K-PASS GLOBAL · KOVIA
Privacy policy
Version 1.0 · Effective date: to be announced
K-PASS GLOBAL (케이패스글로벌, “we”) operates KOVIA, a service brand for foreigners living in Korea (website, mobile web and iOS/Android app, the “service”). Under the Personal Information Protection Act of Korea, this policy explains what personal information we process, why, how long we keep it, who we share it with and how you can use your rights.
1. Who is responsible
| Item | Details |
|---|---|
| Company | K-PASS GLOBAL (케이패스글로벌) |
| Service | KOVIA |
| CEO | 송용권 |
2. What we collect and how
We collect only what the service needs. [Required] items are needed for that feature; you can use the service without the [Optional] ones.
| When | Information | How |
|---|---|---|
| Sign-up (web) | [Required] Google account ID, email address, name (display name), profile picture (if your Google account has one) | Google sign-in |
| Sign-up (app) | Google sign-in: same as above. Sign in with Apple: [Required] Apple account ID, email address (an Apple relay address if you choose “Hide My Email”); [Optional] name (if Apple shares it) | Google or Apple sign-in in the iOS/Android app |
| Member profile | [Required] nickname, nationality, language, residence status (living in Korea, planning to come, returned home); [Optional] visa type (type only, never the card number), area in Korea, services you are interested in, short bio | Welcome screen after sign-up, Edit profile |
| Optional consents | [Optional] whether you agree to personalized recommendations and partner offers, and to news and deadline reminders | Profile screen, consultation form |
| Consultation request | Name, nationality, whether you are in Korea, contact channel and ID (messenger ID, phone number or email), consultation language, your message, service details (program, visa type, income type, departure date, etc.), confirmation that you are 14 or older, consent records | Consultation form after signing in (PC, mobile, app) |
| Documents | Documents your consultant asks for (passport copy, ARC copy, withholding tax receipt, etc.) | One-time secure link or the My consultations page |
| Messenger connection | Your messenger user ID (chat ID, etc.) and the messages you send us there (attachments are not stored) | When you connect Telegram, Zalo or another messenger to get updates |
| Community | Your posts, comments, chat messages and photos; likes, saved posts, blocks and reports | Boards and chat |
| App notifications | Push notification token, device platform (iOS/Android), app version, app language | When you allow notifications in the app |
| Partnership request | Business name, category, contact person, phone, email, business registration number, message | Partnership form |
| Reports | What you report, the reason and your description (linked to your account if you are signed in) | Report a problem |
| Automatically | IP address, browser and device information, access and sign-in times, cookies (section 11), how you reached the consultation form (landing page, referring page, ad banner ID, PC/mobile/app) | While you use the service |
We never ask for passport or ARC numbers at sign-up or in the consultation form. If your case needs a document, we request it only through a secure link, and before you upload an ID copy we ask for a separate consent (Article 24 of the Personal Information Protection Act) that explains the purpose, the information involved, how long we keep it and your right to refuse. If you refuse, only the work that needs the ID copy cannot go ahead; you can still use every other consultation. ID copies are stored encrypted. Numbers that look like phone, passport, ARC or bank account numbers in community posts and chat are hidden automatically.
Posts and comments on the boards can be seen by anyone, including people who are not signed in, and may appear in search engines. Your nickname and nationality are shown with them.
3. Why we use it
- Sign-up and account management: confirming your account through social sign-in, preventing abuse, handling account deletion
- Consultations: receiving and answering your request, sending progress updates (on your chosen channel, as app notifications and in your notification inbox), requesting and checking documents
- Services: carrying out the study, visa, tax and housing services and contracts you sign up for. Job information and job matching are included only if and when we offer them after completing the registration and reporting the law requires.
- Tailored screens: using your profile (residence status, visa type, interests) to show the most relevant guides first.
- [Optional consent] Personalized recommendations and partner offers: using your profile to suggest services and offers from partner schools, banks, agents and others. Your documents are never used, and you can turn this off anytime.
