Privacy Policy
Effective date: 2026-10-15T00:00:00.000Z
i-Aurora Co., Ltd. (the "Company") complies with applicable laws and regulations, including the Personal Information Protection Act, the Electronic Financial Transactions Act, the Act on the Protection, Use, etc. of Location Information, and the Act on Reporting and Using Specified Financial Transaction Information, and protects users' personal information. Accordingly, the Company establishes and discloses this Privacy Policy as follows so that related grievances can be handled promptly and smoothly.
(The Privacy Policy of i-Aurora Co., Ltd. contains the following:
Article 1 (Purposes of Processing and Items of Personal Information Collected)
Article 2 (Processing and Retention Period of Personal Information)
Article 3 (Entrustment of Personal Information Processing)
Article 4 (Provision of Personal Information to Third Parties)
Article 5 (Retention and Use Period of Personal Information)
Article 6 (Procedures and Methods for Destruction of Personal Information)
Article 7 (Rights and Obligations of Users and Legal Representatives and How to Exercise Them)
Article 8 (Installation, Operation, and Refusal of Devices that Automatically Collect Personal Information)
Article 9 (Mobile App Access Permissions)
Article 10 (Measures to Ensure the Security of Personal Information)
Article 11 (Chief Privacy Officer)
Article 12 (Processing of Personal Location Information)
Article 13 (Processing of Pseudonymized Information)
Article 14 (Overseas Transfer of Personal Information)
Article 15 (Changes to the Privacy Policy)
Article 1 (Purposes of Processing and Items of Personal Information Collected)
The Company collects and uses the minimum personal information necessary to provide the service, as set out below. The Company processes personal information on the basis of Article 15(1)1 (performance of a contract) and Article 15(1)2 (compliance with legal obligations) of the Personal Information Protection Act. Required information is information needed to perform the essential functions of the relevant service, and optional information is additionally collected to provide more specialized services (use of the service is not restricted even if optional information is not entered). The Company does not collect personal information from children under the age of 14.
① Items of Personal Information Collected and Used
When Collected and Used | Items Processed | Category |
At member registration [APP] | Email / password / date of birth / nationality / gender | Required |
During service use and processing | Service usage records, access logs, cookies, access IP information, MAC address, OS type and version, device information, identity verification values (CI, DI), user location information | Required |
During top-up, payment, and refund | Merchant name, terminal information, card information (card number, CVC, expiration date, recent transaction history, balance), bank account information (bank name, account number, account holder's name) | Required |
When performing customer due diligence obligations under the Act on Reporting and Using Specified Financial Transaction Information [Customer Due Diligence] | [Residents] Name, unique identification information (one of: Resident Registration Number, Driver's License Number (including Resident Registration Number), or Alien Registration Number), mobile phone number (optional), address, bank name and account number, and, for Alien Registration Card holders, status of stay information (visa type, period of stay) [Non-residents] Name, unique identification information (Passport Number), address, facial recognition information, status of stay information (visa type, period of stay) | Required |
When performing customer due diligence obligations under the Act on Reporting and Using Specified Financial Transaction Information [Enhanced Due Diligence] | Information collected for customer due diligence, purpose of transaction, source of funds information, occupation category | Required |
During phone consultations with Customer Center | Email address, phone number, card number, transaction history | Optional |
During chat consultations with Customer Center | Email address, card number, transaction history | Optional |
Prepaid card registration | Prepaid card information (card number, BIN, expiration date, CVC), transportation card information (card number) | Required |
When applying for the income tax deduction service | Name, date of birth, gender, mobile phone number, CI | Required |
When receiving marketing information | Mobile phone number, email address | Optional |
When using location-based services | Personal location information | Optional |
② Methods of Collecting Personal Information
Provided directly by users through the application, collected through automatic collection devices during service use, and provided by partner companies
Article 2 (Processing and Retention Period of Personal Information)
The Company processes and retains personal information within the processing and retention period consented to by users at the time of collection.
