursuant to Article 30 of the Personal Information Protection Act, the Company hereby establishes and discloses this Privacy Policy to inform users of the procedures and standards for the processing and protection of personal information and to ensure that complaints related thereto are handled promptly and efficiently.
The Company continuously makes this Privacy Policy available on the first screen of its website so that users can easily check the processing procedures and standards for personal information at any time.
This Privacy Policy may be changed in accordance with applicable laws and regulations and the Company's internal policies, and any changes will be managed through version control for easy reference.
The Company processes users’ personal information for the following purposes. The processed personal information is not used for purposes other than the following, and if the purpose of use is changed, necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act, will be taken.
The Company collects and uses personal information within the minimum scope necessary to achieve the purpose of processing.
The Company, with the consent of users pursuant to Article 15, Paragraph 1, Subparagraph 1 and and Article 24, Paragraph 1, Subparagraph 1 of the Personal Information Protection, collects and uses the minimum necessary personal information for the establishment, maintenance, execution, and management of digital asset transactions and the provision of services as follows. Even in cases where personal information is processed for the establishment, maintenance, performance, and management of Digital Asset transactions and the provision of services under Article 15, Paragraph 1, Subparagraph 4 of the Personal Information Protection Act, or for the fulfillment of statutory obligations under Article 15, Paragraph 1, Subparagraph 2 of the Personal Information Protection Act, the Company operates a procedure to obtain prior consent to inform users of the processing of personal information in detail.
| Category | Legal Basis | Collected and Used Items | |
| Account Registration and Management | Registration | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | [Individual] Upbit Nickname [Corporation] Email, Password, Nationality |
| Upbit Login | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | Name, Mobile Phone Number, Date and Year of Birth, Gender, Resident/Non-resident Information, Telecommunication Company, Verification Information (CI, DI), Names of financial institutions, Account Number, PIN Password(*Names of financial institutions, account numbers, and PINs are processed solely for validation purposes and are not stored separately by the Company.) | |
| Delivery of Various Notifications and Notices Related to the Service | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | Mobile Phone Number, Email | |
| Mobile Phone Authentication | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | Name, Mobile Phone Number, Date and Year of Birth, Gender, Resident/Non-Resident Information, Telecommunication Company, Verification Information (CI, DI) | |
| If Using Biometric Authentication | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | [Optional] Fingerprint Information, Facial Information (**Only the result obtained by comparing the information with the data registered on the device is used, without being transmitted/stored on a separate server. Users can control the use of this feature with the on/off option.) |
|
| Provision of Goods or Services | Individual Customer Verification | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)2 (Fulfillment of statutory obligations or as provided for by law) | Name (Korean/English), Address, Nationality, Email, Occupation, Workplace Information (Company Name, Address), Transaction Purpose, Source of Funds |
| Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)2 (Fulfillment of statutory obligations or as provided for by law), 24-2(1)1 (Processing of resident registration numbers) | [Identification Card Verification] (Korean) Copy of Identification Card, Name, Resident Registration Number, Driver's License Number with Secured Serial Number, Vaild through(expriation date) and Issuance Date (Foreigner) Copy of Identification Card, Name, Alien Registration Number, Issuance date, Serial Number, Expiration Date of Stay, Proof of Stay | ||
| Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract) | [Account Verification] Name of Financial Institution, Account Number | ||
| KRW Deposits and Withdrawals | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4(Performance of a contract) | [Real-Name Deposit-Withdrawal Account Verification]Name of Financial Institution, Account Number [Processing of KRW Deposits and Withdrawals] Name, Date and Year of Birth, Gender, CI(Connecting information), Mobile Phone Number, Account Number, Deposit and withdrawal information |
|
