Table of Contents
1. Purposes of Processing, Items Collected, and Retention Periods
The Company does not process the personal information of children under the age of 14.
(1) Personal Information Processed Without the Consent of the Data Subject
The Company processes the following items of personal information without the consent of the data subject.
| Service | Legal Basis | Category | Items Collected | Purposes of Processing | Retention Period |
|---|---|---|---|---|---|
| DodoPoint (Users) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Sign-up and use of the service | Mobile phone number, service usage information | ・Performance of the contract and provision of the service ・Statistical analysis of service usage records ・Delivery of notices and announcements ・Handling of inquiries, complaints, and grievances ・Prevention of illegal or fraudulent use | Until membership withdrawal |
| DodoPoint (Business members) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Conclusion and performance of the service agreement | Representative’s name, representative’s phone number, representative’s email address, representative’s date of birth (for sole proprietors), contact person’s name, contact person’s phone number, contact person’s email address, store business registration number, store landline number, bank account information, business verification documents (business registration certificate) | ・Performance of the contract for provision of the service, and settlement, collection, and payment of fees ・Notification of usage details and prevention of fraudulent or unauthorized use ・Handling of complaints and responses to consultation requests | Until termination of the service agreement |
| Application for CMS automatic transfer of fees | Transfer applicant information (name, business name, contact number, mobile phone number), financial information (bank name, account holder name, account number, business registration number, account holder’s mobile phone number), email address | ・Application for and processing of CMS automatic transfer of fees ※ When registering for automatic account transfer (CMS), identity verification takes place on the processor’s simplified consent screen, and the identity verification method on that screen is governed by the processor’s privacy policy. | Until termination of the service agreement | ||
| Coin top-up (card payment) | Card issuer name, last 4 digits of the card number ※ Information required for card payment, such as the full card number, expiration date, and CVC, is collected and processed directly by the payment gateway, and the Company does not store such information. | ・Entry of payment card information when topping up coins ・Payment and settlement of charges ・Handling of inquiries, complaints, and grievances ・Statistics and analysis of service usage records | Until termination of the service agreement | ||
| Consultation on service adoption and request for proposal | Store name/company name of the store or company wishing to use DodoPoint, and the contact person’s name, job title, email address, and details of the consultation | ・Sending proposals for use of the DodoPoint service ・Service consultation and consulting | Until completion of the consultation and consulting | ||
| Inquiries about service use and issues | Store name, mobile phone number, region of residence, business type, details of the consultation | ・Consultation and inquiries regarding service use and issues | Until termination of the service agreement | ||
| NowWaiting (Users) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Members – sign-up and use of the service | <Mobile> When linking with KakaoTalk: Mobile phone number, profile information (nickname/profile photo), email address When linking with Naver: User identifier, mobile phone number, member name When verifying identity: Mobile phone number <On-site> When joining a waitlist: Mobile phone number, email address When ordering: Mobile phone number | ・Performance of the contract and provision of the service ・Statistics and analysis of service usage records ・Delivery of notices and announcements ・Handling of inquiries, complaints, and grievances ・Prevention of illegal or fraudulent use | Until membership withdrawal |
| Service users – when joining a waitlist or making a reservation | Mobile phone number, name | ・Performance of the contract and provision of the service (for waitlists and reservations) | Deleted within 5 days of the date of entry | ||
| NowWaiting (Business members) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Service application and operation | <When completing the application form> Business information (business name, business owner name, business registration number, business contact number, business address), payer information (payer name, contact number, date of birth) <When managing spots> Store information (store name (branch name), representative contact number, mobile phone number, address, email address), staff management (name, mobile phone number, email address) <When managing invoices> Tax invoice information (contact person name, email address, contact number) | ・Performance of the contract and provision of the service ・Settlement, billing, collection, and recovery of fees ・Delivery of notices and announcements ・Handling of inquiries, complaints, and grievances | Until termination of the service agreement |
| Payment and settlement of fees | Name, email address, payer number (date of birth or business registration number), card issuer name, last 4 digits of the card number ※ Information required for card payment, such as the full card number, expiration date, and CVC, is collected and processed directly by the payment gateway, and the Company does not store such information. | ・Payment and settlement of fees | Until termination of the service agreement | ||
| Application for CMS automatic transfer of fees | <Account transfer> Applicant information (name, business name, contact number, mobile phone number), financial information (bank name, account holder name, account number, business registration number, mobile phone number) <Credit card payment> Name, mobile phone number, payer number (date of birth or business registration number), card issuer name, last 4 digits of the card number, email address ※ Information required for card payment, such as the full card number, expiration date, and CVC, is collected and processed directly by the payment gateway, and the Company does not store such information. | ・Application for and processing of CMS automatic transfer of fees ※ When registering for automatic account transfer (CMS), identity verification takes place on the processor’s simplified consent screen, and the identity verification method on that screen is governed by the processor’s privacy policy. | Retained for 5 years after cancellation of the automatic transfer | ||
