Contents
PokerUs Privacy PolicyApplies to the PokerUs service provided by A2K Interactive, Inc. (주식회사 에이투케이인터랙티브)
01 Purposes of Processing Personal Information
The Company processes personal information for the following purposes. Personal information processed is not used for any purpose beyond these, and where the purpose of use changes, the Company will obtain separate consent and take other measures required under Article 18 of the Personal Information Protection Act.
| Category | Purpose of processing |
|---|---|
| Membership registration and management | Confirming intent to register, identifying and authenticating Members for member-based services, maintaining and managing membership status, preventing improper use of the Service, confirming eligibility to use content rated unsuitable for minors under the Game Industry Promotion Act (verifying age 19 or older), providing notices, and handling complaints |
| Provision of the Service | Providing the game service, managing game records/statistics/rankings, providing content, providing customized services, and Service usage statistics and quality improvement |
| Provision of paid services | Purchase and payment for paid products/services, managing purchase history, processing refunds, issuing invoices, and debt collection |
| Service operation and user protection | Detecting and sanctioning conduct that violates the Operating Policy (use of abnormal programs, abusive conduct, account theft, exchange or trading of Game Chips, etc.), retaining records for dispute mediation, handling complaints, and operating user-protection measures to maintain a fair game environment |
| Marketing and advertising | Announcing new services and events, providing promotional information (where separately consented to), and analyzing access frequency and Service usage statistics |
| Compliance with legal obligations | Fulfilling obligations under the Game Industry Promotion Act, the Act on Consumer Protection in Electronic Commerce, the Telecommunications Business Act, and other applicable law |
02 Items Processed and Method of Collection
a. Items collected
| Category | When collected | Required items | Optional items |
|---|---|---|---|
| Membership registration (e-mail) | At registration | E-mail address, password, nickname | - |
| Membership registration (social login) | At registration | Social account identifier (ID), e-mail address, nickname (linked services: Google / Apple / Kakao / Naver / Facebook / Payco) | - |
| Identity verification (adult verification, etc.; users in Korea) | As needed | Name, date of birth, gender, mobile phone number, connecting information (CI) and duplicate-registration confirmation information (DI) from the identity verification agency | - |
| Age verification (users outside Korea) | At registration | Date of birth, country of residence, record of 18+ confirmation (time of confirmation, IP country) | Government-ID information (where additional verification is required, processed via Stripe Identity or similar) |
| Paid payments | At payment | Payment method information (card issuer, partial card number, mobile phone number, and other items processed by the payment gateway), purchase history, payment approval information | - |
| Customer inquiries | At inquiry | E-mail address, inquiry content | Attachments, mobile phone number |
| Events / prize drawings | At entry | Name, mobile phone number, address (for prize shipment) | - |
b. Information generated and collected automatically while using the Service
- Service usage records, access logs, access IP information, cookies, visit timestamps, and records of improper use
- Device information (device type, OS and version, browser type, language setting, screen resolution)
- Game play records (match history, rankings, in-game chat history, and item/point holdings and usage history)
c. Method of collection
- Directly entered by the user during membership registration, use of the Service, payment, customer center inquiries, and event entry on the website or application
- Received from a social login provider with the user's consent
- Automatically collected through information-generation collection tools while using the Service
03 Processing and Retention Period of Personal Information
The Company processes and retains personal information within the retention and use period required by law, or the period consented to by the data subject at the time of collection.
a. Retention under the Company's internal policy
| Item | Retention period | Basis |
|---|---|---|
| Membership registration and management information | Until withdrawal | Performance of the service use agreement |
| Records of improper use (sanction history, related identifying information) | 1 year after withdrawal | Preventing recurrence of improper use |
| Information to prevent re-registration by a withdrawn Member (DI, etc.) | 30 days after withdrawal | Re-registration restriction policy |
| Monitoring records for Game Chips exchange and improper transactions | 2 years | Preventing improper use and maintaining Service integrity |
Notwithstanding the foregoing, in the following cases the Company retains the information until the relevant matter is resolved.
- Where an investigation is under way in connection with a violation of applicable law: until the investigation concludes
- Where a claim or obligation arising from use of the Service remains outstanding: until that claim or obligation is settled
b. Retention required by applicable law
| Item retained | Retention period | Legal basis |
|---|---|---|
| Records of contracts or subscription withdrawal | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of payment and supply of goods | 5 years | Act on Consumer Protection in Electronic Commerce |
| Records of consumer complaints or dispute handling | 3 years | Act on Consumer Protection in Electronic Commerce |
| Records of labeling and advertising | 6 months | Act on Consumer Protection in Electronic Commerce |
| Service visit records (access logs, access location tracking data) | 3 months | Protection of Communications Secrets Act |
| Records of electronic financial transactions | 5 years | Electronic Financial Transactions Act |
| Tax-related transaction records | 5 years | Framework Act on National Taxes, Corporate Tax Act |
c. Personal information of long-term inactive Members
The Company may separately store and manage, or destroy, the personal information of a Member who has not used the Service for one year or more, apart from other Members' personal information. The Company will notify the Member of such action, by e-mail or another method, no later than 30 days beforehand.
