Privacy Policy
Effective date: August 5, 2026 (Last revised: October 19, 2026)
This Privacy Policy is written in Korean, and translations such as the English and Dutch versions are provided to help users understand it. In the event of any conflict of interpretation between a translation and the Korean original, the Korean original shall prevail. However, this clause does not limit the rights guaranteed to data subjects by the personal data protection laws of the country in which they reside (such as the EU GDPR).
01 Article 1 (Purpose and Scope)
- 1. K-NARU (hereinafter "Company") considers users' personal information to be of utmost importance and strictly complies with global data protection regulations, including South Korea's Personal Information Protection Act and the European Union's General Data Protection Regulation (GDPR).
- 2. In processing the personal data of users worldwide, the Company adheres to the principles of Data Minimization and Purpose Limitation and applies top-level encryption and security measures.
- 3. This policy applies to the entirety of the website and online education services provided by the Company.
- 4. Controller: K-Culture Exchange Center (service name K-NARU), representative Minoo Kim, business registration number 666-29-01718, address F2901A, Building A, Osan Hyundai Terra Tower CMC, 35 Sumogwon-ro 88beon-gil, Osan-si, Gyeonggi-do, Republic of Korea, email contact@k-naru.com
02 Article 2 (Personal Data Collected and Legal Basis)
The Company collects the minimum amount of personal data necessary to provide the Service and processes it based on the following legal bases in accordance with GDPR Article 6.
1. Account Registration and Management (Performance of Contract & Consent)
Mandatory data: Email address, password (stored with one-way encryption), name in English as shown on the passport, phone number, date of birth, nationality.
Optional data: Social media messenger platform and account.
Purpose: Identifying members and contacting them as needed to use the Service, such as for class schedules, counseling appointments and payments.
2. Service Use and Learning Management (Performance of Contract)
Automatically collected data: Service usage logs, learning progress, completion rates.
3. Application Processing and Eligibility Verification (Performance of Contract; Separate Consent for Unique Identification Information)
Data collected: application documents such as a copy of your passport (unique identification information such as your passport number, and your name, date of birth, nationality and photo) and your academic transcript. Purpose: verifying your eligibility and identity. Unique identification information such as your passport number is processed only where you have given consent on the application form separately from any other consent (Article 24(1)(1) of the Korean Personal Information Protection Act). You may refuse to consent, but if you do, you cannot submit an application. Passport copies are checked only by Company staff and are not provided to universities or any other third party. If your passport shows a national personal number (for example, the Dutch citizen service number, BSN), please cover it before uploading.
[Special Protection Measure]: Application documents are stored encrypted (Cloudflare R2) and are permanently destroyed within 7 days after the review of the application ends or the application is cancelled. The record of your consent to the processing of passport information (date and time of consent and the Privacy Policy version) is kept until you leave the service, to demonstrate that consent was lawfully obtained.
4. Payment Processing (Performance of Contract)
The Company never directly collects or stores on its servers financial information such as credit card numbers or bank account numbers. Payments are processed securely through a global payment service provider (PayPal). To process payments and refunds, the Company retains, together with the payment records, records of the consents given before payment (Terms version and time of consent) and records of cancellation and refund requests (time of request, reason and outcome); the retention period follows Article 3. The Company also uses refund records to check the number of refunds processed at the member's request in the last 90 days under Article 11(6) of the Terms of Service (legal basis: the legitimate interest in managing payment costs and preventing improper use, GDPR Article 6(1)(f)), and the decision on reviewing a payment is made by staff.
To apply regional pricing and prevent improper use, when you pay we store in your enrollment record the country you connected from (a country code determined from your IP address; the IP address itself is not stored) and the payer country provided by PayPal (legal basis: performance of the contract and our legitimate interest in preventing improper use, GDPR Article 6(1)(b) and (f)). This information is kept for the same period as the payment records described in Article 3. Materials submitted during the explanation process under Article 11 of the Terms of Service are used only for verification and are destroyed without delay once the verification is complete.
5. Customer Support and Dispute Resolution (Legitimate Interest & Legal Obligation)
Data collected: Name, email address, inquiry content, device/browser info, access IP.
6. Cookies and Online Advertising Tracking (Google Ads & Consent Mode)
The Company uses the Google advertising tag to measure advertising performance; in doing so, cookies, device and browser information, and information about the pages visited are processed by Google. Users accessing the service from the European Economic Area (EEA) or the United Kingdom are asked for prior consent through a cookie banner; until they consent, no advertising cookies are stored and only cookieless measurement signals may be sent to Google (Consent Mode v2; legal basis: consent, GDPR Article 6(1)(a)). If a user refuses consent, the refusal is kept for 30 days, and the choice can be changed at any time in the banner. For users accessing from other regions, advertising cookies are used by default; they can refuse cookie storage or delete stored cookies in their browser settings. In addition, at sign-up, login and password recovery, Cloudflare Turnstile processes browser and device information to block automated attacks (legal basis: the legitimate interest in providing and securing the service, GDPR Article 6(1)(f)).
