Privacy policy
(A) Privacy Notice
This Privacy Policy is issued by BUCKETPLACE CO., LTD. (“Bucketplace,” “we,” “us,” or “our”) in relation to the OHouse service (“Service”) provided by us, and is addressed to users of our App (“you”). In this Privacy Policy, the term “App” means any application made available by us (including where we make such applications available via third party stores or marketplaces, or by any other means).
The term “personal information”, as used in this Privacy Policy, shall mean personal information as defined under the relevant data privacy law of your jurisdiction; for the purposes of the General Data Protection Regulation 2016/679 (the “GDPR”), “personal information” shall mean information that is about any individual, or from which any individual is directly or indirectly identifiable, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that individual; for the purposes of the California Consumer Privacy Act (the “CCPA”), “personal information” shall be read to also include information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household; and, for the purpose of the Act on the Protection of Personal Information of Japan (the “APPI”), “personal information” shall mean (i) information containing a name, date of birth, or other identifier or the equivalent (meaning all items made by writing, recording, sound or motion, or other means, in a document, drawing, or electronic or magnetic record) which can be used to identify a specific individual (this includes any information that can be easily collated with other information and thereby used to identify that specific individual) and (ii) those containing an individual identification code as defined in the APPI.
As this Privacy Policy may be amended or updated from time to time, we encourage you to regularly check this Privacy Policy to review any changes with the terms.
(B) Collection of Personal Information
The personal information that we collect about you is as follows:
| Service | Personal information collected |
|---|---|
| When signing up for the Service | Nickname, email address, gender, birth year, Instagram username and profile picture (optional) |
| When signing up for the Service via third-party SNS log-in |
• For all: (Required) Nickname, email address, gender, birth year, unique identifier
• Facebook: (Required) Name, Profile picture, Email address • Line: Name, profile picture, status message • Google: Nickname • Apple: (Optional) Email address |
| Customer inquiry | Name, email address |
| Information created and collected in the course of using the Service | Profile picture, Service usage records, Access log, IP address, Online identifier (including IDFV), app push tokens (FCM device tokens), device information (manufacturer, OS type and version), type of housing, number of cohabitants, geolocation (up to city level, if you agree to provide it to us.) |
(C) Method of Collecting Personal Information
We collect your personal information to the extent that is permitted under the applicable laws of your jurisdiction. The method of collecting your personal information shall always be fair. Your personal information will be used only for the specific purposes that are set forth in this Privacy Policy at the time of the collection.
(D) Purposes of Processing Personal Information
We process your personal information for the following purposes pursuant to applicable law:
| Purposes of Processing |
|---|
| • To provide our App or Service : Providing our App or Service; creating an account; providing customer support on the use of services; responding to inquiries; identifying and preventing wrongful uses; performing statistical analyses; providing promotional materials (upon consent); and communicating with you in relation to our App. |
| • To operate our business : Operating and managing our App; providing you with content; displaying advertising and other information to you; prevention of duplicate uses or other wrongful uses; communicating and interacting with you via our App; and notifying you of changes to any of our App. |
| • To perform communications and marketing activities : Communicating with you via any means (including via email and app push alerts) to provide news items; maintaining and updating your contact information where lawful and appropriate; where applicable, enabling you to opt-out to withdraw your consent to or unsubscribe from emails sent by us, and recording your choice. |
| • To manage IT systems : Managing and operating our communications, IT and security systems; and auditing (including security audits) and monitoring such systems. |
| • To improve our Sites, Apps and services : Identifying issues and detecting anomalies related with our App; planning improvements to our App; and developing new Sites, Apps or services. |
(E) Provision of Personal Information to Third Parties
We may share your personal information with a third party outside our Service except in certain circumstances, including:
- Service Providers: We use other companies, agents or contractors ("Service Providers") to perform services on our behalf or to assist us with the provision of App to you. For example, we engage Service Providers to provide E-commerce, marketing, advertising, communications, security, infrastructure and IT services, to customize, personalize and optimize our service, to provide customer service, to analyze and enhance data (including data about users' interactions with our service), and to process and administer consumer surveys. In the course of providing such services, these Service Providers will have access to your personal information. We do not authorize them to use or disclose your personal information except in connection with providing their services (which includes maintaining and improving their services). This includes our Japan and United States of America entities for operation of our global Service. For such transfers, please see below Section (F) as these are international data transfers.
