개인정보처리방침(Privacy Policy) (2023. 05. 04 ~ 2023. 07. 11)

Ufintech Hub Co., Ltd. (hereinafter referred to as the 'Company') is taking measures to protect users' personal information in compliance with the Personal Information Protection Act and related laws. The privacy policy refers to the company’s act of complying with the guidelines to protect users’ valuable personal information, so that users can use the service with confidence. This privacy policy is equally applied to all services operated by the company. The definition of the terms used below are determined specifically by this document, the relevant laws and regulations, and the company's terms of use, or general commercial practices.

Article 1. Purpose of Collection and Use
The company collects and uses only the minimum personal information necessary for the purposes of each following items. The collected personal information will not be used for any purpose other than the following, and if the purpose of use is changed, necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act will be implemented.

1. Website membership registration and management
Personal information is collected and used to process membership registration and identity verification, to deliver transaction progress and notification, to comply with notice obligations and handle civil complaints, and to prevent members from illegal uses.

2. Provision of goods or services Personal information is collected and used to provide overseas remittance service, foreign currency exchange service, and to manage service use records.

3. Service improvement and marketing Personal information is collected and used to provide marketing and advertising information.

4. Compliance with legal requirements Personal information is collected and used to abide by the Anti Money Laundering(AML) rules, to implement Fraud Detection System(FDS), and to report to financial authorities. The information collected shall be provided to relevant authorities in case a legitimate investigation is requested in response to hacking/fraud-related accident or to fulfill other statutory obligations.

Article 2. Processing and Retention Period of Personal Information
① The company processes personal information either within the personal information processing and retention period according to laws and regulations or period agreed upon by users at the time personal information is (to be) collected.
② Each personal information processing and retention period is as follows.

③ The retention period according to the relevant laws and regulations is as follows.
1. Personal information related to service use (service access record): 3 months (Communication Secret Protection Act)
2. Records on display/advertisement: 6 months (Act on Consumer Protection in Electronic Commerce, etc.)
3. Records on contract or subscription withdrawal: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
4. Records on payment and supply of goods: 5 years (Act on Consumer Protection in Electronic Commerce, etc.)
5. Records on handling consumer complaints or disputes: 3 years (Act on Consumer Protection in Electronic Commerce, etc.)
6. Records of electronic financial transactions and fraudulent transactions: 5 years (Electronic Financial Transactions Act)
7. Financial transaction details for domestic payments and receipts: 5 years (Foreign Exchange Transactions Act)
8. Obligated Customer verification information: 5 years (Article 4 of the Act on the Reporting and Use of Specific Financial Transaction Information and Article 7 of the Enforcement Decree of the Act)

④ The retention period according to the company's internal policy is as follows.
1. Membership registration information to prevent illegal use: 1 year after membership withdrawal

Article 3. Provision of Personal Information to Third Parties
① The company collects and uses the personal information only to the extent specified in Article 1 (Purpose of Collection and Use), and provides personal information to third parties only if the information is subject to Article 17 and 18 of the Privacy Act, including the consent of the information subject and special provisions of the law.

② The company provides personal information to third parties as follows..

Article 4. Consignment of Processing Personal Information
① The company does not consign the user's information to an external company without the user's consent.

② In the event of signing a consignment contract, the company shall stipulate in the documents such as the prohibition of handling personal information other than the purpose of performing consignment work, technical and administrative protection measures, limits on consignment, supervision of trustees, and damages in accordance with Article 25 of the Personal Information Protection Act, and supervise the safe handling of personal information in writings or digital format.

③ The company consigns the processing of personal information as follows.

④ If the contents of the consignment work or the consignee is changed, the company shall notify members through this Privacy Policy without delay.

Article 5. Rights and Duties of Information Subjects and Legal Representatives and Method of Exercising them
① The information subject can exercise the right to view, correct, delete, and suspend processing of personal information at any time with respect to the company.

② The exercise of the rights pursuant to Paragraph 1 may be done through signature, e-mail, facsimile (FAX), etc. in accordance with Article 41 Paragraph 1 of the Enforcement Decree of the Personal Information Protection Act, and the Company shall take action without delay.

③ The exercise of rights pursuant to Paragraph 1 may be done through an agent such as the legal representative of the information subject or a person who has been delegated. In this case, the information subject must submit a power of attorney in the form of Attachment No. 11 of the “Personal Information Processing Method Notice (No. 2020-7)”.

④ The rights of the information subject may be restricted in accordance with Article 35 (4) and Article 37 (2) of the Personal Information Protection Act to request to view and suspend processing of personal information.

⑤ Request for correction and deletion of personal information can be denied if the personal information is specified as a collected item in other laws.

⑥ The company must confirm and verify whether the person who requests for reading, correction or deletion, or request for suspension of processing, is the information subject or a legitimate agent according to the right of the information subject.

⑦ Information subject has the right to request for personal information transmission to 1) Myself 2) Other personal information manager 3) Specialized institution for personal information manage.

 

Article 6. Items of Personal Information to be Processed
① The company processes the following personal information items.

