TapIt Pay Privacy Policy

The Company collects the following personal information in order to provide the Service, including deposit requests and account ownership verification (1-won verification).

In the 1-won transfer verification and real-name account inquiry process, the above information is processed through third-party verification providers (CODEF / Hecto Data Co., Ltd.).

The Company uses the collected personal information for the following purposes.

• Verifying whether the depositor owns the account and whether the account holder name matches (fraud prevention)
• Providing the KRW deposit and withdrawal agency service
• Preventing fraudulent use of the Service and detecting abnormal transactions
• Handling user inquiries and complaints

Collected personal information is not used for any purpose other than the above. If the purpose of use changes, the Company will take the necessary measures in accordance with applicable laws, such as obtaining separate consent.

In principle, the Company destroys a user's personal information without delay once the purpose of its collection and use has been achieved. However, where retention is required under applicable laws, the Company retains member information for the periods prescribed by those laws, as set out below.

In principle, the Company does not provide users' personal information to outside parties. The following cases are exceptions.

• Where the user has consented in advance to the provision to a third party
• Where required by law, or where an investigative agency requests it for investigative purposes in accordance with the procedures and methods prescribed by law

To perform the Service, the Company outsources personal information handling tasks to the external specialist below, and, in accordance with applicable laws, stipulates in the outsourcing contract the matters necessary to ensure that personal information is managed safely.

Pursuant to Article 26 of the Personal Information Protection Act, when concluding an outsourcing contract the Company specifies in writing, such as in the contract, matters concerning the prohibition of processing personal information for purposes other than the outsourced task, technical and managerial protection measures, restrictions on sub-outsourcing, management and supervision of the processor, and liability such as compensation for damages, and supervises whether the processor handles personal information safely.

As a data subject, you may exercise the following rights.

• Request access to personal information
• Request correction in case of errors, etc.
• Request deletion
• Request suspension of processing

You may exercise these rights by contacting the Company in writing, by telephone, by e-mail, or by similar means, and the Company will take action without delay.

When personal information becomes unnecessary, for example because the retention period has elapsed or the purpose of processing has been achieved, the Company destroys it without delay. Personal information stored in electronic files is deleted using technical methods that make the records impossible to reproduce, and personal information recorded or stored on paper documents is destroyed by shredding or incineration.

The Company takes the following measures to ensure the security of personal information.

• Limiting access to personal information to the minimum number of personnel
• Keeping records of the granting, modification, and revocation of access rights to systems that process personal information
• Encrypting important information such as passwords and account information during storage and transmission
• Installing security software against hacking and the like, and updating and inspecting it periodically

The Company bears overall responsibility for personal information processing and has designated the following Chief Privacy Officer to handle user complaints and provide remedies for damage relating to personal information processing.

If this Privacy Policy is added to, deleted from, or amended, the Company will give notice through the announcements on its website at least 7 days before the revision takes effect.

This policy takes effect on September 29, 2026.