IFEZ Pay Privacy Policy

Article 1 (Purposes of Processing Personal Information and Items Collected)

Baerae Co., Ltd. (hereinafter the "Company") collects and processes users' personal information for the following purposes. The personal information processed is not used for any purpose other than those set out below, and if the purpose of use changes, the Company takes the necessary measures, such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.

  1. 1. Member registration and management

    - (Purpose of processing) Identity verification, conclusion and performance of the service agreement, and prevention of misuse

    - (Items processed) Email address, social login provider and the user identifier issued by that provider, phone number

    - (Legal basis) Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract)

  2. 2. Identity verification (KYC)

    - (Purpose of processing) Verifying the user's identity and whether the user is of legal age, and preventing identity theft and misuse

    - (Items processed)

    A. General personal information: name, nationality, date of birth, gender, residential address, passport issuing country, passport expiry date, passport image, whether identity verification was completed and the verification result

    B. Unique identifiers: passport number

    C. Sensitive information: facial images and captured video, facial feature data and liveness determination data processed to identify the individual and confirm liveness

    - (Legal basis)

    A. General personal information: Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract)

    B. Passport number: Article 24(1)1 of the Personal Information Protection Act (separate consent for unique identifiers)

    C. Biometric information such as facial feature data: Article 23(1)1 of the Personal Information Protection Act (separate consent for sensitive information)

    - (Method of processing) The specialised institution to which the Company has entrusted identity verification processes the above information by having the user enter it directly or by capturing it, and the Company receives from that institution whether identity verification was completed, the verification result, and the identity information necessary to provide the service.

  3. 3. Information automatically generated and collected in the course of providing the service

    - (Purpose of processing) Maintaining and improving service quality, error analysis, and security management

    - (Items processed) Access date and time, access logs, service usage records, visit history, device information (OS, device model, app version, advertising identifier, IP address, cookies or similar identifiers), error logs, performance logs, and push notification settings

    - (Legal basis) Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract)

  4. 4. Items collected when using the digital asset top-up and payment services

    - (Purpose of processing) Exchange linking and the provision of wallet-based top-up, payment and withdrawal services

    - (Items processed) Digital asset exchange name, wallet address, type and quantity of digital assets, transaction date and time, and transaction details such as top-ups, payments and withdrawals of digital assets. Exchange login IDs, passwords and authentication data, passkey secrets, and the biometric authentication data or PIN of the device used to approve payments are processed on the user's device or in an authentication service chosen by the user; they are neither transmitted to nor stored on the Company's servers.

    - (Legal basis) Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract)

  5. 5. Customer support and dispute handling

    - (Purpose of processing) Handling users' inquiries, complaints and objections, checking transaction history, and responding to disputes

    - (Items processed) Email address, mobile phone number, the content of the inquiry, the payment, top-up or withdrawal transaction number related to the inquiry, and attachments submitted by the user

    - (Legal basis) Article 15(1)4 of the Personal Information Protection Act (conclusion and performance of a contract)

  6. 6. Marketing purposes (optional collection)

    - (Purpose of processing) Informing users of events and promotions and providing benefits

    - (Items processed) Whether the user has consented to marketing communications. Where additional personal information is processed in the course of participating in an event, the purpose of processing, the items processed and the retention period are separately notified on the relevant event screen and consent is obtained.

    - (Legal basis) Article 15(1)1 of the Personal Information Protection Act (consent)

Article 2 (Processing and Retention Periods of Personal Information)

  1. ① The Company processes and retains personal information within the retention and use period prescribed by law, the period necessary to conclude and perform the service agreement, or the period consented to by the user.

  2. ② The processing and retention period for each category of personal information is as follows.

    1. 1. Information relating to member registration and user management: until the membership is terminated

    2. 2. Information relating to identity verification (KYC)

      Information that the Company retains in order to provide the service, such as name, nationality, date of birth, gender, residential address, whether identity verification was completed and the verification result: until the membership is terminated

      Passport number: processed until the identity verification procedure is complete and then destroyed without delay

      Passport image, facial images and captured video, and facial feature data: not retained by the Company; destroyed by the identity verification trustee within seven days after the identity verification procedure is complete

    3. 3. Information automatically generated and collected in the course of using the service

      Access date and time, IP address, service usage records, access logs, error logs and performance logs: one year from the date each item is generated

      Push tokens and push notification settings: until the membership is terminated or push notifications are turned off

    4. 4. Information relating to transactions such as top-ups, payments and withdrawals of digital assets: until the membership is terminated, provided that where a payment, settlement, cancellation, refund or dispute is outstanding at the time of termination, until that procedure is completed

    5. 5. Customer support and dispute handling information: until the inquiry or complaint has been handled, provided that where a dispute or a relationship of rights and obligations relating to that inquiry continues, until that dispute or relationship ends

    6. 6. Marketing-related information: until the earlier of the termination of membership or the withdrawal of consent to marketing communications. However, personal information separately collected in the course of participating in an event is retained for the period notified on the relevant event screen and consented to by the user.

