Privacy Policy

Dunamu Inc. Upbit Privacy Policy

Dunamu Inc. (hereinafter referred to as the “Company”) considers the protection of the personal information of users very important and is doing its best to protect the personal information provided by users to the Company in order to use the Company's services (digital asset trading services and related services, hereinafter referred to as the “Service”). The Company duly processes and safely manages users' personal information in accordance with the "Personal Information Protection Act" and other related laws and regulations. Accordingly, pursuant to Article 30 of the Personal Information Protection Act, the Company hereby establishes and discloses this Privacy Policy to inform users of the procedures and standards for the processing and protection of personal information and to ensure that complaints related thereto are handled promptly and efficiently.

The Company continuously makes this Privacy Policy available on the first screen of its website so that users can easily check the processing procedures and standards for personal information at any time.

This Privacy Policy may be changed in accordance with applicable laws and regulations and the Company's internal policies, and any changes will be managed through version control for easy reference.

Article 1 (Purpose for Processing Personal Information)
Article 2 (Items of Personal Information Being Processed)
Article 3 (Processing and Retention Period of Personal Information)
Article 4 (Destruction of Personal Information)
Article 5 (Provision of Personal Information to Third Parties)
Article 6 (Criteria for additional use or provision)
Article 7 (Outsourcing of Personal Information Processing)
Article 8 (Transfer of Personal Information to Overseas Parties)
Article 9 (Measures for Ensuring the Security of Personal Information)
Article 10 (Installation, Operation, and Rejection of Automatic Collection Devices for Personal Information )
Article 11 (Management of Connecting Information)
Article 12 (Rights and Obligations of Users and Legal Representatives and Their Exercise Methods)
Article 13 (Personal Information Protection Manager and Department in Charge)
Article 14 (Department for Processing Requests for Access to Personal Information )
Article 15 (Remedies for Infringement of Rights)
Article 16 (Responsibility for Linked Sites)
Article 17 (Changes to the Privacy Policy)

Article 1 (Purpose for Processing Personal Information)

The Company processes users’ personal information for the following purposes. The processed personal information is not used for purposes other than the following, and if the purpose of use is changed, necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act, will be taken.

1. Account Registration and Management: - Verification and identification of users, customer verification (KYC), modification and management of user information, and delivery of various notifications and notices
2. Provision of Goods or Services: - Confirmation of digital asset trading relationships; - Management and provision of services, including setting, maintaining, and terminating digital asset trading relationships; - Prevention of unauthorized use and provision of secure services; - Usage statistics and analysis, provision of new and customized services
3. Complaint Handling: - Confirmation of the identity of complainants and the contents of complaints; - Contact and notification for fact-finding, notification of processing results; - Remedies for damages and handling of complaints
4. Provision of Events and Promotions: - Provision of event and promotion details, benefits and opportunities for participation; - Event participation, prize distribution and related guidance; - Marketing activities based on demographic characteristics, user service usage records, and analysis

Article 2 (Items of Personal Information Being Processed)

The Company collects and uses personal information within the minimum scope necessary to achieve the purpose of processing.

1. Items of Personal Information Processed with User Consent

The Company, with the consent of users pursuant to Article 15, Paragraph 1, Subparagraph 1 and and Article 24, Paragraph 1, Subparagraph 1 of the Personal Information Protection, collects and uses the minimum necessary personal information for the establishment, maintenance, execution, and management of digital asset transactions and the provision of services as follows. Even in cases where personal information is processed for the establishment, maintenance, performance, and management of Digital Asset transactions and the provision of services under Article 15, Paragraph 1, Subparagraph 4 of the Personal Information Protection Act, or for the fulfillment of statutory obligations under Article 15, Paragraph 1, Subparagraph 2 of the Personal Information Protection Act, the Company operates a procedure to obtain prior consent to inform users of the processing of personal information in detail.