② Method of personal information collection
1. Homepage (Web), app (App), written form, fax, telephone, e-mail, entry details
2. Collection through information collection tools (visitor analysis tools, etc.)
3. Collection through third-party consent from other services
4. Collection through inquiries from customer center
5. Information automatically collected in the process of using Internet services
- IP address, cookies, MAC address, service use record, visit record

 

Article 7. Deletion of Personal Information Procedure and Method
① Regarding the user's personal information, after the purpose of collection and use of personal information is achieved, the information shall be deleted without a delay. However, information that must be kept in accordance with related laws is moved to a separate storage space (DB, etc.) In this case, personal information stored and managed separately will not be used for any other purpose except as stipulated by law. Personal information in format of an electronic file shall be completely deleted using a technical method, so that it cannot be recovered or reproduced. Personal Information in format of printed or written documents shall be destroyed by shredding or incineration.

② According to the 'personal information validity period system', the personal information of members who have not used the service for one year is stored and managed separately from other users' personal information. The separation of personal information, its retention period, and the item being stored must be notified to the members 30 days before the expiration date via e-mail, in writing, fax, telephone, or similar methods. However, if there is a separate consent of the member, the information will not be separately stored and managed even if the service is not used for one year.

③ Deletion of Personal Information Procedure and Method are as follows.
1. Deletion procedure
The company selects personal information to be deleted and destroys these with the approval of the company’s personal information manager
2. Deletion method
The company destroys personal information recorded and stored in the form of electronic files so that the record cannot be reproduced, and crushes or incinerates with a shredder for the personal information recorded and stored in paper documents.

 

Article 8. Private Information Security Measures
In accordance with Article 29 of the Personal Information Protection Act, the company is taking administrative/technical and physical measures necessary to ensure safety as follows.

1. Technical measures against hacking, etc.
In order to prevent leakage and damage of personal information due to hacking or computer viruses, the company installs security programs, periodically updates and checks, installs systems in areas where access is controlled from outside, and technically/physically monitors and blocks them.
2. Encryption of personal information
The user's personal information is stored and managed in an encrypted manner, so only the members can recognize it. For important data, a separate security function is used, such as encrypting files and transmission data or using a file lock function.
3. Restricting access to personal information
The company takes necessary measures to control access to personal information by granting, changing, and canceling access rights to the database system that processes personal information, and use an intrusion prevention system to control unauthorized access from outside.
4. Use of locks for document security
Documents and auxiliary storage media containing personal information are stored in a safe place with a lock. 5. Restricting access to unauthorized people
The company establishes and operates access control procedures in a separate physical storage location where personal information is stored.
6. Establishing and implementing an internal management plan The company establishes and implements an internal management plan for the safe management of personal information processed by the company.
7. Minimizing and educating employees handling personal information
The company limits personal information handling employees to the minimum necessary for business performance, and educates them the importance of personal information protection through administrative measures.

 

Article 9. Installation and Operation of The Automatic Personal Information Collection Device and Its Rejection
① The company uses 'cookies' to store and retrieve usage information from time to time to provide users with customized services.
② Cookies are a small amount of information sent by the server (http) used to operate the website to the user's computer browser and are sometimes stored on the hard disk of the user's PC computer.
1. Purpose of use of cookies: It is used to provide optimized information to users by identifying usage patterns, popular search terms, secure access, etc. for each service and website visited by the user.
2. Installation, operation, and rejection of cookies: A user can refuse to store cookies by setting options in Tools>Internet Options>Personal Information menu at the top of the web browser.
3. If a user refuses to store cookies, the user may experience difficulties in using customized services.

 

Article 10 Matters Concerning the Person in Charge of Personal Information Protection
① The company is responsible for the handling of personal information, and thus, appoints the person in charge of personal information protection to handle complaints and damages related to the processing of personal information.

1. Personal Information Protection Officer: Yeonju Park, CPO
2. Contact: support@utransfer.com
3. Address: 14th floor, Agabang Building, 207 Teheran-ro, Gangnam-gu, Seoul


② The information subject may inquire to the person in charge of personal information protection for all personal information protection related inquiries, request for reading, complaint handling, damage relief, etc. that occurred while using the company's services. The company will respond and handle the inquiries of the information subject without delay.

 

Article 11 Matters Related to Processing of Pseudonym Information
The company does not process pseudonymous information. When pseudonymous information is processed, the company will notify members of the purpose of processing, retention period, processing items, and measures to ensure the safety of pseudonymous information through this personal information processing policy.

 

Article 12. Method of Remedy for Infringement of Rights
Members may request the company to receive relief from personal information infringement. Nevertheless, if it is not resolved smoothly, members may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee or the Korea Internet & Security Agency Personal Information Infringement Report Center. If a report or consultation is needed, please contact the following organizations.

1. Personal Information Dispute Coordination Committee (www.kopico.go.kr/1833-6972)
2. Korea Internet & Security Agency Personal Information Infringement Report Center (privacy.kisa.or.kr/[without area code] 118)
3. Cyber Investigation Division, Supreme Prosecutors' Office (www.spo.go.kr/[without area code] 1301)
4. National Police Agency Cyber Security Bureau (www.police.go.kr/[without area code] 182)

 

Article 13. Privacy Policy Change

① This personal information processing policy is effective from 2023.5.4
② Please check previous privacy policy(s) below.
- 2019. 10. 04 ~ 2021. 09. 06 Apply (click)
- 2021. 09. 07 ~ 2022. 09. 29 Apply (click)
- 2022. 09. 30 ~ 2023. 05. 03 Apply (click)