Jitdot(jitdot.com) · 주식회사 달콤자재창고
Effective date 11 August 2026
주식회사 달콤자재창고 (the “Company”) establishes and publishes this Privacy Policy under Article 30 of the Personal Information Protection Act to protect individuals’ personal information and address related concerns promptly and effectively. 1. Purposes of Processing Personal Information (1) Membership registration and management: identity verification, member services and prevention of misuse. (2) Material orders, quotes and delivery: order processing, quote issuance, delivery address management, payment settlement and tax invoice issuance. (3) Showroom visit bookings: booking management, smart key (QR) delivery and account manager assignment. (4) Customer support: one-to-one support through Channel Talk, complaint handling and notices. (5) Service improvement: improving AI search and recommendation quality and analysing usage statistics. (6) Marketing and advertising, only with consent: email and app push notifications about events, benefits and new materials through the Jitdot newsletter. (7) Enterprise account operation: inviting and verifying members, applying prices under company agreements, company wallet accruals and withdrawals, transaction statements, and 짓피티 recommendations and answers based on company orders. 2. Personal Information Collected and Collection Methods (1) Required information: name, email address (account ID), password and mobile phone number. (2) Optional information: company name; business registration certificate image and its contents, including business registration number, representative’s name, business type and activities, and business address; delivery address; and bank account details when requesting a withdrawal. (3) Automatically collected information: IP address, cookies, access logs and service usage records, including search terms and material image compositing history. (4) Collection methods: information entered directly by users during registration and use of the Service, and automatic collection tools. (5) Enterprise account member information: the email address and role of a person whom a company wishes to invite, and the name, email address and role listed in the agreement’s member roster. This information is received from the company, rather than from that individual. The Company creates a pre-registration account with the email address to send an invitation email. 2-2. Catalog API and MCP Request Logs For request limits, prevention of misuse and usage statistics, the Company records the following for each request to the Catalog API (jitdot.com/api/catalog/) and MCP server (jitdot.com/mcp), which can be used without registering: request time, function called, client type, a value derived from the IP address using a secret key, the first 120 characters of the search text after removing patterns resembling phone numbers, email addresses and resident registration numbers, search filters, result count, response time and response status. The original IP address is not stored in these logs. This processing is based on Article 15(1)(6) of the Personal Information Protection Act and does not require separate consent. Logs are destroyed 90 days after collection, retaining only monthly aggregates that do not identify individuals. Storage is provided by the cloud service providers listed in section 5, Outsourced Processing of Personal Information. This section takes effect on 30 October 2026. 3. Processing and Retention Periods (1) The Company destroys personal information after the 30-day grace period following an account closure request. Information continues to be retained if closure is cancelled during the grace period. If the member chooses immediate destruction without a grace period, destruction begins within 24 hours. If an order, delivery, settlement or 짓캐시 withdrawal is in progress, destruction begins after that transaction is completed. (2) The following records are stored and managed separately from member information for the periods required by applicable laws, then destroyed. During retention, names, contact details and addresses are deleted or replaced with substitute values, leaving only transaction facts. - Contracts and cancellation of purchases: 5 years (Article 6 of the Electronic Commerce Act). - Payments and supply of goods: 5 years (Article 6 of the Electronic Commerce Act). - Ledgers and supporting documents, including tax invoices: 5 years after the filing deadline (Article 71 of the Value-Added Tax Act and Article 85-3 of the Framework Act on National Taxes). - Consumer complaints and dispute resolution: 3 years (Article 6 of the Electronic Commerce Act). - Labelling and advertising: 6 months (Article 6 of the Electronic Commerce Act). - Access logs for personal information processing systems: 2 years (Article 8 of the Standards for Personal Information Security Measures). - Account closure processing and destruction execution records: 5 years, as evidence that destruction was carried out. (3) For business members with a history of tax invoice issuance, the business name, business registration number, representative’s name, business address and tax invoice recipient email address are retained for the periods above. This is because tax invoices may need to be reissued following returns or contract changes. The contact