Category		Legal Basis	Collected and Used Items
Account Registration and Management	Registration	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	[Individual] Upbit Nickname [Corporation] Email, Password, Nationality
	Upbit Login	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	Name, Mobile Phone Number, Date and Year of Birth, Gender, Resident/Non-resident Information, Telecommunication Company, Verification Information (CI, DI), Names of financial institutions , Account Number, PIN Password (*Names of financial institutions, account numbers, and PINs are processed solely for validation purposes and are not stored separately by the Company.)
	Delivery of various notifications and notices related to the Service	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	Mobile Phone Number, Email
	Mobile Phone Authentication	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	Name, Mobile Phone Number, Date and Year of Birth, Gender, Resident/Non-Resident Information, Telecommunication Company, Verification Information (CI, DI)
	If Using Biometric Authentication	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	[Optional] Fingerprint Information, Facial Information (**Only the result obtained by comparing the information with the data registered on the device is used, without being transmitted/stored on a separate server. Users can control the use of this feature with the on/off option.)
Provision of Goods or Services	Individual Customer Verification	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)2 (Fulfillment of statutory obligations or as provided for by law)	Name (Korean/English), Address, Nationality, Email, Occupation, Workplace Information (Company Name, Address), Transaction Purpose, Source of Funds
		Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)2 (Fulfillment of statutory obligations or as provided for by law), 24-2(1)1 (Processing of resident registration numbers)	[Identification Card Verification] (Korean) Copy of Identification Card, Name, Resident Registration Number, Driver's License Number with Secured Serial Number, Vaild through(expriation date) and Issuance Date (Foreigner) Copy of Identification Card, Name, Alien Registration Number, Issuance date, Serial Number, Expiration Date of Stay, Proof of Stay
		Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract)	[Account Verification] Name of Financial Institution, Account Number
	USDT Deposits and Withdrawals	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4(Performance of a contract)	[Real-Name Deposit-Withdrawal Account Verification] Name of Financial Institution, Account Number [Processing of USDT Deposits and Withdrawals] Name, Date and Year of Birth, Gender, CI(Connecting information), Mobile Phone Number, Account Number, Deposit and withdrawal information
	Corporate Verification	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)2 (Fulfillment of statutory obligations or as provided for by law), 24(1) 1(Processing of unique identification information) and 24-2(1)1 (Processing of resident registration numbers)	[Representative Information] (Common) Name (Korean/English), Nationality, Date of Birth, Gender, Phone Number, Mobile Phone Number, Real-Name Verification Number, Address, Email, Occupation, Copy of Identification Card, (for Foreigners) Certificate of Residence or Permanent Resident Card in Korea [Agent Information] Name (Korean/English), Verification Number, Copy of Identification Card, Nationality, Residence Status, Address, Mobile Phone Number, Email, Company Name, Occupation, Workplace Address, Relationship with the Transaction Party, Purpose of Transaction, Source and Origin of Transaction Funds [OTP Receiving Device Owner Information] Name, Mobile phone Number, Proof of Mobile Phone Contract, Proof of Employment. [Login Information] ID (Email Address), Password [Security Settings] Security Password
	Digital Asset Transactions	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	Digital Asset Transactions Information, such as Trading Date, Quantity, Type, Asset Name, Deposit/Withdrawal Records and wallet address,etc.
	Issuance of Cash Receipt	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Mobile Phone Number, Business Registration Number
	Registration of Personal Wallet Address	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	Personal Digital Asset Address
	Open Api service	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	[IP Address registration] IP Address [Withdrawal Whitelist Address Registration] Digital Asset Exchange, Withdrawal Whitelist Address, Withdrawal Network, Digital Asset, Recipient Information
	Digital Asset Deposit Request	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	TXID, Name of the Sending Exchange, Screenshot of an account information on the Sending Exchange, withdrawal history showing the transaction details
	Lending	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	Name, nickname, date of birth, mobile phone number, address, information on the Digital Assets requested for lending, collateral information, lending-to-value-ratio, repayment and liquidation details, information regarding the conclusion of lending and pledge agreements, Usage records of Digital Assets transactions and Lending services
	Upbit Trading League and Other Trading Competitions	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	[Trading League] Upbit Nickname, gender, Participation and operation information of Upbit Trading League(Investment Report & Portfolio of Digital Asset Transactions, Participating League information, League ranking& dashboard, Service statistics) [Investment Champions League] mobile phone number, Digital Asset Transactions Information, including the transaction date, Asset Name and transaction amount [TOP Trading Event] Masked nickname, mobile phone number, Digital Asset Transactions Information, including the transaction date, Asset Name and transaction amount, Leaderboard information
	Investment Note	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	Member Number, Investment Note
	NFT Service	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	[Usage of NFT Service] Nickname, NFT Transaction History (**To verify transactions and activity history within the service, due to the nature of NFT digital assets) [Registration of NFT Personal Wallet Address] Personal Digital Asset Address, NFT Information held within Personal Digital Asset Address
Provision of Events and Promotions	Participate in the event	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	[To participate in NFT event] Mobile Phone Number
	Conducting of Events and Promotions	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	[Optional] Name, Mobile phone number, Email, information for user statistics analysis (gender, residential area, age group), access logs and service usage records (Device Information, KYC compliance status, linking of USDT deposit and withdrawal accounts, digital asset trading status, digital asset balances, period returns, trading types)