- Business advisors: We may share, for example, your information with our lawyers, accountants, business consultants, insurers, and auditors, to the extent it is necessary for them to provide us with their services.
- Protection of Service and others: We and our Service Providers may disclose and otherwise use your personal and other information where we or they reasonably believe such disclosure is needed to (a) satisfy any applicable law, regulation, legal process, or governmental request, (b) enforce applicable terms of use, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address illegal or suspected illegal activities (including payment fraud), security or technical issues, or (d) protect against harm to the rights, property or safety of the Service, its users or the public, as required or permitted by law.
- Business transfers: In connection with any reorganization, restructuring, merger or sale, or other transfer of assets (this includes bankruptcy and follow-up situation of bankruptcy), we will transfer information, including personal information, provided that the receiving party agrees to respect your personal information in a manner that is consistent with our Privacy Policy.
- Other Parties with Your Consent or on Your Request: In addition to the disclosures described in this Privacy Policy, we may share information about you with third parties when you separately consent to or request such sharing.
- Links to Other Websites, Devices, Apps and Features: The Service may provide the ability to connect to other websites, devices, apps and other features, which may operate independently from us and may have their own privacy notions or policies, which we strongly suggest you review. To the extent any linked website, device, app or other feature is not owned or controlled by us, we are not responsible for its content, use or privacy practices.
(F) International Transfer of Personal Information
For the purposes of providing our services and enhancing users’ convenience, we may transfer and/or manage your nickname and email address overseas. In particular, your personal information will be transferred to (1) Korea, Singapore, or the United States of America, depending on where your jurisdiction is, and also to (2) our Japan and United States of America entities for operation of our global Service. Please note that the data protection and other laws of countries to which your information may be transferred might not be as comprehensive as those in your country, in which case we take steps, as required under local law, to ensure that your personal information is adequately protected.
(G) Data Security
We have implemented, in accordance with applicable law, appropriate technical and organizational security measures designed to protect your personal information against accidental or unlawful destruction, loss, alteration, theft, divulgence, unauthorized disclosure, unauthorized access and other unlawful or unauthorized forms of processing, as follows:
Organizational measures: Establishment and implementation of internal management plans, provision of regular employee training, etc.
Technical measures: Management of access rights to the personal information processing systems, installation of access control systems, encryption of uniquely identifiable information, etc., installation of security programs
Physical measures: Access control of IT rooms, data storage rooms, etc.
(H) Data Retention
If we collect any personal information from you, we comply with our internal policy to use and retain such personal information for the period during which you use our App. In addition, if we need to preserve personal information in accordance with the provisions of applicable law or our internal policies, we will retain relevant personal information for a specified period as required by applicable laws of your jurisdiction.
(I) Procedures and Methods of Destruction of Personal Information
Once the purposes of collection and use of your personal information is achieved, we will destroy your personal information in accordance with our internal policies and other applicable laws. Personal information collected with your consent or stored in the form of electronic files will be deleted using technical means that make the records unreproducible, and personal information printed on paper such as filings or printed materials will be shredded or incinerated.
(J) Your Legal Rights
Subject to applicable law, you may have the following rights relating to your personal information managed by us:
The right not to provide your personal information to us (however, please note that we will be unable to provide you with the full benefit of our Sites, Apps, or services, if you do not provide us with your personal information – e.g., we might not be able to process your requests without the necessary details);
The right to request information regarding the nature, processing and disclosure of your personal information managed by us and request access to, or copies of such personal information;
The right to request rectification of any inaccuracies in your personal information managed by us;
The right to request, on legitimate grounds:
- Deletion of your personal information managed by us; or
- Suspension of processing of your personal information managed by us;
The right to have certain personal information transferred to another entity, in a structured, commonly used and machine-readable format, to the extent applicable;
Where we process your personal information managed by us on the basis of your prior consent, the right to withdraw that consent (noting that such withdrawal does not affect the lawfulness of any processing performed prior to the date on which we receive Privacy Policy of such withdrawal, and does not prevent the processing of your personal information in reliance upon any other available legal bases, as applicable); and
The right to submit complaints to an authority in charge of protection of data regarding the processing of your personal information managed by us.
