Privacy Policy
Announced 2025-07-01·Effective 2025-07-08
ONDA Inc. (hereinafter the "Company") collects only the minimum information necessary and only when it is needed. Information collected is used solely within the scope disclosed to the user, and is never used beyond that scope or disclosed externally without prior consent. Users may fully exercise their rights over the information collected, including the rights to access, correct, withdraw consent, delete, and suspend processing. Whenever this Privacy Policy changes, the Company will always notify users in advance and post the change on the website notice board (or by individual notice) so that it can be reviewed at any time. However, only where required by law, or where an investigative or administrative agency makes a request accompanied by a court warrant, may the minimum necessary information be provided without consent after internal review.
Article 1 (Categories of Personal Information Collected and Purposes of Use)
The Company processes personal information for the purposes set out below. The personal information being processed is not used for any purpose other than those below, and if the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.
| Category | Purpose of use | Items collected | Retention and use period |
|---|---|---|---|
| Required | Listing inquiries and consultation | Property information (representative's name, main phone number, main email address, business address) | Until termination of the contract. However, except where retention is required by applicable law, the information is destroyed without delay once the purpose is achieved |
| Required | Listing applications, management of listed businesses, use of the service, verification of fraudulent use | ID, password, property information (representative's name, main phone number, main phone number, main email address, business address), business registration number, type of business (business category and item), contact person information (name, telephone number, mobile number, email), IP address | Until termination of the contract. However, except where retention is required by applicable law, the information is destroyed without delay once the purpose is achieved |
| Required | Issuance of tax invoices, provision of payment settlement services | Settlement information (account number, account holder name, copy of bankbook) | Until termination of the contract. However, except where retention is required by applicable law, the information is destroyed without delay once the purpose is achieved |
| Required | Handling of complaints | Property name, business name, business owner (representative's name), contact person's name, property location, contact details for reply (mobile, email, telephone) | Until termination of the contract. However, except where retention is required by applicable law, the information is destroyed without delay once the purpose is achieved |
| Required | Reservations, provision of the service and performance of the contract (verification of the user and usage information), resolution of consumer disputes including complaint handling | Name, contact details, email, card information (card number, expiry date, name, linked number) | Until termination of the contract. However, except where retention is required by applicable law, the information is destroyed without delay once the purpose is achieved |
| Required | Automatically generated and collected during use of the service | IP address, date and time of visit, service usage records | Until termination of the contract. However, except where retention is required by applicable law, the information is destroyed without delay once the purpose is achieved |
| Optional | Selection of recipients for information delivery, and delivery of products/services, promotions/events, educational information and other advertising information | All information collected under the required items | |
| Optional | Delivery of reports and related information | Email address, name, occupation or job title, mobile phone number | Destroyed immediately after delivery of reports and related information ends |
| Optional | Newsletter delivery | Email address, name, occupation or job title | Destroyed immediately upon termination of the service or cancellation of the newsletter subscription |
As a matter of principle, the Company does not collect personal information from children under the age of 14.
Article 2 (Processing and Retention Period of Personal Information)
The Company processes and retains personal information within the retention and use period prescribed by law, or within the retention and use period consented to by the data subject at the time of collection.
The processing and retention period for each category of personal information is as follows.
| Information retained | Retention period | Legal basis |
|---|---|---|
| Records on contracts or withdrawal of subscription | 5 years | Act on Consumer Protection in Electronic Commerce, Etc. |
| Records on payment settlement and the supply of goods, etc. | 5 years | Act on Consumer Protection in Electronic Commerce, Etc. |
| Records on consumer complaints or dispute resolution | 3 years | Act on Consumer Protection in Electronic Commerce, Etc. |
| Records on labelling and advertising | 6 months | Act on Consumer Protection in Electronic Commerce, Etc. |
| Website visit records | 3 months | Protection of Communications Secrets Act |
Article 3 (Provision of Personal Information to Third Parties and Overseas Transfer of Personal Information)
The Company processes the personal information of data subjects only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only where Article 17 or Article 18 of the Personal Information Protection Act applies, such as with the consent of the data subject or under special provisions of law.
| Recipient | Purpose of provision | Items provided | Use and retention period |
|---|---|---|---|
| Accommodation service providers | Provision of the reserved or purchased goods and services and performance of the contract (verification of the user and usage information), resolution of consumer disputes including complaint handling | Reservation number, reserver information (reserver's name, mobile number) or visitor information (visitor's name, mobile number) | Until the purpose of using the personal information is achieved. However, where retention is required by applicable law, the information is retained until that point and then destroyed without delay |
Article 4 (Entrustment of Personal Information Processing)
In order to provide a convenient and better service, the Company entrusts part of its operations to external parties.
| Entrustee | Entrusted work |
|---|---|
| Kakao Pay Corp. ((주)카카오페이), Chai Corporation ((주)차이코퍼레이션), NHN KCP Corp. (엔에이치엔한국사이버결제 주식회사), Korea PortOne Inc. (주식회사 코리아포트원), Toss Payments Inc. ((주)토스페이먼츠) | Payment processing (mobile phone, bank transfer without bankbook, account transfer, credit card and other payment methods) |
| Aligo Inc. ((주)알리는사람들), Daou Tech Inc. ((주)다우기술) | Provision of SMS services |
| Amazon Web Services Inc. | Data storage |
| Stibee Inc. (스티비 주식회사) | Newsletter delivery, subscriber management, usage statistics analysis |
| Matrix Cloud Inc. ((주)매트릭스클라우드) | Provision of the customer centre solution |
| CS Sharing Co., Ltd. (씨에스쉐어링(주)) | Customer centre consultation |
| Oatech Inc. ((주) 오아테크) | Reservation information synchronisation |
In order to provide a convenient and better service, the Company entrusts personal information processing work to overseas specialist providers and operates it as follows.