| Consultation on partner registration | Contact person name, email address, mobile phone number, store information (branch name, business type, region), details of the inquiry | ・Consultation and inquiries regarding partner registration | Until the consultation/inquiry is closed (however, if no contract is concluded, retained for 1 year from the date of registration) | ||
| Coupang Logistics | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Use of the vehicle entry/exit queuing and call service | Mobile phone number, name, vehicle number (Automatically generated and collected during use of the service) Entry and exit date and time, queue registration and call history, service usage records | ・Registering vehicles in the entry/exit queue at logistics centers and managing queue order ・Vehicle calls, dispatch guidance, and sending notifications ・Updates on loading and unloading progress ・Delivery of notices and announcements ・Handling of inquiries, complaints, and grievances ・Prevention of illegal or fraudulent use and ensuring service stability | Until 90 days from the date of last use (upon withdrawal of consent or membership withdrawal, destroyed without delay at that time — provided, however, that even in this case the vehicle number is retained for up to 60 days for the purpose of preventing illegal/fraudulent use and then destroyed) |
| Business Services (General) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Sign-up and account settings | [At sign-up] Email address, password, name, mobile phone number [Settings after sign-up] Display name, language | ・Conclusion and performance of the service agreement ・Member identification and login authentication ・Delivery of notices and announcements ・Handling of inquiries, complaints, and grievances | Until termination of the service agreement |
| Mobile phone identity verification | Name, date of birth, gender, Korean national/foreign national status, mobile carrier, mobile phone number, connecting information (CI), duplicate registration verification information (DI), identity verification transaction identifier, access IP and browser information at the time of identity verification | ・Real-name verification through mobile phone identity verification ・Prevention of duplicate registration ・Identity verification when changing the mobile phone number ・Finding a user ID (email) | Until termination of the service agreement | ||
| Verification of business information | [Entered by the store owner] Business registration number [Verified through business information lookup] Trade name, representative’s name, business category, business item, business address, postal code, corporate registration number, taxation type, business status, sole proprietor/corporation status, date of suspension or closure of business | ・Verification of the authenticity of the business ・Entry in the contract ・Determination of the recipient of electronic tax invoices ・Billing and determination of taxation | Until termination of the service agreement | ||
| Payment and refund of usage fees | [Registration of payment method] Masked payment method display (e.g., “Shinhan Card ****1234”), payment method type, payment transaction identifier [Virtual account] Deposit bank and account number, account holder name as shown on the bankbook [Automatic account transfer] Automatic transfer consent identifier [Refund] Bank name, account number, account holder name, copy of bankbook | ・Billing of usage fees ・Collection and settlement ・Processing of payments and refunds ・Prevention of fraudulent use | Until termination of the service agreement | ||
| Article 15(1)2 of the Personal Information Protection Act (Provisions of law), Article 85-3(2) of the Framework Act on National Taxes, Article 71(3) of the Value-Added Tax Act | Issuance of electronic tax invoices | Business registration number, trade name, representative’s name, name of the person receiving tax invoices, email address of the person receiving tax invoices | ・Issuance of electronic tax invoices and transmission to the National Tax Service | Retention period under the Framework Act on National Taxes (5 years) | |
| Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | 1:1 inquiries and service applications | [1:1 inquiry] Inquiry category, subject, details of the inquiry [Service application] Business registration number, applicant’s email address, requests and inquiries | ・Receipt of and consultation on 1:1 inquiries ・Receipt and review of service applications | Until processing of the inquiry or application is completed | |
| Management of devices installed in stores | Device identifier, platform (Windows, iOS, Android), operating system version, app version, device model name, device label designated by the store owner, network type, name of connected wireless router (WiFi SSID), average response time, date and time of first and most recent activity | ・Checking the operating status of devices installed in stores ・Fault diagnosis and remote support ・Distribution of app updates | Until the device is deregistered or the service agreement is terminated | ||
| Manager/staff accounts – invitation | Email address, granted role (manager/staff) | ・Sending invitation emails ・Granting of permissions ※ Manager/staff accounts: When a store owner invites a manager or staff member to the Business Services so that they can use the Business Services, the Company receives only the invitee’s email address from the store owner, and collects other information, such as name and password, directly from the invitee. | Until the invitation expires or is canceled, or the account is closed | ||
| Manager/staff accounts – account creation | Name, password | ・Account creation and login authentication | Until the account is closed | ||
| Business Services (Franchise/Brand) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Invitation, sign-up, and account settings | [At invitation] Email address, granted role (primary contact/general contact) [At sign-up] Name, password [Settings after sign-up] Display name, language | ・Conclusion and performance of the brand contract ・Account identification and login authentication ・Delivery of notices and announcements ※ Brand contact accounts: Brand contacts do not undergo mobile phone identity verification, and the Company does not collect the mobile phone numbers of brand contacts. All communication with brand contacts is conducted by email. | Until termination of the brand contract |
| Verification of brand business information | Business registration number, trade name, representative’s name, business category, business item, business address, postal code, corporate registration number, taxation type, business status | ・Verification of the authenticity of the brand business ・Entry in the contract ・Determination of the recipient of electronic tax invoices | Until termination of the brand contract | ||
| Bulk payment of affiliated stores’ invoices | Masked payment method display, payment method type, payment transaction identifier, (for refunds) bank name, account number, and account holder name | ・Bulk payment of affiliated stores’ invoices ・Billing, collection, and settlement of usage fees | Until termination of the brand contract | ||