In addition to the above rights, you remain entitled to all other statutory rights.
(K) Data Protection Officer
In order to protect users’ personal information and handle complaints related to personal information, we have designated our Data Protection Officer as follows. Users may report all complaints related to personal information protection arising in the course of using our services to the Data Protection Officer, and we will provide prompt and sufficient responses to such reports.
- Data Protection Officer: Tae Ho, Kuk (CPO/CISO); please see the specific terms at the bottom of this Privacy Policy for the email address pertaining to your specific jurisdiction.
(L) Handling of Comments and Complaints
We operate a customer services center for smooth communication and resolution of any comments and/or complaints presented by our users in connection with personal information protection.
(M) Right to Refuse Third Party Targeting Tools for Personal Information
We do not use cookies for our App. You may refuse our use of iOS Identifiers for Advertisers (IDFA).
Jurisdiction-Specific Terms
The following are supplementary clauses applicable depending on your location or nationality. In the event of conflict between the following and the main text of this Privacy Policy, the following shall prevail.
- California Consumer Privacy Act (CCPA)
For Clause (B) of this Privacy Policy, the following shall be additionally applied:
| Service | Personal information collected |
|---|---|
| When using E-commerce service through the app | Information of the orderer(name, e-mail address, phone number), shipping address, information of the receiver(name, phone number), billing address, payment information |
For Clause (D) of this Privacy Policy, the following shall be additionally applied:
| Purposes of Processing |
|---|
| • To provide E-commerce service, payment : Taking and handling orders, delivering products and services, process payments, and communicating with you about orders, products and services, and promotional offers. |
We may also aggregate or de-identify personal information so that it may no longer be used to identify you. We will maintain and use deidentified data in deidentified form and will not attempt to re-identify the information, except for the limited purpose of testing our deidentification processes for compliance with applicable laws.
Clause (H) of this Privacy Policy shall be replaced with the following:
(H) Data Retention
We will retain your personal information for only as long as we need in order to provide the Service to you, as long as we maintain an ongoing relationship with you, or for as long as necessary in connection with other legitimate business purposes such as resolving disputes, safety and security reasons, or complying with our legal obligations. How long we retain your personal information will depend on a number of factors, such as the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure, our purpose for processing the information, and any legal or regulatory requirements.
Clause (J) of this Privacy Policy shall be replaced with the following:
(J) California Consumer Privacy Act Disclosures
Under the CCPA, we must disclose our practices regarding the collection, use, and disclosure of the personal information of California residents (“Consumers”).
Collection of personal information
We have collected and will collect the following general categories of personal information about Consumers:
Identifiers, including names, nicknames, IP addresses, SNS identifiers, usernames, and email addresses;
Records of products or services you have purchased, obtained, or considered(Commercial Information);
Protected classifications, including birth year and gender;
Geolocation, including citi level location (based on GPS);
Internet or other electronic network activity information, including Service usage records, device information (manufacturer, OS type and version);
Visual information, including profile picture;
Optional, personalized information such as housing types and number of cohabitants; and
Inferences for use in creating a consumer profile.
We do not collect personal information of users under the age of 13 as those under the age of 13 are not allowed to use our App.
Use of Personal information
We may use the categories of personal information described above for the following business or commercial purposes:
To provide our App or Service;
To operate our business;
Advance our commercial or economic business interests;
Maintain or service customer accounts;
Provide customer service;
Provide advertising or marketing services;
Provide analytic services;
Perform internal research for technological development;
Ensure the quality and safety of services or devices;
Improve the quality and safety of services or devices;
Debugging to address impairments to operational functionality;
Detect security incidents;
Comply with applicable law and law enforcement requirements;
Protect against malicious, deceptive, fraudulent or illegal activity;
Prosecute those responsible for malicious, deceptive, fraudulent or illegal activity; and
Defend against or bring legal action, claims and other liabilities.
