Privacy Policy
How VINOFOLIO Co., Ltd. handles personal information.
Effective date October 29, 2026
VINOFOLIO Co., Ltd. (the “Company”) establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act of the Republic of Korea (the “PIPA”) to protect the personal information of data subjects and to handle related concerns promptly and smoothly.
This Policy applies to the Company’s website and its online ordering system for trade partners (the “Ordering System”). The Company trades with business customers such as restaurants, wine shops and hotels, and in doing so processes the personal information of their staff.
This English version is a translation provided for convenience. If there is any discrepancy, the Korean version prevails.
1. Purposes of processing
The Company processes personal information for the following purposes. It does not use personal information for any other purpose, and if a purpose changes it will take the necessary steps, such as obtaining separate consent under Article 18 of the PIPA.
- Receiving and reviewing partner applications: checking applications, verifying the business (checking its registration status with the National Tax Service), explaining trading terms and contacting the applicant
- Managing partner accounts: sign-in to the Ordering System and identity verification, account management and prevention of misuse
- Processing orders and managing trade: receiving, approving, amending and cancelling orders; issuing sales slips and trade statements; settlement; dispatch and delivery
- Order status updates: KakaoTalk notification messages (if you have consented), web push notifications and in-system notifications
- Responding to enquiries: reviewing and answering enquiries and chats
- Account management for sales: records of consultations and visits, preparing and sending proposals
2. Personal information we process
| Category | Items | How collected |
|---|---|---|
| Partner application (registered business) | Copy of business registration certificate, business registration number, business name, type of business, contact person’s name, mobile number, email, business address, trading (signboard) name, delivery address and enquiry details (only if provided), result of the National Tax Service status check (active, suspended or closed; time of check) | Partner application form on the website (Korean only) |
| Partner application (preparing to open) | Planned business name, type of business, planned opening (year and month), area (city and district), contact person’s name, mobile number, email, enquiry details (only if provided) | Partner application form on the website (Korean only) |
| Partner account | Business (trading) name, business registration number (sub-business number), representative’s name, business address, business type and items, contact person’s name, phone number, email, sign-in password (stored encrypted) | Provided by the partner when trading begins (email, phone, in writing, etc.); the Ordering System |
| Request to start official trading | Phone number, email, copy of business registration certificate | “Start official trading” in the Ordering System |
| Delivery locations | Location name, address, location contact number | Provided by the partner; the Ordering System |
| Orders | Items, quantities and amounts ordered, delivery location, requests | The Ordering System |
| KakaoTalk notifications | Mobile number for notifications; date and time of consent, how consent was confirmed (entered by you or on your behalf by staff) and the consent wording version | The Ordering System (separate consent) |
| Web push | Browser push subscription data (subscription endpoint, encryption keys) | When you allow notifications in your browser |
| Enquiries | Enquiry and chat content, attachments (photos, PDFs) | Enquiries and chat in the Ordering System |
| Automatically generated data | Sign-in session cookie, last sign-in time, server access logs (IP address, access time, requested URL, browser information, etc.) | Generated automatically while using the service |
The public pages of the website (wineries, wines, about us, etc.) can be viewed without signing in, and the Company does not use advertising or analytics cookies on them.
3. Retention periods
The Company processes and retains personal information within the retention period required by law or agreed to by the data subject at the time of collection.
| Category | Retention period |
|---|---|
| Partner application | Destroyed without delay once the review is complete. Rejected applications are destroyed automatically 30 days after rejection, and applications from businesses preparing to open are destroyed automatically 6 months after receipt unless the applicant has become a partner. If the applicant becomes a partner, the necessary details are moved to partner account data and kept until trading ends, and the application itself is destroyed |
| Partner account and delivery locations | Until trading ends (account closure) or deletion is requested |
| Notification mobile number and consent record | Until trading ends or the number is deleted (consent withdrawn) |
| Web push subscription | Until the subscription is cancelled |
| Enquiries | Until trading ends or deletion is requested |
| Sign-in session cookie | 15 days after sign-in (deleted immediately on sign-out) |
However, information that must be kept under applicable laws is retained for the required period.
- Books and supporting documents on transactions: 5 years (Framework Act on National Taxes)
- Commercial books and important business documents: 10 years; slips: 5 years (Commercial Act)
- Service access logs: 3 months (Protection of Communications Secrets Act)
4. Destruction procedure and method
When personal information is no longer needed, for example because the retention period has passed or the purpose has been achieved, the Company destroys it without delay. Where it must be kept under law, it is stored separately.
- Procedure: personal information due for destruction is identified and destroyed after confirmation by the Privacy Officer.
- Method: electronic files are deleted in a way that makes them unrecoverable; paper documents are shredded or incinerated.
5. Provision to third parties
The Company processes personal information only within the purposes in Section 1 and provides it to third parties only where Articles 17 and 18 of the PIPA allow, such as with the data subject’s consent or under a specific legal provision. The Company currently does not provide personal information to any third party.
However, when a registered business applies to become a partner, the Company checks the business registration number in the application against the National Tax Service business status service (via the Korean Public Data Portal) to verify the business. Only the business registration number is used; no names, contact details or other information are sent. This check only confirms the business status (active, suspended or closed) from information the National Tax Service already holds; it does not hand personal information to the National Tax Service to process on the Company’s behalf or to use for its own purposes, so it is neither a provision to a third party nor outsourcing of processing.
