개인정보처리방침 – 플러그링크

Privacy Policy

Effective November 2, 2026.

PLUGLINK Inc. (the “Company”) establishes and publishes this Privacy Policy in accordance with the Personal Information Protection Act and other applicable laws to protect users’ personal information, explain how and why it is processed and the measures taken to protect it, and address users’ concerns.

1. Purpose and Retention of Personal Information

1. PLUGLINK Inc. processes the following personal information items for the purposes described below. The Company processes and retains personal information within the retention and use periods prescribed by law or consented to by users at the time of collection. Personal information being processed will not be used for any purposes other than those stated below, and if the purposes or items of use change, the Company will take necessary measures, such as obtaining separate consent, as prescribed by the Personal Information Protection Act.

Purpose of Processing	Personal Information Items	Retention Period
Membership registration and management	(Required) Name, CI (Connecting Information), mobile phone number, date of birth, gender (Optional) Address, vehicle information (manufacturer)	Until membership withdrawal (Where relevant laws provide exceptions, such exceptions shall apply.)
Social login integration (e.g., Kakao, Apple, Google)	Integration information for each SNS (user identifier ID, SNS token value)
Payment records	Card issuer, card type, card number, expiration date, date of birth, encrypted card identification information (key) (Optional) Bank account information (account holder, bank name, account number) for exceptional payments/refunds made at the customer’s request and with the customer’s consent
Customer support (1:1 inquiries, malfunction reports, automated customer support and complaint handling using AI chatbots/voicebots, consultation quality management, etc.)	Name, CI, mobile phone number, date of birth, gender, recorded voice files of consultations, speech-to-text (STT) data, chatbot conversation text, charging and payment information, consultation date/time and channel	Members: 3 years after the consultation ends Non-members: 90 days after the consultation ends However, voice files are retained for 3 years after the consultation ends, regardless of membership status.
Membership card registration	(Optional) Name, transportation card number (16-digit card number)	Until the membership card is deleted or until membership withdrawal (deleted upon withdrawal)
Promotion and marketing	(Optional) Name, mobile phone number, member ID	Until consent is withdrawn
Charger installation inquiries	Name, email, contact number, facility name, applicant type, address	Until membership withdrawal
Operation of the electric vehicle battery safety management policy of the Ministry of Climate, Energy and Environment and the Korea Environment Corporation	EV VIN (or battery pack ID), battery charging information (SOC), battery degradation information (SOH), battery cell voltage, pack current, module temperature	Until the vehicle is scrapped or until the end of the mandatory retention period under relevant laws (in accordance with relevant laws, including the internal policies of the Korea Environment Corporation)

2. However, where the Company is obligated to retain personal information under relevant laws such as the Commercial Act, the Company retains users’ personal information. In such cases, the Company uses the retained information only for the purpose of retention, and the retention periods are as follows:(1) Information related to the Company’s commercial books, important documents concerning its business, and slips: 10 years for important documents / 5 years for slips (Commercial Act)(2) Information related to books and supporting documents for all transactions: 5 years (Framework Act on National Taxes, Corporate Tax Act)(3) Records on contracts or withdrawal of offers, and records on payment and supply of goods: 5 years (Act on the Consumer Protection in Electronic Commerce, etc.)(4) Records on consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.)(5) Books and issued tax invoices or receipts: 5 years (Value-Added Tax Act)(6) Service usage records, access logs, and access IP information under the Protection of Communications Secrets Act: 3 months※ Under the “personal information validity period system,” the personal information of members who have not used the service for one year is stored and managed separately.(7) Information necessary for confirming contract performance, internal reporting, responding to audits and inspections, settling and billing costs, and responding to future disputes, even after the purpose of collection has been achieved or the data subject has requested withdrawal: until 6 months after the end of the transaction relationship (if non-performance or a dispute continues, retained and used until performance is completed or the dispute is resolved)

2. How Personal Information Is Destroyed

1. Unless personal information must be retained under other laws, the Company destroys personal information without delay when it is no longer necessary, such as when the retention period has expired or the purpose of processing has been achieved.