| Business Services (Common) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Internal audit logs | Access IP, browser and operating system information (User-Agent), date and time of access and actions, name and email address of the actor, target of the action and change history, request tracing identifier | ・Retention of internal (audit) records of who did what and when ・Detection of fraudulent use and abuse of privileges ・Analysis of the causes of failures | 5 years |
| Login session management | Login date and time, number of failed login attempts, account lockout expiration time, session identifier (cryptographic hash), access IP and browser information at the time the session was issued | ・Login session management ・Detection of account takeover ・Blocking of brute-force attacks | Until the session expires or the user logs out (failed login records are reset when the lock is released) | ||
| Identity verification for password reset and withdrawal requests | Authentication link identifier (cryptographic hash), access IP at the time of the request | ・Identity verification for password reset and membership withdrawal requests | Until the authentication link expires (1 hour after the request) | ||
| Place&QR (Users) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | QR ordering | QR order information (menu items, amount, etc.), mobile phone number (only for users who log in with Naver) | ・Viewing of menus ・Receipt and relay of orders ・Calling staff ・Updating order status ・Customer service and dispute handling related to orders | Until termination of the service agreement However, the mobile phone number is retained for up to 5 years from the date of the order |
| Handling of inquiries | Name, phone number, email address, details of the inquiry, results of handling (including the store used, order date and time, and order details) | ・Receipt of and response to inquiries | Up to 3 years after handling of the inquiry is completed | ||
| Automatically generated and collected during use of the service | Service usage records, access logs, access IP information, cookies, records of improper and fraudulent use, browser and operating system information | ・Ensuring service stability ・Prevention of illegal or fraudulent use | Up to 1 year from the date of collection | ||
| Place&QR (Business members) | Article 15(1)4 of the Personal Information Protection Act (Performance of a contract) | Merchant agreement | Trade name, business registration number, representative’s name, store address, store owner’s name, store owner’s mobile phone number | ・Conclusion and management of the merchant agreement ・Installation support | Until termination of the service agreement |
| Delivery of QR stickers | Name of the store owner or of the recipient designated by the store owner, contact number of the store owner or recipient, delivery address | ・Delivery of QR stickers | Up to 30 days after delivery is completed | ||
| Handling of inquiries | Name, phone number, email address, details of the inquiry, results of handling | ・Receipt of and response to inquiries | Up to 3 years after handling of the inquiry is completed | ||
| Automatically generated and collected during use of the service | Service usage records, access logs, access IP information, cookies, records of improper and fraudulent use, browser and operating system information, login records, information on the POS provider used | ・Ensuring service stability ・Prevention of illegal or fraudulent use | Until termination of the service agreement |
(2) Personal Information Processed with the Consent of the Data Subject
The Company processes the following personal information with the consent of the data subject pursuant to Article 15(1)1 of the Personal Information Protection Act.
| Service | Category | Items Collected | Purposes of Processing | Retention Period |
|---|---|---|---|---|
| DodoPoint | Users – upon consent to personalized services and advertising information | Name, gender, age, birthday | ・Personalized service and product recommendations related to the services provided by the Company ・Provision of advertising information such as giveaways and events ・Provision of information at the request of the Company, affiliates, or partners (member stores) | Until consent is withdrawn or membership is withdrawn |
| Businesses – upon consent to use for marketing | Representative’s name, representative’s phone number, representative’s email address, representative’s date of birth (for sole proprietors), contact person’s name, contact person’s phone number, contact person’s email address, store landline number, business registration number | ・Use for marketing and advertising | Until consent is withdrawn or the service agreement is terminated | |
| NowWaiting | Users – upon consent to receive personalized benefit information | Mobile phone number, email address | ・Provision of information on personalized product and service benefits | Until consent is withdrawn or membership is withdrawn |
| Sign-up via affiliate integration (items received from affiliates) | Shinsegae Co., Ltd.: Mobile phone number Shinsegae Property Co., Ltd. (Starfield), Kyungbang Co., Ltd. (Times Square): Name, mobile phone number | ・Sign-up for and use of the queuing/reservation service | Until consent is withdrawn or membership is withdrawn | |
| Place&QR | Upon consent to the collection and use of personal information for marketing purposes | Mobile phone number, user identifier | Sending advertising information, such as events, benefits, and coupons, of services operated by the Company (such as DodoPoint) and of merchants | Until consent is withdrawn |
| DodoPoint/NowWaiting (Common) | When using location-based services | Location information | ・Performance of the contract and provision of the service ・Statistics and analysis of product and service usage records ・Improvement and recommendation of products and services ・Provision of information on personalized product and service benefits | Destroyed immediately after being processed for the purpose of use and not separately stored in the location information system (see Section 10 for details) |
| Business Services | Store accounts – upon consent to receive benefit and event information | Mobile phone number, email address | ・Provision of information on product and service benefits of the Company and its affiliates ・Notices of events and promotions and processing of participation ・Personalized service recommendations | Until consent is withdrawn or the service agreement is terminated |
| Brands – upon consent to receive benefit and event information | Email address | ・Notices of product and service benefits and events | Until consent is withdrawn or membership is withdrawn |
(3) Personal Information Received from Third Parties and Processed
The Company receives the following personal information from third parties and processes it.