| Corporate Verification | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)2 (Fulfillment of statutory obligations or as provided for by law), 24(1) 1(Processing of unique identification information) and 24-2(1)1 (Processing of resident registration numbers) | [Representative Information] (Common) Name (Korean/English), Nationality, Date of Birth, Gender, Phone Number, Mobile Phone Number, Real-Name Verification Number, Address, Email, Occupation, Copy of Identification Card, (for Foreigners) Certificate of Residence or Permanent Resident Card in Korea [Agent Information] Name (Korean/English), Verification Number, Copy of Identification Card, Nationality, Residence Status, Address, Mobile Phone Number, Email, Company Name, Occupation, Workplace Address, Relationship with the Transaction Party, Purpose of Transaction, Source and Origin of Transaction Funds [OTP Receiving Device Owner Information] Name, Mobile phone Number, Proof of Mobile Phone Contract, Proof of Employment. [Login Information] ID (Email Address), Password [Security Settings] Security Password |
|
| Digital Asset Transactions | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | Digital Asset Transactions Information, such as Trading Date, Quantity, Type, Asset Name, Deposit/Withdrawal Records and wallet address,etc. | |
| Issuance of Cash Receipt | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Mobile Phone Number, Business Registration Number | |
| Registration of Personal Wallet Address | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | Personal Digital Asset Address | |
| Open API Service | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | [IP Address Registration] IP address [Withdrawal Whitelist Address Registration] Digital Asset Exchange, Withdrawal Whitelist Address, Withdrawal Network, Digital Asset, Recipient Information |
|
| Digital Asset Deposit Request | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | TXID, Deposit Exchange, Screenshot of an account information on the Deposit Exchange, withdrawal history showing the transaction details | |
| Lending | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | Name, nickname, date of birth, mobile phone number, address, information on the Digital Assets requested for lending, collateral information, lending-to-value-ratio, repayment and liquidation details, information regarding the conclusion of lending and pledge agreements, Usage records of Digital Assets transactions and Lending services | |
| Upbit Trading League and Other Trading Competitions | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | [Trading League] Upbit Nickname, gender, Participation and operation information of Upbit Trading League(Investment Report & Portfolio of Digital Asset Transactions, Participating League information, League ranking& dashboard, Service statistics) [Investment Champions League] mobile phone number, Digital Asset Transactions Information, including the transaction date, Asset Name and transaction amount [TOP Trading Event] Masked nickname, mobile phone number, Digital Asset Transactions Information, including the transaction date, Asset Name and transaction amount, Leaderboard information |
|
| Investment Note | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | Member Number, Investment Note | |
| NFT Service | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | [Use of NFT Service] Nickname, NFT Transaction History (**To verify transactions and activity history within the service, due to the nature of NFT digital assets) [Registration of NFT Personal Wallet Address] Personal Digital Asset Address, NFT Information held within Personal Digital Asset Address |
|
| Provision of Events and Promotions | Participation in the event | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | [To participate in NFT event] Mobile Phone Number |
| Conducting of Events and Promotions | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | [Optional] Name, Mobile phone number, Email, information for user statistics analysis (gender, residential area, age group), access logs and service usage records (KYC compliance status, linking of KRW deposit and withdrawal accounts, digital asset trading status, digital asset balances, period returns, trading types) |
|
| Event Winning | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract) | Name, Mobile Phone Number, [When providing physical prizes] Address [When Paying Taxes] Copy of Identification Card (**The items collected and used may vary depending on the event being held, and consent is obtained for the items collected and used for each event.) | |
| Handling of Complaints | Inheritance | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract) | [Decedent] Name, Date of Birth, Address, Certificate of Family Relations, Death Certificate [Heir] Name, Date of Birth, Address, Contact Information, Relationship with the Decedent, Copy of Identification Card, Unique Identification Number, Upbit Account Information (If a Representative is Appointed) Certificate of Personal Seal Impression (If the Heir is a Minor) Certificate of Identification |
| Inquiry into Inherited Assets | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | [Decedent] Name, Date of Birth, Resident registration number, Mobile phone number, Certificate of Family Relations, Death certificate or Certificate of Identification [Heir] Name, Mobile Phone Number, Relationship with the Decedent, Copy of Identification Card |
