This English version is a translation provided for convenience. If there is any discrepancy between this version and the Korean original, the Korean original prevails.
K&2P Co., Ltd. (the "Company") complies with the Personal Information Protection Act of the Republic of Korea and other related laws and regulations. To protect the personal information of users of the MoriPay application (the "Service"), the Company establishes and discloses this Privacy Policy as follows.
Article 1 (Purposes of Collection and Use of Personal Information)
The Company collects and uses the minimum personal information necessary for the following purposes:
- Membership registration and identity verification
- Provision and operation of the Service, and member management
- Payment, delivery and customer support for products sold by the Company (such as eSIMs)
- Linking with and processing applications for Individual Services
- Handling customer inquiries and complaints, and responding to disputes
- Preventing violations of laws and terms, and preventing fraudulent use
- Improving the Service and developing new services
Article 2 (Personal Information Collected)
- Information collected at membership registration
- (a) Required items: name (in English or romanized letters), nationality, date of birth, gender, email address, password, MoriPay ID, nickname, profile photo, passport information (passport photo, passport number, expiration date, etc.), device information, push notification token, service usage records and access logs
- (b) Some information may be required to verify that the user is a foreign national and to provide Individual Services.
- Information collected during use of the Service
- (a) Payment information (payment method identifiers, payment history, etc.)
- (b) Remittance information (remittance history, remittance messages, etc.)
- (c) Delivery information (for products sold by the Company)
- (d) Customer consultation and inquiry history
- (e) Service usage records, error logs and access IP information
Article 3 (Provision of Personal Information to Third Parties)
As a rule, the Company does not provide users' personal information to third parties. However, the Company may provide personal information as follows, only where the user has consented to such provision in the course of using the Service.
- Recipients: partner service providers of Individual Services linked with the Service
- (a) Prepaid electronic payment means, payment and PG (payment gateway) services: Hecto Financial Co., Ltd.
- (b) Other partner service providers whose services the Company offers to foreign users:
- (1) Passenger transport business operators (taxi transport operators and drivers): Jumbo Taxi Association
- (2) Non-life insurance business operator (travel insurance): Meritz Fire & Marine Insurance Co., Ltd.
- (3) Electronic financial business operator (transit card operator): EZL Corp.
- Information provided: of the personal information collected at registration and during use of the Service, the minimum information necessary to provide the relevant partner service (name, payment information and service usage information)
- Purposes: application for and provision of individual partner services, identity verification, payment processing, customer support and dispute response
- Timing and scope: provided only when the user actually uses the relevant Individual Service, and only to the extent necessary
- Legal basis: the user's consent to the provision of personal information to third parties under Article 17(1)(1) of the Personal Information Protection Act
The use of an Individual Service is subject to the terms of use and privacy policy of the relevant Service Provider.
Article 4 (Outsourcing of Personal Information Processing)
Where necessary for the smooth provision of the Service, the Company may outsource part of its personal information processing to external specialist vendors. In such cases, the Company concludes outsourcing contracts in accordance with applicable laws and supervises the vendors to ensure that personal information is managed securely.
Article 5 (Retention and Use Period)
The Company retains and uses personal information until the purposes of collection and use are achieved. However, where retention is required by applicable laws, the Company retains the information for the period prescribed by those laws.
- Records of contracts or withdrawal of offers: the retention period prescribed by laws on electronic commerce
- Payment and transaction records: the retention period prescribed by applicable laws
- Records of customer inquiries and dispute handling: a certain period after the dispute is resolved
- Identification information of withdrawn members: as set out in Article 6 (Handling of Withdrawn Members)
Article 6 (Handling of Withdrawn Members)
- Members who withdraw normally
- (a) Information retained and form: email address and MoriPay ID (converted by one-way hash encryption)
- (b) Retention period: 90 days from the date of withdrawal
- (c) Reasons for retention and re-registration policy
- (1) Preventing misdirected remittances: if a third party registers the same email address or MoriPay ID immediately after a withdrawal, former counterparties or acquaintances may mistake that person for the previous user and send money to the wrong recipient. Retention prevents such financial accidents.
- (2) Preventing pre-emptive registration of IDs and email addresses: for 90 days, other persons may not register the same account.
- (3) Exception for re-registration by the same person: a withdrawn member who re-registers with the same email address may do so immediately, without the 90-day waiting period.
- Fraudulent users (users subject to restrictions)
- (a) Information retained and form: passport number and date of birth (converted by one-way hash encryption)
- (b) Retention period: 1 year from the date of withdrawal
- (c) Reason for retention: to prevent re-registration and malicious reuse by persons who engaged in misconduct such as identity theft, false identity verification, or illegal currency exchange or resale, as set out in Article 5 (Fraudulent Use and Restrictions on Use of the Service) of the Service Terms for Foreign Users.
Article 7 (Procedures and Methods for Destroying Personal Information)
- When the retention period expires or the purposes of processing are achieved, the relevant personal information is destroyed without delay.
- Personal information in electronic files is deleted by a method that makes it unrecoverable, and paper documents are shredded or incinerated.
Article 8 (Users' Rights and How to Exercise Them)
Users may exercise the following rights at any time:
- Request access to their personal information
- Request correction or deletion of their personal information
- Request suspension of processing of their personal information
- Withdraw consent and request withdrawal of membership
These rights may be exercised through the Customer Center, in writing, by email or by similar means.
Article 9 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to protect personal information:
- Management of access rights to personal information
- Encryption of passwords
- Operation of security systems and firewalls
- Establishment of an internal management plan and training of officers and employees
Article 10 (Chief Privacy Officer)
- Chief Privacy Officer: Jinsoo Park
- Title: CEO (Representative Director)
- Email: sales@kn2p.co.kr
- Contact: MoriPay Customer Center
Article 11 (Changes to this Privacy Policy)
If this Privacy Policy is changed, the Company will give advance notice of the changes and their effective date through announcements within the Service.
Addendum
This Privacy Policy takes effect on October 1, 2026.