Privacy policy
Effective:
This is a translation. If the English and Korean versions differ, the Korean version applies. 한국어로 보기
- Company
- Ibranics
- [email protected]
Ibranics (“we”) follows the Personal Information Protection Act of Korea (PIPA) and related laws. This policy explains how we process personal information and how we handle related requests. It applies to our website (mibnox.com) and to the services we provide: Mibnox POS, KIOSK, back office, online payments and member features (the “Service”).
1. Why we process personal information
- Accounts: identifying and signing in our business customers and their staff, invitations, permissions and preventing misuse
- Providing the Service: POS, kiosks, back office, device pairing, sales, payments, refunds, receipts, stock, sales and closing records, members, points and coupons
- Contracts: concluding, running and ending service contracts, billing and service notices
- Enquiries: sales questions, technical support and complaints
- Security and reliability: keeping access records, handling outages, preventing and investigating incidents
2. What we process and how we collect it
| Category | Items | How |
|---|---|---|
| Staff accounts of our customers | Name, email, password (stored only as a one-way hash), company and stores, role and permissions | Registered or invited by us or the customer's admin, then entered by the person |
| Customer business details | Business name, registration number, representative, address, phone (printed on receipts) | Entered by the customer |
| Usage records | IP address, access time, browser details, sign-in records, admin actions (audit log) | Created automatically |
| Paired devices | Device identifier, device name, app version, last seen time | Created automatically |
| Payment records | Amount, method, approval number, payment company transaction ID, status | Received from the card terminal or payment company |
| Enquiries | Name, email address, the service you are interested in, message, and optionally phone number and company. On WhatsApp: your WhatsApp phone number and profile name | What you send us through the contact form (after you agree), by email or on WhatsApp. Phone numbers and messages from the form are stored encrypted |
We never collect or store card numbers, expiry dates or CVC codes. Card details are entered on the card terminal or the payment company’s own payment window and handled by that company.
3. Processing on behalf of our customers (shop members)
When a shop uses the member, points or coupon features, the shop is the controller of its members’ information and we process it on the shop’s behalf.
- Items: mobile number (stored encrypted and shown masked to staff), name (optional), member code, points history, purchase history, marketing consent
- We do not use this information for any other purpose and do not give it to anyone else.
- Members can ask the shop to see, correct or delete their information; we carry out the shop’s instructions without delay. If you contact us directly, we pass the request to the shop and help with it.
4. How long we keep it
We delete personal information without delay once its purpose is fulfilled, except:
- Account information: until the account is deleted or the contract ends; after the contract ends we keep it 30 days so the customer can export its data, then delete it
- Shop member information: until the contract with the shop ends or the shop asks us to delete it
- Enquiries: 3 years after they are resolved
- Shops’ sales and payment records: kept on the shop’s instructions for its own legal duties (for example 5 years for tax)
| Kept by law | Law | Period |
|---|---|---|
| Records of contracts and withdrawals | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records of payment and supply | Act on Consumer Protection in Electronic Commerce | 5 years |
| Records of consumer complaints and disputes | Act on Consumer Protection in Electronic Commerce | 3 years |
| Books and evidence of transactions under tax law | Framework Act on National Taxes | 5 years |
| Website access logs | Protection of Communications Secrets Act | 3 months |
Deleted information may remain in encrypted backups until they roll over, at most 90 days. Backups are used only to restore the Service.
5. How we destroy it
Once the period ends, information is destroyed after the privacy officer’s check: electronic files are deleted so they cannot be recovered, paper is shredded or burned. Information that the law requires us to keep is stored separately.
6. Providing information to third parties
We provide personal information to third parties only with consent or where PIPA Articles 17 and 18 allow it (for example a specific legal duty). We currently provide none.
Payments are processed by the card terminal (VAN) or payment (PG) company the shop has its own contract with. The order number and amount are sent to that company as part of the shop’s payment processing.
7. Outsourcing
To run the service we entrust the following work to other companies. Our servers and databases are run by us in Korea.
| Provider | Work |
|---|---|
| Cloudflare, Inc. | Connecting visitors to the website and services (tunnel), security and traffic protection. IP addresses, access logs and transmitted data pass through it. |
| Hostinger International Ltd. | Company email ([email protected]): enquiry notifications and account invitations. |
Our contracts require these providers to protect personal information, and we check that they do. If a provider changes, we update this policy.
8. Transfers abroad
For the work above, personal information is transferred abroad as follows. You may refuse, but the connection service is needed to use the website at all. Instead of email you can contact us on WhatsApp.
| Recipient (contact) | Country | When and how | Items | Purpose | Retention |
|---|---|---|---|---|---|
| Cloudflare, Inc. ([email protected]) | USA and countries with Cloudflare data centres | Over the network, on every visit | IP address, access logs, transmitted data | Connection, security, traffic protection | As set by Cloudflare's policy after delivery |
| Hostinger International Ltd. ([email protected]) | Countries of Hostinger's email servers (e.g. the EU) | Over the network, when email is sent or received | Email address, name, message | Company email | Until we delete it (same as enquiry retention) |
If you choose to message us with the WhatsApp button, your message and phone number travel through WhatsApp (Meta Platforms), under WhatsApp's own terms and privacy policy; WhatsApp may store them on servers outside Korea (for example in the USA). You can always write to us by email instead.
9. Your rights
- You may ask at any time to see, correct or delete your personal information, to stop its processing, or to withdraw consent.
- Ask in writing or by email; we act without delay (within 10 days) and tell you the result.
- A legal representative or someone you authorise may ask on your behalf with a power of attorney.
- Deletion is not possible where another law requires the information, and a request to stop processing may be refused where the law allows.
- The Service is for businesses; we do not knowingly collect information from children under 14.
10. How we protect it
- Organisation: an internal management plan, as few people with access as possible, regular checks
- Access control: role-based permissions, each customer’s data separated in the database itself (row-level security), two-factor sign-in for our staff
- Encryption: passwords hashed with Argon2id; mobile numbers and payment keys encrypted with AES-256-GCM; HTTPS in transit
- Records: sign-in and admin action logs (audit log), reviewed
- Backups: every backup encrypted, restoring tested regularly
- Physical: access to servers and backup storage is restricted
11. Cookies
Our website (mibnox.com) uses no cookies. The back office uses only the cookies it needs to keep you signed in and to remember your language; no advertising or tracking cookies. You can block cookies in your browser, but then you cannot sign in to the back office. The chat assistant on the website runs only in your browser: what you type is not sent to our servers, and the conversation stays in your browser's session storage until you close the tab.
12. Privacy officer
- Name: Mibnox privacy team
- Email: [email protected]
13. Remedies
For help with an infringement of personal information you can contact:
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
- Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
- Korean National Police Agency: 182 (ecrm.police.go.kr)
14. Changes
This policy applies from 2026-10-11. We announce changes on the website 7 days before they apply (30 days for important changes to your rights).