|
| Transfer | Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract) | [Transferor] Name, Date and Year of Birth, Address, Mobile Phone Number, Nickname, Copy of Identification Card, Documentary Evidence of Mobile Phone Usage, Documentary Evidence of Inability to Log In [Transferee] Name, Date and Year of Birth, Address,Nickname, Copy of Identification Card [Agent] Name, Date and Year of Birth, Address, Mobile Phone Number, Power of Attorney |
|
| Compensation | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract) | Time of the Incident, Trading Market, Digital Asset Involved in the Trade, Type of System Failure, Detailed Description of the Issue, Requested Compensation Amount and Justification, Supporting Documents or Evidence | |
| Trading Support-Related Fraud Reporting | Personal Information Protection Act Art.15(1)1 (Consent of information subject) | [Required] Email, Details of the Report [Optional] Name, Phone Number, Attachments |
|
| Abnormal Transaction Reporting | Personal Information Protection Act Art.15(1)1 (Consent of information subject) | [Required] E-mail, Details of the Report, Attachments [Optional] Name, Phone Number |
|
| Report of Multi-Level Marketing (MLM) Activities / Report of Abusive or Malicious User Behavior | Personal Information Protection Act Art.15(1)1 (Consent of information subject) | [Required] Detailed Description of the Report, [Optional] Supporting Evidence for the Report | |
| Report of Impersonation Involving Upbit Staff, Agents, or Representatives | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Detailed Description of the Report, Supporting Evidence for the Report | |
| Support for Asset Withdrawals for Members unable to complete KYC Verification | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Copy of Identification Card, Proof Photo to verify the Member's Identity, Mobile Phone Number, Email Address, Information about the Digital Asset to be withdrawn, Address of the Receiving Digital Asset and Proof of Ownership, Screenshot of the Receiving Exchange's Member Information Screen | |
| Releasing Suspension of Transactions Placed on Financial Fraud Accounts | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) |
- Name, Date of Birth, Address, Contact Information, Copy of Identification Card - Deposit/Withdrawal History that Confirms the Movement Path of the Affected Money (Transaction History with Financial Institutions, Account Number, Transaction History with other Digital Asset Exchanges) - Notice of Termination of Debt Extinction Proceedings or Confirmation of Facts related to Telecommunications Fraud - Evidence that can Prove the Source of the Affected Money (Objection Documents, Contracts, or Supporting Documentation such as Promissory Notes) - Court Enforcement Documents or Incident Fact Confirmation Documents to Prove the Fact of Damage - (If Cancellation of Damage Relief is Needed) Certificate of Personal Signature, Application for Cancellation of Damage Relief - (If a Representative is Appointed) Name, Date of Birth, Address, Contact Information, Document Showing the Relationship, Copy of Identification Card, Personal Seal Certificate, and Personal Seal |
|
| Change of Member Information /Naturalization | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)4 (Performance of a contract) | Name after changing member information, Documents such as Resident Registration Abstract which may confirm changes in member information, Nickname of the Existing Account | |
| Certificate of Loss of Nationality for Foreigners | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Certificate of Loss of Nationality | |
| Proof of Purpose of Stay in Korea | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Certificate of Employment or Certificate of Enrollment, Certificate of Alien Registration or Certificate of Domestic Residence, Entry and Exit Management Certificate, Unique Identification Information Included in Each Document | |
| Certificate of Residence for Alien Registration | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Residency certificate or Certificate of Facts related to Entry and Exit | |
| Submission of Additional Documents for Customer Verification | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) |
- Purpose of Transaction, Source and Origin of Transaction Funds, Company Name, Address The Following Documents Submitted by the User: - Health Insurance Eligibility Confirmation or Entry and Exit Fact Confirmation - Confirmation of Resident Registration Card Issuance Application - Resident Registration Certificate, Overseas Business Trip Certificate, Short-Term Study Abroad Certificate - Passport Copy - Unique Identification Information (Resident Registration Number, Driver's License Number, Passport Number, Alien Registration Number) Additional Documents Required for Customer Verification (Certificate of Enrollment or Employment, Document to Confirm the Purpose of the Transaction and the Source of Funds, Documents Related to Workplace Information) |
