South Korea Privacy Notice (PIPA)

Effective: September 18, 2026
Updated: September 18, 2026
Version: 1.2

On this page

This notice explains how Tanqory Inc. (“Tanqory”, “we”, “us”) collects, uses, discloses, transfers, and protects personal information under the Personal Information Protection Act (“PIPA”) of the Republic of Korea (South Korea) and guidance from the Personal Information Protection Commission (“PIPC”). It is aligned with our Data Processing Addendum and written to give merchants, partners, and users clear, practical information about lawful processing, transparency and consent, data subject rights, cross-border transfers, security, breach notification, pseudonymization/anonymization, youth protections, and accountability.

Authoritative resources:

PIPA (English): https://www.law.go.kr/LSW/eng/engLsSc.do?menuId=2&section=lawNm&query=Personal%20Information%20Protection%20Act
PIPC: https://www.pipc.go.kr/eng/
Pseudonymization guidance (PIPC/KISA): https://www.kisa.or.kr/eng/main.jsp (see Data Policy resources)
Breach notification FAQ (PIPC/KISA): https://www.pipc.go.kr/eng/ (notifications under Art. 34/39-6)

Scope, purpose, and roles

Scope: Applies to merchants, developers, end customers of merchants, users of our apps/services, and visitors whose personal information is processed under the laws of the Republic of Korea (South Korea).
Roles: Tanqory acts as processor when handling merchant customer data under the DPA, and as controller when providing services directly (e.g., merchant accounts, billing, payments, support, platform analytics).
Coverage: Data you provide, data provided by merchants, and data generated by Tanqory systems (logs, telemetry, analytics), including data exchanged with third-party providers and cross-border services.
Language and openness: Notices, Statements of Reasons (SoR), and rights forms are made available in Korean for ease of understanding, and in English for international users, consistent with PIPC expectations on “plain language” communication.
Accountability: We maintain Records of Processing Activities (RoPA), role allocations in contracts, and risk/impact assessments for high-risk processing to evidence compliance.

Privacy by design and default

PD principles—purpose limitation, data minimization, transparency, accuracy, protection, retention limitation, and integrity—are embedded into product and engineering lifecycles.
New or materially changed processing undergoes privacy/security review; higher-risk cases trigger PIPA impact assessments (similar to DPIA) and approvals before launch.
Defaults favour minimal collection, least-privilege access, and non-essential tracking set to “off.”
Sensitive identifiers (e.g., resident registration numbers (RRNs) or passport numbers) are avoided unless strictly necessary and lawful; if collected, they are encrypted, access-restricted, and subject to short retention.
Change management logs data flow changes; rollback plans and audit trails support accountability.

What we collect, sources, and purposes

We collect only what is necessary for identified purposes:

Account and contact data (name, email, phone, business address, role): To create/manage accounts, authenticate, support, invoice, and communicate. Basis: contract or consent where required.
Transaction and payment data (orders, refunds, disputes, payment tokens via providers, billing details): To deliver services, manage fraud/chargebacks, and comply with tax/finance/AML obligations. Basis: contract and legal obligation.
Technical and event data (IP, device/browser/OS, app version, event logs, cookies/pixels, language/time zone, session IDs, diagnostic telemetry): To secure services, prevent abuse, improve reliability/performance, and run non-essential analytics only with consent where required. Basis: legitimate interests and consent for non-essential cookies/trackers, supported by balancing tests.
Merchant customer data: Orders, fulfillment, communications, and related metadata processed on behalf of merchants. Merchant is controller; Tanqory is processor under the DPA.
Data requiring special care:
- Financial and identity verification data: Payment method metadata, identity documents, or limited biometrics for fraud/AML only where necessary and lawful.
- Sensitive/special categories (e.g., health, biometric identifiers, beliefs): Processed only with explicit consent or another PIPA-permitted ground, with access restrictions, encryption, and logs.
Youth/minor data: Collected only with parental/guardian consent where required (under 14) and subject to heightened protections.

Sources include: data you provide directly; data provided by merchants; data from service providers (payment authorizations, fraud signals, logistics events); and lawful third-party/public sources (e.g., sanctions/PEP lists for AML/CTF and fraud risk). We avoid over-collection, apply data minimization, and use pseudonymization/anonymization where feasible—especially in testing/analytics. Accuracy checks are applied where decisions affect eligibility, security, or risk.

