Privacy Policy
BaroFood Privacy Policy
Koroco Co., Ltd. ("Koroco" or the "Company") complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws and regulations. All personal information of users handled within the information network operated by Koroco is collected, retained, and processed in accordance with applicable laws or with the user's consent. Pursuant to Article 30 of the Personal Information Protection Act, Koroco has established the following Privacy Policy to protect users' personal information and rights and to handle users' privacy-related grievances promptly.
Article 1 (Purposes of Collection and Use of Personal Information)
Koroco collects and processes personal information for the following purposes and does not use it for any purpose other than those stated below.
(1) Member registration and management
Personal information is processed for the purposes of confirming the intent to register as a member, verifying identity and authenticating users for paid membership services, maintaining and managing membership status, preventing fraudulent use of the Service, providing various notices and notifications, handling grievances and complaints, and preserving records for dispute resolution.
(2) Handling of civil complaints and inquiries
Personal information is processed for the purposes of verifying the identity of the inquirer, confirming the details of the inquiry, contacting and notifying for fact-finding, and communicating the results of the handling.
(3) Performance of service contracts and fee settlement
Personal information is processed for the purposes of identity verification for financial transactions, payment and settlement of fees, issuance of invoices, age verification, and the provision of content and services.
(4) Marketing and advertising
Personal information is processed for the purposes of providing event and advertising information and opportunities to participate, providing services and displaying advertisements based on demographic characteristics, verifying the effectiveness of the Service, developing new services and providing customized services, and analyzing access frequency or compiling statistics on members' use of the Service.
Article 2 (Items of Personal Information Collected)
(1) At the time of membership registration, Koroco collects the following items for identity verification and service provision:
Login account, contact information, name, national identification number (resident registration number), address, phone number, email address, business registration number, vehicle information, bank account number, etc.
(2) In addition to the items in Paragraph (1), the following items may be generated and collected in the course of service use and business processing:
Service usage records, records of suspension of use, access logs, cookies, visit dates and times, payment records, transport performance records, etc.
(3) Types of "personal information" and "sensitive user data" accessed, collected, used, or shared by the app:
The personal information used in this app consists of a login account (unrelated to any Google account) and contact information.
This app does not collect, use, or share any data other than the "personal information" and "sensitive user data" described above.
By using this app, you are deemed to consent to the transmission of the above "personal information" and "sensitive user data" to our servers for use.
This information is accessible only by the Company, unless you publicly share data through the app.
(4) Procedures for the secure handling of personal information and sensitive user data, and purposes of use:
The login account and contact information among the "personal information" are used to filter out unlawful duplicate users and to respond to customer inquiries.
Contact information is used solely to determine, via a server API, whether a counterpart is using this Service, and is not separately stored or retained on the server.
"Sensitive user data" consists of basic app data values required to use the app, and users may delete such data at any time.
Article 3 (Retention and Use Period of Personal Information)
In principle, users' personal information is destroyed without delay once the purpose of its collection and use has been achieved. However, the following information is retained for the periods specified below for the reasons stated.
(1) Retention based on internal Company policy
Records of fraudulent use
Reason for retention: prevention of fraudulent registration and fraudulent use
Retention period: 5 years
(2) Retention required by applicable laws
Where retention is required under applicable laws such as the Commercial Act and the Act on Consumer Protection in Electronic Commerce, the Company retains member information for the period prescribed by such laws. In such cases, the Company uses the retained information solely for the purpose of such retention, and the retention periods are as follows:
Records concerning contracts or withdrawal of offers
Reason: Act on Consumer Protection in Electronic Commerce
Retention period: 5 years
Records concerning payments and the supply of goods (electronic financial transactions)
Reason: Act on Consumer Protection in Electronic Commerce
Retention period: 5 years
Records concerning consumer complaints or dispute resolution
Reason: Act on Consumer Protection in Electronic Commerce
Retention period: 3 years
Records concerning identity verification
Reason: Act on Promotion of Information and Communications Network Utilization and Information Protection
Retention period: 6 months
Records concerning site visits (access logs)
Reason: Protection of Communications Secrets Act
Retention period: 3 months
Records concerning statistical surveys
Reason: statistical survey data for customer satisfaction and service improvement
Retention period: 3 years
Article 4 (Provision of Personal Information to Third Parties)
(1) In principle, Koroco processes users' personal information with due care only within the scope of the purposes specified in Article 1.
(2) Except in the following cases, Koroco does not use users' personal information beyond the scope specified in Article 1 or provide it to third parties without the user's prior consent:
Where separate consent has been obtained from the data subject
Where there are special provisions in other laws
Where the data subject or their legal representative is unable to express their intent, or prior consent cannot be obtained due to an unknown address or similar reasons, and it is clearly deemed necessary for the urgent protection of the life, body, or property of the data subject or a third party
Where personal information is provided in a form that does not identify a specific individual, as necessary for purposes such as compiling statistics or academic research
Article 5 (Outsourcing of Personal Information Processing)
Koroco does not currently outsource the processing of personal information. If the Company outsources personal information processing to a third party in the future, it will do so under a written agreement that includes the following matters, and any change to this policy will be announced through this Privacy Policy:
Prohibition of processing personal information for purposes other than the performance of the outsourced work
Technical and managerial protective measures for personal information
Other matters prescribed by Presidential Decree for the safe management of personal information
Article 6 (Rights and Obligations of Data Subjects and How to Exercise Them)
Users, as data subjects, may exercise the following rights.