| Service | Provider and Legal Basis | Category | Items Collected | Purposes of Processing | Retention Period |
|---|---|---|---|---|---|
| Place&QR (Users) | Naver Corporation (Article 17(1)1 of the Personal Information Protection Act (consent)) | Naver-linked orders | User identifier, information on coupons held | ・Provision of the Naver ID login service ・Processing of the download, application, and use of Naver Place coupons ・Linking to Naver review writing ※ For reference, store visitors may place orders at the store without logging in with Naver; in this case, however, they cannot use Naver coupons and are restricted from writing Naver reviews. | Up to 5 years from the date on which the results of coupon use processing are returned to Naver |
| Naver Corporation (Article 17(1)1 of the Personal Information Protection Act (consent), Article 50(1) of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc. (consent)) | Marketing to store visitors | Mobile phone number, user identifier | ・Sending information on events, benefits, and coupons of services operated by the Company (such as DodoPoint) and of the relevant merchant (text messages, KakaoTalk messages) | Up to 5 years from the date of consent | |
| Place&QR (Business members) | Naver Corporation (Article 17(1)1 of the Personal Information Protection Act (consent)) | Store owner admin login and store linking | User identifier, Smartplace store ID (Place ID), store name, store address | ・Identity verification of the store owner ・Store owner admin login and maintenance of login status ・Linking of Smartplace stores | Until termination of the service agreement |
(4) Additional Use and Provision Within the Scope Reasonably Related to the Original Purpose of Collection
Pursuant to Articles 15(3) and 17(4) of the Personal Information Protection Act, the Company may use or provide personal information to third parties without the consent of the data subject within the scope reasonably related to the original purpose of collection, taking the following matters into consideration. However, the Company does not currently engage in any additional use or provision of personal information under the above provisions, and if it does so in the future, it will disclose its specific assessment of the following matters in this Privacy Policy.
- Whether the use or provision is reasonably related to the original purpose of collection
- Whether, in light of the circumstances in which the personal information was collected or the practices for its processing, the additional use or provision of the personal information is foreseeable to the data subject
- Whether it unfairly infringes upon the interests of the data subject
- Whether measures necessary to ensure security, such as pseudonymization or encryption, have been taken
2. Provision of Personal Information to Third Parties
To ensure smooth provision of the services, among other purposes, the Company provides personal information to third parties with the consent of the data subject pursuant to Article 17(1)1 of the Personal Information Protection Act in the following cases.
| Service | Recipient | Purpose of Provision | Items Provided | Retention Period |
|---|---|---|---|---|
| DodoPoint | Member stores or brands of the service (List of third-party recipients of personal information) | Earning, using, and topping up points (verification of users and usage information), and resolution of consumer disputes, including handling of complaints | Mobile phone number, point earning and usage information, name, gender, age, birthday | Until consent is withdrawn or membership is withdrawn |
| Naver Corporation | Linking Naver services (MY Place/Reservation/Order) with affiliate membership services, providing features for using affiliate memberships within Naver services, and providing benefits and personalized services based on service use | Internal identifier, name, date of birth, gender, mobile phone number, membership tier and history of benefits provided/used, order/payment history | Until consent is withdrawn or membership is withdrawn | |
| NowWaiting | Stores subscribed to the service (List of third-party recipients of personal information) | Performance of the contract and provision of waitlist/queuing services, verification of users and usage information, handling of complaints, and resolution of consumer disputes | Service usage information, (if entered by the user) name, mobile phone number, email address (for foreign nationals) | Until consent is withdrawn or membership is withdrawn |
| Place&QR | Naver Corporation | Provision of Place&QR sales information, processing of Naver Place coupon use, and writing of Naver reviews | Sales information by store and users’ order information, payment history, coupon usage history | Until the end of use of the Smartplace service |
| Provision of order history, processing of Naver Place coupon use, and verification of visits for writing Naver reviews | User identifier, merchant used, order date and time, menu items ordered, order amount, payment history, coupon usage history | Upon withdrawal from Naver membership | ||
| Business Services | No provision to third parties (see (1) below) | |||
(1) Regarding Business Members
No Provision of Personal Information to Third Parties
The Company does not currently provide the personal information of business members to third parties in connection with the Business Services.
For stores linked to a brand headquarters, information on those stores is displayed on the brand management screen; however, the displayed items are limited to the store name, store address, business status, brand linking date, invoice number, billing period, billed amount, payment due date, and service usage status, and personally identifiable information, such as the name or email address of the store’s contact person, is not displayed.