person’s name, mobile phone number and personal email address are deleted on account closure. (4) The Company does not collect resident registration numbers. If a representative’s resident registration number appears on a business registration certificate, the Company masks that part before storage and destroys the unmasked original without delay. (5) The Company does not mark accounts as dormant or automatically close them solely because members have not used the Service for a long time. (6) Company or organisation, name, email address, contact number if provided, and inquiry content received through the advertising, partnership and media inquiry page (https://jitdot.com/partnership) are used only to receive and respond to advertising, marketing, partnership and media inquiries. They are destroyed without delay one year after the response is completed. (7) Email addresses and roles supplied by a company for invitations, referred to as invitation records, are destroyed 30 days after the invitation ends through acceptance, expiry or cancellation. When sending an invitation email, the Company creates a pre-registration account with that email address. If the invitee does not complete registration, that account is destroyed on the same day as the invitation record. If the invitee has logged in or used the Service with that account, the Company informs them that they can complete registration with that email address or close the account. The account is destroyed if registration is not completed within 30 days of that notice. Transactions made with the account are retained under paragraphs (2) and (3). After an invitee accepts and joins the Enterprise account, their email address is processed as member information. An agreement’s member roster is retained as part of the agreement and destroyed 5 years after the agreement ends, a retention period for agreement disputes and tax checks. (8) Records of consent to Enterprise account membership and its withdrawal are destroyed 3 years after membership of that Enterprise account ends, regardless of whether the member closes their service account. These records include the consent text, company, timestamp, email address at the time, withdrawal request time and any reason for delayed removal. 4. Provision of Personal Information to Third Parties The Company does not generally provide users’ personal information to external parties, except in the following cases. (1) Recipient information, consisting of name, contact details and address, is provided to delivery providers, including logistics providers contracted for 짓배송 and parcel carriers, for delivery. (2) The user has given prior consent. (3) Disclosure is required by law or requested by an investigative authority through lawful procedures. (4) Information about an order placed in a company’s name by a member of its Enterprise account is provided to that company. When the member joins the Enterprise account, the Company explains the following and obtains consent. - Recipient: the company the member is joining, identified by name when consent is obtained. - Recipient’s purposes: checking and managing orders in the company’s name, making payments and informing members’ material selections. - Information provided: ordering member’s name, order number, order and supply dates, site name and delivery address, materials ordered (Jitdot code, display description and specifications), quantities, unit prices, amounts and order status. - Methods of provision: transaction statements sent to companies on monthly settlement; company wallet details in the company management screen, available to owners and administrators; and the Enterprise account owner’s company queries in 짓피티, after the Company enables that feature for the company. Other members’ 짓피티 material recommendations use only the types of materials ordered, identified by Jitdot code and display description. - Retention and use period: while the member belongs to the Enterprise account. Transaction statements already received by the company are retained for the periods required by applicable laws. - Right to refuse consent and consequences: members may refuse consent. Without consent, they do not join that Enterprise account and may continue using the Service as individual members. If a member withdraws consent after joining, the Company removes them from the Enterprise account. 5. Outsourced Processing of Personal Information The Company outsources personal information processing to provide the Service as follows. (1) Customer support platform operation: Channel Corporation (Channel Talk). (2) Cloud infrastructure and data storage: Supabase Inc. and other cloud service providers. (3) AI material search and recommendations, 짓피티 responses including company order queries, image analysis, document information extraction (OCR) and AI assistance with business tasks: Google LLC (Vertex AI and Gemini) and Anthropic PBC (Claude). (4) Website usage statistics: Google LLC (Google Analytics). (5) Alimtalk and text message delivery: 알리고. (6) Electronic tax invoice and cash receipt issuance, and bank deposit inquiries: (주)링크허브 (Popbill). (7) Showroom smart access permissions (door locks): 잇츠오키. (8) Email delivery, including sign-up verification, password resets, quotes, orders, transaction statements, booking notifications and marketing sent with consent: Plus Five Five, Inc. (Resend). (9) Staff work notifications and processing records, including orders, customer support, bookings, settlements and withdrawal notifications: Slack Technologies Limited (Slack). (10) Inquiry and application forms: TYPEFORM, S.L. (Typeform). (11) Business email and storage of documents such as quotes and business registration certificate copies: Google LLC and its affiliates (Google Workspace). (12) App push notifications: Google LLC (Firebase Cloud Messaging). Outsourcing agreements expressly address compliance with personal information laws, restrictions on subcontracting and allocation of responsibilities. The Company manages and supervises these arrangements. 