Categories of Sources of Personal information
We collect or obtain personal information of Consumers from the following sources:
Information provided to us by Consumers;
Information we obtain on our own;
Information provided to us through collaboration with Consumers;
Information provided to us in the course of our relationship with Consumers;
App data;
Site data;
Information registered by Consumers;
Information obtained from content and advertising providers; or
Information provided to us by third parties.
Disclosure of Personal information
We do not "sell" personal information or "share" personal information of minors under 16 years of age (as those terms are defined by the CCPA) and minors of under 18 years of age is not permitted to use the Ohouse service under Ohouse Terms of Service appendix 1.
In the preceding twelve (12) months, we may have disclosed personal information for the business purposes described above to the following categories of recipients:
| Category of information | Categories of recipients |
|---|---|
| Identifiers | Service providers, business advisors |
| Commercial information | Service providers, business advisors |
| Protected classifications | Service providers, business advisors |
| Geolocation | Service providers |
| Internet / network activity information | Service providers |
| Visual information | Service providers |
| Optional, personalized information | Service providers |
| Optional, personalized information | Service providers, business advisors |
| Inferences | Service providers |
Please note that we may also disclose any or all of these categories of personal information in connection with the protection of the Service or others (e.g., to comply with laws, respond to government requests, detect or prevent suspected illegal activities, or protect our rights or the rights of a third party; in the event of a business transfer (e.g., a merger, transfer of assets, bankruptcy, etc.); or with your consent or upon your request, in each case as described in more detail in the Notice above.
For Clause (K) of this Privacy Policy, the email address for the CPO is: contact@ohouse.com.
Clause (L) of this Privacy Policy shall be replaced with the following:
(L) Consumer Rights under the CCPA
If you are a Consumer, the CCPA grants you the following rights regarding your personal information. If you make a certain request to us in order to exercise, or cause an authorized representative you appointed to exercise on your behalf, your rights to know and delete set forth in the CCPA, we will generally require you to provide us with certain personal information for the purpose of identifying you in the course of handling your request and compare such personal information against the personal information we have collected about you to verify your identity (“verifiable consumer request”).
Verifiable consumer requests to know or delete may be submitted through the above email address for the CPO. You may also have the right to appeal a decision we make relating to requests to exercise your rights under applicable law. To appeal a decision, please send your request to the above email address for the CPO as well.
Right to Know About Personal Information We Collected about You. Consumers have the right to submit a verifiable consumer request that we disclose the following personal information we collected about you over the 12 month period preceding the verifiable consumer request, in a readily useable format:
The categories of personal information we collected about you.
The purposes for which the categories of personal information collected about you will be used.
The categories of sources for the personal information we collected about you.
The categories of third parties with whom we share your personal information.
Our business or commercial purpose for collecting your personal information.
The specific pieces of personal information we collected about you.
The categories of personal information we have disclosed for a business purpose.
Right to Request Deletion of Personal Information. Consumers have the right to request that we delete any personal information we have collected from them, subject to certain exceptions.
Right to Correct Inaccurate Personal Information. Consumers have the right to request that we correct or update any inaccurate information that we maintain about them.
Right to Non-Discrimination. Consumers have the right to be free from discrimination when they exercise their rights under the CCPA and, should you exercise those rights, we cannot:
Deny you goods or services;
Charge you a different price or rate for goods or services;
Provide you with a different level of quality of goods or services;
Suggest that you may receive a different level of quality of goods or services.
Notice of Financial Incentive
We offer consumers who provide personal identifiers, including their name, home address, and email address, and commercial information, including their participation history, access to O House events. As participants in these programs, consumers will have the opportunity to win prizes. The value of this personal information to our business will vary depending on the consumer's use of O House services. Consumers may opt-in to our O House events by signing up on our website. Consumers may cancel their participation in these events at any time by sending us an email to contact@ohouse.com.
Authorized Agent
Under the CCPA, you may appoint an authorized agent to submit requests to exercise your rights on your behalf. Should you choose to do so, for your and our protection, we will require your authorized agent to provide us with a signed permission demonstrating they are authorized to submit a request on your behalf. We note, should your authorized agent fail to submit proof that they have been authorized to act on your behalf, we will deny their request.