	Event Winning	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract)	Name, Mobile Phone Number, [When providing physical prizes] Address [When Paying Taxes] Copy of Identification Card (**The items collected and used may vary depending on the event being held, and consent is obtained for the items collected and used for each event.)
Handling of Complaints	Inheritance	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract)	[Decedent] Name, Date of Birth, Address, Certificate of Family Relations, Death Certificate [Heir] Name, Date of Birth, Address, Contact Information, Relationship with the Decedent, Copy of Identification Card, Unique Identification Number, Upbit Account Information (If a Representative is Appointed) Certificate of Personal Seal Impression (If the Heir is a Minor) Certificate of Identification
	Inquiry into inherited assets	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	[Decedent] Name, Date of Birth, Resident registration number, Mobile phone number, Certificate of Family Relations, Death certificate or Certificate of Identification [Heir] Name, Mobile Phone Number, Relationship with the Decedent, Copy of Identification Card
	Transfer	Personal Information Protection Act Art.15(1)1 (Consent of information subject) and (1)4 (Performance of a contract)	[Transferor] Name, Date and Year of Birth, Address, Mobile Phone Number, , Nickname, Copy of Identification Card, Documentary Evidence of Mobile Phone Usage, Documentary Evidence of Inability to Log In [Transferee] Name, Date and Year of Birth, Address,Nickname, Copy of Identification Card [Agent] Name, Date and Year of Birth, Address, Mobile Phone Number, Power of Attorney
	Compensation	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract)	Time of the Incident, Trading Market, Digital Asset Involved in the Trade, Type of System Failure, Detailed Description of the Issue, Requested Compensation Amount and Justification, Supporting Documents or Evidence
	Procedures under the Special Act on the Prevention of Loss Caused by Telecommunications-Based Financial Fraud and Refund for Loss and procedures related to other forms of phishing frau	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	[Application for Remedy for Loss] Name, date of birth, address, telephone number, mobile phone number, email, details of and grounds for the application for a remedy for loss, supporting evidence substantiating the loss, confirmation document of loss report issued by an investigation agency, copy of identification card, and personally identifiable information (resident registration number, driver's license number, alien registration number, and passport number) [Objection] Name, date of birth, address, telephone number, mobile phone number, email, details of the account subject to suspension of payment and grounds for the objection, documents proving that the relevant account has not been exploited for fraud, and a copy of identification card (with the driver's license number, alien registration number, and the latter part of the resident registration number masked) [Objection– other forms of phishing fraud] Name, date of birth, address, contact information (telephone number and mobile phone number), email, transaction suspension report reference number, details of the objection submitted at the time of filing, and supporting documents [Withdrawal of Application for Remedy for Loss] Name, date of birth, address, telephone number, mobile phone number, email, details of and grounds for the withdrawal request, and a copy of identification card (with the driver's license number, alien registration number, and the latter part of the resident registration number masked) [Application for Change of Information] Name, date of birth, address, mobile phone number, details of the requested changes, details of the information before and after the change, and a copy of identification card (with the driver's license number, alien registration number, and the latter part of the resident registration number masked) [Return of Funds] Name, date of birth, address, and contact information [Request for Transaction Termination (Account Closure) – other forms of phishing fraud] Name, date of birth, address, contact information (telephone number and mobile phone number), email, transaction suspension report reference number, and details of and grounds for the request submitted when requesting transaction termination (account closure) [Notification of Completion of Customer Due Diligence – other forms of phishing fraud] Supporting documents necessary to verify the source of funds and purpose of the transaction for the performance of enhanced customer due diligence
	Trading Support-Related Fraud Reporting	Personal Information Protection Act Art.15(1)1 (Consent of information subject)	[Required] E-mail, Details of the Report [Optional] Name, Phone Number, Attachments
	Abnormal Transaction Reporting	Personal Information Protection Act Art.15(1)1 (Consent of information subject)	[Required] E-mail, Details of the Report, Attachments [Optional] Name, Phone Number
	Report of Multi-Level Marketing (MLM) Activities / Report of Abusive or Malicious User Behavior	Personal Information Protection Act Art.15(1)1 (Consent of information subject)	[Required] Detailed Description of the Report, [Optional] Supporting Evidence for the Report
	Report of Impersonation Involving Upbit Staff, Agents, or Representatives	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Detailed Description of the Report, Supporting Evidence for the Report
	Support for Asset Withdrawals for Members unable to complete KYC Verification	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Copy of Identification Card, Proof Photo to verify the Member's Identity, Mobile Phone Number, Email Address, Information about the Digital Asset to be withdrawn, Address of the Receiving Digital Asset and Proof of Ownership, Screenshot of the Receiving Exchange's Member Information Screen
	Releasing Suspension of Transactions Placed on Financial Fraud Accounts	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	- Name, Date of Birth, Address, Contact Information, Copy of Identification Card - Deposit/Withdrawal History that Confirms the Movement Path of the Affected Money (Transaction History with Financial Institutions, Account Number, Transaction History with other Digital Asset Exchanges) - Notice of Termination of Debt Extinction Proceedings or Confirmation of Facts related to Telecommunications Fraud - Evidence that can Prove the Source of the Affected Money (Objection Documents, Contracts, or Supporting Documentation such as Promissory Notes) - Court Enforcement Documents or Incident Fact Confirmation Documents to Prove the Fact of Damage - (If Cancellation of Damage Relief is Needed) Certificate of Personal Signature, Application for Cancellation of Damage Relief - (If a Representative is Appointed) Name, Date of Birth, Address, Contact Information, Document Showing the Relationship, Copy of Identification Card, Personal Seal Certificate, and Personal Seal