Illustrative purpose mapping

Service delivery: Onboarding, checkout, order fulfillment, shipping updates, invoicing, customer support.
Security and fraud/abuse prevention: Authentication, device/account integrity, sanctions/AML risk checks, chargeback management, anomaly detection.
Product reliability and improvement: Performance analytics, feature testing, error diagnostics, contextual experience tuning (non-essential analytics only with consent where required).
Legal and compliance: Tax/finance recordkeeping, AML/CTF, responding to lawful requests, enforcing terms, defending claims.
Marketing (optional): Product updates/offers with consent or applicable opt-out/soft opt-in, limited to lawful channels.

Lawful grounds (PIPA Art. 15/17): consent; contract performance; compliance with legal obligations; protection of life/health/property in emergencies; performance of public duties; and legitimate interests of the controller/third parties where compatible with data subject rights (applied cautiously and documented).
Consent: Specific, informed, freely given, unbundled from non-essential services, and as easy to withdraw as to give. Separate consent is sought for sensitive data, cross-border transfers, third-party sharing, marketing, and non-essential cookies/trackers. Consent/withdrawal receipts are retained.
Notification (Art. 15/17): At or before collection, we describe data categories, purposes, retention, recipients, transfer details, rights, and how to object/withdraw consent. Statements of Reasons and layered notices are provided for clarity.
Change of purpose: If purposes change materially, we notify and obtain fresh consent where required.
Avoidance of over-reliance on consent: Where a clearer legal basis applies (e.g., legal obligation), we avoid using consent to reduce consent fatigue and ensure validity.

Handling unique identifiers and biometrics

RRNs are generally not collected; if unavoidable (e.g., legally required KYC), they are encrypted, access-restricted, logged, and retained for the shortest necessary period per PIPA and Enforcement Decree.
Biometrics for authentication/risk controls are used only where necessary, with explicit consent (or another lawful ground), spoofing protection, and deletion upon withdrawal or end of purpose.

Do Not Call / marketing practices

Marketing is permission-based and channel-specific (email/SMS/voice/push/in-app).
Opt-out instructions accompany every message; suppression lists are enforced promptly.
We avoid behavioural targeting of minors and restrict profiling for sensitive segments.
Consents/opt-outs are logged to evidence compliance; soft opt-in is used only where lawful and appropriate.

Your rights under PIPA

Data subjects may:

Access personal information we hold (and sources/third-party recipients where applicable).
Correct/rectify inaccuracies.
Suspend processing or sharing in certain cases (e.g., where unlawful or no longer necessary).
Delete (destroy) data when no longer needed for the stated purpose or after withdrawal of consent, subject to legal retention.
Withdraw consent for processing that relies on consent.
Request copies/portability where technically feasible and permitted by law.
Object to third-party provision or certain processing grounded in legitimate interests.
Complain to the PIPC if dissatisfied.

We aim to respond without undue delay (target: within 10 business days) and will inform you if more time is needed for complex requests. Identity verification is required. If we refuse or limit a request, we explain why and cite the relevant legal ground/exemption (e.g., risk to others’ rights, legal claims, statutory exemptions). Requests and outcomes are logged for accountability.

How to exercise your rights

Email privacy@tanqory.com with “PIPA request” in the subject, your contact details, the right(s) you wish to exercise, and information to help locate your data.
We may request additional verification (e.g., ID confirmation) to protect your data.
If your data originates from a merchant, we may coordinate with that merchant consistent with controller/processor roles.
Responses are provided securely; where feasible, we provide structured, machine-readable formats for access copies.
Complaints to PIPC: https://www.pipc.go.kr/eng/ (contact/complaints).

Additional guidance on withdrawal and marketing preferences

Marketing consent: You can withdraw marketing consent in any channel (unsubscribe link/SMS keyword/app settings). We synchronize preferences across systems and enforce suppression lists promptly.
Cookies/trackers: Use the cookie banner/control centre to toggle non-essential cookies/SDKs; you may also clear cookies in your browser or adjust OS/app permissions.
Effect of withdrawal: Withdrawal of consent does not affect processing already conducted lawfully; core service functions may still require certain data under contract/legal obligations.

If you are not satisfied

Request a re-review with additional context.
Escalate to the PIPC using official channels (https://www.pipc.go.kr/eng/); we will cooperate with any investigation or directions.
For consumer disputes relating to a merchant transaction, contact the merchant and consider mediation via South Korean consumer bodies where applicable.