Notice Regarding Naver Smartplace Integration
The Company provides stores with a Naver Smartplace integration feature. For this integration, only identifiers for store mapping and integration status information are provided to Naver Corporation, and no personal information of data subjects, including business members, is provided. The integration is authenticated using the partner credentials of the Company (Place&), not those of the store owner.
(2) Common to All Services
The Company may provide personal information to relevant authorities without the consent of the data subject pursuant to Article 18(2)2 of the Personal Information Protection Act in the following cases.
| Recipient | Purpose of Provision | Items Provided | Retention Period |
|---|---|---|---|
| Investigative agencies such as the police, and courts | Responding to requests for personal information made through warrants for seizure, search, or inspection, etc. | Personal information requested under a warrant, etc. | Until the purpose of use is achieved |
3. Destruction of Personal Information
When personal information becomes unnecessary, such as when the data subject withdraws consent, the retention period expires, or the purpose of processing has been achieved, the Company destroys the personal information without delay. However, where personal information must be retained for a certain period under relevant laws, the Company stores it separately from other personal information for that period in accordance with the provisions of such laws.
(1) Retention Periods Under Relevant Laws
| Information Retained | Retention Period | Legal Basis |
|---|---|---|
| Records of contracts or withdrawal of subscriptions, etc. | 5 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc., Article 6 of the Enforcement Decree of the same Act |
| Records of payment and supply of goods, etc. | 5 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc., Article 6 of the Enforcement Decree of the same Act |
| Records of consumer complaints or dispute resolution | 3 years | Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc., Article 6 of the Enforcement Decree of the same Act |
| Records of labeling and advertising | 6 months | Article 6 of the Act on the Consumer Protection in Electronic Commerce, Etc., Article 6 of the Enforcement Decree of the same Act |
| Communication confirmation data, such as website visit records | 3 months | Article 15-2 of the Protection of Communications Secrets Act, Article 41 of the Enforcement Decree of the same Act |
| Transaction evidence such as tax invoices | 5 years | Article 85-3 of the Framework Act on National Taxes, Article 71 of the Value-Added Tax Act |
(2) Destruction Procedures and Methods
- Destruction procedures : When personal information becomes unnecessary, such as when the purpose of processing has been achieved, the Company destroys it without delay unless it must be stored separately for a certain period under relevant laws. For personal information with a defined retention period, the Company periodically checks whether it is subject to destruction through an automated review process and destroys it accordingly.
- Destruction methods : Personal information stored in electronic files is permanently destroyed using methods that make it impossible to reuse or recover the records, and personal information printed on paper is destroyed by shredding or incineration.
4. Outsourcing of Processing and Overseas Transfer
To ensure smooth provision of the services, the Company outsources personal information processing tasks as follows. When concluding an outsourcing contract, the Company specifies in the contract the matters required by law, such as the prohibition of processing personal information for purposes other than performing the outsourced tasks, technical and administrative safeguards, restrictions on re-outsourcing, management and supervision of the processor, and liability including compensation for damages, and supervises whether the processor processes personal information securely.
(1) Domestic
| Applicable Service | Processor | Outsourced Tasks |
|---|---|---|
| Common | LG Uplus | Message delivery services |
| Mono Communications | Message delivery services | |
| The White Communication | Customer consultation | |
| CJ Logistics | Product delivery, product installation, returns, refunds, delivery of QR stickers | |
| Hyosung FMS | CMS automatic transfer management | |
| DodoPoint | AJ Networks | Product delivery, product installation, returns, refunds |
| NICE Information Service | Mobile phone identity verification | |
| KICC (Korea Information & Communications) | Provision of automatic point earning services | |
| KG Inicis, NHN KCP | Electronic payment services | |
| NowWaiting | KICC (Korea Information & Communications), Toss Payments | Electronic payment services |
| MyChango | Product delivery, product installation, returns, refunds | |
| Linkhub | Issuance of electronic tax invoices | |
| Modusign | Provision of electronic signature services | |
| Business members | NHN KCP | Identity verification, electronic payment services, account real-name verification |
| Linkhub | Issuance of electronic tax invoices |
(2) Overseas
For the provision of the services, the Company transfers (outsources) the personal information of data subjects overseas without their consent as follows, pursuant to Article 28-8(1)3 of the Personal Information Protection Act (where outsourcing or storage of personal information is necessary for the conclusion and performance of a contract with the data subject).
| Applicable Service | Processor | Destination Country | Outsourced Tasks (Purpose of Use) | Personal Information Outsourced | Date, Time, and Method of Transfer | Retention Period |
|---|---|---|---|---|---|---|
| DodoPoint | Amazon Web Services, Inc. (aws-koreaprivacy@amazon.com) | Japan | IT infrastructure services (storage and management of personal information, etc.) | Items collected under Section 1 (all personal information collected by the Company) | Transmitted over the network at the time of service use | Until the earlier of the end of the Company’s retention period for the personal information or the termination of the outsourcing contract |
If you refuse the overseas transfer of your personal information, you will not be able to use DodoPoint and NowWaiting. If you do not wish your personal information to be transferred overseas, you may withdraw your membership through the website or mobile app of the relevant service, or request membership withdrawal by contacting the responsible department listed in Section 6 by phone or email.