	Change of Member Information /Naturalization	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)4 (Performance of a contract)	Name after changing member information, Documents such as Resident Registration Abstract which may confirm changes in member information, Nickname of the Existing Account
	Certificate of Loss of Nationality for Foreigners	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Certificate of Loss of Nationality
	Proof of Purpose of Stay in Korea	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Certificate of Employment or Certificate of Enrollment, Certificate of Alien Registration or Certificate of Domestic Residence, Entry and Exit Management Certificate, Unique Identification Information Included in Each Document
	Certificate of Alien Registration	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Residency certificate or Certificate of Facts related to Entry and Exit
	Submission of Additional Documents for Customer Verification	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	- Purpose of Transaction, Source and Origin of Transaction Funds, Company Name, Address - The Following Documents Submitted by the User: - Health Insurance Eligibility Confirmation or Entry and Exit Fact Confirmation - Confirmation of Resident Registration Card Issuance Application - Resident Registration Certificate, Overseas Business Trip Certificate, Short-Term Study Abroad Certificate - Passport Copy - Unique Identification Information (Resident Registration Number, Driver's License Number, Passport Number, Alien Registration Number) - Additional Documents Required for Customer Verification (Certificate of Enrollment or Employment, Document to Confirm the Purpose of the Transaction and the Source of Funds, Documents Related to Workplace Information)
	Verification of the Source of Funds	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Deposit Date and Time, Type of Digital Assets deposited, Deposit TXID, Source of the Assets, Reason for the Deposit, Trading Plan for the deposited Digital Assets, Financial Institution Transaction Records, Records of Transactions on other Digital Asset Exchanges, Documents for proving Donation, Transfer, Inheritance, or other Relevant Transactions
	Submission of Supporting Documentation for Withdrawals	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Withdrawal Destination, Reason for Withdrawal, Materials that Can Confirm the Withdrawal Destination
	Withdrawal Suspension Objection	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Effective Date of the Withdrawal Suspension, Details of the Objection, Materials that Can Confirm the Withdrawal Destination and Reason for Withdrawal
	Additional submission for identity verification	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract)	Photo Identification that can verify the Member's Identity (including confirmation forms and ID cards; provided that for ID cards, the last seven digits of the Resident Registration Number (RRN) are masked)
	Digital Asset Return Application·Incorrect Deposit	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	[from Address return] Withdrawal Destination, TXID, Digital Asset Name and Quantity, from Address [Return to an alternative Wallet Address] TXID, Proof of Withdrawal, Digital Asset Name and Quantity, Receiving Exchange, Proof of Ownership of Digital Asset Address Used for Withdrawal, Return Digital Asset Address and Proof of Ownership, Proof of Mobile Service Subscription(if required) [Incorrect Deposit] Type of Incorrect Deposit, TXID, Digital Asset name and Quantity, Name of the Withdrawal Source (Exchange or Personal Wallet) [Consent to Return of Incorrect Deposit] TXID, Information Regarding Digital Assets Sent in Error [Fee Payment] Name of the Digital Asset, Fee Deposit Statement
	Submission of Supporting Documentation for Digital Asset Return	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	TXID, Additional Supporting Documents for a Previously Submitted Digital Asset Return Request
	Submission of Attachment(s)	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law) and (1)4 (Performance of a contract)	Additional Supporting Documents Related to a Previously Submitted Inquiry
	Registration of Digital Asset withdrawal address	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Name of Digital Asset, Digital Asset withdrawal address, Secondary address (if applicable), Type and name of deposit destination, Screen displaying the wallet address where the deposit destination is confirmed, Proof screen showing the confirmed deposit destination name
	For Lifting Self-Requested Withdrawal Suspension	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Call Recording for Self-Verification
	Inquiry Regarding Digital Asset Trading	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	[Required] Type of Digital Asset, Detailed Description of the Inquiry [Optional] Screenshots or Other Evidence Demonstrating the Occurrence of the Error or Service Disruption
	Request for Corporation Account Services	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Copy of Identification Card, Certificate of corporate seal
	Corporate Account Registration Inquiry	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Name of Business manager, Phone Number, and Email Address
	Inquiries Related to NFT Services	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Inquiries regarding NFT Drops / Marketplace / Deposits and Withdrawals, If necessary Attachments that may help verify or support the details of the inquiry
	Inquiries about NFT Collaboration	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	[Individual] Name, Exhibition History, Artist Statement, Website or SNS Address, Business manager’ Name, Business manager’ Email Address, Business manager’ Contact Information, Relationship with Original Copyright Holder, Sales Experience [Corporation] Corporate Name of Creator, Exhibition History, Website or SNS Address, Corporate Name of the Creator’s Business manager, Email Address and Contact Information of Business manager, Relationship with Original Copyright Holder, Sales Experience
Items Generated and Processed during the Service Usage Process	Service Usage	Personal Information Protection Act Art.15(1)1 (Consent of information subject), (1)2 (Fulfillment of statutory obligations or as provided for by law)	Member ID, Device Information (OS, Model Name, Telecommunication Company, Device ID assigned by the Company, Language Information, ADID, IDFA, IDFV), IP Address, Service Usage Record, Cookie