| Recipient | ZENDESK (United States) |
| Contact details of the recipient | privacy@zendesk.com |
| Purpose of provision | Management of customer consultation history and inquiry responses |
| Items provided | Name, email, mobile phone number, reservation number |
| Date and method of provision | Provided by electronic transmission at the time the customer centre is used |
| Use and retention period | Until the purpose of using the personal information is achieved. However, where retention is required by applicable law, the information is retained until that point and then destroyed without delay |
| Recipient | zapier (United States) |
| Contact details of the recipient | privacy@zapier.com |
| Purpose of provision | Management of customer consultation history and inquiry responses |
| Items provided | Name, email, mobile phone number |
| Date and method of provision | Provided by electronic transmission at the time the customer centre is used |
| Use and retention period | Until the purpose of using the personal information is achieved. However, where retention is required by applicable law, the information is retained until that point and then destroyed without delay |
※ You may refuse to consent to the above provision of personal information to third parties; if you refuse, use of the service will be restricted.
When entering into an entrustment agreement, the Company specifies in the contract or other document, pursuant to Article 26 of the Personal Information Protection Act, matters such as the prohibition of processing personal information for any purpose other than performing the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, management and supervision of the entrustee, and liability including damages, and supervises whether the entrustee processes personal information safely. If the content of the entrusted work or the entrustee changes, the Company will disclose this without delay through this Privacy Policy.
Article 5 (Rights and Obligations of Data Subjects and Their Legal Representatives, and How to Exercise Them)
Paragraph 1. Data subjects may exercise their rights against the Company at any time, including requests to access, correct, delete, or suspend the processing of their personal information.
Paragraph 2. The rights under Paragraph 1 may be exercised against the Company in writing, by email, by fax and by other means pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.
Paragraph 3. The rights under Paragraph 1 may be exercised through an agent, such as the data subject's legal representative or a duly authorised person. In such a case, a power of attorney in the form of Annex No. 11 of the "Public Notice on Methods of Processing Personal Information" must be submitted.
Paragraph 4. Requests to access personal information and to suspend its processing may be restricted under Article 35(5) and Article 37(2) of the Personal Information Protection Act.
Paragraph 5. Where other statutes expressly specify the personal information as subject to collection, deletion of that personal information may not be requested.
Paragraph 6. Where a data subject exercises the right to request access, correction or deletion, or suspension of processing, the Company verifies whether the person making the request is the data subject or a duly authorised agent.
Article 6 (Destruction of Personal Information)
-
Where personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose, the Company destroys it without delay.
-
Where personal information must continue to be retained under other statutes even though the retention period consented to by the data subject has expired or the processing purpose has been achieved, the Company moves that personal information to a separate database or stores it in a different location.
-
The procedure and method for destroying personal information are as follows.
Destruction procedure: The Company selects the personal information for which grounds for destruction have arisen and destroys it with the approval of the Company's personal information protection officer. Destruction method: Personal information recorded and stored in electronic file form is destroyed so that the records cannot be reproduced, and personal information recorded and stored in paper documents is destroyed by shredding or incineration.
Article 7 (Measures to Ensure the Safety of Personal Information)
The Company takes the following measures to ensure the safety of personal information.
-
Administrative measures: establishment and implementation of an internal management plan, regular staff training, etc.
-
Technical measures: access rights management for personal information processing systems, installation of access control systems, encryption of unique identifying information, installation of security programs
-
Physical measures: access control for the computer room, data storage room, etc.
Article 8 (Installation and Operation of Devices that Automatically Collect Personal Information, and Refusal Thereof)
In operating its web services, ONDA uses "cookies" that store user information where necessary.
A cookie is a very small text file sent to the user's computer by the server used to operate the website, and is stored on the hard disk of the user's computer. Users may therefore decide for themselves whether to allow cookies to be installed and collected, and may refuse such collection. However, if you refuse to allow cookies to be stored, use of some services that require login may be restricted.
<How to refuse cookie settings>
- For Internet Explorer
At the top of the web browser: "Tools" menu > "Internet Options" menu > "Privacy" tab > configure directly
- For ChromeAt the top right of the web browser, select the "" icon > select "Settings" > select "Show advanced settings" at the bottom of the screen > "Content settings" button in the privacy section > configure directly in the cookies section
Article 9 (Personal Information Protection Officer)
In order to protect customers' personal information and handle complaints relating to personal information, the Company designates the relevant department and the personal information management officer as set out below. You may direct any personal information protection complaint arising from your use of the Company's services to the personal information management officer or the responsible department. The Company will provide prompt and sufficient answers to reports from users.
| Personal Information Protection Officer | Personal Information Protection Manager |
|---|---|
| Name: Oh Hyunseok Telephone: 1544-3812 Email: sec@onda.me | Name: Won Kyungmuk Telephone: 1544-3812 Email: sec@onda.me |
Article 10 (Changes to This Privacy Policy)
Where this Privacy Policy is changed, the Company will give notice without delay and take measures so that users can easily identify the changes.
Previous versions of the Privacy Policy
Superseded versions are preserved in the Korean original only.