04 Provision of Personal Information to Third Parties
The Company processes a data subject's personal information only within the scope specified in Section 1, and provides personal information to a third party only where the data subject has consented or another case under Articles 17 and 18 of the Personal Information Protection Act applies.
The Company does not currently provide personal information to any third party. Where third-party provision becomes necessary in the future, the Company will notify data subjects of the recipient, purpose, items, and retention/use period, and obtain separate consent.
05 Outsourcing of Personal Information Processing
The Company outsources the processing of personal information as follows for the smooth provision of the Service.
| Recipient | Outsourced task |
|---|---|
| Amazon Web Services, Inc. (USA) | Service infrastructure operation and data storage (Tokyo, Japan region); sending e-mail, SMS, and app push notifications |
| A2K Interactive Corp. (USA) | Processing payments for Paid Items through Stripe, managing payment information, and processing refunds |
| Stripe, Inc. (USA) | Payment processing and management of payment information (sub-processor engaged by A2K Interactive Corp.). If you choose Stripe Link at checkout, your payment details may be stored by Stripe for faster checkout under Stripe's own privacy policy |
| Dream Security | Identity verification and adult verification (users in Korea) |
When entering into an outsourcing agreement, the Company specifies, in the contract or other document, matters required under Article 26 of the Personal Information Protection Act — including a prohibition on processing personal information beyond the outsourced purpose, technical and administrative safeguards, restrictions on re-outsourcing, supervision of the processor, and liability for damages — and supervises whether the processor handles personal information safely.
Where the content of an outsourced task or the identity of a processor changes, the Company will disclose this without delay through this Privacy Policy.
06 Overseas Transfer of Personal Information
The Company transfers personal information overseas (for storage and outsourced processing) as follows in order to provide the Service. The Service infrastructure is operated in the Tokyo, Japan region of Amazon Web Services, and for purchases made through Stripe, payment-related information is transferred to A2K Interactive Corp. (USA), the seller and an affiliate of the Company, and to the payment processor Stripe, Inc. (USA).
| Recipient | Country | Time and method of transfer | Items transferred | Purpose of use | Retention/use period |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. | Japan (Tokyo region) | Transmitted over the network and stored on servers during use of the Service | All items collected under Section 2 | Service infrastructure operation, data storage, and sending e-mail, SMS, and app push notifications | Until withdrawal of membership or termination of the outsourcing agreement (statutory retention periods apply separately) |
| A2K Interactive Corp. | United States | Transmitted over the network at the time of payment | Member identifiers (account ID, e-mail), payment method information (card issuer, partial card number, etc.), payment approval information, purchase history | Processing payments and refunds for Paid Items through Stripe | Until withdrawal of membership or termination of the outsourcing agreement (statutory retention periods apply separately) |
| Stripe, Inc. | United States | Transmitted over the network at the time of payment | Payment method information, payment approval information | Payment processing (sub-processor engaged by A2K Interactive Corp.) | Until termination of the outsourcing agreement |
A data subject may contact the Chief Privacy Officer under Section 13 below to refuse the overseas transfer. However, because the Service infrastructure itself is located overseas, refusing the transfer makes use of the Service impossible, and refusing the transfer of payment information restricts paid purchases through Stripe.
07 Procedure and Method of Destroying Personal Information
The Company destroys personal information without delay once it becomes unnecessary, such as upon expiration of the retention period or achievement of the processing purpose.
Where the retention period consented to by a data subject has expired or the processing purpose has been achieved, but the personal information must nonetheless continue to be preserved under other applicable law, the Company transfers it to a separate database or otherwise preserves it in a distinct location.
- Destruction procedure: The Company selects personal information for which a ground for destruction has arisen and destroys it upon approval of the Chief Privacy Officer.
- Destruction method: Personal information recorded and stored in electronic file form is permanently deleted using technical means that prevent the record from being reproduced, and personal information recorded and stored on paper is destroyed by shredding or incineration.
08 Rights and Obligations of Data Subjects and Their Legal Representatives, and How to Exercise Them
- A data subject may, at any time, exercise rights against the Company to request access to, correction of, deletion of, or suspension of processing of their personal information, and to withdraw consent.
- Such rights may be exercised through the settings menu within the Service (editing member information, withdrawal, etc.), or in writing, by e-mail, or by another method under Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on the request without delay.
- Rights may be exercised through a data subject's legal representative or an authorized agent, in which case a power of attorney in the form set out in Attached Form No. 11 of the Notification on Methods of Processing Personal Information must be submitted.
- A request for access to, or suspension of processing of, personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.
- A request for correction or deletion may not be made where other applicable law specifically requires the collection of that personal information.
- Upon a request for access, correction, deletion, or suspension of processing, the Company verifies whether the person making the request is the data subject or a legitimate agent.
- A data subject may withdraw their consent to the collection and use of personal information by withdrawing from membership. Please note that upon withdrawal, game records and held points/items cannot be recovered.
