Privacy Policy

Orange Square Co., Ltd. and our service platform www.wowpass.io (collectively “Orange Square” hereinafter), pursuant to the Article 30 of the Personal Information Protection Act, establish and publish our privacy policy as follows, in order to protect your personal data and efficiently respond to any inconveniences you may experience regarding our use of the information.

• This Policy will take effect from July 11, 2022.

Article 1. Purposes for using personal information
Your personal information will not be used for any other purposes than what is stated below. If any changes are made to this policy, we will ask for your consent pursuant to Article 18 of the Personal Information Protection Act. We use your personal information we obtain to:

1. manage membership for our unmanned kiosks and mobile applications;

As we provide membership services, we use your personal information to identify and authenticate you and send notifications.

2. handle complaints;

We may contact you to investigate what disturbed you and notify you of how we handled it.

3. provide goods and/or services;

We use your personal information to provide services (including customized services) and process payments.

4. provide advertisements; and

We use your personal information when we develop new services and products; to provide tailored services, notices on events, and advertisements; to offer services and show advertisements according to your demographic characteristics; and to analyze the frequency of visits and the service usage statistics.

5. ensure customer safety

We use your video information to prevent and investigate criminal activities, ensure the safety of our facilities, and prevent fire.

Article 2. Usage and Retention Period of personal information
① Orange Square uses and retains your personal information within the period allowed by legal authorities or by you.

② The usage and retention periods of personal information items categorized by their purposes are as follows:

1. Membership management for unmanned kiosks and mobile applications

We use and retain your personal information for 5 years from the date of consent to manage membership and provide services.
Grounds for retention: Records related to cancellation of contracts or subscriptions, etc.
Relevant laws: Records related to cancellation of contracts or subscriptions, etc.: 5 years

2. Handling of complaints

We use and retain your personal information for 3 years from the date of consent to address complaints.
Grounds for retention: Records related to resolution of consumer complaints or disputes
Relevant laws: Records related to resolution of consumer complaints or disputes: 3 years

3. Provision of goods and services

We use and retain your personal information for 5 years from the date of consent to provide our goods and services.
Grounds for retention: Records related to payment for and supply of goods, etc.
Relevant laws: Records related to payment for and supply of goods, etc.: 5 years

4. Marketing/Advertising

We use your personal information for marketing and advertising purposes for 6 months from the date of consent.
Grounds for retention: Records related to marks and advertisements
Relevant laws: Records related to marks and advertisements: 6 months

5. Video information

We use and retain your video information for 5 years from the date of consent.
Grounds for retention: Mandatory identification of customers (Article 4 of the Act on Reporting and Using Specified Financial Transaction Information)
Relevant laws: Mandatory identification of customers: 5 years

Article 3. Items of personal information to be collected
① Orange Square collects the following (by category):

1. Membership management for unmanned kiosks and mobile applications

Required: Passport number, name, nationality for unmanned kiosks; email, password for Mobile applications
Optional:

2. Handling of complaints

Required: Email
Optional: Records of service usage

3. Provision of goods and services

Required: Prepaid card information; passport number, name, nationality for unmanned kiosks
Optional: Records of service usage/payments, credit card information, name, payer's email

4. Marketing/advertising

Required: Gender, date of birth, payment history, nationality
Optional: Locations of customers

5. Video information

Required: Videos of customers using our services
Optional:

Article 4. Provision of personal information to third parties
① Orange Square handles personal information within the scope specified hereunder (Article 1). We provide personal information we collect to third parties only when such provision conforms with Article 17 and Article 18 of the Personal Information Protection Act, in which the content addresses consent from customers, certain legal regulations, etc.

② We inform you that we are providing personal information to the third party below.

1. Samsung Card

Information receiver: Samsung Card
The reason Samsung Card is provided with your information: to issue WOWPASS Cards, authorize transactions, and pay stores as an agent.
Items of personal information Samsung Card is provided with: payment history, 16-digit WOWPASS card number
Personal information usage and retention periods of the third party: Until you cancel the card or its contract with us ends.

2. SK Telecom

Information receiver: SK Telecom
The reason SK Telecom is provided with your information: to log prepaid SIM card reservation.
Items of personal information SK Telecom is provided with: reservation status, name, country, email
Personal information usage and retention periods of the third party: according to the third party's policy & legal requirement of South Korea

3. Eximbay, Inc.

Information receiver: Eximbay, Inc
The reason Eximbay is provided with your information: to process credit card payment for travel package reservation
Items of personal information Eximbay is provided with: payer's email address, preferred currency
Personal information usage and retention periods of the third party: according to the third party's policy & legal requirement of South Korea

Article 5. Entrustment of personal information processing
① Orange Square entrusts personal information processing tasks shown below for efficiency.