5-2. International Transfers of Personal Information Among these processors, Google LLC, Anthropic PBC and Supabase Inc., all in the United States, process information overseas. Their privacy contacts are Google LLC (https://support.google.com/cloud/contact/dpo), Anthropic PBC (privacy@anthropic.com) and Supabase Inc. (privacy@supabase.com). (1) Information transferred: search queries; uploaded images, including site photos and business registration certificates; service usage records, including identifiers for statistical analysis; order and transaction information needed for AI assistance with business tasks, such as company names and order details; and company order information needed to answer Enterprise account members’ questions in 짓피티. The latter includes order numbers and dates, materials and quantities ordered, total amounts, progress status and company wallet reward records. Site names, delivery addresses and ordering members’ names are not sent overseas. (2) Purposes: AI search, image analysis, document information extraction, AI assistance with business tasks, 짓피티 recommendations and responses based on company orders, cloud data storage and usage statistics. (3) Timing and method: transmitted over a network whenever the user uses the relevant feature, including when asking 짓피티 a question. (4) Retention and use period: until the processing purpose is achieved, subject to each processor’s retention policy, with destruction when the outsourcing arrangement ends. The following processors handling email, work notifications, forms, business documents and app push notifications also process information overseas. - Plus Five Five, Inc. (Resend, support@resend.com): destination countries are the United States and Japan, where email delivery servers are located. Transferred information includes recipients’ email addresses and names, and information in email bodies and attachments, such as order numbers, materials, quantities, amounts, delivery addresses, booking dates and times, quotes and transaction statements. The purposes are email delivery and confirmation of delivery results. - Slack Technologies Limited (Slack, privacy@slack.com): information is stored in the United States. Transferred information includes customer details needed to process orders, customer support, bookings and settlements: name or company name, phone number, email address, delivery address, business registration number, 짓캐시 withdrawal account and account holder, inquiry content and quotes. The purposes are staff work notifications and processing records. - TYPEFORM, S.L. (Typeform, gdpr@typeform.com): destination countries are Spain and the United States, where information is stored. Transferred information consists of the name, contact details, email address, company name and inquiry or application content entered in the form. The purpose is to receive inquiries and applications. - Google LLC and its affiliates (Google Workspace; the contracting entity is specified in the Google Workspace agreement; https://support.google.com/cloud/contact/dpo): destination countries include the United States and other countries with Google data centres. Transferred information includes emails exchanged with customers and business documents such as quotes and business registration certificate copies. The purposes are business email and document storage. - Google LLC (Firebase Cloud Messaging, https://support.google.com/cloud/contact/dpo): destination countries include the United States and other countries with Google data centres. Transferred information consists of device notification tokens and notification titles and bodies, including order, delivery and booking updates and marketing sent with consent. The purpose is app push notification delivery. Notifications to iPhones pass through Apple Inc.’s notification servers (APNs) in the United States. - Timing and method: transmitted over a network whenever email, notifications, app push messages, form submissions or document storage occur. - Retention and use periods: Resend delivery records are retained for 30 days; Slack messages for one year; and Typeform responses for one year from receipt. Google Workspace documents are retained for the periods in section 3 of this Policy. Firebase Cloud Messaging retains undelivered notifications for up to 28 days. Information is destroyed when the outsourcing arrangement ends. - How to refuse and the consequences: contact customer support at support@jitdot.com or 070-8865-5568 if you do not want international transfers. Within 10 days of receiving a request, the