Youth and minors (under 14)

Parental/guardian consent is required for collection/use/disclosure of minors’ data beyond what is strictly necessary for a core service.
Age gates and proportionate age assurance are applied; parental verification (e.g., consent form/OTP) is used where required.
Behavioural tracking and targeted advertising for minors are disabled; age-restricted content/features are segregated.
Guardians can pause or request deletion through a simple channel; requests are logged with audit trails.

Automated decision-making (ADM) and profiling

ADM or profiling (e.g., fraud/risk scoring, personalization) includes human oversight for decisions with legal or similarly significant effects.
Meaningful information about logic/principal factors and likely consequences is provided where required; opt-out from direct marketing profiling is offered.
Models/thresholds are reviewed to reduce bias and unintended impacts; high-risk ADM undergoes impact/risk assessment.
Adverse decisions are subject to escalation and human review unless immediate risk requires temporary holds.

Cookies and similar technologies

Strictly necessary cookies: for security, authentication, core functionality.
Analytics/marketing cookies or trackers: used only with consent where required.
Preferences can be managed via cookie banners/control centre or browser settings. See Cookie Policy: https://legal.tanqory.com/legal/platform/cookie-policy.

Cross-border transfers (PIPA Articles 28, 39-12)

When personal information is transferred outside South Korea, we provide prior notice and obtain separate consent where required, specifying: recipient name/contact, purpose of use, items transferred, country/transfer method, retention/use period, and right to refuse and potential impact of refusal. Safeguards include:

Contractual protections ensuring protection equivalent to PIPA (confidentiality, security, breach notice, onward transfer limits, audit/inspection rights where appropriate).
Technical/organizational measures: encryption in transit/at rest, access controls, logging, minimization/tokenization.
Transfer risk assessments and justifications recorded; contracts reviewed periodically.
South Korea or regional hosting options may be offered to reduce transfers; alternate routing/replication plans exist if regulations tighten.

Security (protection measures)

We apply measures consistent with PIPA and Enforcement Decree expectations, including:

Encryption in transit/at rest (e.g., TLS 1.3/AES-256); key management with limited access.
RBAC/MFA, least privilege, segregation of duties, privileged access monitoring.
24x7 monitoring (SIEM/SOC), anomaly detection, anti-malware, vulnerability management, and secure SDLC/code review.
Access log retention consistent with legal/industry norms; sensitive identifier handling (e.g., RRN) with encryption and strict access controls.
Physical and environmental controls through vetted data centre/hosting providers.
Subprocessor/security due diligence against standards (e.g., SOC 2, ISO 27001, PCI DSS for payments).

Retention and destruction

Data is retained only as necessary for stated purposes and legal obligations (e.g., tax/finance, AML, accounting).
Upon purpose completion or service termination, personal information is destroyed without delay or segregated/stored separately if retention is legally required, then destroyed at the end of that period.
Destruction methods follow PIPA guidance: secure wiping for electronic data; shredding/incineration for paper; deletion from backups on scheduled cycles.
Retention schedules are published at https://legal.tanqory.com/legal/data-protection/data-retention-policy; South Korea-specific summaries are available on request.
Proof of destruction and timing is logged for audit.

Retention illustrations

Account and billing data: Contract duration plus statutory finance/tax periods.
Payments/transactions: Retained per financial/AML obligations and chargeback windows.
Security logs: Retained for periods needed for incident investigation and compliance; sensitive access logs maintained per PIPA/Enforcement Decree expectations.
Marketing consents/suppressions: Retained to evidence compliance and honour opt-outs.
Backups: Purged on rolling cycles with documented timelines.

Pseudonymization and anonymization (PIPA Art. 28-2)

When using pseudonymized data for analytics, R&D, or statistics, we separate keys/mapping tables, limit re-identification, restrict access, and prohibit combination with other data unless permitted.
Anonymized data is rendered non-identifiable; re-identification is prohibited. We document techniques used and, where required, maintain a management plan consistent with PIPC/KISA guidance.
If purposes change in ways that could affect individuals, notices are updated and consent sought where required.