1. Issuance of WOWPASS cards, authorization of transactions, making payments to stores

Trustee: Samsung Card
What we are entrusting: issuance of WOWPASS cards, authorization of transactions, making payments to stores
Entrustment Period: Until you cancel the card or its contract with us ends.

② Orange Square stipulates in the contract, pursuant to the Article 26 of the Personal Information Protection Act, that we forbid the trustee from processing personal information for any other purposes, make sure the trustee takes measures for technological and managerial issues, restrict re-entrustment, supervise and manage the trustee, and pose damage liability, in order for the trustee to do its best for protecting personal information.

③ We will immediately inform you through this privacy policy if we happen to change the trustee or the tasks we are entrusting.

Article 6. How we remove your personal information

① Orange Square immediately removes personal information that has gone unneeded after meeting its purposes and its retention period has ended.

② When we must retain personal information pursuant to Article 2 Section 2 hereof, even though the retention period you have agreed upon has ended and the purposes of having such information are met, we will transfer your information specified in Article 3 Section 1 hereunder to a separate database.

③ Our personal information removal process and methods are as follows:
1. Removal process
We screen personal information that needs to be removed and remove it upon the approval of our person in charge of personal information protection.

2. Methods of removal

Digital files: We apply a technology that irrevocably destroys digital files.

Paper: We shred or incinerate the paper containing personal information.

Article 7. Rights and obligations of customers and their legal representatives

① You have the right to request to see, modify, delete, and pause the handling of your personal information.

② Pursuant to Article 41 Section 1 of the Enforcement Decree of the Personal Information Protection Act, you are able to exert your abovementioned right via letter, email, and fax. We will promptly respond.

③ You can exert your right as stated in Section 1 above through your legal representative or someone who has been delegated. To do so, you shall submit a proxy statement, which shall use the form (number 11) attached to Notice on Personal Information Processing Method (No. 2020-7).

④ Pursuant to Article 35 Section 4 and Article 37 Section 2 of the Personal Information Protection Act, your rights to request to see or pause the handling of your personal information may be limited.

⑤ If we are obligated to retain pieces of your information according to another law, you cannot request for modification or deletion of them.

⑥ When you request to see, modify, delete, or pause the handling of your information, we will verify that the requester is either you or a legitimate proxy.

Article 8. Measures to protect your information
Orange Square is taking the following measures to protect the personal information we are retaining.

1. Regular in-house inspection
We inspect quarterly how personal information is being handled to ensure its protection.

2. Few personal information handling personnel/Training
We designate persons handling personal information and allow only those people to manage personal information.

3. Establishment and implementation of a management manual
We established and have been implementing a personal information management manual for the safe handling of personal information.

4. Preventive technology against hacking
We have installed security programs in prevention of information leaks and possible damage caused by hacking or computer viruses.

5. Encryption of personal information
Users’ personal information is encrypted before being stored and managed. Nobody is able to see your information. Important data are under our special care; Additional security functions including file locking are applied.

6. Storage of access history/prevention of falsification
We are keeping and managing the access records to our information processing system for at least 1 year. In case we need to add pieces of personal information of 50,000 or more users, process personal identification data, or process sensitive information, we store and manage such information for at least 2 years. We are using security functions to prevent falsification, theft, and loss of access records.

7. Restriction on accessing personal information
We are taking measures to restrict access to personal information; We authorize few staff members to access the database system, and we modify or delete some of the personal information. Also, we are operating an intrusion prevention system to block access from outside.

8. Locking devices for documentation security
We store documents and storage media that contain personal information in safe places where that have locking devices.

9. Access denial for unauthorized persons
We have a separate room for storing personal information. We established and have been implementing processes to restrict access to the room.

Article 9. Use of Cookies, which automatically collect personal data, and refusal

① Orange Square uses “Cookies,” which save and retrieves user information, to offer customized services to individuals.

② Cookies are small pieces of information that the server, which the website uses, sends to users’ computer browser. They could be saved in users’ computer hard drive.

A. Purpose of using Cookies: We identify websites that our users visited, their usage patterns, popular keywords, whether they are using secure connections, etc. to provide them with the most relevant information.

B. Installation and operation of Cookies/Refusal: Click on tools (at the top of Internet Explorer) > Internet Options > Privacy, and move the slider under Settings to decline Cookies.

C. If you decline Cookies, you may not be offered customized services.

Article 10. Collection, usage, and provision of usage patterns, and refusal

① Our person in charge of processing personal information collects and uses your usage patterns to provide tailored services, benefits, and advertisements.

