Privacy Policy

Whomi Global Inc. (the "Company") protects the personal data it collects through Apostille Korea (apostillekorea.com) in accordance with the Personal Information Protection Act (Republic of Korea) and other applicable laws and regulations, and processes such data as follows. The Company is a corporation of the Republic of Korea, and personal data is processed and stored in the Republic of Korea.

Article 1 (Purposes of Processing)

The Company processes personal data only for the following purposes.

1. Confirming the intention to register as a member, identifying the individual, and managing members
2. Performing the ordered services, such as obtaining, translating, notarizing, and certifying documents on the User's behalf and delivering them
3. Payment of fees and refunds
4. Responding to customer inquiries, handling disputes, and delivering notices
5. Retaining records as required by applicable laws and regulations

Article 2 (Categories of Personal Data Processed)

1. Information required for membership registration and use of the Service

• Required: name, e-mail address, password, mobile phone number (including country code), country of residence
• Optional: delivery address

2. Information processed on a per-case basis when authorizing document issuance

• Categories: information contained in the application forms, letters of authorization, copies of identification documents, and attached documents submitted for the application, issuance, translation, and certification services performed on the User's behalf (such as passport number, government-issued unique identifiers, address, and name, as required for each document to be issued)
• Time of processing: such information is not collected at membership registration; it is processed on a per-case basis at the time the User authorizes the issuance of an individual document, by the User personally entering it in the letter of authorization or application form and signing electronically.
• Legal basis: government-issued unique identifiers (such as passport numbers) are processed within the minimum necessary scope on the basis of compliance with legal obligations under applicable laws and regulations or the User's separate prior consent.
• Scope of use and destruction: such information is used solely for the purpose of applying for the issuance of the relevant document and preparing and submitting the letter of authorization; it is stored in fully encrypted form while retained and is automatically destroyed without delay once the work is completed (the User's "receipt confirmed").

3. Payment information

• Payments are processed by the payment service provider (Stripe); the Company does not store card numbers and retains only the payment authorization result, transaction number, and payment amount.

4. Information collected automatically

• Access IP address, date and time of access, browser and device information, and Service usage records

Article 3 (Processing and Retention Period)

1. Member information: until withdrawal of membership; provided, however, that if there is an Order in progress, until its completion
2. Unique identifiers and copies of identification documents relating to authorization for document issuance: destroyed without delay after completion of the issuance work
3. Records containing personal data among order and delivery records: automatically destroyed 30 days after the User's receipt is confirmed
4. The Company destroys personal data without delay once the statutory retention period has expired. However, anonymized data from which all identifiers have been completely removed so that no specific individual can be identified (Anonymized Data) may be permanently retained and used for customer identification, compilation of statistics, and service improvement and analysis.

Article 4 (Provision to Third Parties)

The Company provides personal data to, or entrusts the transfer of personal data to, the following institutions and third parties within the minimum scope necessary to perform the contracted services, such as the issuance, translation, notarization, apostille, and consular legalization of the documents applied for by the User. Any other provision to third parties is limited to cases where the User has given separate prior consent or where specifically provided by law.

1. Relevant authorities in each country involved in document issuance and certification (competent authorities of the issuing country and the certifying country)
   • Recipients: government agencies, judicial bodies, local governments, educational institutions, notary offices, diplomatic and consular missions of the relevant countries, and public or private issuing and certifying entities with equivalent authority
   • Purpose of provision: issuance, translation, notarization, apostille, and consular legalization of the documents applied for, and handling of related administrative requests on the User's behalf
   • Categories provided: the signature and personal particulars required to be entered in the application form and letter of authorization for the issuance and certification of the relevant document (name, passport number, government-issued unique identifiers, etc.) and attached documents
2. Receiving and administrative authorities of the destination country designated by the User
   • Recipients: the relevant government agencies, visa centers, submission offices, and diplomatic and consular missions of the country to which the User intends to submit the documents
   • Purpose of provision: submission, acceptance, and verification of the documents and conduct of related administrative procedures
   • Categories provided: all finally certified and issued documents and the basic personal particulars required for the submission application

Article 5 (Outsourcing of Processing)

The Company outsources the following tasks and manages and supervises the processors to ensure that they process personal data securely.

Payment service provider

• Processor: Stripe
• Outsourced task: processing of payments for use of the Service
• Categories of personal data provided: name, mobile phone number, e-mail address

Delivery service providers

• Processors: DHL, FedEx, National Postal Services (EMS)
• Outsourced task: delivery of civil documents and goods
• Categories of personal data provided: name, mobile phone number, address

Article 6 (Automatic Collection Devices)

This Site does not use cookies to collect personal data.

Article 7 (Destruction)

1. The Company destroys personal data without delay once the retention period has expired or the purpose of processing has been achieved.
2. Electronic files are deleted by a method that renders them unrecoverable, and paper documents are shredded or incinerated.
3. Information that must be retained under applicable laws and regulations is stored separately and is not used for any other purpose.

Article 8 (Rights of Users)

1. Users may at any time request access to, correction of, deletion of, or suspension of processing of their personal data.
2. Requests may be made by e-mail (help@apostillekorea.com), and the Company shall notify the User of the outcome within 10 days after verifying the User's identity.
3. Any additional rights guaranteed by the laws and regulations of the country or region in which the User resides may be exercised in the same manner through the above procedure.
4. Personal data of children under 14 years of age is processed with the consent of the child's legal representative, who may exercise the child's rights on the child's behalf.

Article 9 (Security Measures)

The Company takes the following measures to ensure the secure processing of personal data.

1. Minimizing the number of staff handling personal data and providing regular training
2. Encrypted storage of unique identifiers and passwords, and encryption of data in transit
3. Access control management and retention of access logs
4. Operation of security programs such as intrusion prevention and anti-virus software
5. Establishment of an internal management plan and regular inspections

Article 10 (Data Protection Officer)

The Company has designated a Data Protection Officer to protect Users' personal data and to handle related inquiries and complaints.

• Data Protection Officer (DPO): Kim, Young seok
• Position: Director
• E-mail: help@apostillekorea.com

Users may direct all inquiries regarding personal data protection, complaints, and requests to exercise their rights arising in the course of using the Company's Service to the contact above.

Users residing outside the Republic of Korea may apply for mediation or lodge a complaint with the data protection supervisory authority of their country.

Article 11 (Changes to this Policy)

If this Policy is changed, notice shall be posted on the Site from 7 days before the change takes effect. Changes material to Users shall also be notified by e-mail.

This Policy takes effect on 2026-10-01.