Data breach notification

To data subjects: Without delay when leakage, loss, or alteration of personal information occurs that may infringe on data subjects’ rights/interests (PIPA Art. 34).
To PIPC: Without delay and when certain thresholds are met (e.g., 1,000 or more data subjects affected, or as required by PIPC direction under Art. 39-6).
Our commitments: Notify customers (controllers) within 24 hours of confirmation; cooperate on notifications. Content includes incident details, data affected, timing, likely impacts, mitigation, and user guidance.
Post-incident review, remediation, and evidence of notifications are documented; runbooks are updated.

Breach response detail

Early assessment: Determine root cause, data categories, sensitivity (e.g., RRNs, financial/biometric data), and whether encrypted.
Containment: Disable compromised accounts/keys/tokens, isolate affected systems, block malicious traffic, and coordinate with hosting providers.
Authority thresholds: We document thresholds and triggers (e.g., ≥1,000 data subjects or PIPC direction) and maintain templates for PIPC notifications.
Notification channels: Email/SMS/website/app notices are used where appropriate; we include specific remedial advice (e.g., password resets, monitoring for fraud).
Evidence: Timeline, decisions (notify/not notify), and remediation are logged for audit and regulatory cooperation.

Operators/subprocessors and payments

Third-party providers (hosting, cloud, security, analytics, payments) operate under contracts requiring PIPA-equivalent protections, confidentiality, breach notification, and PCI DSS for payment data.
Access is limited to need-to-know; periodic reassessments are conducted.
For overseas operators, Section 28/39-12 safeguards and consent/notice requirements are applied. Current subprocessors: https://legal.tanqory.com/legal/data-protection/subprocessor-list.
South Korea-based providers are used where appropriate (e.g., local payment gateways, regional hosting) to reduce transfer scope.

Operator commitments (when Tanqory is processor)

Process only on documented instructions; maintain confidentiality; implement technical/organizational measures; assist the controller with security, breach notices, and data subject requests where applicable; allow oversight/audit where contractually agreed; delete/return data at end of processing unless law requires retention; maintain processing records for services provided as processor.

Provision to third parties vs. entrustment

Entrustment (processing on our behalf): Governed by contracts and disclosed in our subprocessors list.
Provision to third parties (independent controllers): We seek separate consent where required, disclosing recipient, purpose, data items, retention/use period, and consequences of refusal, consistent with PIPA Art. 17/18. We do not sell personal information.
Where law permits provision without consent (e.g., life/health emergencies, legal obligations), we document the basis and limit the scope.

Record-keeping, governance, and training

RoPA maintained for PIPA-covered processing (purposes, categories, recipients, transfers, retention, safeguards).
Impact/risk assessments for high-risk processing (e.g., profiling, cross-border changes, sensitive identifiers).
Data protection governance assigns accountable owners; change management logs material updates to data flows.
Training: onboarding and periodic refreshers on PIPA, security, incident response, handling of RRNs/identifiers, consent/DNC-like practices, and privacy by design/default. Role-based modules for engineering/product, support, and sales/marketing. Completion and effectiveness are tracked.

Accuracy, minimization, and fairness

Reasonable steps are taken to keep personal information accurate, complete, and up to date for its intended use; users/merchants are prompted to correct inaccuracies.
Minimality is applied to collection, storage, and access; stale or excessive data is pruned or archived with strong controls.
Fairness and non-discrimination are considered when introducing analytics/ADM; if risks of unfair treatment are identified, models/thresholds are adjusted or processing is avoided.

Data localization and architecture transparency

While PIPA does not impose general localization, customers may request South Korea or regional hosting; we accommodate where feasible.
Some telemetry may traverse other regions for resilience/security; such flows are covered by Section 28 safeguards.
Under NDA, we can provide high-level data-flow/architecture diagrams and residency/transfer summaries to support customer compliance reviews.

Data classification and baseline controls

Personal information and data requiring special care (e.g., RRNs, financial, biometric) are classified at higher protection levels with stricter access, encryption, and monitoring.
Administrative, technical, and physical controls follow defense-in-depth: endpoint protection, network segmentation, WAF/IDS/IPS, secure configuration baselines, and least-privilege IAM.
Logging/monitoring: access to production data is logged, reviewed periodically, and retained consistent with legal and security needs; suspicious activity triggers alerts.
Change management: peer review for code/config, pre-deployment testing, and rollback plans reduce operational risk.

