Privacy Policy
This English translation is provided for convenience. The Korean version prevails.
HJ Company (the "Company") complies with the Personal Information Protection Act and other applicable laws, and has established and publishes this Privacy Policy to process the personal information of users of the ONJI website and mobile app (the "Service") safely.
Effective date: November 6, 2026 (announced on October 30, 2026 / the previous version took effect on October 5, 2026)
1. Personal Information Collected and Collection Methods
| Category | Items collected | When collected |
|---|---|---|
| Sign-up (web and app) | Email, password, name or nickname, mobile phone number, user ID (for web sign-up) | At sign-up |
| Identity verification (mobile phone text message (SMS) verification) | Mobile phone number, the fact and time of verification, and a value for detecting duplicate sign-ups (a hash converted from the mobile phone number) | At sign-up or identity verification |
| Social login (Kakao and Apple, app) | Kakao member number or Apple user identifier, and the email and nickname the user agreed to provide | When signing up or logging in with social login |
| App push notifications | Push token, device type (iOS or Android), device model name, app version | When notifications are turned on in the app and allowed on the device |
| App location information | Approximate location. It is used only when you tap the "My location" button on the Art Map. It is used only on your device to center the map and show distances, and is not sent to or stored on the Company's servers. The map is displayed by the Google Maps SDK, and when you use your location, the approximate location may be passed to Google to display the map (see Section 5(b)). | When you tap the "My location" button and allow location permission |
| Paid service payment (web) | Order history, payment method information, payment approval number (processed directly by the card company or payment gateway; the Company does not store full card numbers) | At subscription or deposit payment |
| Subscription purchase (app) | Purchase record (store transaction receipt, product ID). The Company sends the receipt to Apple or Google servers for verification and does not receive payment method information such as card numbers. | When purchasing or restoring a subscription in the app |
| Tax consultation referral | Contact details, content of the consultation request | When requesting a consultation |
| Use of the Service | Taste test responses, saved places and itinerary records, report request details, service usage records, access logs, access IP, device information, cookies | While using the Service |
| Receiving promotional information (optional) | Whether you agreed to receive SMS and email, and the time of consent | At sign-up or when you agree in settings |
The Company does not collect date of birth, gender, Connecting Information (CI), or Duplicate Registration Confirmation Information (DI). The Company collects personal information when users agree to the collection and enter it themselves during the use of the Service, such as at sign-up, payment, and customer consultation, and may also collect some information through automatic collection tools such as cookies.
2. Purposes of Collecting and Using Personal Information
- Confirming the intent to sign up, verifying identity by mobile phone text message (SMS), preventing duplicate sign-ups, and providing the member service
- Performing contracts for paid services such as the subscription membership and deposits, settling fees, and confirming app subscription entitlements (verifying store receipts)
- Recommending content and exhibitions based on taste test results, and displaying the map
- Preparing and issuing curator reports, and sending push notifications about report issuance, payments, and subscriptions
- Referral to partner services such as tax consultation
- Delivering notices, handling complaints, and keeping records for dispute resolution
- Sending promotional information (SMS and email) where the user has agreed
- Preventing misuse and operating the Service stably
3. Retention and Use Period of Personal Information
- As a rule, the Company destroys personal information without delay once the purpose of its collection and use has been achieved. When a member withdraws, account information and service usage records are deleted without delay.
- Where retention is required under applicable laws, the Company retains information for a set period as follows.
- Records of contracts or withdrawal of purchase: 5 years (Act on the Consumer Protection in Electronic Commerce)
- Records of payment and the supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce)
- Records of consumer complaints or dispute handling: 3 years (Act on the Consumer Protection in Electronic Commerce)
- Records of labeling and advertising: 6 months (Act on the Consumer Protection in Electronic Commerce)
- Transaction books and supporting documents under tax law: 5 years (Framework Act on National Taxes)
- Website visit records: 3 months (Protection of Communications Secrets Act)
4. Provision of Personal Information to Third Parties
The Company processes users' personal information only within the scope of the purposes in Section 1 and does not provide it to third parties without the user's prior consent. Exceptions are made where there is a basis in law or where an investigative agency requests it through lawful procedures.
5. Entrustment of Personal Information Processing and Overseas Transfers
(a) Domestic entrustment of processing
| Processor | Entrusted task |
|---|---|
| Toss Payments Co., Ltd. | Processing and settlement of web subscription and deposit payments |
| Aligo | Sending mobile phone text message (SMS) verification codes and notification messages (processes mobile phone numbers) |
| FASTWEB | Managing the server infrastructure needed to operate the Service |
| Kakao (Kakao Login) | Login authentication using a Kakao account (processes Kakao member numbers, etc.) |
(b) Overseas transfer of personal information
Some features of the Service use the servers of the overseas providers below, and personal information may be transferred abroad over the information and communications network when you use those features.
