Privacy Policy
Last updated: 2026-10-01
Privacy Policy
Volnewmer Genuine Verification Web Service (rededition.volnewmer.com)
Classys Inc.
Classys Inc. (the "Company") values the personal information of its users and complies with the Personal Information Protection Act of the Republic of Korea and related laws. Through this Privacy Policy the Company discloses how the personal information you provide is used, and what measures are taken to protect it. This English version applies to the Volnewmer genuine verification web service (the "Service") and describes only the personal information actually processed through the Service. If this Privacy Policy is revised, the Company will announce the changes on the Service.
- Purposes and items of personal information processed
- Processing and retention period
- Provision to third parties
- Outsourcing of processing and overseas transfer
- Rights of data subjects and how to exercise them
- Destruction of personal information
- Personal information protection officer
- Cookies and similar technologies
- Security measures
- Changes to this Privacy Policy
1. Purposes and items of personal information processed
(1) The Company collects and processes the following personal information for the purposes below.
| Purpose | Details | Items | Retention |
|---|---|---|---|
| Account management | Creating and managing your account, verifying that you own your email address, identifying you when you sign in, preventing fraudulent or unauthorized use, delivering notices, handling inquiries | Required: email address, name, password (email sign-up only; stored as a one-way hash), your agreement choices and the time of agreement Optional: country, language preference Social sign-in (Google, Apple, Facebook, LINE): the account identifier issued by the provider, and the email address and name provided by the provider or entered by you |
Until account deletion |
| Email verification | Sending a 6-digit code to confirm ownership of your email address when you sign up, sign in with a social account for the first time, change your email address or reset your password | Email address, verification code, number of attempts, expiry time | Codes expire after 5 minutes; verification records are kept for a short period for operation and abuse prevention |
| Treatment verification | Registering the verification code issued by your clinic, confirming the treatment is genuine, and showing your verification history and next-treatment schedule ("My verification") | Required: verification code, treatment date, clinic name Optional: rating |
Until account deletion |
| Benefits | Issuing a mobile gift voucher after a completed verification and delivering it to you by email | Email address, voucher issuance and delivery records | Until account deletion, or as required by law |
| Customer support | Receiving and answering 1:1 inquiries and notifying you of replies by email | Title and content of the inquiry, replies, email address | Until account deletion, or as required by law |
| Marketing (optional) | Sending product news and offers | Email address, marketing consent status | Until consent is withdrawn or the account is deleted |
(2) The following information may be generated and collected automatically while you use the Service: IP address, browser and device information (user agent), access date and time, service usage records and records of improper use. This information is used to keep the Service secure, to limit abusive requests, and to diagnose problems.
(3) The Company collects personal information through the Service's web pages (sign-up, sign-in, verification, support forms), through the social sign-in providers you choose to use, and through automatic collection during use of the Service.
(4) The Company does not collect location information, payment information, or government identification numbers through the Service.
2. Processing and retention period
In principle, the Company destroys personal information without delay once the purpose of its collection and use has been achieved. Personal information collected for account management and treatment verification is retained until you delete your account. However, the Company retains the following information for the periods stated below.
(1) Retention under the Company's internal policy
| Information | Period | Reason |
|---|---|---|
| Email address of a deleted account | 7 days after deletion | Preventing immediate re-registration and misuse of the deletion function |
| Records of improper use and inquiry records | 1 year | Preventing improper use and keeping a record of inquiries |
(2) Retention required by law
| Information | Period | Legal basis |
|---|---|---|
| Records of consumer complaints or dispute resolution | 3 years | Act on the Consumer Protection in Electronic Commerce |
| Records of labelling and advertising | 6 months | Act on the Consumer Protection in Electronic Commerce |
| Records of identity verification | 6 months | Act on Promotion of Information and Communications Network Utilization and Information Protection |
| Website access records | 3 months | Protection of Communications Secrets Act |
3. Provision to third parties
The Company does not provide your personal information to outside parties, except in the following cases:
- where you have given prior consent;
- where required by law, or where an investigative agency requests it in accordance with the procedures and methods prescribed by law.
Treatment verification requests are checked against the Company's genuine-product ledger using the verification code only. Your email address, name and other account information are not sent to clinics or to the voucher issuer.
4. Outsourcing of processing and overseas transfer
(1) To operate the Service, the Company entrusts the following processing to external service providers.
| Provider | Entrusted work |
|---|---|
| Amazon Web Services, Inc. (AWS, Seoul region) | Hosting of the Service, database and server operation, and delivery of service emails (verification codes, benefit and reply notifications) |
| Google LLC, Apple Inc., Meta Platforms, Inc. (Facebook), LY Corporation (LINE) | Authentication when you choose to sign in with a Google, Apple, Facebook or LINE account. Each provider processes your data under its own privacy policy; the Company receives only your account identifier and, where available, your email address and name. The Company does not post to, or read any other data from, your social account. |
| Mobile gift voucher issuer | Issuing the voucher provided as a benefit. The Company does not send your personal information to the voucher issuer; the voucher is delivered to you by the Company. |
(2) The Service is operated by the Company in the Republic of Korea and your personal information is stored on servers located in the Republic of Korea (AWS Seoul region). If you use the Service from outside Korea, your personal information is transferred to and processed in Korea as described in this Privacy Policy.