7. Receiving Promotional and Event Information (User Consent, Optional)
Data used: Of the email address, phone number and social media messenger account, the channels through which the user has consented to receive information. Purpose: Information about new courses, coupons and events (legal basis: user consent, Article 6(1)(a) GDPR). Retention period: Until consent is withdrawn or the account is deleted. The sending of promotional emails is outsourced to Resend (Article 4).
Not consenting does not restrict registration or course enrollment. Consent can be withdrawn at any time, either for each channel on the 'Edit Profile' screen or without logging in via the unsubscribe link in promotional emails, and the Company will notify the user by email of the result of processing a consent or withdrawal within 14 days from the date of processing. Every 2 years from the date of consent, the Company confirms whether the user wishes to maintain their consent. Promotional emails are marked with '(광고)' (Korean for “advertisement”) at the beginning of the subject line. Promotional information sent by phone, text message or social media messenger is sent only between 8:00 a.m. and 9:00 p.m. in both Korean time and the recipient's local time.
8. Parental consent for members under 16 (compliance with a legal obligation)
Items collected: the name of the parent or legal guardian (legal representative), their relationship to the student, their email address, and the consent record (the items consented to, the versions of the Terms of Service and Privacy Policy, the date and time of consent, and staff verification notes). Purpose: to verify, and be able to demonstrate, the consent of the legal representative of members under 16 (legal basis: compliance with a legal obligation, GDPR Article 6(1)(c) and Article 8, and Article 22-2 of the Korean Personal Information Protection Act). Retention: if consent is not given within 30 days of sign-up, or the guardian refuses consent, this information is destroyed without delay together with the account; where consent is given, the consent record is kept separately for 5 years after the member leaves, in the same way as the contract records in Article 3. The Company does not collect identity documents or family relationship certificates from guardians.
03 Article 3 (Retention and Use Period)
The Company destroys personal data without delay in an irrecoverable manner when the purpose of processing has been achieved or the user requests to withdraw membership. However, in accordance with the laws of the Republic of Korea, the following information is securely stored separately for the periods specified.
- 1. Records on contracts or withdrawal of orders: 5 years (Act on the Consumer Protection in Electronic Commerce)
- 2. Records on payments and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce)
- 3. Records on consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce)
- 4. Website visit records (access logs, IPs, etc.): 3 months (Protection of Communications Secrets Act)
Destruction procedure and method: the Company destroys personal data without delay once the retention period has ended or the purpose of processing has been achieved. Information in the database is deleted so that it cannot be recovered, and uploaded document files are permanently deleted from storage. Information that must be kept under applicable laws is stored separately from other information and destroyed in the same way when its retention period ends.
04 Article 4 (Third-Party Provision and Cross-Border Transfer)
1. The Company does not sell or provide personal data to third parties without the user's prior consent.
2. The Company entrusts the processing of personal data to the processors listed below in order to operate the service. All of these processors are located outside the Republic of Korea, so personal data is transferred abroad; the Company ensures that personal data is processed securely under the data processing agreement (data processing addendum) concluded with each processor.
3. [Cross-Border Transfer]
Although the Company is a business located in the Republic of Korea, the service's database is stored in Australia (Sydney) and uploaded document files are stored in the United States, and email delivery, website delivery and advertising measurement are carried out in the countries where each of the providers below is located. When personal data of users in the European Union (EU) or the European Economic Area (EEA) is transferred to a country that does not have an adequacy decision from the European Commission, the transfer is based on the EU Standard Contractual Clauses (GDPR Article 46), and, where a processor is certified under the EU-U.S. Data Privacy Framework, also on that certification (GDPR Article 45). For users in the Republic of Korea, the transfer falls under entrustment of processing for the performance of a contract disclosed in this Policy (Article 28-8(1)(3) of the Korean Personal Information Protection Act); for users in other countries, the Company also complies with the cross-border transfer requirements of those countries' laws. If you do not want your personal data to be transferred abroad, you may ask the data protection officer in Article 7 to stop the transfer or you may delete your account; in that case, your use of the service may be limited.
4. [Cross-Border Transfer Due to Outsourcing of Email Sending]
Recipient: Plus Five Five, Inc. (service name Resend, contact support@resend.com). Destination country: United States. Time and method of transfer: transmitted over an encrypted network each time an email is sent. Items transferred: email address, name, email content. Purpose of use: sending emails. Retention and use period: sending records are kept for 30 days and then deleted, and backups are kept for up to 7 additional days. Legal basis for the transfer: for users in the Republic of Korea, outsourcing of processing for the performance of a contract, as disclosed in this Policy (Article 28-8(1)3 of the Personal Information Protection Act); for EU/EEA users, the EU Standard Contractual Clauses (Article 46 GDPR), with Resend's certification under the EU-U.S. Data Privacy Framework (Article 45 GDPR) serving as an additional basis. If you do not want your data to be transferred, you may refuse the transfer by contacting the Personal Information Protection Officer named in Article 7 or delete your account; in this case, the use of services that require email, such as class and payment notices, may be restricted.
