Privacy Policy

i-Aurora Co., Ltd. (the "Company") complies with applicable laws and regulations, including the Personal Information Protection Act, the Electronic Financial Transactions Act, the Act on the Protection, Use, etc. of Location Information, and the Act on Reporting and Using Specified Financial Transaction Information, and protects users' personal information. Accordingly, the Company establishes and discloses this Privacy Policy as follows so that related grievances can be handled promptly and smoothly.

(The Privacy Policy of i-Aurora Co., Ltd. contains the following:

Article 1 (Purposes of Processing and Items of Personal Information Collected)

Article 2 (Processing and Retention Period of Personal Information)

Article 3 (Entrustment of Personal Information Processing)

Article 4 (Provision of Personal Information to Third Parties)

Article 5 (Retention and Use Period of Personal Information)

Article 6 (Procedures and Methods for Destruction of Personal Information)

Article 7 (Rights and Obligations of Users and Legal Representatives and How to Exercise Them)

Article 8 (Installation, Operation, and Refusal of Devices that Automatically Collect Personal Information)

Article 9 (Mobile App Access Permissions)

Article 10 (Measures to Ensure the Security of Personal Information)

Article 11 (Chief Privacy Officer)

Article 12 (Processing of Personal Location Information)

Article 13 (Processing of Pseudonymized Information)

Article 14 (Overseas Transfer of Personal Information)

Article 15 (Changes to the Privacy Policy)

Article 1 (Purposes of Processing and Items of Personal Information Collected)

The Company collects and uses the minimum personal information necessary to provide the service, as set out below. The Company processes personal information on the basis of Article 15(1)1 (performance of a contract) and Article 15(1)2 (compliance with legal obligations) of the Personal Information Protection Act. Required information is information needed to perform the essential functions of the relevant service, and optional information is additionally collected to provide more specialized services (use of the service is not restricted even if optional information is not entered). The Company does not collect personal information from children under the age of 14.

① Items of Personal Information Collected and Used

② Methods of Collecting Personal Information

Provided directly by users through the application, collected through automatic collection devices during service use, and provided by partner companies

Article 2 (Processing and Retention Period of Personal Information)

The Company processes and retains personal information within the processing and retention period consented to by users at the time of collection.

① User management and service provision

User identification for concluding, performing, and terminating service contracts; issuance, top-up, payment, and refund of the NAMANE Card; retention of records for service-related consultations, handling complaints, and resolving disputes; delivery of notices such as service changes; prevention of fraudulent or unauthorized use of the service; processing of income tax deduction applications (including providing data to the National Tax Service's Year-End Tax Settlement Simplified Service); card receipt confirmation, card registration, and usage guidance; processing of open banking and firm banking services; performance of customer due diligence obligations under the Act on Reporting and Using Specified Financial Transaction Information; statistics and analysis, pseudonymization and anonymization, provision of personalized services, and service research and improvement

② Use for new service development and marketing/advertising

Development of new services and provision of customized services through collection of service usage statistics, etc.; delivery of advertising information such as events and provision of opportunities to participate (only where separate consent has been obtained)

Article 3 (Entrustment of Personal Information Processing)

The Company entrusts some of the work necessary to provide services to users to external companies.

① Entrustment Status

Payment · Settlement

Top-up

Authentication · Identity Verification

Benefits

Notifications · CS

Infrastructure · Security

② Management and Supervision of Trustees

When entering into an entrustment agreement, the Company includes in the agreement, in accordance with Article 26 of the Personal Information Protection Act, provisions on the prohibition of processing personal information for purposes other than the performance of the entrusted work, technical and managerial safeguards, restrictions on sub-entrustment, management and supervision of the trustee, and liability for damages, and supervises whether the trustee processes personal information securely.

③ Disclosure of Changes

If the details of the entrusted work or the trustee change, the Company will disclose the change without delay through this Privacy Policy.

Article 4 (Provision of Personal Information to Third Parties)

① In principle, the Company processes users' personal information only within the scope notified in Article 2, and does not use it beyond that scope or provide it to third parties without the user's prior consent.

However, in the following cases, the Company may use personal information for purposes other than the original purpose or provide it to third parties, except where doing so is likely to unfairly infringe on the interests of the customer or a third party. Matters related to the provision of information to third parties will be separately notified, and consent will be obtained, during the course of using the service.

a. Where the customer has consented in advance to provision to and disclosure to third parties

b. Where special provisions exist in other laws

c. Where the customer or their legal representative is unable to express their intention, or prior consent cannot be obtained because the address is unknown, etc., and the provision is clearly deemed necessary to protect the urgent life, physical, or property interests of the customer or a third party

d. Where necessary for purposes such as compiling statistics or academic research, and personal information is provided in a form in which a specific individual cannot be identified

e. Where the Company provides, within the scope of the purpose of collection, personal information that it inevitably collected to comply with legal obligations

② The Company may provide personal information to relevant authorities without the consent of the data subject, as follows.

Article 5 (Retention and Use Period of Personal Information)

In principle, the Company destroys personal information without delay once the purposes of collection and use consented to by the user have been achieved. However, where retention is necessary under internal policy or applicable laws and regulations, the information is retained for a certain period as set out below.