(3) The home page of the Service embeds a video hosted by YouTube (Google) in privacy-enhanced mode. YouTube may collect data from your browser once the video starts playing, in accordance with Google's privacy policy.
5. Rights of data subjects and how to exercise them
- You may at any time exercise your rights to access, correct, delete, or suspend the processing of your personal information, or to withdraw your consent.
- You can exercise these rights in the following ways. Where restricted by law, the Company may refuse a request.
- Access and correction: Account Settings in the Service (name, country, language, email address, password).
- Deletion of your account: Account Settings > Delete my account. Accounts created in the Volnewmer mobile app must be deleted in the app.
- Withdrawal of marketing consent, and all other requests: 1:1 Support in the Service, or the personal information protection officer listed in Section 7.
- These rights may also be exercised through your legal representative or an authorized agent.
- You are responsible for the security of your password and sign-in accounts. The Company will never ask for your password by email.
- If you are under 14 years of age, the consent of your legal guardian is required to use the Service. A legal guardian may access, correct or delete the child's personal information, or request account deletion, and the Company will take the necessary action without delay.
- You may refuse to consent to the collection and use of personal information. However, without the required items you cannot create an account or use the treatment verification service.
6. Destruction of personal information
(1) Procedure: When the purpose of collection has been achieved, personal information is destroyed after any retention period required by internal policy or applicable law (see Section 2). When you delete your account, your sign-in methods are removed immediately, the account is deactivated and can no longer be accessed, and the remaining information is retained only for the periods described in Section 2 before it is destroyed. Information retained after the purpose has been achieved is not used for any other purpose except as required by law.
(2) Method: Personal information stored in electronic form is deleted using technical methods that prevent the records from being restored. Personal information printed on paper is shredded or incinerated.
7. Personal information protection officer
(1) The Company has designated the following department and officer to protect your personal information and to handle related complaints.
| Department | Management Division |
|---|---|
| Personal information protection officer | Yoonseok Choi |
| Telephone | +82-2-6313-2100 |
| yschoi@classys.com |
(2) You may report any personal information related complaint arising from your use of the Service to the officer or department above, or through 1:1 Support in the Service.
(3) For other reports or consultation about personal information infringement, you may contact the following organizations in the Republic of Korea:
- Personal Information Infringement Report Center (privacy.kisa.or.kr / +82-118)
- Personal Information Dispute Mediation Committee (www.kopico.go.kr / +82-1833-6972)
- Supreme Prosecutors' Office, Cyber Investigation Division (spo.go.kr / +82-1301)
- Korean National Police Agency, Cyber Bureau (cyberbureau.police.go.kr / +82-182)
8. Cookies and similar technologies
- The Service does not use cookies or third-party analytics tools to track you for advertising or profiling.
- To keep you signed in, the Service stores your sign-in session in your browser's session storage. This data is removed when you close the browser tab or sign out.
- The Service stores a small amount of data in your browser to remember your preferences (for example, whether you have dismissed a notice). You can clear this data at any time through your browser settings.
- The embedded YouTube video on the home page may set cookies from Google once playback starts (see Section 4). You can block third-party cookies in your browser settings; the video may then not play.
9. Security measures
The Company takes the following technical and administrative measures so that personal information is not lost, stolen, leaked, altered or damaged.
- Minimization and training of staff: The Company limits the staff who handle personal information to the minimum necessary and provides training on the importance of personal information protection.
- Encryption: Passwords are stored using one-way hashing with a salt and cannot be recovered by the Company. All communication between your browser and the Service is encrypted using TLS (HTTPS).
- Access control: Access to the database and servers is restricted to authorized personnel and systems, and sign-in credentials issued by the Service are short-lived and can be revoked.
- Abuse prevention: Requests to send verification codes and to sign in are rate-limited by email address and IP address, and accounts are locked after repeated failed sign-in attempts.
- Hacking prevention: The Company uses security software and keeps its systems updated to prevent damage from malicious code and intrusion.
10. Changes to this Privacy Policy
This English version of the Privacy Policy applies to the Volnewmer genuine verification web service from 16 September 2026. If content is added, deleted or amended due to changes in laws, policies or security technology, the Company will announce the changes on the Service at least 7 days before they take effect.
- Effective date: 16 September 2026
- The Korean Privacy Policy of Classys Inc. (ver 2.1, effective 10 November 2022) is available at www.classys.co.kr.