2. Items of Personal Information Processed without User Consent

The Company may collect personal information without the user’s consent if any of the grounds under Subparagraphs 2 through 7 of Article 15, Paragraph 1 of the Personal Information Protection Act are met, and may use such information within the scope of the purpose of collection.

Category	Legal basis	Collected and Used Items
Reporting and payment of taxes and public dues pursuant to the Income Tax Act, the Corporate Tax Act, the National Tax Collection Act, and other laws related to the collection and payment of taxes	Personal Information Protection Act Art. 15(1)2 (Fulfillment of statutory obligations or as provided for by law)	resident registration numbers and copies of identification cards
Information in self-certification forms pursuant to the Act on International Tax Adjustment	Personal Information Protection Act Art. 15(1)2 (Fulfillment of statutory obligations or as provided for by law)	Processing of information necessary for fulfillment the obligations of crypto-asset service providers pursuant to the Public Notice on the Implementation of the Automatic Exchange of Crypto-Asset Information under the Information Exchange Agreement issued by the Minister of Economy and Finance, which prescribes matters delegated under Article 36 of the Act on International Tax Adjustment and Article 76 (Name, nationality, residential address, tax residence jurisdiction, mobile phone number, taxpayer identification number (TIN), date of birth, place of birth, and supporting documentation)
Compliance with the Best Practice Guidelines for Advertising and Promotional Activities of Virtual Asset Service Providers (VASPs)	Personal Information Protection Act Art. 15(1)4 (Performance of a contract) and (1)6 (Legitimate interest)	Counterparty information regarding the provision of economic benefits pursuant to Article 19, Paragraph 2 and Article 22 of the Best Practice Guidelines for Advertising and Promotional Activities of Virtual Asset Service Providers (VASPs) (Amount of economic benefits provided by the Company, identification information of the counterparty; for non-members: date of birth and the last four digits of the mobile phone number)
Check for fraudulent Account re-Registration	Personal Information Protection Act Art. 15(1)4 (Performance of a contract)	Verification Information (CI)
Prevention of Financial Incidents	Personal Information Protection Act Art. 15(1)4 (Performance of a contract)	Detection and diagnostic information concerning financial fraud-related software programs, including remote control applications and malicious applications installed on mobile devices
Digital asset airdrops	Personal Information Protection Act Art. 15(1)4 (Performance of a contract)	Information on Digital asset holdings eligible for airdrops
Provision of physical-linked NFT	Personal Information Protection Act Art. 15(1)4 (Performance of a contract)	Eligibility information for physical-linked NFT drops (Information on the purchase or holding of the relevant NFT)
NFT Creator Registration	Personal Information Protection Act Art. 15(1)4 (Performance of a contract)	Social media (SNS)-related information of creators within the NFT service (Nickname, Profile URL)

Article 3 (Processing and Retention Period of Personal Information)

① The Company shall process and retain personal information within the period of time required by law for personal information processing and retention or within the period of processing and holding personal information agreed upon when collecting personal information from users.

② The period of time for processing and retention of each personal information is as follows:

1. Account Registration and Management : Deleted upon termination of a commercial transaction relationship, including Digital asset transactions. However, information that is required to be retained according to applicable laws will be preserved under Article 3, Paragraph 1. for 5 years from the account termination.

2. Provision of Goods or Services : Retained 5 years following termination of a commercial transaction relationship, including Digital asset transactions. However, information that is required to be retained according to applicable laws will be preserved under Article 3, Paragraph 1.

3. Provision of Event : until the end of the relevant event or the termination of a commercial transaction relationship, including Digital asset transactions.

4. Complaint Handling : Retained 5 years following termination of a commercial transaction relationship, including Digital asset transactions. However, information that is required to be retained according to applicable laws will be preserved under Article 3, Paragraph

③ The Company processes and retains personal information until the end of the relevant reasons in the case of the following Subparagraphs to fulfill statutory obligations. However, if the processing and retention periods specified in Paragraph 2 and this Paragraph are different, the longest period will be applied.

1. For the items in the following categories, until the end of the relevant period

Record	Relevant Laws	Retention Period
Digital asset transaction records View details >	Article 9 of Act On The Protection Of Virtual Asset Users	15 years
Record of Customer Verification (KYC)	Article 5-4 of Act on Reporting and Using Specified Financial Transaction Information	5 years
Information in self-certification forms pursuant to the Act on International Tax Adjustment	Article 36 of the Act on International Tax Adjustment	6 years
Record of Contract or Subscription Withdrawal	Article 6 of Act on Consumer Protection in Electronic Commerce, etc.	5 years
Record of Payment Settlement and Supply of Goods		5 years
Record of Consumer Complaints or Dispute Resolution		3 years
Login Record	Article 15-2 of Act on Protection of Communications Secrets	More than 3 months
Record of Payment of Taxes and Public Dues	Acts related to the collection and payment of taxes, such as Article 160 and Article 160-2 of the Income Tax Act, Article 116 of the Corporate Tax Act, Article 71 of the Value-Added Tax Act, and National Tax Collection Act, Article 85-3 of the Framework Act on National Taxes	5 years
Record of Processing Cash Receipts		5 years

2. If an investigation is ongoing due to a violation of applicable laws and regulations, the personal information will be stored until the end of the relevant investigation is concluded

3. If there is an outstanding debt or credit relationship arising out of use of the service, the personal information will be stored until the debt is settled

4. If there is an ongoing legal dispute between the user and the Company, the personal information will be stored until the dispute is officially resolved

Article 4 (Destruction of Personal Information)

① When personal information becomes unnecessary due to the passage of the retention period or the accomplishment of the processing purpose, the Company shall promptly destroy such personal information.

② In the case of personal information that must be retained under applicable laws despite the expiration of the retention period for personal information or the achievement of the processing purpose, the Company will move such personal information to a separate database or store it in a different location. Detailed information on the personal information retained according to applicable laws can be found in Article 3 (Processing and Retention Period of Personal Information).

③ The Company securely manages the personal information of a user who has been processed as a dormant user in accordance with the old Personal Information Protection Act.

④ The personal information for which a reason for destruction has occurred due to the passage of the retention period or the accomplishment of the processing purpose, shall be destroyed upon approval of the personal information protection manager or through automatic deletion by the system.

⑤ The method of personal information destruction is as follows.