① Information Retained Under Internal Policy

② Information Retained Under Applicable Laws

Article 6 (Procedures and Methods for Destruction of Personal Information)

① Destruction Procedures

The Company destroys personal information without delay when it is no longer necessary, such as when the retention period has expired or the purpose of processing has been achieved. Where personal information must continue to be retained under other laws, it is moved to a separate database (DB) or stored in a different location.

② Destruction Methods

Personal information recorded or stored in paper documents is destroyed by shredding or incineration. Personal information recorded or stored in electronic files is deleted using technical methods that make the records unrecoverable.

Article 7 (Rights and Obligations of Users and Legal Representatives and How to Exercise Them)

① Types of Rights

Users may exercise the following rights against the Company at any time.

•    Request to access personal information

•    Request to correct or delete personal information

•    Request to suspend processing of personal information

•    Request to transmit personal information (Article 35-2 of the Personal Information Protection Act)

•    Request to refuse or obtain an explanation of automated decisions (Article 37-2 of the Personal Information Protection Act)

② How Users Exercise Their Rights

Customer Center: 1:1 chat inquiry or phone inquiry, or a direct request to the Chief Privacy Officer in writing or by email

③ Legal Representatives, etc.

Requests to access, etc. personal information of children under the age of 14 must be made directly by their legal representative. Users who are minors aged 14 or older may exercise their rights themselves or through their legal representative.

④ Processing and Grounds for Refusal

The Company handles users' requests without delay. However, in the following cases, the Company may notify the user of the reason and refuse a request to suspend processing, etc.: where special provisions exist in law or it is unavoidable to comply with legal obligations; or where there is a risk of harming another person's life or body, or of unfairly infringing on another person's property or other interests.

Article 8 (Installation, Operation, and Refusal of Devices that Automatically Collect Personal Information)

① Use of Cookies

The Company uses 'cookies', which store usage information and retrieve it from time to time, to provide users with individually customized services. Cookies are small amounts of information sent by the server operating the website to the user's browser and are stored on the user's computer or mobile device.

② Purpose of Using Cookies

Cookies are used to provide personalized services, such as analyzing users' access frequency and visit times, identifying user preferences and interests, and tracking participation in events.

③ How to Refuse Cookies

Users can allow or block cookies through their web browser's option settings. However, if users refuse to store cookies, use of some services may be restricted.

Article 9 (Mobile App Access Permissions)

① Permissions Requested

The Company may request the following access permissions on users' mobile devices to provide the service.

② Required Permissions

Required permissions are permissions essential to provide the basic functions of the service. If you do not consent, use of the relevant service may be restricted.

③ Optional Permissions

You may use the basic service without restriction even if you do not consent to optional permissions.

④ How to Withdraw or Change

Android: Phone Settings → Apps → NAMANE → Permissions

iOS: Settings → Apps → NAMANE → Permissions

Article 10 (Measures to Ensure the Security of Personal Information)

In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following measures to ensure the security of personal information.

Article 11 (Chief Privacy Officer)

The Company designates a Chief Privacy Officer, as set out below, to oversee personal information processing and to handle user complaints and provide remedies for damages related to personal information.

If you need to report or seek advice on a personal information infringement, you may contact the following organizations.

Article 12 (Processing of Personal Location Information)

① Basis for Processing

The Company processes users' personal location information to provide location-based services, and obtains consent after specifying the relevant details in its terms and conditions in advance.

② Purposes of Processing Personal Location Information

Checking and guiding to nearby merchant locations, and providing location-based customized services

③ Retention and Destruction

The Company retains personal location information until the purpose of use or provision has been achieved, and destroys it without delay once the purpose has been achieved. However, in accordance with Article 16 of the Act on the Protection, Use, etc. of Location Information, records confirming the collection, use, and provision of location information are kept for at least 6 months.

④ Provision to Third Parties

The Company does not provide personal location information to third parties without the user's prior consent.

Article 13 (Processing of Pseudonymized Information)

① Definition of Pseudonymized Information

Pseudonymized information means information processed, by methods such as deleting part of the personal information or replacing part or all of it, so that a specific individual cannot be identified without additional information.

② Purposes of Processing

The Company may pseudonymize and use personal information for the purposes of compiling statistics, scientific research, and archiving in the public interest.

③ Security Measures

④ Prohibition of Re-identification

The Company does not use pseudonymized information for the purpose of re-identification, and if re-identification occurs, destroys the information immediately.

Article 14 (Overseas Transfer of Personal Information)

The Company transfers personal information collected from users overseas as set out below and, pursuant to Article 28-8(2) of the Personal Information Protection Act , provides the following information on the overseas transfer.

You have the right to refuse consent. However, as this is required to use the service, use of the service may be restricted if you refuse. If you do not want your information transferred overseas, you may request withdrawal of consent through the Customer Center.

Article 15 (Changes to the Privacy Policy)

① This Privacy Policy applies from the effective date below. If any content is added, deleted, or modified due to changes in laws, policies, or security technology, the Company will give prior notice through a Company announcement before implementation. 

Effective Date: October 15, 2026

② Previous versions of the Privacy Policy can be found below. 

• Privacy Policy (effective December 18, 2020)