Company deletes that person’s information remaining in Slack and Typeform and accepts inquiries by phone instead of through Typeform. However, order and customer support notifications are automatically posted to Slack, so the Company cannot prevent information in those notifications from being transferred while you continue placing orders with Jitdot. If you also refuse those transfers, you will have difficulty using Jitdot ordering. Order and quote emails can be replaced with text messages or phone calls. Sign-up verification and password reset emails are sent only through Resend, so refusing transfers for email delivery prevents registration and password resets. Business email and document storage use only Google Workspace. If you refuse those transfers, assistance will be provided by text message or phone instead of email support and emailed quotes. App push notifications can be disabled in your device settings or notification settings in My account. Disabling them does not affect other use of the Service. Google LLC and Anthropic PBC, which process information for AI services, do not use the information they receive to train or improve their own AI models. The Company confirms this through its contractual terms with each processor. Users who do not want international transfers may stop using the relevant features, including AI search, 짓피티 and OCR, and request that transfers stop through customer support. Refusing transfers prevents use of those features but does not affect other services. 6. Individuals’ Rights and How to Exercise Them Users may request access to, correction or deletion of their personal information, or suspension of its processing, at any time. - Account closure (full deletion): “Edit profile > Account management > Close account”. - Partial correction or deletion: “Edit profile” or customer support. - If you cannot log in: https://jitdot.com/account-deletion or customer support at support@jitdot.com or 070-8865-5568. The Company takes action and informs you of the result within 10 days of receiving a request. Account closure includes a 30-day grace period during which you can cancel it yourself. If you want immediate deletion without a grace period, select that option on the closure screen or contact customer support. The Company cannot comply with a deletion request for personal information whose collection is expressly required by another law. In that case, it explains the reason. 7. Destruction of Personal Information (1) Procedure: personal information is destroyed without delay when its retention period ends or its processing purpose has been achieved. (2) Methods: electronic files are deleted using technical methods that prevent recovery. Paper documents are shredded or incinerated. 8. Security Measures for Personal Information (1) Encryption of passwords and other important information in storage. (2) Minimisation of access permissions and access controls. (3) Retention of access logs and protection against falsification or alteration. 9. Cookies The Company uses cookies to provide personalised services. Users may refuse cookie storage through their browser settings, which may restrict some features of the Service. 10. Privacy Officer - Name: 장태욱 (Chief Executive Officer). - Contact: support@jitdot.com / 070-8865-5568. Individuals may contact the Privacy Officer about personal information inquiries, complaints and remedies. Other reports and consultations are available through the Personal Information Infringement Report Center at privacy.kisa.or.kr or 118 without an area code in Korea. 11. Changes to This Policy Additions, deletions and amendments to this Privacy Policy are announced through notices in the Service at least 7 days before taking effect. Effective date: 11 August 2026 New material updates through the Jitdot newsletter under section 1(6), Purposes of Processing Personal Information, take effect on 9 November 2026. Paragraphs (8) through (12) of section 5, Outsourced Processing of Personal Information, and the paragraphs in section 5-2, International Transfers of Personal Information, covering email, work notifications, forms, business document storage and app push processors apply to this Policy from 30 October 2026. These outsourcing arrangements and international transfers were already in place; this amendment corrects missing disclosures. These disclosures are required in the Privacy Policy under Articles 26, 28-8 and 30 of the Personal Information Protection Act. Processing methods do not change. Delaying publication would allow transfers to continue while delaying only the notice, so these provisions apply immediately without the 7-day advance notice in section 11. Refusal requests are accepted from the date they apply. Amendments to section 1(7); section 2(5), Personal Information Collected and Collection Methods; section 3(7) and (8), Processing and Retention Periods; section 4(4), Provision of Personal Information to Third Parties; section 5(3); and the first paragraph (each processor’s privacy contact), paragraphs (1) through (3), and the final paragraph (refusal of international transfers) of section 5-2 take effect on 1 December 2026. This does not include the paragraphs in section 5-2 covering email, work notifications, forms, business document storage and app push processors.