2. If personal information must continue to be retained under other laws, internal policies, or information protection reasons (see Retention and Use Period) even though the retention period consented to by the user has expired or the purpose of processing has been achieved, the Company transfers such personal information to a separate database (DB) or stores it in a different location (a separate file cabinet for paper documents). Personal information transferred to a separate DB will not be used for any purpose other than the purpose of retention, unless required by law.(1) Legal basis: Act on the Consumer Protection in Electronic Commerce, etc.(2) Personal information items retained: Account information, transaction date

3. The procedures and methods for destruction of personal information are as follows:(1) Destruction procedure: The Company selects the personal information for which a reason for destruction has arisen and destroys it with the approval of the Company’s Chief Privacy Officer.(2) Destruction method: Personal information recorded and stored in electronic file form is destroyed in a way that the records cannot be restored, and personal information recorded and stored in paper documents is destroyed by shredding or incineration.

3. Outsourcing of Personal Information Processing

1. To ensure the smooth processing of personal information, the Company entrusts personal information processing activities to the following service providers:

Service Provider	Services Provided
NICEPAY (㈜나이스페이), Korea Information & Communications Co., Ltd. (한국정보통신㈜), SMARTRO Co., Ltd. (㈜스마트로), EVAR CNP Co., Ltd. (에바씨엔피㈜), Kakao Pay Corp. (㈜카카오페이)	Electronic payment processing
Channel Corp. (㈜채널코퍼레이션), EV Plus Co., Ltd. (㈜이브이플러스), Neosapience, Inc. (네오사피엔스㈜)	Customer support
NICE Information Service Co., Ltd. (NICE평가정보㈜)	Identity verification for service use (mobile phone)
Daou Technology Inc. (㈜다우기술), dktechin (㈜디케이테크인)	SMS and KakaoTalk notification (AlimTalk) services
EV Sesang Co., Ltd. (㈜이브이세상), Ride Co., Ltd. (라이드㈜)	Regular inspection and maintenance of chargers
EVAR Co., Ltd. (㈜에바), ULVAC Korea, Ltd. (한국알박㈜), GRE System Co., Ltd. (㈜지알이시스템), Jinyoung Electric Wire Co., Ltd. (진영전선㈜), LS ELECTRIC Co., Ltd. (엘에스일렉트릭㈜), Blue Networks Co., Ltd. (㈜블루네트웍스), Clean Elex Co., Ltd. (㈜클린일렉스), CastPro Co., Ltd. (㈜캐스트프로), EVSIS Co., Ltd. (이브이시스㈜), Kostel Co., Ltd. (코스텔㈜)	Charger after-sales service (A/S)
Hanbaek Co., Ltd. (㈜한백), Chaevi Co., Ltd. (채비㈜)	Management of charger installation applications and installation work

2. When entering into an entrustment agreement, the Company specifies in the contract or other documents, in accordance with the Personal Information Protection Act, matters such as the prohibition of processing personal information for purposes other than performing the entrusted activities, technical and administrative safeguards, restrictions on re-entrustment, management and supervision of service providers, and liability for damages, and supervises whether the service providers process personal information securely.

3. If the entrusted activities or the service providers change, the Company will disclose such changes through this Privacy Policy without delay.

4. Disclosure of Personal Information to Third Parties

1. The Company does not provide personal information to third parties except with the user’s consent or where specifically provided by law.