09 Measures to Ensure the Security of Personal Information
The Company takes the following security measures under Article 29 of the Personal Information Protection Act.
a. Administrative measures
- Establishing and implementing an internal management plan
- Minimizing the number of staff who handle personal information and providing them regular training
- Granting and managing tiered access rights for staff who handle personal information
b. Technical measures
- Managing access rights to personal information processing systems and installing access control systems
- One-way encrypted storage of passwords and encryption of unique identifying and other sensitive information
- Encryption of data in transit (TLS)
- Installing security programs and regularly updating and inspecting them
- Retaining access records (at least 1 year) and preventing their forgery or alteration
c. Physical measures
- Controlling access to server rooms and data storage areas
- Relying on the cloud provider's physical security systems
10 Installation, Operation, and Right to Refuse Automatic Personal-Information Collection Devices
- The Company uses "cookies," which store and periodically retrieve usage information, to provide personalized services to users.
- A cookie is a small piece of information sent by the server operating the website to the user's browser and stored on the user's device.
- Purpose of use: maintaining login status, analyzing access frequency and visit duration, understanding usage patterns, verifying secure connections, and providing personalized services
- How to refuse: A user may refuse to allow cookies through their web browser settings.
- Chrome: Settings > Privacy and security > Cookies and other site data
- Edge: Settings > Cookies and site permissions > Manage and delete cookies and site data
- Safari: Preferences > Privacy > Cookies and website data
- Refusing cookies may cause difficulty using certain parts of the Service, such as features that require login.
- The Company does not currently use a separate external usage-analytics tool. Where such a tool is adopted in the future, the Company will announce its name and how to opt out through this section in advance.
11 Criteria for Additional Use or Provision of Personal Information
Under Article 15(3) and Article 17(4) of the Personal Information Protection Act, the Company may additionally use or provide personal information without the data subject's consent after considering the matters set out in Article 14-2 of the Enforcement Decree of the Personal Information Protection Act. In doing so, the Company considers the following.
- Whether the additional use or provision is related to the original purpose of collection
- Whether the additional use or provision is foreseeable in light of the circumstances of collection or processing practices
- Whether the additional use or provision unfairly infringes the data subject's interests
- Whether measures necessary for security, such as pseudonymization or encryption, have been taken
12 Restriction on Use by Minors
The Service is content rated unsuitable for minors under the Game Industry Promotion Act, and a minor under Article 2(1) of the Youth Protection Act (a person under 19 years of age) may not register as a Member. For users in Korea, the Company verifies age at registration through mobile phone identity verification or another method provided by an identity verification agency.
Users outside the Republic of Korea may register only if they are at least 18 years of age (or the age of majority in their country of residence, if higher). The Company confirms this through date-of-birth verification and, where necessary, additional age verification.
Where it is confirmed, notwithstanding these verification procedures, that the personal information of a person below the applicable age was collected, the Company will destroy that information without delay.
13 Chief Privacy Officer and Responsible Department
The Company designates a Chief Privacy Officer as follows, who has overall responsibility for personal information processing and handles data subjects' complaints and remedies relating to personal information processing.
Chief Privacy Officer
- Name: Dongho Cho
- Title: Chief Executive Officer
- E-mail: contact@a2k.team
- Phone: +82-10-2069-3273
Personal Information Protection Department
- Department: Service Operations
- Contact: Dongho Cho
- E-mail: contact@a2k.team
Data subjects may direct any inquiry, complaint, or request for remedy relating to personal information protection arising from use of the Company's Service to the Chief Privacy Officer or the responsible department above. The Company will respond and act on such inquiries without delay.
14 Department for Receiving and Handling Requests to Access Personal Information
A data subject may direct a request to access personal information under Article 35 of the Personal Information Protection Act to the department below. The Company will endeavor to process such requests promptly.
- Department: Service Operations
- Contact: Dongho Cho
- E-mail: contact@a2k.team
15 Remedies for Infringement of a Data Subject's Rights and Interests
A data subject may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, and similar bodies, in order to obtain a remedy for an infringement of personal information. For other reports of, or consultation regarding, personal information infringement, please contact the following bodies.
- Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
- Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
- Supreme Prosecutors' Office Cyber Investigation Division: 1301 (no area code) (www.spo.go.kr)
- National Police Agency Cyber Investigation Bureau: 182 (no area code) (ecrm.police.go.kr)
A person whose rights or interests are infringed by a disposition or omission of the head of a public institution regarding a request under Article 35 (access to personal information), Article 36 (correction/deletion of personal information), or Article 37 (suspension of processing of personal information) of the Personal Information Protection Act may file an administrative appeal in accordance with the Administrative Appeals Act.
- Central Administrative Appeals Commission: 110 (no area code) (www.simpan.go.kr)
16 Changes to This Privacy Policy
- This Privacy Policy applies from September 11, 2026.
- The Company may revise this Privacy Policy to reflect changes in applicable law or the Service. Where this Privacy Policy is revised, the Company will announce the changes through an in-Service notice or its website no later than 7 days before the effective date (30 days before, for a material change to data subjects' rights).