The Company does not transfer the personal information of data subjects overseas in connection with the Business Services. All personal information related to the Business Services is processed and stored on servers located in the Republic of Korea (Amazon Web Services Seoul Region), and all of the Business Services processors listed in (1) above are domestic businesses.
The Company does not transfer the personal information of data subjects overseas in connection with Place&QR. Personal information related to Place&QR is processed and stored on servers located in the Republic of Korea (Amazon Web Services Korea Region).
5. Rights and Obligations of Data Subjects and How to Exercise Them
Data subjects or their representatives may exercise their rights against the Company at any time, including requests to access, correct, delete, or suspend the processing of personal information, or to withdraw consent.
As described in the table below, data subjects may modify their member information or withdraw their membership through the in-service settings, and may also exercise their rights by contacting the relevant responsible department listed in Section 6 by phone or email.
| Service | How to Check and Exercise Rights Within the Service |
|---|---|
| DodoPoint | Access, correction, and deletion of personal information: In the app, ‘More’ > ‘My Info’ Suspension of processing and withdrawal of consent: On the web, ‘More’ > ‘Settings’ > ‘Withdraw from Service’ |
| NowWaiting | View consent history or withdraw consent via the personal information collection and marketing consent confirmation page linked from the footer of the NowWaiting website ※ Withdrawal of consent is deemed a membership withdrawal, and personal information is deleted immediately unless there is a legal obligation to retain it. |
| Business members | Access to personal information: Request in writing, by phone, or by email to the personal information protection department listed in Section 6 Correction of personal information: Display name and language can be edited directly under ‘My Info’ in Portal/Brand; for other items, request in writing, by phone, or by email to the personal information protection department listed in Section 6 Deletion and suspension of processing of personal information: Request in writing, by phone, or by email to the personal information protection department listed in Section 6 Withdrawal of consent to receive marketing information: Withdraw directly under ‘My Info’ > ‘Marketing Preferences’ in Portal/Brand Membership withdrawal: ‘My Info’ > ‘Withdraw Membership’ in Portal/Brand |
| Place&QR | Request access, correction, deletion, suspension of processing, etc. in writing, by phone, or by email to the personal information protection department listed in Section 6 |
Rights may also be exercised through a representative, such as the data subject’s legal representative or a person delegated by the data subject. In this case, a power of attorney in the format of Annexed Form No. 11 of the 「Notice on Methods of Processing Personal Information」 must be submitted. The rights of a child under the age of 14 must be exercised directly by the child’s legal representative, and a minor aged 14 or older may exercise their rights personally or through their legal representative.
Requests for access to and suspension of processing of personal information may be restricted pursuant to Article 35(4) and Article 37(2) of the Personal Information Protection Act, and deletion of personal information may not be requested where other laws specify that the personal information is subject to collection.
The Company verifies whether the person exercising the rights is the data subject or a legitimate representative, and responds with the results of processing within 10 days from the date on which the request to exercise the rights is received. The personal information protection department listed in Section 6 is responsible for receiving and processing requests to exercise rights.
However, withdrawal of consent or suspension of processing may not be possible in the following cases.
- Where there are special provisions in law or it is unavoidable in order to comply with legal obligations
- Where there is a risk of harm to the life or body of another person, or a risk of unfairly infringing upon the property or other interests of another person
- Where the service agreed upon with the user cannot be provided without processing personal information and the user has not clearly expressed an intention to terminate the contract
For business members, business information such as the business registration number, trade name, and representative’s name is managed as the values verified through a business registration information lookup to ensure accuracy in issuing electronic tax invoices and in contract entries, and cannot be modified by the data subject at will. If a correction is needed, please submit a request to the responsible department listed in Section 6.
6. Chief Privacy Officer and Responsible Department
The Company has designated the Chief Privacy Officer and the department responsible for personal information protection as follows.
| Category | Details |
|---|---|
| Chief Privacy Officer | Kim Jaeheon (CEO/CPO) |
| Responsible Department (DodoPoint) | Business Operations Team / Customer Center 1670-6463 / dodo@placen.co.kr |
| Responsible Department (NowWaiting) | Business Operations Team / Customer Center 1522-5954 / waiting@placen.co.kr |
| Responsible Department (Place&QR) | Business Operations Team / Customer Center 1522-4565 / placenqr@placen.co.kr |
Data subjects may direct all inquiries, complaints, and requests for remedies related to personal information protection arising from their use of the services to the department above. The Company will respond to and handle data subjects’ inquiries without delay.
7. Remedies for Infringement of Rights
To obtain remedies for infringement of personal information, you may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center of the Korea Internet & Security Agency, and others.