① User management and service provision
User identification for concluding, performing, and terminating service contracts; issuance, top-up, payment, and refund of the NAMANE Card; retention of records for service-related consultations, handling complaints, and resolving disputes; delivery of notices such as service changes; prevention of fraudulent or unauthorized use of the service; processing of income tax deduction applications (including providing data to the National Tax Service's Year-End Tax Settlement Simplified Service); card receipt confirmation, card registration, and usage guidance; processing of open banking and firm banking services; performance of customer due diligence obligations under the Act on Reporting and Using Specified Financial Transaction Information; statistics and analysis, pseudonymization and anonymization, provision of personalized services, and service research and improvement
② Use for new service development and marketing/advertising
Development of new services and provision of customized services through collection of service usage statistics, etc.; delivery of advertising information such as events and provision of opportunities to participate (only where separate consent has been obtained)
Article 3 (Entrustment of Personal Information Processing)
The Company entrusts some of the work necessary to provide services to users to external companies.
① Entrustment Status
Payment · Settlement
Trustee | Entrusted Work | Sub-entrustment | Sub-entrusted Work |
NICE Payments Co., Ltd. | Payment processing |
|
|
㈜KSNET | Account transfer processing, payment processing | Financial institutions (banks, mutual financial institutions, securities firms) |
|
Kookmin Bank | Prepaid top-up and reimbursement |
|
|
KB Kookmin Card Co., Ltd. | Prepaid card transaction authorization relay, acquiring and settlement, and ISP service provision |
|
|
COOCON Corporation | ATM deposit and withdrawal processing | Lotte Shopping Co., Ltd. (7-Eleven), Korea Electronic Financial Co., Ltd., Hyosung TNS Inc., Hannet Co., Ltd. | ATM deposit and withdrawal processing by device provider |
Bank account remittance | IBK Industrial Bank of Korea | Remittance intermediation | |
Korea Railroad Corporation | Transportation card payment and settlement |
|
|
NICE Payments Co., Ltd., Global Tax Free Co., Ltd. | Tax refund processing |
|
|
Alipay Connect Pte. Ltd. | Alipay+ Merchant payment/settlement service provision |
|
|
Top-up
Trustee | Entrusted Work | Sub-entrustment | Sub-entrusted Work |
BGF Retail Co., Ltd. (CU) | Convenience store top-up/withdrawal service |
|
|
㈜KSNET | Auto top-up (firm banking) processing | Financial institutions (banks, mutual financial institutions, securities firms) | deposit and withdrawal processing |
Authentication · Identity Verification
Trustee | Entrusted Work | Sub-entrustment | Sub-entrusted Work |
Argos Identity Korea Co., Ltd. | When performing customer due diligence obligations under the Act on Reporting and Using Specified Financial Transaction Information [Customer Due Diligence] | [Domestic] Hecto Data | ID document authenticity verification |
[Domestic] Hana Bank | 1-won account verification | ||
[Overseas] AWS | Cloud server operation | ||
[Overseas] Google LLC | Information validation | ||
[Overseas] OpenAI LLC | Information validation | ||
[Overseas] ION Group | Watch List Filtering Database screening | ||
Hecto Innovation Co., Ltd., Dayside Co., Ltd., ATON Inc. | Identity verification (PASS) |
|
|
Benefits
Trustee | Entrusted Work |
Coup Marketing Co., Ltd. | Benefits service operation |
Notifications · CS
Trustee | Entrusted Work |
Bloom AI Co., Ltd. (Happytalk), Kakao Corp. (Kakao Biz) | Chat consultation operation |
Munjaline Co., Ltd., Sweet Tracker | Sending of KakaoTalk notification messages and text messages (SMS/LMS) |
Infrastructure · Security
Trustee | Entrusted Work |
KT Cloud Co., Ltd. | Cloud server operation |
Google LLC | Web tag management (GTM), app and web analytics |
② Management and Supervision of Trustees
When entering into an entrustment agreement, the Company includes in the agreement, in accordance with Article 26 of the Personal Information Protection Act, provisions on the prohibition of processing personal information for purposes other than the performance of the entrusted work, technical and managerial safeguards, restrictions on sub-entrustment, management and supervision of the trustee, and liability for damages, and supervises whether the trustee processes personal information securely.
③ Disclosure of Changes
If the details of the entrusted work or the trustee change, the Company will disclose the change without delay through this Privacy Policy.
Article 4 (Provision of Personal Information to Third Parties)
① In principle, the Company processes users' personal information only within the scope notified in Article 2, and does not use it beyond that scope or provide it to third parties without the user's prior consent.