2. The Company provides users’ personal information to third parties as follows:

Recipient	Recipient’s Purpose of Use	Personal Information Provided	Recipient’s Retention and Use Period
Korea Environment Corporation	Membership card registration	Transportation card number (16-digit card number)	Until the membership card is deleted or until membership withdrawal (deleted upon withdrawal)
Ministry of Climate, Energy and Environment, Korea Environment Corporation, charging roaming operators*	Use and settlement of roaming charging services	Membership card number	Until membership withdrawal
Ministry of Climate, Energy and Environment, Korea Environment Corporation, Seoul Energy Corporation	Operation of the electric vehicle battery safety management policy	EV VIN (or battery pack ID), battery charging information (SOC), battery state information (SOH), battery cell voltage, pack current, module temperature	Until the vehicle is scrapped or until the end of the mandatory retention period under relevant laws (in accordance with relevant laws, including the internal policies of the Korea Environment Corporation)

* Charging roaming operators

3. Users have the right to refuse consent to the provision of personal information to third parties; however, if they refuse, the registration of membership cards and use of related services may be restricted.

4. If the details of provision to third parties change, the Company will take necessary measures in accordance with relevant laws, such as the Personal Information Protection Act, and disclose such changes through this Privacy Policy.

5. Security Measures

The Company uses the following technical and administrative measures to protect personal information against loss, theft, leakage, alteration, or damage.

1. Technical measures(1) Encryption of user information: Users’ valuable personal information is encrypted and stored in the DB, so that it cannot be used even if leaked through external intrusion.(2) Encryption of communication sections: The Company uses SSL to ensure that user information is transmitted securely in the sections where users enter and transmit their information when registering for membership and logging in through the website.(3) Installation of security solutions: To provide services and manage user information securely, the Company installs antivirus programs on its personal information processing systems, performs periodic updates and regular inspections, and applies DB encryption and screen capture prevention solutions. In addition, to prepare for external intrusions such as hacking, the Company has installed intrusion prevention/detection systems and continuously monitors for hacking and external intrusions through an integrated security control center.

2. Administrative measures(1) Establishment of a personal information management system: The Company has established and operates an internal personal information management system to manage personal information securely.(2) Operation of a privacy committee: The Company operates a committee for the protection of personal information and strives to improve and correct matters such as the operation of the personal information management system and privacy issues.(3) Management of personnel authorized to handle personal information: The Company obtains privacy pledges from personnel authorized to handle personal information who process users’ personal information and provides privacy training so that they recognize the importance of user information and manage it securely. In addition, the Company minimizes unnecessary access to and exposure of users’ personal information by managing the access rights of personnel authorized to handle personal information.

6. Cookies

1. The Company uses cookies to store and retrieve usage information and provide personalized services.

2. Cookies are small pieces of data sent by a website server to a user’s browser. They may be stored on the user’s computer.(1) Purpose of using cookies: The Company uses cookies to provide targeted marketing and personalized services by identifying and analyzing users’ visits to and usage patterns of each service and website, users’ areas of interest, participation in events, and number of visits. Users can manage cookie settings in their web browsers to allow all cookies, require confirmation each time a cookie is stored, or refuse all cookies.(2) Installation, operation, and rejection of cookies: Users can allow all cookies, require confirmation each time a cookie is stored, or refuse all cookies through their browser settings.※ How to configure (for Internet Explorer): Tools at the top of the web browser > Internet Options > Privacy > Advanced > Select settings(3) However, if users refuse to store cookies, they may have difficulty using some services that require login.

7. Users’ Rights and How to Exercise Them

1. Users or their legal representatives (in the case of children under the age of 14) may withdraw their consent to the collection, use, and provision of personal information (cancel membership) at any time, and may exercise rights such as requesting access to, correction or deletion of, or suspension of processing of their personal information.

2. Users or their legal representatives may exercise the above rights online by accessing the Company’s website and completing an identity verification procedure through the personal information management menu, or by contacting the customer center or the Company’s privacy team manager or staff in writing, by phone, or by email, and the Company will take action without delay.

3. The rights under paragraphs 1 and 2 may be exercised through an agent, such as the user’s legal representative or a person who has been delegated authority. In this case, a power of attorney in the form of Attached Form No. 11 under the “Notice on Personal Information Processing Methods (No. 2020-7)” must be submitted.

4. Users’ rights to request access to and suspension of processing of personal information may be restricted under Article 35(4) and Article 37(2) of the Personal Information Protection Act.