Clause (M) of this Privacy Policy shall be replaced with the following:
(M) California’s “Shine the Light” Law
Under California’s “Shine the Light” law, California residents are entitled to ask us for a notice describing what categories of personal customer information we share with third parties or our affiliates in connection with direct marketing performed by such third parties or our affiliates. The aforementioned notice will identify the categories of information we shared with third parties and our affiliates, and will include a list of names and addresses of such data recipients. If you are a California resident and would like a copy of this notice, please submit a written request to the following email address: contact@ohouse.com.
2. Colorado
For Clause (B) of this Privacy Policy, the following shall be additionally applied:
| Service | Personal information collected |
|---|---|
| When using E-commerce service through the app | Information of the orderer(name, e-mail address, phone number), shipping address, information of the receiver(name, phone number), billing address, payment information |
For Clause (D) of this Privacy Policy, the following shall be additionally applied:
| Purposes of Processing |
|---|
| • To provide E-commerce service, payment : Taking and handling orders, delivering products and services, process payments, and communicating with you about orders, products and services, and promotional offers. |
We may also aggregate or de-identify personal information so that it may no longer be used to identify you. We will maintain and use deidentified data in deidentified form and will not attempt to re-identify the information, except for the limited purpose of testing our deidentification processes for compliance with applicable laws.
The following rights described in Clause (I) of this Privacy Policy are available to Colorado consumers:
The right to request information regarding the nature, processing and disclosure of your personal information managed by us and request access to, or copies of such personal information;
The right to request rectification or correction of any inaccuracies in your personal information managed by us;
The right to request deletion of your personal information managed by us, subject to certain exceptions;
The right to have certain personal information transferred to another entity, in a structured, commonly used and machine-readable format, to the extent applicable.
Additionally, Colorado consumers have the right to appeal a decision we make relating to requests to exercise their rights. To appeal a decision, please send your request to contact@ohouse.com.
For Clause (K) of this Privacy Policy, the email address for the CPO is: contact@ohouse.com.
For Clause (L) of this Privacy Policy, the following shall be additionally applied:
You may have the right to appeal a decision we make relating to requests to exercise your rights under applicable law. To appeal a decision, please send your request to the above email address for the CPO as well.
3. Japan
Clause (B) of this Privacy Policy shall be replaced with the following:
(B) Collection of Personal Information
The personal information that we collect about you includes the following:
| Service | Personal information collected |
|---|---|
| When signing up for the Service | Nickname, email address, gender, birth year, Instagram username and profile picture (optional) |
| When signing up for the Service via third-party SNS log-in |
• For all: (Required) Nickname, email address, gender, birth year, unique identifier
• Facebook: (Required) Name, Profile picture, Email address • Line: Name, profile picture, status message • Google: Nickname • Apple: (Optional) Email address |
| Customer inquiry | Name, email address |
| Information created and collected in the course of using the Service | Profile picture, Service usage records, Access log, IP address, Online identifier (including IDFV), app push tokens (FCM device tokens), device information (manufacturer, OS type and version), type of housing, number of cohabitants, geolocation (up to city levelm if you agree to provide it to us) |
| When using e-commerce features on the app | Name, unique identification information (known as My Number), address to receive invoice, delivery address, email address, phone number, payment information |
For Clause (D) of this Privacy Policy, the following shall be additionally applied:
| Purposes of Processing |
|---|
| • For the performance of ambassador activities: This includes processing applications for and managing subscribers of the ambassador service, providing information and operating services/promotions related to ambassador activities, communicating settlement details, and preventing and handling fraudulent use |
| • To provide E-commerce service, payment |
Clause (E) of this Privacy Policy shall be replaced with the following:
(E) Provision of Personal Information to Third Parties
Unless otherwise permitted by APPI (such as (i) as required by Japanese laws, (ii) providing or sharing personal data under a joint-use structure, or (iii) providing personal data in connection with entrustments of data processing), we do not disclose, sell, provide, share, or transfer your personal data to any third party without your consent.
a.Joint-use
As described below, we share personal data under a joint-use structure.