However, in the following cases, the Company may use personal information for purposes other than the original purpose or provide it to third parties, except where doing so is likely to unfairly infringe on the interests of the customer or a third party. Matters related to the provision of information to third parties will be separately notified, and consent will be obtained, during the course of using the service.
a. Where the customer has consented in advance to provision to and disclosure to third parties
b. Where special provisions exist in other laws
c. Where the customer or their legal representative is unable to express their intention, or prior consent cannot be obtained because the address is unknown, etc., and the provision is clearly deemed necessary to protect the urgent life, physical, or property interests of the customer or a third party
d. Where necessary for purposes such as compiling statistics or academic research, and personal information is provided in a form in which a specific individual cannot be identified
e. Where the Company provides, within the scope of the purpose of collection, personal information that it inevitably collected to comply with legal obligations
② The Company may provide personal information to relevant authorities without the consent of the data subject, as follows.
Recipient | Items Provided | Purpose of Provision | Legal Basis |
Korea Financial Intelligence Unit | Information within the scope of the request | Where information is requested for anti-money laundering purposes | Article 13 of the Act on Reporting and Using Specified Financial Transaction Information |
National Tax Service | Name, Resident Registration Number, details of deductible medical expenses | Issuance of supporting documents for simplified year-end tax settlement | Article 17(1)2 and Article 15(1)2 of the Personal Information Protection Act (special provisions in law), Article 165 of the Income Tax Act |
Competent police agencies and prosecutors' offices | Information within the scope of the request | Requests made through a search, seizure, or inspection warrant | Article 18(2)2 of the Personal Information Protection Act (special provisions in law), Article 215 of the Criminal Procedure Act |
Article 5 (Retention and Use Period of Personal Information)
In principle, the Company destroys personal information without delay once the purposes of collection and use consented to by the user have been achieved. However, where retention is necessary under internal policy or applicable laws and regulations, the information is retained for a certain period as set out below.
① Information Retained Under Internal Policy
Items Retained | Reason and Basis for Retention | Retention Period |
Fraudulent use records | Preventing illegal or improper gains through repeated voluntary termination, and preventing fraudulent use through re-registration of blocked accounts | 1 year |
CI, DI, Mobile carrier information | In preparation for handling complaints from deleted members, settling transaction amounts with partner institutions, and other necessary cases | 6 months |
Email address, ID, name, date of birth, gender | In preparation for handling complaints from deleted members, settling transaction amounts, and other necessary cases | 1 year |
② Information Retained Under Applicable Laws
Items Retained | Reason and Basis for Retention | Retention Period |
Records of contracts or withdrawal of subscriptions | Article 6 of the Act on the Consumer Protection in Electronic Commerce | 5 years |
Records of payment and supply of goods | Article 6 of the Act on the Consumer Protection in Electronic Commerce | 5 years |
Records of consumer complaints or dispute handling | Article 6 of the Act on the Consumer Protection in Electronic Commerce | 3 years |
Records of electronic financial transactions exceeding ￦10,000 per transaction | Article 12 of the Enforcement Decree of the Electronic Financial Transactions Act | 5 years |
Records of electronic financial transactions of ￦10,000 or less per transaction | Article 12 of the Enforcement Decree of the Electronic Financial Transactions Act | 1 year |
Website visit records | Article 15-2 of the Protection of Communications Secrets Act | 3 months |
Records of personal location information | Article 16 of the Act on the Protection, Use, etc. of Location Information | 6 months |
Customer due diligence information | Article 5-4 of the Act on Reporting and Using Specified Financial Transaction Information | 5 years |
Article 6 (Procedures and Methods for Destruction of Personal Information)
① Destruction Procedures
The Company destroys personal information without delay when it is no longer necessary, such as when the retention period has expired or the purpose of processing has been achieved. Where personal information must continue to be retained under other laws, it is moved to a separate database (DB) or stored in a different location.
② Destruction Methods
Personal information recorded or stored in paper documents is destroyed by shredding or incineration. Personal information recorded or stored in electronic files is deleted using technical methods that make the records unrecoverable.
Article 7 (Rights and Obligations of Users and Legal Representatives and How to Exercise Them)
① Types of Rights
Users may exercise the following rights against the Company at any time.