- [Optional consent] News and deadline reminders: intake deadlines, tax filing season, new guides
- Community: running boards and chat, handling reports, restricting accounts that break the rules
- Statistics and improvement: non-identifiable visit and search statistics, and counting impressions, clicks and consultation requests for each ad banner
4. How long we keep it
We delete personal information without delay when the period below ends or the purpose is fulfilled.
| Information | Retention |
|---|---|
| Member account | Deleted immediately when you delete your account (email, name, photo, profile, sign-in connections, notifications, saved posts, likes, block list, push tokens) |
| Community posts, comments and chat | They stay after you leave so that other members’ replies and conversations still make sense, and are shown as “Deleted member” (no nickname, photo or nationality). You can delete your posts and comments yourself before leaving; to remove chat messages, ask the privacy officer. |
| Removed photos | Photos from deleted posts or removed by moderators are kept for 30 days for report review, then deleted |
| Consultation without a contract | 12 months after the consultation ends (an open consultation counts as ended after 12 months with no activity) |
| Consultation with a service contract | 5 years after the contract or the completion of the work (longer if a law requires) |
| Consultations after you leave | The consultation retention periods above still apply. For an ongoing case, we keep contacting you through the contact you gave in the request. |
| Document upload links | Valid for 7 days after they are sent |
| Uploaded documents | Deleted automatically 30 days after your case is closed (or earlier, when the consultation retention period ends) |
| Sign-in sessions | Web 30 days, app 90 days (extended while you use the service; deleted when you sign out or leave) |
| Partnership requests | For the partnership contract period, then as required by law after it ends (requests we decline are deleted 30 days after we tell you the result) |
| Access logs | 1 year (including the 3 months for sign-in records required by the Protection of Communications Secrets Act) |
5. Sharing with third parties
We share personal information with third parties only with your consent or when the law requires it.
| Recipient | Purpose | Information | Retention |
|---|---|---|---|
| Yesong Tax & Accounting (예송세무회계) (licensed tax accountant, a separate business) | Tax consultation, year-end tax settlement and refund filing | Name, nationality, contact, message, tax documents | As required by tax law after the work ends |
| The school or licensed real estate agent you choose (and the employer you choose, if job matching is offered) | Admission, room inquiries, job applications | Only the items needed from name, nationality, contact and message | Until the purpose is fulfilled |
Tax consultations require this consent. Without it, we can only give general information. We never sell personal information.
6. Service providers
We entrust the following work involving personal information to service providers. Our contracts require them to protect your information, and we supervise them. If a provider or the work changes, we will update this policy.
| Provider | Work |
|---|---|
| 주식회사 찬스 | Operating and maintaining the service’s servers |
| Google LLC (Google Cloud, Seoul region — stored in Korea) | Hosting servers, databases and backups |
| Nurigo Co., Ltd. (SOLAPI) | Sending KakaoTalk notification messages and text messages (if you choose KakaoTalk as your contact channel) |
| 650 Industries, Inc. (Expo) | Sending app push notifications (transfer outside Korea, see section 7) |
7. Transfers outside Korea
App push notifications
To send app push notifications, we transfer personal information outside Korea as follows.
| Item | Details |
|---|---|
| Recipient | 650 Industries, Inc. (Expo; privacy contact: expo.dev/contact). Notifications go through Expo and are delivered to your device by Apple Inc. (APNs, iPhone — apple.com/legal/privacy/contact) or Google LLC (Firebase Cloud Messaging, Android — googlekrsupport@google.com). |
| Country | United States |
| When and how | Each time a notification is sent, over an encrypted connection (HTTPS) |
| Information | Push notification token, notification title and text, the in-app page the notification opens, unread notification count |
| Purpose | Delivering app push notifications |
| Retention | As long as needed to deliver the notification (under each provider’s policy) |
| How to refuse | Turn off KOVIA notifications in the app or in your device settings, or sign out. When you sign out or delete your account, your push token is deleted. Without push notifications you can still see every notification in the in-app inbox. |
Overseas messengers
If you choose a messenger run by a company outside Korea — Telegram, WhatsApp (Meta), Zalo or Facebook Messenger (Meta) — as your contact channel, the messages sent through it (confirmations, progress updates, replies from your consultant and your own messages) pass through that company’s servers and are handled under its privacy policy. If you don’t want this, choose another channel such as email or KakaoTalk. We never accept documents through messengers and do not store attachments sent there.