Personal Information to be Shared: we share the following personal information:
- with regard to the operation, e-mail address, gender, age, type of housing, number of cohabitants, and information created and collected in the course of using the Service; and
- with regard to e-commerce transactions, name, address, telephone number and payment information.
Scope of Joint Users: we share the shared personal data with Bucketplace Co., LTD. Japan.
Purpose of Use: the purposes of use of the shared personal data is the same as the purpose of use described in Clause (D).
Name, address, and the name of the representative: the name, address, and name of the representative of the corporation responsible for managing the shared personal data are as follows:
- Name: BUCKETPLACE JAPAN CO., LTD.
- Address: Links Square Shinjuku 16F, 5-27-5 Sendagaya, Shibuya-ku, Tokyo, Japan
- Name of the Representative: Sehyeon Jung
b. Enturstment
We may entrust certain tasks(construction/operation of infrastructure, payment, shipment, customer support, etc.) to third parties. These Subcontractors will only process minimum personal information necessary to perform operation on our behalf and will not process personal information beyond the scope of entrument. We shall comply APPI and shall examine qualification of subcontractor. We also explicitly define data security measures in the entrustment contracts which will ensures that subcontractors adhere to the personal information protection regulations of their respective countries and that personal information is appropriately managed and overseen.
Clause (F) of this Privacy Policy shall be replaced with the following:
①
- Business Operator Name: Kokusai Express Co., Ltd.
- Country Name: Republic of Korea
- Personal Information Provided: Name, phone number, shipping address information (recipient's name, phone number, address)
- Law of Personal Information Protection in the Providing Country: http://www.ppc.go.jp/files/pdf/korea_report.pdf
②
- Business Operator Name: KG Inicis Co., Ltd.
- Country Name: Republic of Korea
- Personal Information Provided: Information on payment method, payment date and time, payment amount, payment ID
- Law of Personal Information Protection in the Providing Country: https://www.ppc.go.jp/files/pdf/korea_report.pdf
Please note that the data protection and other laws in the countries to which your information is transferred may not be as comprehensive as those in your country. The receiving business operators are taking measures to ensure that your personal information is adequately protected in accordance with applicable laws.
Clause (J) of this Privacy Policy shall be replaced with the following:
(J) Your Legal Rights
If your personal information is subject to the APPI, you may have the following rights provided under the APPI relating to your personal information managed by us, such as the below rights, but this would depend on the specific situation to be considered.
Right to request notification of the purpose of use of personal data.
Right to request disclosure of personal data.
Right to request disclosure of a record of provision of personal data to a third party.
Right to request a correction of, addition to, or deletion of the contents of the personal data.
Right to request the cessation of use or elasure of personal data, or the cessation of provision of personal data to a third party.
For Clause (K) of this Privacy Policy, the email address for the CPO is: contact@ohouse.com.
The following clause shall be added to this Privacy Policy:
(N) Inquiries and Contacts
If you have any inquiries with respect to your personal data that we maintain, would like to exercise your rights under the APPI, or would like to obtain further details about the data security measures we have in place, please contact us at contact@ohouse.com.
4. Indonesia
Language
This Privacy Policy is also made available in the Indonesian language. In the event of any conflict of inconsistency between the Indonesian language and the English language versions, the provision in the English language provision of the Privacy Policy shall prevail.
Retention on Personal Data
We will retain your personal information to fulfill the purposes set out in this Privacy Policy and so long as we required to do so under prevailing laws and regulations and if you are no longer using our services, for the period of 5 (five) years thereafter (unless required otherwise by prevailing laws and regulations in Indonesia).
CPO Email Address
The email address for the CPO in Indonesia is: contact@ohouse.com.
Amendment
We will notify you of the changes to our Privacy Policy to the extent that the changes to be made are required to be notified under prevailing laws and regulations. You may discontinue to use our Service if you do not agree with the changes.
Children
Our websites and online services are not intended for children under the age of 18 and we do not knowingly collect personal information from children under age 18, without parental consent. Children under the age of 18 should not provide their personal information to us.