|
| Verification of Source of Funds | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Deposit Date and Time, Type of Digital Assets deposited, Deposit TXID, Source of the Assets, Reason for the Deposit, Trading Plan for the deposited Digital Assets, Financial Institution Transaction Records, Records of Transactions on other Digital Asset Exchanges, Documents for proving Donation, Transfer, Inheritance, or other Relevant Transactions | |
| Submission of Supporting Documentation for Withdrawals | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Withdrawal Destination, Reason for Withdrawal, Materials that Can Confirm the Withdrawal Destination | |
| Withdrawal Suspension Objection | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Effective Date of the Withdrawal Suspension, Details of the Objection, Materials that Can Confirm the Withdrawal Destination and Reason for Withdrawal | |
| Additional submission for identity verification | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract) | Photo Identification that can verify the Member's Identity (including confirmation forms and ID cards; provided that for ID cards, the last seven digits of the Resident Registration Number (RRN) are masked) | |
| Digital Asset Deposit Application | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | TXID, Proof of Withdrawal, Name of Withdrawal Exchange, Withdrawal Exchange Profile Information | |
| Digital Asset Return Application·Incorrect Deposit | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | [from Address return] Withdrawal Destination, TXID, Digital Asset Name and Quantity, from Address [Return to an alternative Wallet Address] TXID, Proof of Withdrawal, Digital Asset Name and Quantity, Proof of Ownership of Digital Asset Address Used for Withdrawal, Return Digital Asset Address and Proof of Ownership [Incorrect Deposit] Type of Incorrect Deposit, TXID, Digital Asset name and Quantity, Name of the Withdrawal Source (Exchange or Personal Wallet) [Consent to Return of Incorrect Deposit] TXID, Information Regarding Digital Assets Sent in Error [Fee Payment] Name of the Digital Asset, Fee Deposit Statement |
|
| Submission of Supporting Documentation for Digital Asset Return | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | TXID, Designated Return Address and Proof of Ownership, Return Digital Asset Address and Proof of Ownership | |
| Submission of Attachment(s) | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract) | Additional Supporting Documents Related to a Previously Submitted Inquiry | |
| Registration of Digital Asset withdrawal address | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Name of Digital Asset, Digital Asset withdrawal address, Secondary address (if applicable), Type and name of deposit destination, Screen displaying the wallet address where the deposit destination is confirmed, Proof screen showing the confirmed deposit destination name | |
| For Lifting Self-Requested Withdrawal Suspension | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Call Recording for Self-Verification | |
| Inquiry Regarding Digital Asset Trading | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | [Required] Type of Digital Asset, Detailed Description of the Inquiry [Optional] Screenshots or Other Evidence Demonstrating the Occurrence of the Error or Service Disruption |
|
| Request for Corporation Account Services | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Copy of Identification Card, Certificate of corporate seal | |
| Corporate Account Registration Inquiry | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Name of Business manager, Phone Number, and Email Address | |
| Inquiries Related to NFT Services | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Inquiries regarding NFT Drops / Marketplace / Deposits and Withdrawals If necessary Attachments that may help verify or support the details of the inquiry |
|
| Inquiries about NFT Collaboration | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | [Individual] Name, Exhibition History, Artist Statement, Website or SNS Address, Business manager’ Name, Business manager’ Email Address, Business manager’ Contact Information, Relationship with Original Copyright Holder, Sales Experience [Corporation] Corporate Name of Creator, Exhibition History, Website or SNS Address, Corporate Name of the Creator’s Business manager, Email Address and Contact Information of Business manager, Relationship with Original Copyright Holder, Sales Experience |
|
| Items Generated and Processed during the Service Usage Process | Service Use | Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) | Member ID, Device Information (OS, Model Name, Telecommunication Company, Device ID assigned by the Company, Language Information, ADID, IDFA, IDFV), IP Address, Service Usage Record, Cookie |
The Company may collect personal information without the user’s consent if any of the grounds under Subparagraphs 2 through 7 of Article 15, Paragraph 1 of the Personal Information Protection Act are met, and may use such information within the scope of the purpose of collection.