1. Personal information stored in electronic form is permanently deleted to prevent playback of the record.

2. Personal information recorded or stored on paper documents is shredded or incinerated.

Article 5 (Provision of Personal Information to Third Parties)

① The Company handles users' personal information only within the scope specified in Article 1 of the Privacy Policy (Purpose for Processing Personal Information), and the Company provides personal information to the third parties only if it falls under Articles 17 (Provision of Personal Information) and 18 (Restrictions on the Use and Provision of Personal Information other than the Purpose) of the Personal Information Protection Act, such as consent of the information subject, special provisions of the law, or inevitable to comply with legal obligations.

② The Company provides the following personal information to third parties with prior consent from users. The recipient may be changed without any notice depending on the nature of the partnered service and the contract.

View details on the provision of personal information to third parties >

③ In accordance with Article 18, Paragraph 2, Subparagraph 2 of the Personal Information Protection Act, the Company may provide personal information to relevant agencies in order to fulfill legal obligations as follows, according to the procedures and methods prescribed by such statutes. The Company shall not disclose personal information beyond the scope permitted under the Personal Information Protection Act or other applicable laws. Moreover, the Company requests that the recipient agencies establish necessary measures under the Personal Information Protection Act.

View details on the provision of personal information to third parties according to law >

Article 6 (Criteria for additional use or provision)

① In the process of providing services, the company may use or provide personal information without the user's consent pursuant to Article 15 (3) and Article 17 (4) of the Personal Information Protection Act.

Recipient	Purpose of Provision	Provided Items	Retention Period
Courts or public agencies	Resolution of grievances or disputes arising from the use of the Service	Service usage records	In accordance with the provisions of the laws and regulations governing each respective agency

② When the Company further uses or provides personal information without the user's consent pursuant to paragraph 1, such processing shall be conducted in consideration of the following factors:

1. Whether it is reasonably related to the original purpose for which the personal information was collected;

2. Whether additional use or provision of personal information is foreseeable in light of the circumstances under which the personal information was collected and processing practices;

3. Whether additional use or provision of personal information does not unfairly infringe on the interests of the data subject;

4. Whether the measures required to ensure safety such as pseudonymization or encryption have been taken.

Article 7 (Outsourcing of Personal Information Processing)

① The Company outsources some of the necessary work for providing services to external companies. When the outsourced companies process personal information while performing the delegated tasks, management and supervision are implemented to ensure that personal information is processed safely in accordance with Article 26 of the Personal Information Protection Act.

② The personal information processing tasks that the Company has outsourced to external companies are as follows.

1. List of Personal Information Processing Consignment Companies (Domestic)

Consignment Company	Content of consignment
Dunamu Inc.CX Inc.	Customer consultation related to Upbit services
Amazon Web Services, Inc., Microsoft Corporation, Google LLC.	Storage of data for the provision of services and operation of services
Coocon Co., Ltd.	Verification of authenticity of identification cards, account ownership certification, issuance of cash receipts
Bonanza Factory Co., Ltd.	USDT deposit/withdrawal and account ownership certification, Transaction safety management
Linkhub Co., Ltd.	Issuance of cash receipts and tax invoices
NICE Information Service Co., Ltd.	Real-name verification, Mobile Phone Authentication, Account Ownership Certification
Danal Co., Ltd.	Mobile Phone Authentication
FutureWiz Co., Ltd.	Two-channel Additional Authentication and Verification
Naver Corp., KEB Hana Bank	Two-channel Additional Authentication and Verification
BizTalk Co., Ltd.	Agent for sending KakaoTalk message (Kakao)
KT Corp., LG Uplus Corp.	Sending SMS
BRIDGETEC	Customer Consultation Recording System Development and Maintenance
Kakao Corp.	Personal Information Processing and Gift Sending through KakaoTalk Plus Channel
Lambda256 Corp. (recommissioned by VerifyVASP Pte. Ltd.)	Linked data transfer in relation to digital asset deposit and withdrawal.
OpenSurvey Inc.	Use of survey service platform
HYOSUNGITX Co.,Ltd	Customer verification inspection tasks

View Details of Personal Information Processing Reconsignment Status

Consignment Company	Reconsignment Company	Content of reconsignment
Dunamu Inc.CX Inc.	Hyosung ITX Co. Ltd	Customer consultation related to Upbit services
Dunamu Inc.CX Inc.	Kakao Corp.	Mobile Voucher Operations
Bonanza Factory Co., Ltd.	Kakao Corp., Naver Corp., KEB Hana Bank	Two-channel additional authentication and identity verification
Bonanza Factory Co., Ltd.	Coocon Co., Ltd., Samsung SDS, Inc.	ARS phone authentication
NICE Information Service Co., Ltd.	Hecto financial Co., Ltd.	Account ownership certification
FutureWiz Co., Ltd.	Kakao Corp.	Two-channel Additional Authentication and Verification
BRIDGETEC	returnzero Inc.	STT Development and Maintenance
OpenSurvey Inc.	NHN Cloud Corp.	Sending Message

Article 8 (Transfer of Personal Information to Overseas Parties)

The Company transfers personal information overseas as follows.

1. Personal Information Processing Overseas Consignment Company

The Company, under Article 28-8, Paragraph 1, Subparagraph 3, Item a of the Personal Information Protection Act, entrusts the processing of and stores personal information duties through contracts with overseas companies to provide the services, and manages and supervises the foregoing so that the entrusted personal information for processing can be processed securely. Users may refuse the transfer of personal information through the customer center, but users who refuse may not use the services.