    7. 7. Access records of the personal information processing system: two years

    8. 8. Electronic financial transaction records (access records of electronic devices, applications for transactions and changes to their terms, and records of transactions exceeding KRW 10,000 per transaction): five years

    9. 9. Electronic financial transaction records of KRW 10,000 or less per transaction and records of approvals of electronic payment means: one year

  3. ③ Notwithstanding paragraph 2, where any of the following grounds exists, the relevant personal information may be retained until that ground ceases to exist.

    1. 1. Where an investigation, inquiry or judicial proceeding relating to a violation of applicable laws is under way: until that procedure ends

    2. 2. Where a claim, debt or settlement relationship arising from use of the service remains: until that claim, debt or settlement relationship ends

    3. 3. Where litigation or dispute resolution proceedings are under way: until those proceedings become final or are concluded

    4. 4. Where another statute requires personal information to be preserved for a certain period: until the period prescribed by that statute

  4. ④ Where the Company preserves personal information pursuant to another statute, it stores and manages that personal information separately from other personal information and does not use it for any purpose other than the one prescribed by that statute.

Article 3 (Provision of Personal Information to Third Parties)

As a rule, the Company processes users' personal information within the scope of the purposes specified in Article 1, and provides personal information to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the user's consent or under a special provision of law.

Article 4 (Entrustment of Personal Information Processing)

① In order to provide the service smoothly, the Company entrusts personal information processing tasks as follows.

TrusteeEntrusted work
Jumio Singapore Pte. Ltd.Identity verification (eKYC) through checks on the authenticity of identity documents and facial matching
NICE Information & Telecommunication Inc.Payment processing and payment gateway services
SentBe Inc.Overseas remittance and foreign currency exchange processing
Google Cloud Korea LLCOperation of cloud infrastructure and storage of data
Google LLC, Apple Inc.Delivery of push notifications (FCM / APNs)

② The Company enters into entrustment agreements pursuant to Article 26 of the Personal Information Protection Act and supervises whether trustees process personal information securely.

③ Where the content of the entrusted work or the trustee changes, the Company discloses the change without delay through this privacy policy.

④ The specifics of the direct collection and processing of personal information by an overseas identity verification institution are governed by Article 5.

Article 5 (Overseas Collection and Processing of Personal Information for Identity Verification)

  1. ① For identity verification, the Company entrusts identity verification tasks to Jumio Singapore Pte. Ltd. That institution collects the personal information relating to identity verification (KYC) under Article 1 directly from the user and processes it in Singapore and the Republic of Korea.

  2. ② The Company receives from the identity verification institution whether identity verification was completed, together with the user's name, date of birth, gender, nationality, passport number, residential address and the identity verification result.

  3. ③ Where the Company processes unique identifiers such as a passport number, or biometric feature data generated to authenticate and identify an individual, it obtains separate consent distinct from the consent to the processing of general personal information. The specific items processed and the retention periods are governed by Articles 1 and 2.

  4. ④ Users may refuse to consent to the processing of personal information for identity verification. However, if consent is not given, identity verification cannot be completed and the use of services that require identity verification may be restricted.

Article 6 (Processing of Sensitive Information)

  1. ① The Company may process facial images and video during the identity verification process. Information generated in that process by certain technical means for the purpose of identifying a specific individual, being information on that individual's physical, physiological or behavioural characteristics (hereinafter “biometric information”), constitutes sensitive information.

  2. ② Where the Company processes the biometric information referred to in paragraph 1, it obtains separate consent distinct from the consent to the processing of other personal information pursuant to Article 23(1)1 of the Personal Information Protection Act. The Company does not store original biometric information on its own servers; Jumio Singapore Pte. Ltd., the trustee for identity verification, processes and stores it solely for the purpose of checking whether the user is the same person as shown in the photograph on the identity document. The Company receives only the result of that check (success or failure) and its reason code, and the biometric information concerned is destroyed within seven days after the identity verification procedure is complete.