| Category | Legal Basis | Collected and Used Items |
| Reporting and payment of taxes and public dues pursuant to the Income Tax Act, the Corporate Tax Act, the National Tax Collection Act, and other laws related to the collection and payment of taxes | Personal Information Protection Act Art. 15(1)2 (Fulfillment of statutory obligations or as provided for by law) | resident registration numbers and copies of identification cards |
| Information in self-certification forms pursuant to the Act on International Tax Adjustment | Personal Information Protection Act Art. 15(1)2 (Fulfillment of statutory obligations or as provided for by law) | Processing of information necessary for fulfillment the obligations of crypto-asset service providers pursuant to the Public Notice on the Implementation of the Automatic Exchange of Crypto-Asset Information under the Information Exchange Agreement issued by the Minister of Economy and Finance, which prescribes matters delegated under Article 36 of the Act on International Tax Adjustment and Article 76 (Name, nationality, residential address, tax residence jurisdiction, mobile phone number, taxpayer identification number (TIN), date of birth, place of birth, and supporting documentation) |
| Compliance with the Best Practice Guidelines for Advertising and Promotional Activities of Virtual Asset Service Providers (VASPs) | Personal Information Protection Act Art. 15(1)4 (Performance of a contract) and (1)6 (Legitimate interest) | Counterparty information regarding the provision of economic benefits pursuant to Article 19, Paragraph 2 and Article 22 of the Best Practice Guidelines for Advertising and Promotional Activities of Virtual Asset Service Providers (VASPs) (Amount of economic benefits provided by the Company, identification information of the counterparty; for non-members: date of birth and the last four digits of the mobile phone number) |
| Check for Fraudulent Re-registration | Personal Information Protection Act Art. 15(1)4 (Performance of a contract) | Verification Information (CI) |
| Prevention of Financial Incidents | Personal Information Protection Act Art. 15(1)4 (Performance of a contract) | Detection and diagnostic information concerning financial fraud-related software programs, including remote control applications and malicious applications installed on mobile devices |
| Digital Asset Airdrops | Personal Information Protection Act Art. 15(1)4 (Performance of a contract) | Information on Digital asset holdings eligible for airdrops |
| Provision of Physical-linked NFTs | Personal Information Protection Act Art. 15(1)4 (Performance of a contract) | Eligibility information for physical-linked NFT drops (Information on the purchase or holding of the relevant NFT) |
| NFT Creator Registration | Personal Information Protection Act Art. 15(1)4 (Performance of a contract) | Social media (SNS)-related information of creators within the NFT service (Nickname, Profile URL) |
| Record | Relevant Laws | Retention Period |
| Digital asset transaction records - Records of Digital Asset type - Information about users and trading counterparts - Date, type, quantity, and amount of digital asset transactions - Order information - Changes to transaction instructions - Virtual asset addresses - Records and access logs regarding the types of electronic devices, such as computers, used in digital asset transactions - Details and reasons for blocking deposits and withdrawals - Continuous monitoring and action results of suspicious transactions - Records related to the notification, declaration, and reporting of unfair trading activities - Records regarding fees - Records necessary for tracking or searching digital assets, or identifying and correcting errors |