Consignment Company	Purpose of Consignment	Consignment Items	Country of Consignment, Contact	Date and Method of Consignment	Retention and Use Period
Amazon Web Services, Inc.	Data backup (storage) for uninterrupted service provision even in the event of disasters and accidents	Minimum data for service recovery (such as Account registration and management information, Customer verification information, USDT deposits and withdrawals information, Digital asset transactions information)	United States, Go to Contact	When using services, data is transferred over the network	15 years after withdrawal from membership
Twilio Inc.	Sending notification mails or SMS	Email, Mobile Phone Number, Nickname, Attachment	United States, privacy@twilio.com	When sending emails or SMS, data is transferred over the network	Email : 30 Days after email delivery SMS : 13 months after SMS delivery
Amplitude, Inc.	Collecting behavioral logs and performing statistical analysis	Member ID, Device Information (OS, Model Name, Language Information, IP Address, ADID, IDFA, IDFV, Telecommunication Company), Service Usage Records	United States, privacy@amplitude.com	When using services, data is transferred over the network	15 years after withdrawal from membership
Appsflyer Ltd.	Collecting behavioral logs and performing statistical analysis.	Member ID, Device Information (OS, Model Name, Language Information, Connection Network Type, IP Address, ADID, IDFA)	Ireland, Belgium, privacy@appsflyer.com	When using services, data is transferred over the network.	2 years
Braze, Inc.	Sending in-app messages	Member ID, Device Information (App version, Model Name, OS, Telecommunication Company)	United States, privacy@braze.com	When using services, data is transferred over the network.	Deleted upon the withdrawal of membership.
VerifyVASP Pte. Ltd.	Linked data transfer in relation to digital asset deposit and withdrawal	Sender/Recipient Name, Date of birth and Digital Asset Address, Digital Asset Name and Quantity	Singapore, corporate@verifyvasp.com	When making deposits or withdrawals of digital assets, the information is transmitted over the network	5 years
Chainalysis Inc.	Detection of abnormal transactions and management of transaction safety	Digital Asset Address	Germany, privacy@chainalysis.com	When making using services, Data is transferred over the network	5 years

2. Overseas companies receiving personal information

The Company provides the following personal information to third parties overseas with the prior consent of users in accordance with Article 28-8, Paragraph 1, Subparagraph 1 of the Personal Information Protection Act. In order to provide the services requested by the user, personal information must be necessarily transferred to overseas companies. If users do not want their personal information to be provided to an overseas company, they can refuse it through the customer center and, in this case, such users may not use the services. Overseas companies to which the transfer has been made may be changed without prior notice, depending on the characteristics of the partnered services and the contract.

View details on the receiving of personal information to the overseas >

Article 9 (Measures for Ensuring the Security of Personal Information)

The Company has implemented the following administrative, technical, and physical measures necessary for ensuring the security of personal information, in accordance with Article 29 of the Personal Information Protection Act.

1. Administrative measures: - Establishment of an internal management plan : The Company has established and implemented an internal management plan to ensure the secure management of personal information.; - Minimization and education of personal information handlers : The Company limits personal information handlers to the minimum necessary for job performance, and educates them on the importance of personal information protection.; - Operation of a dedicated personal information protection organization: The Company continuously performs tasks of inspecting the implementation status of measures to ensure the security of personal information in the personal information processing system through the operation of a dedicated personal information protection organization.
2. Technical measures: - Management of access rights to personal information processing systems: The Company grants, modifies, and revokes access rights to personal information processing systems to control access to personal information. The Company also uses intrusion prevention systems to control unauthorized access from external sources to the personal information processing systems.; - Encryption of personal information: The Company stores and manages personal information after encryption thereof, such as the user's unique identification information and bank account number, which are subject to encryption under the Personal Information Protection Act, using a secure encryption algorithm.; - Technical measures to prepare for hacking: The Company is doing its best to prevent the leakage or damage of user's personal information due to hacking, computer viruses, or other means. It backs up data in anticipation of damage to personal information, uses up-to-date virus protection software to prevent the leakage or damage of personal information or data, and uses encrypted communication to safely transmit personal information over the network.
3. Physical measures: - To prevent the leakage or damage of personal information, the Company installs personal information processing systems in areas that are secured against external access and has established and operates access control procedures.

Article 10 (Installation, Operation, and Rejection of Automatic Collection Devices for Personal Information)

① The Company uses ‘cookie,’ which store and retrieve user information, in order to provide more convenient services to users. Cookie is small amounts of information that websites send to customers' computer and Mobile.

② The Company uses cookies to support a faster web environment for users by storing their preferences. Furthermore, the Company utilizes service visit and usage records to provide optimized services and further enhance service quality.

③ The Company processes behavioral information, such as cookies, through automated collection systems without identifying individual users. The Company utilizes such behavioral information for service development and analysis, as well as to provide and enhance optimized services tailored to user behavior.

Items Collected	Collection Method	Purpose of Collection	Retention and Usage Period
User activity information, including web/app service visit records, search/click history, device information, and IP addresses	Automatically generated and stored through log analysis tools (Google Analytics) during service use	Improving service features, developing new products and services, statistical analysis, and provision of services based on behavioral information	Up to 26 months from the date of collection

④ Users have the right to choose whether to allow the installation of cookies and may, at any time, refuse to store cookies or adjust their settings through the methods provided below.