8. How we delete information
- An automatic job regularly checks for information whose retention period has ended and deletes it without delay. Account deletion is processed as soon as you ask.
- When a consultation is deleted, we erase the name, contact, message, details, notes, history, messenger connections and uploaded documents, and keep only a statistical record (service type, request date, outcome and similar).
- If you give a reason when deleting your account (optional), it is kept in our internal work log with anything that looks like a phone number or email address masked.
- So that deleted information does not linger in backups kept for disaster recovery, backups are deleted automatically after 30 days.
- Electronic files are deleted so they cannot be recovered, and paper documents are shredded or incinerated.
9. Your rights
- You can ask at any time to see, correct or delete your information, to stop its processing, or to withdraw your consent.
- You can delete your account yourself at Account settings > Delete account (the same menu on the web, mobile web and app). If you signed in with Apple, your Sign in with Apple connection is revoked as well.
- You can change your profile and the optional consent (personalized recommendations and partner offers) at any time in Edit profile.
- For other requests, such as about your consultations, contact the privacy officer (section 12) with your reference number. We reply within 10 days.
- A legal representative or someone you authorize can also make requests (a power of attorney is needed).
- Only people aged 14 or older can request a consultation. For children under 14, a legal representative must apply and exercise these rights.
10. Security measures
- Contact details, messages, uploaded documents and messenger IDs are stored encrypted (AES-256)
- Sign-in tokens are stored only as one-way hashes, never in their original form
- Two-step sign-in for staff, and access limited by job role
- Logs of every view and download of personal information
- Documents only via one-time links, deleted automatically after the retention period
- Location and other metadata removed from community photos; numbers that look like personal data hidden automatically
- Encrypted transfer (HTTPS); servers run in the Google Cloud Seoul region with restricted administrative access
11. Cookies and similar technologies
We do not use advertising cookies or third-party analytics tools. We use only the cookies below, which the service needs to work and to measure our own ad banners.
| Cookie | Purpose | Kept for |
|---|---|---|
| kv_lang | Remembers your language | 1 year |
| kv_view | Remembers whether you chose the PC or mobile view | 1 year |
| kv_s | Keeps you signed in | 30 days (deleted when you sign out or leave) |
| kv_oauth | Protects the Google sign-in step against forgery | 10 minutes |
| kv_q | Lets you reopen the consultations you sent from this device | 1 year |
| kv_ref | If you arrive by clicking one of our ad banners, remembers the banner ID; if you then request a consultation, the ID is saved with it so we can count consultations per banner (ad performance) | 7 days |
Display settings (language, the visa type you picked, school search filters) are kept only in your browser’s storage and are not sent to us. Instead of cookies, the app uses a sign-in token stored on your device (90 days); it stops working on our server when you sign out or delete your account.
Visit statistics are counted only by date, language, device and section, banner impressions and clicks, and how often each search term is used — never linked to you. You can block cookies in your browser settings, but if you block the sign-in cookie (kv_s), features that need sign-in will not work. If we add an analytics tool, we will list it here before it goes live.
12. Privacy officer
| Item | Details |
|---|---|
| Privacy officer | 송용권 (CEO) |
| Hours | Mon–Fri 09:00–18:00 (KST) |
Send any question, complaint or request for remedy about personal information to the contact above. We will answer and act without delay.
13. Other places to get help
If you need advice about a privacy violation or help resolving a dispute, you can contact these Korean public bodies.
| Organization | Contact |
|---|---|
| Personal Information Infringement Report Center (KISA) | privacy.kisa.or.kr · 118 |
| Personal Information Dispute Mediation Committee | www.kopico.go.kr · 1833-6972 |
| Supreme Prosecutors’ Office | www.spo.go.kr · 1301 |
| Korean National Police Agency | ecrm.police.go.kr · 182 |
14. Changes to this policy
We announce changes in the service 7 days before they take effect (30 days for changes that are unfavorable to you).