Fees, limits, and exemptions for rights

Access/correction fees are generally not charged unless allowed cost-based fees apply for repetitive or excessive requests; we will disclose any fee before proceeding.
Requests may be refused or limited under PIPA exemptions (e.g., risk to others’ rights, serious disruption of service, legal claims, investigation/security, trade secrets, statutory prohibitions). Reasons and legal bases are provided.
Suspension/deletion may be deferred where retention is required by law (e.g., finance/tax, AML) or for defense of legal claims; data will be segregated and access-limited during any required retention.

Transparency on cookies/SDKs

We disclose categories/purposes of cookies/SDKs (e.g., strictly necessary vs. analytics/marketing) and request consent for non-essential ones.
SDKs in mobile apps are reviewed for data flows; unnecessary tracking is disabled.
Users can withdraw consent at any time via app/browser controls; withdrawal does not affect strictly necessary cookies.

Examples of safeguards for sensitive identifiers

Avoid RRN collection where possible; if collected, encrypt at rest/in transit, restrict access to a minimal set of staff, and store separately from operational data.
Do not use RRNs as authentication credentials; implement masked display where necessary.
Apply short retention and documented destruction; keep access/processing logs for audits.

Destruction protocols

Electronic media: cryptographic wiping or secure deletion; backup destruction on scheduled purge cycles.
Physical media: shredding or incineration to prevent reconstruction.
Proof: destruction logs with date/time, method, and responsible personnel; subject to internal review.

Behavioural advertising and cookies

Non-essential advertising cookies/SDKs are opt-in only; behavioural targeting is disabled by default and not applied to minors.
Users can withdraw advertising consent at any time via cookie controls; withdrawal does not affect strictly necessary functions.
We limit third-party tracking pixels/SDKs to vetted providers with contractual data protection and prohibit resale or secondary use.

Merchant/partner responsibilities

Merchants remain controllers for their customer data and must provide their own PD-compliant notices/consents where required.
Merchants must not transmit RRNs or other prohibited data unless legally required and agreed; if transmitted, they must notify us and ensure lawful basis.
Merchants must honour data subject rights and DNC/marketing obligations in their campaigns; Tanqory will assist within agreed roles.

Appeals and dispute pathways

If you disagree with our response to a rights request, you may request reconsideration and provide context or evidence.
You may escalate to the PIPC via their complaint channels; we will cooperate with any investigation or directions.
For consumer disputes related to transactions, you may contact the merchant and, where applicable, seek mediation through South Korean consumer bodies.

Vendor oversight and audits

Due diligence on vendors/operators (security, privacy, compliance, financial stability); contracts include breach notice, audit/inspection rights where appropriate, and flow-down obligations.
High-risk vendors may face periodic reassessment, certification reviews, and control evidence requests.
Supply chain security is monitored; incident cooperation clauses are enforced.

Interaction with other Tanqory terms

This notice supplements the Tanqory Privacy Policy, DPA, Cookie Policy, and service terms. If there is a conflict, the stricter or more specific document or applicable law prevails. Product- or region-specific notices may add complementary requirements.

Updates to this notice

We update this notice when PIPA/PIPC guidance or our services change. Material changes will be communicated in advance (e.g., dashboard/email) with version/date and a summary. If you disagree, you may adjust settings or stop using the services. Change history is retained for reference and audit.

Governing law and dispute resolution

This notice is governed by the laws of Singapore as stated in our service terms/DPA, without limiting your rights to seek recourse with the PIPC or other competent authorities in South Korea under PIPA. Contractual dispute resolution (e.g., arbitration) is described in the applicable agreement.

Additional references (South Korea)

PIPC main site: https://www.pipc.go.kr/eng/
PIPA FAQs and guidelines (KISA/PIPC): https://www.kisa.or.kr/eng/main.jsp
Data Breach Notification Guide (PIPC): https://www.pipc.go.kr/eng/ (Help & Resources)
Pseudonymization guidance (PIPA Art. 28-2): see PIPC/KISA materials above.
Cyber incident hotline (KISA): dial 118 in South Korea for incident reporting/assistance.
Consumer dispute resolution (South Korea National Council of Consumer Organizations): https://www.consumer.or.kr/ (for consumer dispute mediation in applicable cases).

Contact

Privacy: privacy@tanqory.com
Data Protection Officer: dpo@tanqory.com
South Korea channel: korea@tanqory.com
Policy site: https://legal.tanqory.com/

Change history

Version	Date
1.1	10 Dec 2025
1.0	20 Oct 2025