5. [Cross-border transfer for database and member authentication]
Recipient: Supabase Pte. Ltd. (contact: privacy@supabase.com). Country: Australia (stored in an Amazon Web Services data centre in Sydney). Timing and method: transmitted and stored over encrypted connections whenever the service is used. Items: service data such as sign-up and account information, enrollment, payment and refund records, application information, counseling, chat and Q&A content, and consent records. Purpose: operating the database and member authentication services. Retention and use period: until the retention periods in Article 3 and in each item of Article 2.
6. [Cross-border transfer for website operation, document storage and security checks]
Recipient: Cloudflare, Inc. (contact: dpo@cloudflare.com). Country: United States (uploaded document files are stored in the western United States, and website requests are processed in the Cloudflare data centre closest to the user). Timing and method: transmitted over encrypted connections when the website is accessed or documents are uploaded. Items: IP address, device and browser information, information exchanged while using the website, and uploaded document files (passport copies, transcripts, etc.). Purpose: operating and delivering the website, storing document files, and blocking automated attacks (Turnstile). Retention and use period: document files until the period in Article 2(3); operational records (logs) for up to 7 days.
7. [Cross-border transfer for advertising measurement]
Recipient: Google LLC (contact: https://support.google.com/policies). Country: United States. Timing and method: transmitted over encrypted connections when a website page is opened. Items: IP address, device and browser information, information about the pages visited, and advertising cookies (where cookie use is permitted under Article 2(6)). Purpose: measuring advertising performance. Retention and use period: as set out in Google's privacy policy; advertising cookies until the user withdraws consent or deletes them in the browser.
8. [Payments and video classes]
Payments are processed by PayPal, and live classes by Zoom, each as an independent controller under its own privacy policy. When you pay, the Company sends PayPal the order information (course name, class time, amount and currency) and a member identification number used to match the order, and receives the payment result and the payer's country from PayPal. Payment details such as card numbers are collected directly by PayPal and are not received by the Company. When you join a class, your name, video, audio and similar information are processed by Zoom.
05 Article 5 (Data Subject Rights - GDPR Rights)
Users (including EU citizens) may exercise the following rights at any time, and the Company will act on these requests without delay (within a maximum of 1 month).
- 1. Right to Access and Rectification: Request access to and correction of personal data.
- 2. Right to Erasure (Right to be Forgotten): Request immediate deletion of data that is not subject to a legal retention period.
- 3. Right to Restriction of Processing: Request restriction of data processing under specific conditions.
- 4. Right to Data Portability: Request the download of personal data in a machine-readable format.
- 5. Right to Withdraw Consent: The right to withdraw consent for data processing at any time (via account deletion feature). Consent to receive promotional and event information can be withdrawn for each channel on the 'Edit Profile' screen or via the unsubscribe link in promotional emails.
- 6. Right to object: the right to request that the Company stop processing personal data that it processes on the basis of legitimate interests (such as customer support, regional pricing and fraud prevention, and security checks)
You can exercise these rights by sending a request to the email address in Article 7, and you can view and correct your member information yourself on the 'Edit Profile' screen. To verify your identity, the Company may reply to the email address you signed up with. A legal representative or a person authorised by you may also exercise these rights.
06 Article 6 (Security Measures and Data Breach Notification)
1. To prevent data breaches, the Company encrypts all communication channels (SSL/TLS) and strictly controls access to databases.
2. [Breach Notification Obligation]
In the event of a personal data breach, the Company will report it to the relevant regulatory authorities (KISA in Korea, the competent EU supervisory authority and other bodies designated by applicable law) within 72 hours of becoming aware of it, and will notify the affected data subjects of the breach and the response measures without delay.
07 Article 7 (Personal Information Protection Officer and DPO)
The Company has appointed the following Data Protection Officer (DPO) to protect user data and handle related complaints.
- Name/Title: Minoo Kim (CEO / Chief Officer)
- Email: contact@k-naru.com
- Working Hours: Weekdays 09:00 - 18:00 (KST)
08 Article 8 (Notice of Policy Changes)
If the Company revises this Privacy Policy, it will clearly notify users of the changes at least 30 days prior to the effective date via website announcements or registered email.
09 Article 9 (Remedies for infringement of rights)
If you need relief or advice regarding an infringement of your personal data, you may apply for dispute resolution or advice to the organisations below. Users residing in the European Union (EU) or the European Economic Area (EEA) have the right to lodge a complaint with the data protection supervisory authority of their country of residence, place of work or the place of the alleged infringement (GDPR Article 77).
- 1. Personal Information Dispute Mediation Committee (Korea): 1833-6972 (www.kopico.go.kr)
- 2. Personal Information Infringement Report Center (KISA, Korea): 118 (privacy.kisa.or.kr)
- 3. Supreme Prosecutors' Office (Korea): 1301 (www.spo.go.kr)
- 4. Korean National Police Agency: 182 (ecrm.police.go.kr)