Oryggi Technologies Pvt. Ltd. (hereafter “Company”) is committed to complying with applicable domestic and international data protection laws, including the Personal Information Protection Act (PIPA) and the General Data Protection Regulation (GDPR), to safeguard personal data and ensure effective complaint resolution.
To safeguard the personal data of data subjects and ensure efficient handling of related complaints, the Company has established and is disclosing its privacy policy as follows.
The Company processes the personal data of data subjects as follows:
In addition to the personal information processing indicated in Paragraph 1, the Company may process and preserve personal information in accordance with other laws and regulations. Personal information processed in accordance with other laws will be stored for the period specified in the relevant laws.
The company collects personal information in the following ways.
1. Website operated by the company (mobile web, Collection through apps (including apps)
2. Collection through generated information collection tools (access logs, cookies, etc.)
3. Collection of personal information directly provided by the information subject through offline events such as exhibitions
4. the information subject consults or inquires through email, phone, fax, etc.
When collecting personal information, personal information is collected to the minimum necessary, and the personal information being processed is not used for purposes other than those intended . If the purpose of use changes, we will take necessary measures, such as obtaining separate consent.
The Company will not use or disclose the data subject’s personal data to third parties without consent, except when required by relevant laws or regulations.
However, personal data may be provided without separate consent in the following situations:
1. For the purpose of settling service fees;
2. When providing data in an anonymized form for statistical, research, or market survey purposes to research institutions, survey organizations, or other entities; or
3. When required by special provisions of relevant laws, such as the Personal Information Protection Act, Act on Promotion of Information and Communications Network Utilization and Information Protection, Protection of Communications Secrets Act, Framework Act on National Taxes, Act on Real Name Financial Transactions and Confidentiality, Credit Information Use and Protection Act, Framework Act on Telecommunications, Telecommunications Business Act, Local Tax Act, Act on Consumer Protection in Electronic Commerce, Criminal Procedure Act.
If personal data is provided to third parties without the data subject’s consent under special legal provisions, only the minimum necessary information will be provided, and it will not be used for purposes other than the intended ones.
1. The Company entrusts and transfers (stores) personal data to domestic and overseas entities to ensure smooth information provision, marketing, and stable service delivery, where the personal data is retained by the systems of the entrusted company. The Company shall ensure that the entrusted company only manages the data physically and does not have access to it.
2. The Company manages and supervises the entrusted entity to ensure compliance with technical and administrative protection measures, as well as other relevant laws and regulations related to personal data, and prohibits them from processing the data for purposes beyond the scope specified.
3. In the event of a change in the content of the consigned processing or the entrusted company, the Company will promptly disclose such changes through this privacy policy.
4. The technical and administrative protection measures of cloud services shall comply with the policies of the cloud service provider. The cloud service provider shall solely manage the physical aspect of the outsourced personal data and shall not access it.
5. The data subject may choose to refuse the transfer of their personal data by contacting the Privacy Officer or the relevant department of the Company. However, please note that refusal to transfer personal data may result in limited access to the Company’s relevant services.
When personal data becomes obsolete, such as when the retention period expires or the processing purpose has been achieved, the Company shall dispose of the personal data promptly.
In cases where personal data needs to be retained despite the expiration of the agreed-upon retention period or the achievement of the processing purpose due to other laws, it will be transferred to a separate database (DB) or stored in a different location.
The following outlines the procedure and method-
Information entered by a data subject shall be transferred to a separate database (or a separate document if provided in hard copy) once the intended purpose has been achieved, and stored for a certain period in accordance with internal policies and other related laws. Otherwise, it will be immediately deleted. At this time, the personal information transferred to the database shall not be used for any other purpose, except as required by law.
Any information in the form of electronic files shall be deleted through a technical method that makes the records unrecoverable. Personal information printed in hard copy shall be shredded or incinerated.
The data subject may exercise the following privacy-related rights directly or indirectly through their legal representative with the Company at any time:
You can exercise your rights under Paragraph 1 and withdraw your consent by contacting the Company’s privacy department via email) or the relevant service departments listed below. Once your identity is verified, we will promptly process your request.
The data subject may exercise their rights either directly or indirectly through their legal representative or an authorized agent. In such cases, a letter of authorization is required.
Notwithstanding the provisions of Paragraph 1, access to personal data and the right to correction may be restricted when:
1. It poses a serious threat to the life, body, property, or rights of the data subject or a third party;
2. It significantly disrupts the proper operation of the service provider; or
3. It violates other laws, etc.
The Company does not generally collect personal data from individuals under the age of 16. However, if it becomes necessary to collect personal data from individuals under the age of 16, the Company will comply with the consent requirements and other criteria mandated by applicable laws after obtaining the verifiable consent of their parents or legal guardian as required under applicable law.
The Company takes the following administrative, technical, and physical measures to safeguard personal data.
Establishment and implementation of information security regulations and privacy control policy, operation of a dedicated organization, and regular training for employees.
Access control and authentication for personal data processing systems, installation, and operation of access control systems and security programs, encryption of personal data, encrypted transmission, etc.
Access control for computer rooms, etc.
The Company may use cookies, which have the following characteristics, to provide individualized customized services to users:
1. Cookies are small pieces of information sent by the website’s server to the user’s computer browser.
2. Cookies are used to store and retrieve usage histories of website visitors.
3. Cookies may be stored on users’ PC hard drives.
The Company uses these cookies to recognize users on its website(s) and remember their previous choices for default settings, including language preferences and location. Both first-party and third-party cookies may be used in combination. For detailed information about cookie usage, please refer to our Cookie Policy.
Users have the option to configure their web browsers to allow all cookies, request permission before saving cookies, or refuse all cookies. However, it is important to note that rejecting cookies may lead to limitations and issues in the use of our services, and the Company does not assume responsibility for any resulting restrictions.
The following information other than cookies may be automatically generated and collected during service use or business processing.
The Company has designated a Privacy Officer, who takes on the general roles and responsibilities of a Data Protection Officer (DPO), to ensure the protection of your personal data and handle any privacy-related inquiries or complaints.
Data subjects may contact the Privacy Officer and the competent department for any inquiries, complaints, or damages related to the protection of personal data that arise while using the Company’s services (or business). The Company will promptly respond and handle inquiries from data subjects.
If you need to report or consult about a violation of personal data, you can contact the agencies in respective country of operation and take appropriate action.
The Company ensures that data subjects have the right to control their personal data and is committed to offering assistance and solutions in case of any violations. If you need to report or seek advice, please use the contact details provided in Article 7.
The website where the Company’s Privacy Policy is posted may contain links to other websites. The Company’s Privacy Policy applies solely to its own services provided on the website. Clicking on the links to third-party websites will require reviewing the respective privacy policies of those sites.
This Privacy Policy may be updated whenever necessary to comply with legal requirements or Company policies. Any additions, deletions, or modifications to the policy will be communicated through the Company’s website along with the reasons for the changes.
This Privacy Policy will take effect on May 31, 2024.