- Personal Information Dispute Mediation Committee : (no area code) 1833-6972 / https://www.kopico.go.kr
- Personal Information Infringement Report Center : (no area code) 118 / https://privacy.kisa.or.kr
- Korean National Police Agency : (no area code) 182 / https://ecrm.police.go.kr
8. Measures to Ensure the Security of Personal Information
The Company takes the following measures to ensure the security of personal information. The Company complies with the legal security requirements under relevant laws, including the Personal Information Protection Act, its Enforcement Decree, and the Standards for Measures to Ensure the Security of Personal Information, and strives to manage data subjects’ personal information securely through regular internal and external security inspections.
- Administrative measures : Establishment and implementation of an internal management plan, regular employee training, internal audits, etc.
- Technical measures : Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, retention of access records and prevention of their forgery or alteration, installation of security programs, etc.
- Physical measures : Access control for server rooms, data storage rooms, etc.
Control over Viewing of Contact Information
On screens where data subjects’ mobile phone numbers and email addresses are viewed, the Company displays only masked values, and unmasked values may be viewed only by staff with separate authorization and only for designated purposes. Every viewing of unmasked contact information is recorded in an audit log, and even then, the viewed number itself is not recorded in the log.
When contact information is viewed for the purpose of sending advertising information, only the contact information of data subjects who have consented to receive marketing information is retrieved.
9. Installation and Operation of Automatic Collection Devices and How to Refuse Them
(1) DodoPoint and NowWaiting
To provide individualized services and convenience to data subjects, the Company uses ‘cookies’, which store usage information and retrieve it from time to time. Cookies are small amounts of information sent by the server used to operate a website to the data subject’s browser; they are stored on the data subject’s computer or mobile device and are automatically sent from the data subject’s browser to the server when accessing the website.
The Company uses cookies to process behavioral information in a manner that does not identify individuals for the following purposes.
- Loading advertising identifiers and device IDs into cookies to provide information optimized and differentiated for each device
- Analyzing data subjects’ frequency of visits, time spent, etc. to identify users’ preferences and interests for use in targeted marketing
- Analyzing details of clicked information and traces of information browsed with interest to provide personalized services on the next visit
- Analyzing data subjects’ habits for use as a benchmark for service improvements, etc.
Data subjects may refuse cookies, among other settings, through the following browser option settings. However, refusing cookies may make it difficult to use some services.
| Environment | Settings Path |
|---|---|
| Edge | Settings > Privacy, search, and services > Tracking prevention or cookie settings > Choose whether to enable tracking prevention and its level |
| Chrome | Settings > Privacy and security > Third-party cookies > Block third-party cookies |
| Safari | Settings > Apps > Safari > Advanced > Block All Cookies |
| Android | Chrome : Settings > Site settings > Third-party cookies > Choose whether to block Samsung Internet : Settings > Browsing data > Delete browsing data > Select Cookies and site data > Delete data |
| iOS | Chrome : Settings > Privacy and security > Delete browsing data > Select Cookies, site data Safari : Settings > Apps > Safari > Advanced > Set whether to Block All Cookies |
(2) Business Services
Use of Cookies
The Company does not use cookies for login authentication on the websites related to the Business Services (Portal and Brand), and does not load advertising identifiers or device IDs into cookies. If the Company begins to use cookies in the future, it will disclose their purpose and how to refuse them in advance through this Privacy Policy.
Permitting Collection of Behavioral Information by Third Parties
The Company does not permit third parties to collect behavioral information on Portal and Brand.
Information Collected from Devices Installed in Stores
To verify the proper operation of and diagnose faults in devices installed in stores (tablets, customer call monitors, Windows operating programs, etc.), the Company collects the device information listed under ‘Management of devices installed in stores’ for the Business Services in the table in Section 1(1). This information is collected on a per-device basis and does not include the personal information of customers visiting the store.
10. Processing of Personal Location Information
The Company protects data subjects’ personal location information in compliance with the Act on the Protection, Use, Etc. of Location Information. Details on the processing of personal location information can be found in each service’s Location Information Terms of Use. The Company does not separately store or retain personal location information in its location information system; it uses such information temporarily to provide location-based services and destroys it immediately once the purpose of providing the service has been achieved. Accordingly, the Company does not separately retain personal location information.
For reference, the Company does not collect or process the personal location information of data subjects (business members) in connection with the Business Services. The latitude and longitude included in store information are the coordinates of the business premises’ location and do not constitute personal location information.
(1) Purposes of Processing and Retention Period of Personal Location Information
The Company uses personal location information for the purpose of providing the services below. The Company does not separately store or retain personal location information in its location information system; it uses such information temporarily to provide the location-based services below and destroys it immediately once the purpose of providing the service has been achieved. Accordingly, the Company does not separately retain personal location information.
| Applicable Service | Purposes of Processing |
|---|---|
| DodoPoint | ・Search result service using location information : When a request for information search is made or the location information of the personal location information subject or a mobile device is provided, presenting search results and nearby results (affiliated stores, etc.) using that location information |
| NowWaiting | ・Waitlist and ordering services using location information : Providing waitlist and ordering services for affiliated stores within a specific radius accessible to the data subject ・Search result service using location information : Identifying customers using the service within a specific radius of a store ・Provision of advertising information using the data subject’s location : Presenting location-based advertising content in search results, etc. |
(2) Basis and Retention Period for Records Confirming the Collection, Use, and Provision of Location Information
Pursuant to Article 16(2) of the Act on the Protection, Use, Etc. of Location Information, the Company automatically records and preserves in its location information system records confirming the collection, use, and provision of location information concerning personal location information subjects, and the retention period is 6 months. Records whose retention period has expired are destroyed immediately. However, if a personal location information subject withdraws all or part of their consent to the collection, use, or provision of personal location information, the relevant records are destroyed without delay in accordance with relevant laws.
