Privacy Policy
This policy applies to ondopay.io and the OndoPay verification service and explains the standards for processing the minimum personal information required for user authentication, electronic signatures, and transaction verification.
Last updated: Mar 2026
Personal information controller: Lifening Co. Ltd.
OndoPay does not directly receive or hold customer funds, and personal information is processed only for authentication and transaction verification purposes.
1Scope
This Privacy Policy applies to ondopay.io and the OndoPay verification service. The Company complies with applicable laws and processes only the minimum personal information required to provide the service. OndoPay is transaction verification infrastructure for digital platforms and processes only the information needed for user identity verification, electronic signatures, account confirmation, and transaction verification.
2Categories of Personal Information Collected
The Company may process the following personal information.
| Category | Key Items | Purpose of Processing |
|---|---|---|
| Identity verification (KG Inicis) | Name, date of birth, mobile phone number, gender, nationality status, CI (Connecting Information), DI (Duplicate Information) | User identity verification and identification, electronic signature authentication |
| Account holder verification | Name, date of birth, bank name, account number | Reference account registration and verification of account ownership |
| Transaction verification (Hecto Data/CodeF) | Connected institution name, account identifiers, transaction inquiry results, request comparison results, transaction confirmation logs | Deposit and withdrawal verification and prevention of fraudulent use |
| Electronic signature logs | Electronic signature request information, electronic signature results, requested amount, request_id, authentication time | Electronic signature authentication, approval records, and audit log management |
3Purpose of Use
Collected personal information is used only for the following purposes.
- User identity verification and electronic signature authentication
- Verification of account ownership and registration of a reference account
- Verification of deposits and withdrawals and comparison of requested information with actual transaction records
- Prevention of fraudulent use, customer support, and service operations
4Entrustment of Personal Information Processing
To perform the service, the Company entrusts certain personal information handling tasks to specialized external providers as described below and, in accordance with applicable laws, stipulates necessary matters in its outsourcing agreements to ensure that personal information is managed safely.
| Entrusted Provider | Entrusted Work | Entrusted Information | Retention Period |
|---|---|---|---|
| KG Inicis | Provision of identity verification, electronic signature, and account verification services | Name, date of birth, mobile phone number, gender, nationality status, CI, DI, account information | Until the end of the contract |
| Hecto Data Co., Ltd. | Intermediary services for personal (credit) information using the authenticated credentials of the credit information subject, storage of request/response data for API service quality improvement and operational response, handling requests to access, correct, delete, or suspend processing of personal information | Personal (credit) information, all request/response data, corporate information | Until the end of the outsourcing agreement |
5Credit Information Inquiry and Use
For deposit and withdrawal verification, the OndoPay service may use Hecto Data (CodeF) financial data relay APIs, and in that process may handle account transaction inquiry results and request comparison results.
- Verification of deposits and withdrawals
- Comparison of requested information with actual transaction records
- Prevention of fraudulent use and service operations
6Retention and Protection
The Company applies the following measures to protect personal information.
- Encrypted data storage
- Minimization of access rights and access controls
- Security log recording and regular inspections
- Retained until the retention period required by applicable laws or until the purpose of service provision is fulfilled, then securely destroyed
7Cross-Border Transfer
Personal information processed by the OndoPay service is not transferred overseas. All personal information data is stored and processed on servers located in the Amazon Web Services (AWS) Seoul region.
8User Rights
Users may request access to, correction of, deletion of, and suspension of processing of their personal information at any time, and the Company supports the exercise of these rights in accordance with applicable laws.