② The above person collects your usage patterns as follows:

10. This is the table to enter items of usage patterns we collect, how and why we collect them, usage and retention periods, and how to process the data after the periods end.

Items of usage patterns we are collecting

How we collect usage patterns

Why we collect usage patterns

How we process such information after the retention and usage periods end

Users’ payment history on WOWPASS cards, access history on our mobile app, service usage history

Users’ payment history on their WOWPASS cards, access history on our mobile app, and service usage history are automatically collected.

We offer individualized services according to users’ interests and service payment inclinations.

The information will be destroyed after 90 days.

Article 11. Criteria for deciding additional usage and provision of personal information
Pursuant to Article 15 Section 3 and Article 17 Section 4 of the Personal Information Protection Act, we consider Article 14 Section 2 of the Enforcement Decree of the Personal Information Protection Act, and we may additionally use or provide your personal information without your agreement.
We will consider the following when we additionally need to use or provide your information without your agreement.
▶Whether the purpose of the additional use or provision of personal information is related to original purposes of the collection.

▶ Whether additional use or provision of personal information could have been predicted by reflecting on the circumstances of the collection and information handling practices.

▶ Whether the additional use or provision of personal information could unreasonably harm the users.

▶ Whether information protective measures (anonymization of names, encryption, etc.) are taken.

Article 12. Person in charge of personal information protection

Orange Square is fully responsible for handling personal information. We have a person and a department dedicated to personal information protection to properly handle personal information, address complaints, and remedy damage.

▶ Person in charge of personal information protection

Name: Choi Hyungseok
Position: Chief Privacy Officer
Job level: Vice President
Contact information:
Phone: 070-4858-0351
Email: cs@orangesquare.kr
Fax: 02-6925-6474

▶ Department for personal information protection

Name: Technology Lab
Person in charge: Kim Seongil
Contact information:
Phone: 070-4858-0355
Email: cs@orangesquare.kr
Fax: 02-6925-6474

② You may make inquiries (regarding personal information protection, complaints, and damage relief) to our person or department in charge of personal information protection. We will immediately respond to your inquiries.

Article 13. Department that receives and processes customer requests to see their personal information
Pursuant to Article 35 of the Personal Information Protection Act, you may request the department below to see your information.
We will do our best to process your request as soon as possible.

▶ Department you may contact for seeing your personal information
Department name: Technology Lab
Person in charge: Kim Seongil
Contact information:
070-4858-0355
cs@orangesquare.kr
02-6925-6474

Article 14. Remedies in case your rights are infringed

You may contact the Personal Information Dispute Mediation Committee or KISA’s Personal Information Infringement Report Center to receive remedies if your personal information has been infringed. You may contact the institutions shown below to report or seek consultations on personal data infringement.

1. Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
4. National Police Agency: 182 (ecrm.cyber.go.kr)

If your rights to request, which are guaranteed by Article 35 (Access to Personal Information), 36 (Rectification or Erasure of Personal Information), and 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act, are infringed due to a discretionary act of a head of a public institution or nonfeasance, you are able to file an administrative appeal pursuant to the Administrative Appeals Act.

※ You may visit the website of Online Administrative Appeals (www.simpan.go.kr) to find out more about administrative appeals.

Article 15. Management/operation of video processing devices
Orange square has installed and has been operating video processing devices as follows:

1. Grounds and purposes for installing video processing devices: WOWPASS kiosks’ facility security and crime prevention

2. The numbers, locations, and filming areas of the devices

Number: one per one kiosk
Location: the top-front side of kiosks
Filming area: customers using the service

3. Person and department in charge of management, person accessible to video information : person in charge of management : Chief Privacy Officer’s department and person accessible to video information : person in charge of technical support for Technology Lab and unmanned kiosks

4. Video-recording time, the retention period of recorded videos, places of storage, handling of the videos

Recording time: 24hrs a day
Retention period: From the time of recording to the time when the storage medium is full (Recordings are automatically deleted in chronological order.).
Where we store and how we manage recordings : Where we store : How we manage recordings saved in the DVR devices, which are installed in unmanned kiosks : From the time when the storage medium is full, recordings are automatically deleted in chronological order.

5. How you can check recorded videos: Check from monitors at unmanned kiosks.

6. If you want to make a request to watch your video: You will have to make a formal request by submitting a request form. The request will be accepted in case you were in the video or you need it to protect your life, body, or property.

7. Our technological, managerial, and physical measures to secure video information:

Installation and operation of locking devices: We double-lock the door of unmanned kiosks.
Safe storage of video information: The DVR devices are safely stored in unmanned kiosks. The video information cannot be transferred to outside.

Article 16. Application of this privacy policy

① This privacy policy shall be effective from July 11, 2022.

Privacy Policy

​