Article 9 of the Act on the Protection of Virtual Asset Users | 15 years |
| Record of Contract or Subscription Withdrawal | Article 5-4 of Act on Reporting and Using Specified Financial Transaction Information | 5 years |
| Information in self-certification forms pursuant to the Act on International Tax Adjustment | Article 36 of the Act on International Tax Adjustment | 6 years |
| Record of Contract or Subscription Withdrawal | Article 6 of Act on Consumer Protection in Electronic Commerce, etc. | 5 years |
| Record of Payment Settlement and Supply of Goods | 5 years | |
| Record of Consumer Complaints or Dispute Resolution | 3 years | |
| Login Record | Article 15-2 of Act on Protection of Communications Secrets | More than 3 months |
| Record of Payment of Taxes and Public Dues | Acts related to the collection and payment of taxes, such as Article 160 and Article 160-2 of the Income Tax Act, Article 116 of the Corporate Tax Act, Article 71 of the Value-Added Tax Act, and National Tax Collection Act, Article 85-3 of the Framework Act on National Taxes | 5 years |
| Record of Processing Cash Receipts | 5 years |
| Recipient | Purpose of Provision | Provided Items | Retention / Use Period |
| Courts or public agencies | Resolution of grievances or disputes arising from the use of the Service | Service usage records | In accordance with the provisions of the laws and regulations governing each respective agency |
| Consignment Company | Content of consignment | |
| Reconsignment Company | ||
| DunamuCX Inc. | Customer consultation related to Upbit services | |
| Hyosung ITX Co. Ltd | ||
| Kakao Corp., | Mobile Voucher Operations | |
| Amazon Web Services, Inc., Microsoft Corporation, Google LLC. | Storage of data for the provision of services and operation of services | |
| Coocon Co., Ltd. | Verification of authenticity of identification cards, account ownership certification, issuance of cash receipts | |
| Bonanza Factory Co., Ltd. | KRW deposit/withdrawal and account ownership certification, Transaction safety management | |
| Kakao Corp., Naver Corp., KEB Hana Bank | Two-channel additional authentication and identity verification | |
| Coocon Co., Ltd., Samsung SDS, Inc. | ARS phone authentication | |
| Linkhub Co., Ltd. | Issuance of cash receipts and tax invoices | |
| NICE Information Service Co., Ltd. | Real-name verification, mobile phone authentication, account ownership certification | |
| Hecto financial Co., Ltd. | Account ownership certification | |
| Bonanza Factory Co., Ltd. | KRW deposit/withdrawal, Account Ownership Certification |
|
| Danal Co., Ltd. | Mobile Phone Authentication | FutureWiz Co., Ltd. | Two-channel additional authentication and verification |
| Kakao Corp. | ||
| Naver Corp., KEB Hana Bank | Two-channel Additional Authentication, Verification |
|
| BizTalk Co., Ltd. | Agent for sending KakaoTalk message | |
| KT Corp., LG Uplus Corp. | Sending SMS | |
| BRIDGETEC | Call Center System Development and Maintenance | |
| returnzero Inc. | STT Development and Maintenance | |
| Kakao Corp. | Personal Information Processing and Gift Sending through KakaoTalk Plus Channel | |
| Lambda256 Corp. (recommissioned by VerifyVASP Pte. Ltd.) | Linked data transfer in relation to digital asset deposit and withdrawal. | |
| Opensurvey Inc. | Use of survey service platform | |
| NHN Cloud Corp. | Sending Message | |
| HYOSUNGITX Co.,Ltd | Customer verification inspection tasks | |
| SLASH B SLASH CO., LTD. | Shipment of prizes and responding to delivery-related inquiries | |
| Lotte Global Logistics CO,.LTD. | Shipment of prizes | |
The Company transfers personal information overseas as follows.