| Recipient (country) | Items transferred | Purpose of transfer | Timing and method | Retention and use period |
|---|---|---|---|---|
| Google LLC (the United States and other countries where Google servers are located) | Device and IP information on map requests, approximate location for displaying the map (when you use your location), push token | Displaying Google Maps, sending push notifications via Firebase Cloud Messaging (FCM) | When using the map screen or when a push is sent / encrypted communication (HTTPS) | Follows Google's privacy policy. The push token is deleted from the Company's servers when the member withdraws |
| Apple Inc. (the United States) | Apple user identifier (Sign in with Apple), push token (APNs), subscription transaction receipt | Sign in with Apple, delivering push notifications, App Store subscription payment and receipt verification | When using the relevant feature / encrypted communication (HTTPS) | Follows Apple's privacy policy |
| Google LLC (Google Play, the United States and others) | Subscription transaction receipt (purchase token), product ID | Google Play subscription payment and receipt verification | When purchasing or restoring a subscription / encrypted communication (HTTPS) | Follows Google's privacy policy |
Users can refuse the overseas transfer by not using the features above (for example, by turning off notifications or signing up with email). However, those features will then be unavailable, and the map cannot be displayed without Google Maps. Questions about overseas transfers can be sent to the Chief Privacy Officer in Section 10.
When entering into entrustment contracts, the Company specifies in the contract, in accordance with Article 26 of the Personal Information Protection Act, matters such as the prohibition of processing personal information beyond the purpose of the entrusted task, technical and managerial safeguards, limits on re-entrustment, and supervision of the processor.
6. Rights and Obligations of Data Subjects and How to Exercise Them
- Users may at any time ask the Company to view, correct, or delete their personal information, to stop its processing, or to withdraw consent. Consent to receive promotional information can be withdrawn at any time on My Page (on the My tab in the app).
- Rights can be exercised through My Page or by written request or email to the Chief Privacy Officer below, and the Company will act without delay.
- You can withdraw your membership yourself from the My tab > Delete account in the app, or from the web account deletion page (https://onji.org/account-delete/). Subscriptions paid through an app store are not canceled automatically when you withdraw, so please cancel them yourself in the relevant store.
- Persons under 14 years of age cannot sign up for the Service. The Company confirms at sign-up that the user is at least 14 years old, and deletes accounts found to belong to persons under 14.
7. Procedures and Methods for Destroying Personal Information
- Personal information stored as electronic files is permanently deleted in a way that cannot be recovered or reproduced.
- Personal information recorded or stored on paper documents is destroyed by shredding or incineration.
8. Measures to Ensure the Security of Personal Information
- Passwords are encrypted and stored in a way that cannot be reversed, and mobile phone numbers are converted to a value (hash) for detecting duplicate sign-ups
- Encryption in transit (HTTPS), and app login information is kept in the device's secure storage
- Minimizing the staff who handle personal information, managing access rights, and keeping access records
- Installing security programs against hacking and others, and updating and inspecting them periodically
9. Cookies and External Fonts
- The Company uses cookies needed to provide the Service, such as keeping you logged in, security, and the shopping cart.
- How to refuse cookies: You can refuse or delete cookies in your web browser settings. (Chrome: Settings > Privacy and security > Third-party cookies / Edge: Settings > Cookies and site permissions / Safari: Settings > Privacy > Block all cookies) However, if you refuse essential cookies, some services such as login will be restricted.
- External fonts: To display pages, the website loads the Pretendard font from Google Fonts (fonts.googleapis.com, Google LLC) and jsDelivr (cdn.jsdelivr.net). When a page is opened, the user's IP address and browser information may be sent to those providers' servers (including overseas), and the Company does not store it. If you do not want this, you can use your browser's content blocking feature, in which case the font is displayed in a default font.
10. Chief Privacy Officer and Contact Department
| Company name | HJ Company |
| Chief Privacy Officer | Hyangjeong Lee / CEO |
| Contact | +82 10-2994-6340 / onjiart2016@gmail.com |
| Address | Unit C-206, 238-45 Misari-ro, Seorak-myeon, Gapyeong-gun, Gyeonggi-do, Republic of Korea |
Users may direct all inquiries, complaints, and requests for remedies about personal information arising from their use of the Service to the Chief Privacy Officer. For other reports or consultations about personal information infringement, you can contact the following organizations.
- Personal Information Infringement Report Center (privacy.kisa.or.kr / dial 118, no area code)
- Personal Information Dispute Mediation Committee (www.kopico.go.kr / 1833-6972)
- Supreme Prosecutors' Office Cybercrime Investigation Division (www.spo.go.kr / dial 1301, no area code)
- Korean National Police Agency Cyber Bureau (cyberbureau.police.go.kr / dial 182, no area code)
11. Changes to This Privacy Policy
If content is added, deleted, or modified in this Privacy Policy due to changes in laws, policies, or security technology, the Company will announce it through the notices in the Service at least 7 days before the change.
Announcement date: October 30, 2026 / Effective date: November 6, 2026
Previous version: effective October 5, 2026 (revised by this policy)