NETS PASS
English

Privacy Policy

This is a reference translation. If there is any discrepancy, the Korean original prevails. View the Korean original

Effective date: November 13, 2026

NETS Co., Ltd. (the “Company”) operates the NETS PASS app (the “App”) and the website (www.nets-pass.com), and processes users’ personal information in accordance with the Personal Information Protection Act of Korea and other applicable laws. This Policy explains separately the personal information processed by the Company and the information managed by the company the user belongs to (the “Customer”).

1. Information processed by the Company and information managed by the Customer

NETS PASS is an authentication app for businesses. The information the App handles is divided as follows, depending on who manages it.

  • Information processed by the Company: Information sent from the App to Google Firebase to receive notifications, resolve errors and produce usage statistics. Sections 2 onward of this Policy describe this information.
  • Information managed by the Customer: Account (an ID such as an employee number), affiliation, device registration information (device name and model, operating system version, device identification code, etc.), authentication request details (the requesting service, time, browser and device, etc.) and authentication results. This information is stored on the PASS server operated by the Customer. Its processing standards, retention period and requests such as access or deletion are governed by the Customer’s privacy policy. Please contact your company’s administrator or privacy officer.
  • Authentication request notifications: The Customer’s PASS server sends them to the App through Google Firebase Cloud Messaging (FCM). A notification contains the request details (account, requesting service, connection information, etc.) and passes through Google’s servers on the way. On iOS devices it also passes through Apple’s servers.

2. Personal information processed by the Company, purposes and retention periods

Notification information

  • Items: push token (FCM registration token), Firebase installation ID
  • Purpose: receiving authentication request notifications
  • Retention period: until the App is deleted or the token expires

Error information

  • Items: time of occurrence, error details, device model, operating system version, app version
  • Purpose: identifying and fixing the cause of errors
  • Retention period: 90 days from collection

App usage records

  • Items: usage events such as app launches and screen views, app instance ID, advertising ID (Android), device model, operating system version, app version, approximate location (country and city level)
  • Purpose: usage statistics, improving features and compatibility
  • Retention period: 2 months from collection. After that, only aggregated statistics that cannot identify individuals remain.

Notes

  • The Company does not receive information that directly identifies users, such as name, phone number, email address or employee number.
  • The advertising ID is used only for usage statistics and not for advertising.
  • The Company does not collect location information.
  • Camera images for QR code scanning and biometric information (fingerprint, face) are processed only on the device and are neither stored nor transmitted.

The Company processes personal information, to the extent necessary to provide and stably operate the App, on the grounds set out in Article 15(1) of the Personal Information Protection Act (performance of a contract with the data subject, legitimate interests of the personal information controller, etc.).

4. Destruction of personal information

  • Information whose retention period has passed is deleted automatically in Firebase.
  • In other cases, when personal information is no longer needed, for example because the purpose of processing has been fulfilled, it is deleted without delay using a method that makes recovery impossible.

5. Provision to third parties and outsourcing of processing

The Company does not provide users’ personal information to third parties. To operate the App, the Company outsources processing as follows.

Google LLC

  • Outsourced work: sending notifications, collecting errors and producing usage statistics using Firebase (Cloud Messaging, Crashlytics, Analytics)
  • Retention period: the retention periods in Section 2, or until the outsourcing contract ends

6. Overseas transfer of personal information

Under Article 28-8(1)(iii) of the Personal Information Protection Act, the Company transfers personal information overseas as follows, as outsourcing and storage of processing for operating the App.

  • Recipient: Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA)
  • Contact: Firebase Privacy and Security
  • Destination countries: the United States and countries where Google has data centers
  • Items transferred: the items in Section 2
  • Time and method of transfer: transmitted over the network while the App is in use
  • Purpose and retention period: same as Section 2
  • How to refuse and the effect of refusal: Deleting the App stops further transfers. However, receiving push notifications and handling errors are necessary for the App to work, so if you refuse the transfer you cannot use the App.

7. Automatic collection tools and how to refuse them

  • The App uses identifiers created by Firebase (installation ID, app instance ID). These identifiers are created per device and app installation and are not linked to a name or employee number. They are reset when you delete the App or clear the App’s data in your device settings.
  • On Android devices, Firebase Analytics also collects the device’s advertising ID. You can reset or delete the advertising ID in your device settings under Privacy (or Google) → Ads.
  • The website does not use cookies or analytics tools.

8. Your rights and how to exercise them

  • Please send requests about information managed by the Customer (Section 1), such as your account, registered devices and authentication records, to your company.
  • Information processed by the Company (Section 2) is device-level information that is not linked to a name or employee number. Deleting the App stops further collection and resets the identifiers, and information already collected is deleted automatically when the retention periods in Section 2 have passed.
  • Separately, you may request access to, correction of, deletion of, or suspension of processing of information processed by the Company. If you send a request to the email address in Section 10, we will tell you the result within 10 days.
  • Because the Company holds no information that identifies users, we may ask for details such as your device model, app version and period of use to find the requested information. If we cannot identify the information for your device, we will tell you why and when it will be deleted automatically.
  • You may also make a request through a legal representative or an authorized person. In that case, a power of attorney must be submitted.
  • If we must refuse or limit a request under the law, we will tell you the reason.
  • You can turn off notifications in your device settings. However, if you turn them off you cannot receive push authentication requests.

9. Measures to ensure the security of personal information

  • Encryption in transit (HTTPS) when the App sends information to Firebase and the app configuration server
  • Limiting access to the Firebase console to the staff who need it
  • Regular security updates and vulnerability management

10. Department responsible for privacy and contact

11. Website and app configuration server

The website and the app configuration server are provided through Cloudflare’s services. Connection information (IP address, etc.) may be processed for delivery and security, but the Company does not separately collect or keep this information.

12. Remedies for infringement of rights

If you need advice or wish to report an infringement of personal information, you may contact the following organizations in Korea.

  • Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
  • Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
  • Supreme Prosecutors’ Office: 1301 (www.spo.go.kr)
  • Korean National Police Agency: 182 (ecrm.police.go.kr)

13. Changes to this Policy

When this Policy changes, the Company records the changes and the effective date in this Policy and posts it on the website. The latest Policy is available at https://www.nets-pass.com/en/privacy/. Previous versions are available below.

  • Effective November 13, 2026: Separated information processed by the Company from information managed by the Customer, and rewrote the retention periods by item, the legal basis and the overseas transfer details.
  • Version revised July 1, 2025 (Korean)