• Request to access personal information
• Request to correct or delete personal information
• Request to suspend processing of personal information
• Request to transmit personal information (Article 35-2 of the Personal Information Protection Act)
• Request to refuse or obtain an explanation of automated decisions (Article 37-2 of the Personal Information Protection Act)
② How Users Exercise Their Rights
Customer Center: 1:1 chat inquiry or phone inquiry, or a direct request to the Chief Privacy Officer in writing or by email
③ Legal Representatives, etc.
Requests to access, etc. personal information of children under the age of 14 must be made directly by their legal representative. Users who are minors aged 14 or older may exercise their rights themselves or through their legal representative.
④ Processing and Grounds for Refusal
The Company handles users' requests without delay. However, in the following cases, the Company may notify the user of the reason and refuse a request to suspend processing, etc.: where special provisions exist in law or it is unavoidable to comply with legal obligations; or where there is a risk of harming another person's life or body, or of unfairly infringing on another person's property or other interests.
Article 8 (Installation, Operation, and Refusal of Devices that Automatically Collect Personal Information)
① Use of Cookies
The Company uses 'cookies', which store usage information and retrieve it from time to time, to provide users with individually customized services. Cookies are small amounts of information sent by the server operating the website to the user's browser and are stored on the user's computer or mobile device.
② Purpose of Using Cookies
Cookies are used to provide personalized services, such as analyzing users' access frequency and visit times, identifying user preferences and interests, and tracking participation in events.
③ How to Refuse Cookies
Users can allow or block cookies through their web browser's option settings. However, if users refuse to store cookies, use of some services may be restricted.
Category | Settings Path |
PC Web | Internet Explorer: Tools > Internet Options > Privacy tab option settings Microsoft Edge: Top menu > Settings > View advanced settings > Cookies option settings Chrome: Top menu > Settings > Advanced > Content settings > Cookies option settings Safari: Clear History and Website Data > Confirm |
Mobile App | Android OS: Phone Settings > Apps > NAMANE Card > Storage > Clear Data iOS: Settings > Apps > NAMANE Card > Storage > Clear Data |
Article 9 (Mobile App Access Permissions)
① Permissions Requested
The Company may request the following access permissions on users' mobile devices to provide the service.
Access Permission | Purpose of Use | Permission Type |
Camera | QR code payment scanning, ID document capture (identity verification) | Optional (Required for Verified Members) |
Biometric authentication (Face ID) | Easy login and payment authentication | Optional |
Location | Checking and guiding to nearby merchant locations | Optional |
Photos | Card design customization | Optional |
Notifications (push) | Receiving transaction notifications, service notices, and marketing information | Optional |
② Required Permissions
Required permissions are permissions essential to provide the basic functions of the service. If you do not consent, use of the relevant service may be restricted.
③ Optional Permissions
You may use the basic service without restriction even if you do not consent to optional permissions.
④ How to Withdraw or Change
Android: Phone Settings → Apps → NAMANE → Permissions
iOS: Settings → Apps → NAMANE → Permissions
Article 10 (Measures to Ensure the Security of Personal Information)
In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following measures to ensure the security of personal information.
Category | Measures |
Managerial measures | Establishment and implementation of an internal management plan, regular employee training, and minimizing the number of personal information handlers |
Technical measures | Management of access rights to personal information processing systems, installation of access control systems, encryption of personal information, installation and updating of security programs, and retention of access records and prevention of their forgery or alteration |
Physical measures | Access control for computer rooms and data storage rooms |
Article 11 (Chief Privacy Officer)
The Company designates a Chief Privacy Officer, as set out below, to oversee personal information processing and to handle user complaints and provide remedies for damages related to personal information.
Category | Details |
Chief Privacy Officer | Name: Kim Hye-kyung Contact: +82-2-1588-3073 Email: cs@i-aurora.co.kr |
Department in Charge of Grievances | Department: CS Team Contact: +82-2-1588-3073 1:1 Inquiries (Web/App): Chat Consultation > Contact Us |
If you need to report or seek advice on a personal information infringement, you may contact the following organizations.