(1) A data subject may exercise the following privacy-related rights against Koroco at any time:
Request to access personal information
Users may request access to their personal information. However, Koroco may limit or refuse access, notifying the data subject of the reason, in any of the following cases:
(a) Where access is prohibited or restricted by law
(b) Where access may harm the life or body of another person, or unjustly infringe upon the property or other interests of another person
(c) Where a public institution would face serious difficulty in performing any of its legally prescribed duties
Request to correct or delete personal information
Users may request Koroco to correct or delete their personal information. However, deletion may not be requested where the personal information is specified as subject to collection under other laws. Upon receiving such a request, Koroco will, except where special procedures are prescribed by other laws, investigate the personal information without delay, take necessary measures such as correction or deletion in accordance with the data subject's request, and notify the data subject of the result.
Request to suspend processing of personal information
Users may request Koroco to suspend the processing of their personal information, and Koroco will suspend all or part of the processing without delay in accordance with the request. However, the request may be refused where there are special provisions in law, where it is unavoidable in order to comply with legal obligations, where there is a risk of harming another person, or where it would be difficult to perform a contract agreed upon with the data subject.
(2) The rights under Paragraph (1) may be exercised in writing, by email, by fax, or by other means in accordance with the form prescribed by the Enforcement Rules of the Personal Information Protection Act, and Koroco will take action without delay.
(3) Where a data subject requests the correction or deletion of errors in their personal information, Koroco will not use or provide that personal information until the correction or deletion is completed.
(4) The rights under Paragraph (1) may be exercised through an agent, such as the data subject's legal representative or an authorized person. In such cases, a power of attorney must be submitted.
Article 7 (Destruction of Personal Information)
In principle, Koroco destroys personal information without delay once the purpose of its collection and use has been achieved. The procedures, deadlines, and methods of destruction are as follows.
(1) Destruction procedure
Information entered by the user is transferred to a separate database (or a separate filing cabinet, in the case of paper documents) after the purpose has been achieved, stored for a certain period in accordance with internal policies and other applicable laws, and then destroyed, or destroyed immediately. Personal information transferred to such a separate database is not used for any other purpose except as required by law.
(2) Destruction deadline and method
When personal information becomes unnecessary, such as upon expiration of the retention period, achievement of the processing purpose, discontinuation of the relevant service, or closure of the business, personal information printed on paper is shredded or incinerated, and personal information stored in electronic file format is deleted using technical methods that render the records unrecoverable, as soon as practicable.
Article 8 (Measures to Ensure the Security of Personal Information)
Pursuant to Article 29 of the Personal Information Protection Act, Koroco takes the following technical, managerial, and physical measures necessary to ensure the security of personal information:
Regular internal audits
Minimization and training of personal information handling staff
Establishment and implementation of an internal management plan
Installation and periodic inspection and update of security software
Encryption of important personal information
Retention of access records and prevention of tampering
Restriction of access to personal information
Access control for unauthorized persons
Article 9 (Installation, Operation, and Refusal of Devices that Automatically Collect Personal Information, such as Cookies)
(1) Koroco uses "cookies," which store and retrieve user information from time to time. A cookie is a very small text file sent by the server used to operate the Koroco website to the user's browser, and it is stored on the user's computer hard disk.
(2) Cookies are used to analyze users' access frequency and visit times to the Koroco website and to provide customized, personalized services.
(3) Users have the right to choose whether to allow cookies. Users may configure their web browser options to allow all cookies, require confirmation each time a cookie is stored, or refuse the storage of all cookies.
Article 10 (Personal Information Protection Officer)
Koroco has designated a Personal Information Protection Officer as follows, who is responsible for overseeing personal information processing and handling data subjects' complaints and remedies relating to personal information processing:
Personal Information Protection Officer
Name: Kim Ki Jun, CEO of Koroco
Contact: connected to the personal information protection department
Personal Information Protection Manager
Name: Kim Ki Jun, CEO of Koroco
Contact: +82-1660-0404
Data subjects may direct all inquiries, complaints, and requests for remedies relating to personal information protection arising from the use of Koroco's services to the Personal Information Protection Officer and the responsible department. Koroco will respond to and handle data subjects' inquiries without delay.
Article 11 (Requests for Access to Personal Information / Remedies)
If you are not satisfied with the results of Koroco's own handling of personal information complaints and remedies, or if you need further assistance, please contact the following organizations (Republic of Korea):
Personal Information Infringement Report Center (operated by Korea Internet & Security Agency, https://privacy.kisa.or.kr) — dial 118
Personal Information Dispute Mediation Committee (https://www.kopico.go.kr) — +82-2-405-5150
Cyber Bureau, Korean National Police Agency (https://cyberbureau.police.go.kr) — dial 182
Cyber Investigation Division, Supreme Prosecutors' Office (https://www.spo.go.kr) — dial 1301
Article 12 (Duty of Notification)
This Privacy Policy applies from its effective date. In the event of any addition, deletion, or correction in accordance with laws or policies, such changes will be announced through a notice at least 7 days prior to their implementation.
Date of announcement: March 12, 2026
Effective date: March 12, 2026
Initial effective date: March 12, 2026
Company: Koroco
Representative: Kim Ki Jun
App name: BaroFood
Developer: Kim Ki Jun