Introduction
To protect the freedom and rights of data subjects, the Company complies with the Personal Information Protection Act and related laws, processes personal information lawfully and manages it safely. Under Article 30 of the Personal Information Protection Act, the Company establishes and publishes this privacy policy to inform data subjects of the procedures and standards for processing and protecting personal information and to handle related grievances promptly and smoothly.
Summary of personal information processing
| General personal information | Automatically collected information | Grievance handling department |
|---|---|---|
| 1. Member service operation: company name, name, mobile phone number, e-mail (ID), virtual asset wallet address 2. Customer support: company name, name, mobile phone number, e-mail | 1. Web service provision: IP information, device information, cookie information | 1. Department: Information Security Office 2. E-mail: octet.team@walletone.io |
See the full privacy policy below for details.
01. Purposes, Items Collected and Retention Period
Under the Personal Information Protection Act, the Company collects and uses personal information within the minimum scope necessary to provide the Service.
Personal information processed without the data subject’s consent
The Company processes the following items of personal information without the data subject’s consent.
| Legal basis | Category | Purpose | Items | Retention and use period |
|---|---|---|---|---|
| Personal Information Protection Act, Article 15(1)4 (performance of a contract) | Member service operation | Confirming intent to register, identifying and authenticating the member for member services, maintaining and managing membership, preventing misuse of the Service | Company name, name, mobile phone number, e-mail (ID) | Until withdrawal of membership |
| Blockchain service | Collecting blockchain information | Virtual asset wallet address | 5 years after withdrawal (Article 6 of the E-Commerce Act) | |
| Customer support | Responding to service inquiries | Company name, name, mobile phone number, e-mail | 3 years after the inquiry closes (Article 6 of the E-Commerce Act) |
Personal information processed with the data subject’s consent
The Company does not process the data subject’s personal information for any purpose other than Article 15(1)4 of the Personal Information Protection Act (performance of a contract).
02. Destruction Procedure and Method
When personal information is no longer needed, such as when the retention period has passed or the purpose of processing has been achieved, the Company destroys it without delay.
Where personal information must be kept under other laws even though the retention period agreed with the data subject has passed or the purpose has been achieved, the Company moves it to a separate database or stores it in a separate location.
*The items kept under other laws and the legal basis are listed in “Purposes, Items Collected and Retention Period”.
The procedure and method of destruction are as follows.
| Form of storage | Procedure | Method |
|---|---|---|
| Electronic file | Select the personal information for which a reason for destruction has arisen and destroy it with the approval of the privacy officer | Destroyed so that the record cannot be restored |
| Paper document | Shredded or incinerated |
03. Outsourcing of Processing
WalletOne Co., Ltd. outsources personal information processing as follows for the smooth handling of personal information work.
| Processor | Outsourced work |
|---|---|
| Zendesk | Customer support platform (Zendesk) |
| Stibee | E-mail delivery platform (Stibee) |
When concluding an outsourcing contract, the Company specifies in the contract or other document, under Article 26 of the Personal Information Protection Act, the prohibition of processing outside the purpose of the outsourced work, technical and administrative safeguards, limits on sub-outsourcing, management and supervision of the processor, and liability including damages, and supervises whether the processor handles personal information safely.
Under Article 26(6) of the Personal Information Protection Act, a processor that sub-outsources the Company’s personal information processing work obtains the Company’s consent.
If the outsourced work or the processor changes, the Company will disclose it through this privacy policy without delay.
04. Overseas Transfer of Personal Information
The Company provides and outsources personal information collected from service users overseas as follows. Because a customer support platform is used to respond to service inquiries, the Service cannot be used if you refuse the overseas transfer. If you do not want the overseas transfer, you can withdraw your membership by the deletion and suspension method in “Rights and Obligations of Data Subjects and Legal Representatives” or request withdrawal by e-mail (octet.team@walletone.io).
| Legal basis | Items transferred | Country | Timing and method | Recipient | Purpose | Retention and use period |
|---|---|---|---|---|---|---|
| Personal Information Protection Act, Article 28-8(1)3 (outsourced processing and storage for performance of a contract) | Company name, name, mobile phone number, e-mail | United States | Transmitted over the network when an inquiry is made through Zendesk | Zendesk, Inc / privacy@zendesk.com | Use of a customer support platform to respond to service inquiries | Until the outsourcing contract ends |
05. Measures to Secure Personal Information
WalletOne Co., Ltd. takes the following measures to secure personal information.
| Category | Measures |
|---|---|
| Administrative | Establishing and implementing an internal management plan, operating a dedicated organisation, regular staff training |
| Technical | Managing access rights to personal information processing systems, installing access control systems, encrypting personal information, installing and updating security programs |
| Physical | Access control for computer rooms and data storage rooms |
06. Automatic Collection Devices and How to Refuse Them
Automatic collection devices installed and operated
- ①The Company uses cookies, which store usage information and retrieve it from time to time, to provide users with individual services and convenience.