6. Outsourcing of processing
To run its business smoothly, the Company outsources the processing of personal information as follows.
| Processor | Outsourced work |
|---|---|
| Supabase, Inc. | Operating the database and file storage (partner and order data, business registration certificates, enquiry attachments) |
| Vercel Inc. | Operating the servers for the website and the Ordering System (hosting) |
| SOLAPI Inc. (주식회사 솔라피) | Sending KakaoTalk notification messages on our behalf |
| Kakao Corp. (주식회사 카카오) | Delivering KakaoTalk notification messages |
| Ecount Inc. (주식회사 이카운트) | Operating the ERP (partner records and sales slips) |
| Starlogis (스타로지스) | Storage, dispatch and delivery of goods (delivery location name, address and contact number, and items on the order sheet) |
| CJ Logistics Corporation (CJ대한통운 주식회사) | Parcel delivery (recipient name, address and contact number) |
| Slack Technologies, LLC | Operating the internal work messenger (notifications of work records, comments and schedule notes written by staff) |
When entering into outsourcing contracts, the Company sets out in writing, under Article 26 of the PIPA, the prohibition of processing beyond the outsourced purpose, technical and managerial safeguards, restrictions on sub-outsourcing, supervision of the processor, and liability for damages, and supervises whether processors handle personal information securely. If the outsourced work or processors change, the Company will announce it through this Policy.
7. Transfer of personal information overseas
The Company transfers personal information overseas for internal work collaboration as follows. Work records, comments and schedule notes written by staff may include details of a partner’s contact person, and these are sent to and stored in the internal messenger (Slack) as notifications.
| Item | Details |
|---|---|
| Recipient | Slack Technologies, LLC |
| Recipient’s contact | privacy@slack.com (Slack privacy enquiries) |
| Country | United States |
| Items transferred | Names, contact details and similar information about a partner’s contact person that may be included in work records, comments and schedule notes written by staff |
| Purpose | Internal work collaboration (notifying staff of work records, schedules and comments) |
| When and how | Sent over the network when a work record, comment or schedule is saved or a scheduled reminder is sent |
| Retention | Kept until the work purpose is fulfilled, and destroyed when the Company deletes the message or stops using Slack |
If you do not want your information transferred overseas, please contact the Privacy Officer. On request, the Company will delete your personal information from the relevant work notes and internal messenger messages. This will not disadvantage your trading in any way.
The content of enquiries and chats written by customers, and their phone numbers, email addresses, addresses and business registration numbers, are not sent to the internal messenger. Notifications of new orders and enquiries contain only the business name and transaction details such as the order number, items, quantities and amounts; staff open the link in the notification to view the details in the Company’s own system.
Supabase, Inc. and Vercel Inc. are companies incorporated outside Korea, but the Company has configured its database and servers in the Republic of Korea (Seoul) region so that personal information is stored and processed in Korea.
8. Rights of data subjects and legal representatives
Data subjects may at any time request access to, correction or deletion of, or suspension of processing of their personal information, and may withdraw consent.
- You may exercise these rights by contacting the Privacy Officer in writing, by phone or by email, and the Company will act without delay (within 10 days for access requests).
- You can change or delete your notification mobile number yourself in the Ordering System; deleting it also deletes the consent record.
- You may also exercise these rights through a representative, such as a legal representative or a person you have authorised, who must submit a power of attorney.
- Deletion cannot be requested where another law specifies the information as subject to collection, and suspension of processing may be restricted where the law provides otherwise.
- The Company verifies that the person making a request is the data subject or a legitimate representative.
9. Security measures
The Company takes the following measures to keep personal information secure.
- Password encryption: sign-in passwords are stored using one-way encryption and cannot be recovered.
- Encryption in transit: the website and the Ordering System communicate only over HTTPS.
- Access control: partners can see only their own information; staff can access only the screens permitted for their role, and permissions are checked on every request. Row-level access control is applied in the database.
- File protection: business registration certificates and enquiry attachments are kept in private storage and shown only to authorised people through short-lived links.
- Sign-in protection: the number of sign-in attempts is limited, and session cookies are set so that browser scripts cannot read them (HttpOnly).
10. Cookies
The Company uses cookies to keep you signed in to the Ordering System. A cookie is a small text file that the server sends to your browser and that is stored on your device.
| Cookie | Purpose | Duration |
|---|---|---|
| vf_session | Keeps partners signed in | 15 days (deleted on sign-out) |
| vf_admin_session | Keeps staff signed in | 15 days (deleted on sign-out) |
The Company does not use advertising or analytics cookies. You can refuse cookies in your browser settings (for example, Chrome Settings › Privacy and security › Third-party cookies, or Safari Settings › Privacy). If you refuse cookies, however, you will not be able to sign in to the Ordering System.
11. Privacy Officer
The Company has designated the following Privacy Officer, who is responsible for overseeing the processing of personal information and for handling complaints and remedies relating to it.
- Privacy Officer: 전동혁
- Phone: +82-70-4102-1481
- Email: vinofolio.official@gmail.com
You may contact the Privacy Officer with any privacy-related enquiry, complaint or request for remedy arising from your use of the Company’s services, and the Company will respond and act without delay.
12. Remedies for infringement
To seek remedies for an infringement of personal information, you may apply for dispute resolution or consultation to the following bodies in Korea.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
13. Changes to this Policy
This Privacy Policy takes effect on October 29, 2026. If anything is added, removed or changed, the Company will announce it on the website at least 7 days before it takes effect.
Previous Privacy Policy: effective April 10, 2024