The Company, under Article 28-8, Paragraph 1, Subparagraph 3, Item a of the Personal Information Protection Act, entrusts the processing of and stores personal information duties through contracts with overseas companies to provide the services, and manages and supervises the foregoing so that the entrusted personal information for processing can be processed securely. Users may refuse the transfer of personal information through the customer center, but users who refuse may not use the services.
| Consignment Company | Purpose of Consignment | Consignment Items | Country of Consignment, Contact | Date and Method of Consignment | Retention and Use Period |
| Amazon Web Services, Inc. | Data backup (storage) for uninterrupted service provision even in the event of disasters and accidents | Minimum data for service recovery (such as Account registration and management information, Customer verification information, KRW deposits and withdrawals information, Digital asset transactions information) | United States, Go to Contact |
When using services, data is transferred over the network | 15 years after withdrawal from membership |
| Twilio Inc. | Sending notification mails or SMS | Email, Mobile Phone Number, Nickname, Attachment | United States, privacy@twilio.com |
When sending emails or SMS, data is transferred over the network | Email: 30 days after email delivery SMS: 13 months after SMS delivery |
| Amplitude, Inc. | Collecting behavioral logs and performing statistical analysis | Member ID, Device Information (OS, Model Name, Language Information, IP Address, ADID, IDFA, IDFV, Telecommunication Company), Service Usage Records | United States, privacy@amplitude.com |
When using services, data is transferred over the network | 15 years after withdrawal from membership |
| Appsflyer Ltd. | Collecting behavioral logs and performing statistical analysis. | Member ID, Device Information (OS, Model Name, Language Information, Connection Network Type), IP Address, ADID, IDFA | Ireland, Belgium, privacy@appsflyer.com |
When using services, data is transferred over the network. | 2 years |
| Braze, Inc. | Sending in-app messages | Member ID, Device Information (App version, Model Name, OS, Telecommunication Company) | United States, privacy@braze.com |
When using services, data is transferred over the network. | Deleted upon the withdrawal of membership. |
| VerifyVASP Pte. Ltd. | Linked data transfer in relation to digital asset deposit and withdrawal | Sender/Recipient Name, Date of birth and Digital Asset Address, Digital Asset Name and Quantity | Singapore, corporate@verifyvasp.com |
When making deposits or withdrawals of digital assets, the information is transmitted over the network | 5 years |
| Chainalysis Inc. | Detection of abnormal transactions and management of transaction safety | Digital Asset Address | Germany, privacy@chainalysis.com |
When using services, data is transferred over the network. | 5 years |
The Company provides the following personal information to third parties overseas with the prior consent of users in accordance with Article 28-8, Paragraph 1, Subparagraph 1 of the Personal Information Protection Act. In order to provide the services requested by the user, personal information must be necessarily transferred to overseas companies. If users do not want their personal information to be provided to an overseas company, they can refuse it through the customer center and, in this case, such users may not use the services. Overseas companies to which the transfer has been made may be changed without prior notice, depending on the characteristics of the partnered services and the contract.
View details on the receiving of personal information to the overseas
The Company has implemented the following administrative, technical, and physical measures necessary for ensuring the security of personal information, in accordance with Article 29 of the Personal Information Protection Act.
| Items Collected | Collection Method | Purpose of Collection | Retention and Usage Period |
| User activity information, including web/app service visit records, search/click history, device information, and IP addresses | Automatically generated and stored through log analysis tools (Google Analytics) during service use | Improving service features, developing new products and services, statistical analysis, and provision of services based on behavioral information | Up to 26 months from the date of collection |
If you need help with remedies or consultation regarding personal information infringement, you may contact the following organizations.
The Company may provide links to external sites for users. In this case, the Company cannot guarantee or be responsible for the usefulness, truthfulness, or legality of the services or information provided by the external sites, as the Company has no control over them. The privacy policies of linked external sites are not related to the Company, so please check the policies of the relevant external site.
In the event that the Company changes its Privacy Policy, it will continually disclose the timing of the change and the changed contents, and will make the changed contents easily accessible to users by comparing the contents before and after the change.
This Privacy Policy V2.56 is effective as of July 31, 2026.
The previous Privacy Policy can be found below.