Organization | Website | Phone |
Personal Information Infringement Report Center | privacy.kisa.or.kr | 118 (no area code) |
Personal Information Dispute Mediation Committee | www.kopico.go.kr | 1833-6972 (no area code) |
Cyber Investigation Division, Supreme Prosecutors' Office | www.spo.go.kr | 1301 (no area code) |
Cyber Bureau, Korean National Police Agency | police.go.kr | 182 (no area code) |
Article 12 (Processing of Personal Location Information)
① Basis for Processing
The Company processes users' personal location information to provide location-based services, and obtains consent after specifying the relevant details in its terms and conditions in advance.
② Purposes of Processing Personal Location Information
Checking and guiding to nearby merchant locations, and providing location-based customized services
③ Retention and Destruction
The Company retains personal location information until the purpose of use or provision has been achieved, and destroys it without delay once the purpose has been achieved. However, in accordance with Article 16 of the Act on the Protection, Use, etc. of Location Information, records confirming the collection, use, and provision of location information are kept for at least 6 months.
④ Provision to Third Parties
The Company does not provide personal location information to third parties without the user's prior consent.
Article 13 (Processing of Pseudonymized Information)
① Definition of Pseudonymized Information
Pseudonymized information means information processed, by methods such as deleting part of the personal information or replacing part or all of it, so that a specific individual cannot be identified without additional information.
② Purposes of Processing
The Company may pseudonymize and use personal information for the purposes of compiling statistics, scientific research, and archiving in the public interest.
③ Security Measures
Category | Measures |
Managerial measures | Establishment and implementation of an internal management plan, regular employee training |
Technical measures | Management of access rights to pseudonymized information, prevention of re-identification, installation of security programs |
Physical measures | Access control for computer rooms and data storage rooms |
④ Prohibition of Re-identification
The Company does not use pseudonymized information for the purpose of re-identification, and if re-identification occurs, destroys the information immediately.
Article 14 (Overseas Transfer of Personal Information)
The Company transfers personal information collected from users overseas as set out below and, pursuant to Article 28-8(2) of the Personal Information Protection Act , provides the following information on the overseas transfer.
Recipient | Destination Country | Items Transferred | Purpose of Transfer | Retention Period | How to Withdraw Consent |
Google LLC | United States | Access logs, IP address, device identifier | Web tag management (GTM), app and web analytics (GA) | 1 year from the date of collection | Contact Customer Center |
Alipay Connect Pte. Ltd. (Privacy-OpenPlatform@alipay.com) | Singapore | Payment amount (KRW and foreign currency), payment date and time, approval date and time, items purchased, merchant name, country of payment, user management ID | Alipay+ Provision of payment services | 5 years after payment is completed | Contact Customer Center |
ION Group (Sub-processor of Argos Identity Korea Co., Ltd., info@argosidentity.com) | United Kingdom | Name, date of birth, nationality, gender | Watch List Filtering Database screening
| Deleted after processing and not retained. | Contact Customer Center |
AWS (Sub-processor of Argos Identity Korea Co., Ltd., info@argosidentity.com) | United States | Name, date of birth, nationality, copy of ID document, copy of face photo, document number, identification number, email, address, IP address, encrypted identifier (DI) | Operation of service infrastructure, including data hosting, encryption, processing, queries, and data storage | Until the contract period ends | Contact Customer Center |
Google LLC (Sub-processor of Argos Identity Korea Co., Ltd., info@argosidentity.com) | United States | Copy of ID document, name (Chinese characters → English), address | Validation of images and text, translation of names in certain languages into English, and validation of address information based on map data | Deleted after processing and not retained. | Contact Customer Center |
OpenAI LLC (Sub-processor of Argos Identity Korea Co., Ltd., info@argosidentity.com) | United States | Name, date of birth, nationality, gender | Interpretation and validation of the information provided and conversion into standard data (not used for model training) | Deleted after processing and not retained. | Contact Customer Center |
You have the right to refuse consent. However, as this is required to use the service, use of the service may be restricted if you refuse. If you do not want your information transferred overseas, you may request withdrawal of consent through the Customer Center.
Article 15 (Changes to the Privacy Policy)
① This Privacy Policy applies from the effective date below. If any content is added, deleted, or modified due to changes in laws, policies, or security technology, the Company will give prior notice through a Company announcement before implementation.
Effective Date: October 15, 2026
② Previous versions of the Privacy Policy can be found below.
- Privacy Policy (effective December 18, 2020)