• Microsoft Edge : Click the ‘⋯’ (More options) icon at the top right corner of your web browser >New InPrivate window

• Chrome : Click the ‘⋮’(More options) icon at the top right corner of your web browser > New Incognito window

• Android Phone : Settings > Security and Privacy > Privacy > Other Privacy Settings > ADs > reset or Delete Advertising ID

• iPhone : Settings > Privacy > Tracking > Allow or disable apps to request tracking

- Guide to disabling Google Analytics

⑤ Users may contact the Company using the contact information provided below for any inquiries regarding behavioral information, the exercise of opt-out rights, or other related matters.

- Contacts : 1588-5682 (Support Center)

- Email : cs@upbit.com

Article 11 (Management of Connecting Information)

① The Company processes connecting information (referring to the CI among identity verification information) within the scope of the purpose consented to by the user, in accordance with Article 23-5, Paragraph 4 of Act on Promotion of Information and Communications Network Utilization and Information Protection. When obtaining consent from users regarding the processing of connection information, the Company shall do so in compliance with the Personal Information Protection Act.

② When processing connection information, the Company complies with the security measures stipulated in the Personal Information Protection Act and the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc.

Article 12 (Rights and Obligations of Users and Legal Representatives and Their Exercise Methods)

① Users have the right to access, correct, delete, or request the suspension of processing of their personal information or withdraw their consent to personal information processing from the Company at any time. However, such rights may be limited in accordance with the provisions of relevant laws, including Article 35, Paragraph 4, Article 36, Paragraph 1 proviso, and Article 37, Paragraph 2 proviso and 3 proviso of the Personal Information Protection Act.

② Users can exercise their rights by submitting a written request, email, fax, etc. as stipulated in Article 41, Paragraph1 of the Enforcement Decree of the Personal Information Protection Act, and the Company will take appropriate measures without a delay.

③ Users who appeal against a company’s response to their request for access, correction, deletion, or suspension of processing, or withdrawal of consent can raise an objection by the method referred to in Paragraph 2 within 10 days from the date of action.

④ Users may exercise their rights under Paragraph 1 through their legal representatives or authorized agents. In this case, they must submit a power of attorney in accordance with the form of Annex 11 of the “Regulation on Personal Information Processing Methods.”

⑤Where personal information is explicitly designated as a subject of collection under other applicable laws, a request for the correction or deletion of such information may not be accepted.

⑥ The Company confirms whether the requester for access, correction, deletion, or suspension of processing, or withdrawal of consent is the user or a legitimate representative of the user, before providing access or taking any requested actions.

⑦ Users can exercise their rights under this Article in reference to Article 15 (Department for Processing Requests for Access to Personal Information). The Company will strive to ensure that the exercise of users’ rights is processed promptly.

Article 13 (Personal Information Protection Manager and Department in Charge)

① The Company designates the following department and personal information protection manager to protect user's personal information and handle complaints related to personal information.

▶ Personal Information Protection Person-In-Charge: - Name : Jaeyong Jeong; - Position : Personal Information Protection Person-In-Charge; - Contact : 1588-5682 (Support Center); - Email : cs@upbit.com; - Department in charge : Personal Information Protection Team

▶ Personal Information Protection Manager: - Name : Jihye Choi; - Position : Personal Information Protection Manager; - Contact : 1588-5682 (Support Center); - Email : cs@upbit.com; - Department in charge : Personal Information Protection Team

② Any complaints related to the protection of personal information that arise while using the Company's services can be directed to the personal information protection person-in-charge or the relevant department. The Company will respond and handle the user's inquiry in a timely manner.

Article 14 (Department for Processing Requests for Access to Personal Information )

▶ Department for Processing Requests for Access to Personal Information: - Department in charge : Operation Support Team; - Contact : 1588-5682 (Support Center); - Email : cs@upbit.com

Article 15 (Remedies for Infringement of Rights)

If you need help with remedies or consultation regarding personal information infringement, you may contact the following organizations.

▶ Personal Information Infringement Report Center (operated by Korea Internet & Security Agency): - Website : privacy.kisa.or.kr; - Contact : 118 (without area code)

▶ Personal Information Dispute Mediation Committee: - Website : www.kopico.go.kr; - Contact : 1833-6972 (without area code)

▶ The Supreme Public Prosecutors’ Office: - Website : www.spo.go.kr; - Contact : 1301 (without area code)

▶ The Cyberbureau: - Website : ecrm.police.go.kr; - Contact : 182 (without area code)

Article 16 (Responsibility for Linked Sites)

The Company may provide links to external sites for users. In this case, the Company cannot guarantee or be responsible for the usefulness, truthfulness, or legality of the services or information provided by the external sites, as the Company has no control over them. The privacy policies of linked external sites are not related to the Company, so please check the policies of the relevant external site.

Article 17 (Changes to the Privacy Policy)

In the event that the Company changes its Privacy Policy, it will continually disclose the timing of the change and the changed contents, and will make the changed contents easily accessible to users by comparing the contents before and after the change.

<Supplementary Provisions>
This Privacy Policy V2.56 is effective as of October 6, 2026.
The previous Privacy Policy can be found below.

※ This English version of the Upbit Privacy Policy is a translation based on the original Korean version of the Upbit Privacy Policy. If there is any conflict between the original Korean version and this English version, the original Korean version of the Upbit Privacy Policy shall prevail.