5. Users may not request the correction or deletion of personal information if other laws specify such personal information as subject to collection.

6. When a request for access, correction, deletion, or suspension of processing is made in accordance with the rights of data subjects, the Company verifies whether the person making the request is the data subject or a legitimate agent.

7. If a user requests correction of errors in personal information, the Company will not use or provide such personal information until the correction is completed, and if such personal information has already been provided to a third party, the Company will notify the third party without delay so that the correction can be made.

8. If a user or legal representative withdraws consent (cancels membership), the Company, in principle, destroys the personal information without delay; however, where relevant laws require the retention of such information, the Company processes it in accordance with “Retention and Use Period of Personal Information” in this Privacy Policy and takes measures so that it can be accessed or used only when necessary.

9. If a user objects to the Company’s measures, such as the rejection of a request for access or copying, the user may raise an objection with the person in charge of personal information processing.

8. Remedies for Privacy Violations

Users may contact the following organizations for remedies for and consultation on infringement of personal information. These organizations are independent of the Company. Please contact them if you are not satisfied with the results of the Company’s own handling of personal information complaints and remedies, or if you need more detailed assistance.

Personal Information Infringement Report Center (KISA): 118 (No area code) (https://privacy.kisa.or.kr)

Supreme Prosecutors’ Office of the Republic of Korea: 1301 (No area code) (https://www.spo.go.kr)

Korean National Police Agency: 182 (No area code) (https://ecrm.police.go.kr)

Personal Information Dispute Mediation Committee (KOPICO): 1833-6972 (No area code) (https://www.kopico.go.kr)

9. Privacy Officer and Contact Information

1. The Company has designated the Chief Privacy Officer as follows to take overall responsibility for personal information processing and to handle users’ complaints and remedies related to personal information processing.

[Chief Privacy Officer]

Name: Lee Doho

Position: Chief Technology Officer (CTO)

Contact: doho.lee@pluglink.kr, +82-1533-0702

2. Users may direct all inquiries, complaints, and requests for remedies related to personal information protection arising from their use of the Company’s services (or business) to the Chief Privacy Officer and the responsible department. The Company will respond to users’ inquiries and address them without delay.※ However, emails sent for purposes other than inquiries, complaints, and damages related to personal information protection may not be answered or handled, and commercial advertising emails sent without the consent of the person in charge may be reported to the relevant authorities in accordance with Articles 50 through 50-8 of the Act on Promotion of Information and Communications Network Utilization and Information Protection.

10. Advertising Messages

1. The Company does not transmit advertising information for commercial purposes without the user’s prior consent.

2. When transmitting advertising information for commercial purposes, such as event notices, marketing, and promotions, the Company sends it only to users who have given prior consent to receive advertising information.

3. When transmitting advertising information through electronic transmission media, the Company does so after taking the following measures in accordance with the Act on Promotion of Information and Communications Network Utilization and Information Protection.– Electronic transmission media: App push messages, mobile text messages, email, fax, KakaoTalk notification messages (AlimTalk), and other electronic transmission media(1) Indication of “(Advertisement)” at the beginning of the title(2) Name and contact information of the sender(3) A toll-free number for opting out of receiving such information

4. The Company confirms with users their consent to receive advertising information every two years from the date of consent. If a user does not express any intention after receiving the notice on whether to continue consenting, the user’s consent will remain in effect.

5. The Company does not transmit advertising information through electronic transmission media between 9:00 p.m. and 8:00 a.m. the following day.

6. However, the following content sent through electronic transmission media is not considered advertising information:– Information related to the performance of contracts concluded between the Company and users– Matters that the Company must notify users of under relevant laws, such as information on vehicle safety and quality

11. Changes to This Privacy Policy

If this Privacy Policy changes, the Company will announce the reasons for and details of the changes in advance on the notice section of its website’s home page or in a separate pop-up window.

이전 개인정보처리방침 보기