Privacy Policy

As a B2B service provider, the Company’s legal role is clearly distinguished as follows, depending on the type of personal information it processes. This distinction is the most important consideration when interpreting this Policy.

In case (b), the obligations of a controller, including obtaining consent to the collection and use of personal information, responding to the rights of data subjects and determining the purposes of use, are borne by the Member. The Company processes such information only within the scope of the Service Agreement and the outsourcing terms agreed with the Member, and does not use it for its own purposes without the Member’s express instructions or a requirement of law. End customers should first direct any requests concerning the processing of their personal information to the relevant Member (business).

The personal information of Members (businesses) that the Company collects directly as a controller is as follows.

The Company collects personal information by the following methods.

1. Entered or provided directly by Members in the course of registration, contracting, use of the Service and customer support enquiries
2. Collected automatically through cookies, log analysis tools and similar means in the course of using the Service
3. Returned by Third-Party Services, such as payment service providers, as the results of payment processing

Information of type (b), namely information about Members’ end customers, is processed solely as a result of Members entering or uploading it into the Service, and the Company does not collect it directly from the data subjects.

The Company uses the personal information of Members (businesses) within the scope of the following purposes.

1. Provision of the Service and performance of the agreement: account creation and authentication, provision of core functions such as bookings, POS and payments, and billing and settlement
2. Customer support: handling enquiries and complaints, and delivering announcements and essential operational notices
3. Service improvement and analysis: developing new features and improving usability and stability through de-identified and aggregated processing
4. Security and prevention of misuse: access control, detection of abnormal activity, and dispute response
5. Marketing (with consent): information about new services and events. Members may withdraw their consent to receive such information at any time.
6. Compliance with legal obligations: record retention and reporting required under applicable laws

To provide the Service smoothly, the Company outsources personal information processing tasks to specialist external providers as set out below. Through outsourcing agreements, the Company manages and supervises its service providers to ensure that they process personal information securely.

The actual list of service providers may change depending on how the Service is operated, and any changes will be published through this Policy. With respect to the outsourced processing of end customer information entered by Members, the Company, as a processor for the Member (the controller), may sub-outsource processing to the infrastructure providers listed above and others, on the terms of the Service Agreement with the Member.

1. The Company does not provide Members’ personal information to third parties except with the Member’s consent or where specifically provided for by law.
2. Where there is a lawful request from an investigative or supervisory authority under the law, the Company may provide personal information in accordance with the procedures and within the scope prescribed by applicable laws.
3. Where personal information is transferred as a result of a business transfer, merger or similar event, the Company will give prior notice of that fact in accordance with applicable laws and take measures to protect the rights of data subjects.

1. Because the Company has its place of business in Australia and uses cloud infrastructure and Third-Party Services, personal information may be transferred to, stored in and processed in Australia, the Republic of Korea, the United States, or any other country in which the servers of the relevant Third-Party Services are located.
2. When transferring personal information overseas, the Company takes reasonable contractual and technical measures to ensure the level of protection required by applicable laws (including the Australian APPs and the Personal Information Protection Act of Korea).
3. Data subjects may enquire about the specific details of an overseas transfer (such as the recipient, the destination country and the purpose of the transfer) using the contact details in Article 12.

1. As a general principle, the Company destroys personal information without delay once the purposes of its collection and use have been achieved or the Member has withdrawn from the Service.
2. However, where retention is required under applicable laws (such as laws relating to electronic commerce, taxation and accounting), the Company retains the relevant information separately for the period prescribed by those laws (for example, payment and transaction records are retained for the period prescribed by the applicable laws).
3. End customer data entered by a Member is retained after the Service Agreement ends until the expiry of the grace period set by the Company (for example, 30 days) so that the Member can back it up, and is then destroyed, except where retention is required by law.
4. Information in electronic file form is deleted using technical methods that make recovery impossible, and printed materials are destroyed by shredding or incineration.

1. Members (as data subjects) may request access to, correction or deletion of, or suspension of the processing of their personal information, and may withdraw their consent. This includes the rights to request access and correction under the Australian APPs and the Personal Information Protection Act of Korea.
2. These rights may be exercised through the settings menu within the Service or by contacting the Privacy Officer using the contact details in Article 12, and the Company will act within the period prescribed by applicable laws.
3. Members may withdraw their consent to receive marketing information at any time, after which the sending of information for marketing purposes will cease.
4. If an end customer wishes to exercise rights in relation to their personal information (information entered by a Member), they must make the request to the relevant Member (business), which is the controller. If the Company receives such a request directly, it will forward the request to the relevant Member and handle it in accordance with the Member’s instructions.
5. Data subjects may lodge a complaint or apply for dispute resolution concerning the processing of personal information with a supervisory authority (for example, the Office of the Australian Information Commissioner (OAIC) or the Personal Information Protection Commission of the Republic of Korea).

1. The Company uses cookies, similar technologies and access logs to provide the Service and to analyse its use.
2. Cookies are used for purposes such as keeping users signed in, storing user preferences and analysing Service usage statistics.
3. Data subjects may refuse or delete cookies through their browser settings; however, in that case the use of some Service functions may be limited.

The Company implements the following security measures to ensure that personal information is processed securely.

1. Technical safeguards, including encryption in transit and at rest
2. Minimisation and control of access rights to personal information, and retention and review of access records
3. System security management, including the installation and updating of security software and intrusion detection and prevention
4. Training for personnel who handle personal information, and the establishment and implementation of internal management policies
5. Physical access controls and the use of the security certifications of external infrastructure providers

1. The Service is a B2B service intended for businesses, and the Company does not aim to collect directly the personal information of children under the age of 14 (or such other age as is prescribed by the laws of the relevant jurisdiction).
2. Where a Member processes, through the Service, the personal information of end customers who are children, the Member, as the controller, is responsible for complying with the procedures required by applicable laws, such as obtaining the consent of a legal guardian.

The Company has designated a Privacy Officer to oversee matters relating to the processing of personal information and to handle enquiries and complaints from data subjects.

1. This Policy is based on the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) of Australia, where the Company has its place of business, and has also been prepared having regard to the privacy laws of other applicable jurisdictions, including the Personal Information Protection Act of Korea.
2. Where two or more laws apply to a particular transaction or data subject, the Company endeavours, to a reasonable extent, to apply whichever of the levels of protection prescribed by the respective mandatory laws is more favourable to the data subject.
3. If this Policy conflicts with an individual Service Agreement or the data processing terms agreed with a Member, the relevant Service Agreement prevails in respect of the Member’s end customer information (the processor domain).

1. This Policy may be amended in response to changes in laws, policies or the Service.
2. If the Company changes this Policy, it will give prior notice of the changes and their effective date through an announcement within the Service, by email or by other means.
3. In the case of material changes (such as substantive changes to the information collected, the purposes of use or the provision of information to third parties), the Company will give notice with a reasonable advance notice period and, where necessary, obtain separate consent.
4. This English version is provided for convenience. In the event of any inconsistency between the Korean and English versions, the Korean version shall prevail.