Privacy Policy

**PDPCloud Privacy Policy** Byron Interactive’s PDPCloud platform (the “Company”) complies with applicable privacy laws (including the Personal Information Protection Act of Korea) and processes personal information for the SSO Hub and Linked Services as follows. ## 1. Purposes of Processing | Purpose | Description | |---------|-------------| | Membership | Identity verification, email verification, admin approval, account status, withdrawal/restoration | | Service delivery | SSO login, session handoff, access control, profile delivery | | Security | Password policy, MFA, trusted devices, abuse prevention, audit logs | | Support | Inquiries, notices, Terms/Policy change notices | | Legal compliance | Dispute handling and statutory obligations | ## 2. Categories of Personal Information Collected **Required (sign-up / login)** - Company email (login ID) - Password (processed/stored in AWS Cognito; not stored in plaintext in the Company app database) - Name - Phone number - Company name, tenant, and Client identifiers (via email-domain matching or admin configuration) - Consent to Terms/Privacy Policy, including version and timestamp **Generated/processed during use** - Account status (`pending` / `approved` / `rejected` / `disabled` (withdrawn)) - Role and service access permissions - Session/token data related to login, logout, and handoff (including Host-only cookies) - MFA records and trusted-device identifiers - Audit logs of administrative and member actions - Ordinary operational logs (IP, User-Agent, browser) for security and operations **Optional** - Additional profile fields when such features are provided Registration is limited to **approved company email domains**. ## 3. Retention Period 1. Member information is retained while membership remains active. 2. After withdrawal (`disabled`), the account is retained in a withdrawn state for restoration of the same email, audit, dispute handling, and service continuity, as needed. 3. Where law requires a specific retention period, data is kept for that period. 4. Data no longer needed is destroyed without undue delay, except work content retained under the Terms and Linked Service policies. ## 4. Provision to Third Parties The Company does not provide personal information to third parties except: 1. With prior consent 2. Where required by lawful requests from authorities 3. In anonymized form for statistics or research ## 5. Outsourcing (Processors) | Processor | Scope | |-----------|-------| | Amazon Web Services (including Amazon Cognito) | Authentication, password/attribute management, verification-related functions | | Cloud infrastructure/hosting providers | Servers, databases, logging | | Email/SMS providers (if used) | Verification codes and notices | The Company binds processors by contract and supervises them. Changes will be announced in this Policy or via service notices. ## 6. Cross-Border Transfers Personal information may be processed outside Korea (e.g., AWS regions) for authentication and infrastructure. Items transferred are those needed for identity and authentication, for the duration of service provision. Contact us with questions. ## 7. Destruction 1. Data is destroyed under internal procedures after retention ends or purposes are fulfilled. 2. Electronic files are deleted irreversibly; paper records are shredded or incinerated. 3. Withdrawn accounts are **retained as disabled** by default; they may later be destroyed under separate criteria when restoration/audit needs end and no legal duty remains. ## 8. Data Subject Rights Members may request access, correction, deletion, suspension of processing, or withdrawal of consent (account withdrawal), and may update profile/password via the SSO Hub. Requests may be made through the SSO Hub or `contact@pdpcloud.co.kr`. The Company will act without undue delay as required by law. Requests using another person’s information may be refused. ## 9. Security Measures The Company implements measures including: - Encrypted handling of credentials (Cognito) - HTTPS in transit - Access control by role, approval status, and Client scope - Host-only session cookies and controlled SSO handoff tokens - MFA and administrative audit logs - Data minimization and internal access controls ## 10. Cookies and Sessions 1. The SSO Hub uses **session cookies**, which are generally **Host-only**. 2. Cookies are not shared across different hosts/domains; Linked Services may use secure handoff (`sso_handoff`) instead. 3. Blocking cookies may prevent login/SSO from working. ## 11. Children The Services target organization users and are not intended for children under 14. If such data is identified, the Company will take prompt action. ## 12. Privacy Contact - Privacy inquiries: `contact@pdpcloud.co.kr` - SSO Hub: `https://sso.pdpcloud.kr` ## 13. Remedies In Korea, you may also contact: - Personal Information Infringement Report Center (privacy.kisa.or.kr / 118) - Personal Information Dispute Mediation Committee (www.kopico.go.kr) - Supreme Prosecutors’ Office Cyber Investigation (www.spo.go.kr) - Korean National Police Agency Cyber Bureau (ecrm.cyber.go.kr) ## 14. Changes to this Policy Material changes will be posted on the SSO Hub or `/legal`, with version updates that may require renewed consent at sign-up. **Published:** 2026-07-22 **Effective:** 2026-07-22 **Version:** `2026-07-22.1`