- ②A cookie is a small piece of information that the server (http) operating the website sends to the data subject’s browser, and it is stored on the data subject’s PC or mobile device.
- ③Data subjects can allow or block cookies in the browser settings. Refusing cookies may make it harder to use personalised services.
| Allow or block cookies in a web browser | Allow or block cookies in a mobile browser |
|---|---|
| Chrome: browser settings > Privacy and security > Delete browsing data Edge: browser settings > Cookies and site permissions > Manage and delete cookies and site data | Chrome: mobile browser settings > Privacy and security > Delete browsing data Safari: device settings > Safari > Advanced > Block all cookies Samsung Internet: mobile browser settings > Browsing data > Delete browsing data |
07. Rights and Obligations of Data Subjects and Legal Representatives
- ①You may at any time exercise rights against the Company such as requesting access to, correction of, deletion of or suspension of processing of personal information, withdrawing consent, and refusing or requesting an explanation of an automated decision (“exercise of rights”). *A request for access to personal information about a child under 14 must be made by the legal representative. A minor aged 14 or over may exercise rights over their own personal information personally or through a legal representative.
- ②Rights can be exercised as follows.
Service Access and correction Deletion and suspension Octet v2 Log in → Account settings Owner account: request by e-mail (octet.team@walletone.io)
General user account: log in with the customer’s owner account > [Admin settings] > [Delete admin] - ③Rights may also be exercised through an agent, such as the data subject’s legal representative or a person with a power of attorney. In that case a power of attorney in Annex Form 11 of the Notice on Methods of Processing Personal Information (law.go.kr) must be submitted.
- ④The right to request access to, and suspension of processing of, personal information may be limited under Articles 35(4) and 37(2) of the Personal Information Protection Act.
- ⑤Deletion cannot be requested for personal information that another law specifies as subject to collection.
- ⑥Where the data subject has consented to an automated decision, has been informed of it in advance through a contract or otherwise, or the law clearly provides for it, refusal of the automated decision is not recognised and only an explanation or review may be requested. A request to refuse or explain an automated decision may also be rejected on justified grounds, such as a risk of unfairly harming the life, body, property or other interests of another person.
- ⑦The Company verifies that the person exercising the rights is the data subject or a legitimate agent.
- ⑧Rights can be exercised through the department listed under “Privacy Officer”. The Company will work to handle the exercise of rights promptly.
08. Privacy Officer
The Company designates the following privacy officer to take overall responsibility for personal information processing and to handle data subjects’ complaints and remedies related to it.
Data subjects may direct all privacy-related inquiries, complaints and requests for remedy arising from use of the Service to the privacy officer and department below. The Company will answer and handle inquiries without delay.
| Category | Department and name | Contact |
|---|---|---|
| Privacy officer | Choi Jeong-rok, CEO | E-mail: octet.team@walletone.io |
| Privacy department | Information Security Office |
09. Remedies for Infringement of Rights
To obtain a remedy for infringement of personal information, data subjects may apply for dispute resolution or counselling to the Personal Information Dispute Mediation Committee, the KISA Personal Information Infringement Report Center and similar bodies. For other reports or counselling on personal information infringement, contact the organisations below.
| Organisation | Contact | Website |
|---|---|---|
| Personal Information Dispute Mediation Committee | 1833-6972 (no area code) | www.kopico.go.kr |
| Personal Information Infringement Report Center | 118 (no area code) | privacy.kisa.or.kr |
| Supreme Prosecutors’ Office | 1301 (no area code) | www.spo.go.kr |
| Korean National Police Agency | 182 (no area code) | ecrm.police.go.kr |
The Company guarantees data subjects’ right to informational self-determination and works to provide counselling and remedies for personal information infringement. If you need to report or consult, contact the details listed under “Privacy Officer”.
10. Changes to the Privacy Policy
This privacy policy applies from 21 January 2026.
Previous versions of the privacy policy are available below.
- Effective 2025-07-11: Privacy policy (Korean)
- Effective 2025-03-14: Privacy policy (Korean)
- Effective 2024-05-27: Privacy policy (Korean)
- Effective 2024-05-02: Privacy policy (Korean)
- Effective 2023-09-15: Privacy policy (Korean)
- Effective 2023-06-15: Privacy policy (Korean)
- Effective 2023-05-10: Privacy policy (Korean)
- Effective 2022-06-20: Privacy policy (Korean)
- Effective 2020-07-10: Privacy policy (Korean)