(3) Procedures and Methods for Destroying Personal Location Information
When the purpose of collecting, using, or providing personal location information has been achieved, the Company destroys the personal location information immediately. However, where retention is required under other laws, the information is retained for the period prescribed by such laws, and where the personal location information subject has separately consented to its retention, it is retained for the consented period, up to a maximum of 1 year from the time of consent. When destroying personal location information, the Company uses the following methods so that it cannot be recovered or reproduced.
- Personal location information printed on paper : Shredding or incineration
- Personal location information stored in electronic files : Permanent deletion using technical methods that make the records impossible to reuse
(4) Provision of Personal Location Information to Third Parties and Immediate Notification
The Company does not provide personal location information to third parties. If, in the future, provision to a third party designated by the personal location information subject becomes necessary, the Company will take the following measures.
- Notifying the personal location information subject in advance of the recipient and the purpose of provision and obtaining consent
- Immediately notifying the personal location information subject, each time, of the recipient, the date and time of provision, and the purpose of provision via the communication terminal device from which the personal location information was collected
- Where the communication terminal device from which the personal location information was collected lacks the capability to receive text, voice, or video, or where the personal location information subject has requested in advance to be notified via a communication terminal device other than that device, an email address, etc., notifying via the communication terminal device or email address, etc. specifically designated in advance by the personal location information subject
(5) Rights and Obligations of Guardians of Children Aged 8 or Under, etc., and How to Exercise Them
- Where the guardian of a child aged 8 or under, a person under adult guardianship, or a person with a mental disability under Article 2(2)2 of the 「Act on Welfare of Persons with Disabilities」 who is a person with a severe disability under Article 2 Subparagraph 2 of the 「Act on the Employment Promotion and Vocational Rehabilitation of Persons with Disabilities」 (limited to persons registered as persons with disabilities under Article 32 of the 「Act on Welfare of Persons with Disabilities」) consents to the collection, use, or provision of personal location information for the protection of that person’s life or body, the Company deems that the person’s own consent has been given.
- A guardian wishing to give consent must submit to the Company a written consent form in accordance with relevant laws, accompanied by a document proving that they are the guardian.
- When a guardian consents to the collection, use, or provision of personal location information, the guardian may exercise all of the rights of the personal location information subject.
- A guardian may withdraw all or part of the consent to the collection, use, or provision of personal location information, or request its temporary suspension, and may exercise the rights of the personal location information subject, such as requesting access to or notification of records confirming the collection, use, and provision of location information and correction of errors. These rights may be exercised through the Company’s customer center or by other methods provided by the Company, such as its contact number or email.
(6) Location Information Manager
| Category | Details |
|---|---|
| Location Information Manager | Kim Jaeheon |
| Contact (DodoPoint) | 1670-6463 / dodo@placen.co.kr |
| Contact (NowWaiting) | 1522-5954 / waiting@placen.co.kr |
11. Automated Decisions and Processing of Pseudonymized Information
The Company does not make decisions that significantly affect the rights or obligations of data subjects by processing personal information through fully automated systems as defined in Article 37-2 of the Personal Information Protection Act. If the Company introduces such automated decisions in the future, it will disclose in advance, through this Privacy Policy, the criteria and procedures as well as how to refuse them or request an explanation.
The Company may process pseudonymized information pursuant to Article 28-2 of the Personal Information Protection Act for purposes such as compiling statistics, scientific research, and archiving in the public interest; in such cases, it will disclose through this Privacy Policy the purposes of processing, the retention period, whether the information is provided to third parties, and the security measures for the pseudonymized information. The Company does not currently process any pseudonymized information in connection with DodoPoint, NowWaiting, the Business Services, or Place&QR.
12. Amendments to This Privacy Policy and Notice Thereof
This Privacy Policy may be amended due to changes in the services or in laws, and when it is amended, the Company will give advance notice of the changes through its announcements.
For Place&QR, when this Privacy Policy is changed, the Company will provide notice through the announcements on its website and the announcements in the store owner admin starting 7 days before the effective date. Changes that have little impact on the rights of data subjects, such as changes to the list of processors performing the same tasks, may be compiled in 4-week intervals and announced together with their start and end dates.
- Notice date : November 16, 2026
- Effective date : November 16, 2026
- Major changes to the Privacy Policy
・ Initial establishment of the Place&QR Privacy Policy
Previous versions of the Privacy Policy are available below.
- Previous Business Services Privacy Policies