Article 7 (Procedure and Method for Destroying Personal Information)

  1. ① Where personal information becomes unnecessary, for example because the retention period has elapsed or the purpose of processing has been achieved, the Company destroys that personal information without delay.

  2. ② The Company identifies the personal information for which a ground for destruction has arisen and destroys it with the approval of the privacy officer.

  3. ③ Personal information recorded and stored in electronic file form is deleted in a manner that prevents the records from being recovered or reproduced, and personal information recorded and stored on paper is destroyed by shredding or incineration.

  4. ④ Where personal information must continue to be preserved pursuant to another statute, that personal information is stored and managed separately from other personal information. In such cases, the grounds for preservation, the items preserved and the preservation period are set out in Article 2.

Article 8 (Users' Rights and How to Exercise Them)

  1. ① Users may at any time request access to, correction or deletion of, or suspension of the processing of their personal information, and may withdraw any consent they have given.

  2. ② Users may do so through the in-app settings or by any of the following methods, and the Company takes action without delay. Through the in-app settings, users may unlink accounts, terminate their membership or withdraw consent to marketing communications.

    - Email: cs.ifezpay@baerae.com

    - In the app: [Settings > Customer support > 1:1 inquiry]

    - Post: Room 207, 41 Sangnok-ro 16-gil, Suseong-gu, Daegu 42012, Republic of Korea / Attn: Privacy Officer

  3. ③ Users may exercise their rights through a duly authorised representative. The Company may verify whether the person exercising the rights is the user or a legitimate representative.

  4. ④ Requests for access to personal information and for suspension of its processing may be restricted pursuant to Articles 35(4) and 37(2) of the Personal Information Protection Act, and where another statute expressly provides for the collection of the personal information concerned, deletion may not be requested pursuant to Article 36(1) of the same Act. Where the Company restricts or refuses the exercise of a right, it informs the user of the grounds and of how to object.

Article 9 (Measures to Ensure the Security of Personal Information)

  1. ① The Company takes administrative, technical and physical measures to ensure the security of personal information.

    1. 1. Administrative measures: establishing and implementing an internal management plan and providing regular training for personnel who handle personal information

    2. 2. Technical measures: granting and managing access rights to the personal information processing system on a least-privilege basis, access control, encryption of personal information, retention and review of access records, and the installation and operation of security programs

    3. 3. Physical measures: access control for locations where personal information is stored and secure storage of documents and auxiliary storage media containing personal information

Article 10 (Installation and Operation of Automatic Collection Devices such as Cookies)

  1. ① In order to provide a more convenient service, the Company uses cookies, which store usage information and retrieve it from time to time.

  2. ② A cookie is a small amount of information that the server used to operate a website sends to the user's browser. It is stored on the user's computer or mobile device and is automatically transmitted to the server through the browser when the user visits the website.

  3. ③ Users may refuse cookies and adjust related settings through their browser options as follows.

▶ How to block cookies in a web browser

• Chrome: select ‘⁝’ at the top right of the browser > New Incognito window (shortcut: Ctrl+Shift+N)

• Edge: select ‘‧‧‧’ at the top right of the browser > New InPrivate window (shortcut: Ctrl+Shift+N)

▶ How to block cookies in a mobile browser

• Chrome: select ‘⁝’ at the top right of the mobile browser > New Incognito tab

• Safari: device Settings > Apps > Safari > Advanced > Block All Cookies

• Samsung Internet: select the ‘Tabs’ icon at the bottom of the mobile browser > Turn on Secret mode > Start

Article 11 (Privacy Officer and Contact Point)

  1. ① The Company has designated a privacy officer who takes overall responsibility for personal information processing and handles users' personal information inquiries, complaints and remedies.

- Name: Junghyun Kim

- Position: Information Security Officer

- Contact: 010-4306-0030, privacy@baerae.com

Personal information inquiries, complaints and requests for remedies may be submitted to the officer above.

Article 12 (Remedies for Infringement of Rights)

If you need remedies or advice regarding an infringement of personal information, you may contact the following organisations.

  1. 1. Privacy Infringement Report Centre (operated by the Korea Internet & Security Agency): privacy.kisa.or.kr / 118 (no area code)

  2. 2. Personal Information Dispute Mediation Committee: www.kopico.go.kr / 1833-6972 (no area code)

  3. 3. Supreme Prosecutors' Office: www.spo.go.kr / 1301 (no area code)

  4. 4. National Police Agency Cyber Bureau: ecrm.cyber.go.kr / 182 (no area code)

Article 13 (Changes to the Privacy Policy)

This privacy policy applies from 20 August 2026.