Console
|
WAAP
Public Cloud Security
ZTNA
Security Apps
CTI
Cloudbric VPN Privacy Policy
Penta Security Inc. (the “Company”) places great importance on the personal information of users in providing Cloudbric VPN (the “Service”) and complies with applicable data protection and information and communications network laws. Through this Privacy Policy, the Company informs users of the purposes for which and the manner in which their personal information is processed and of the protective measures that are taken.
This Privacy Policy applies to the Cloudbric VPN application and the user console provided by the Company. The processing of personal information through the Company’s website is governed by the privacy policy posted on that website.
The Company does not store the addresses of websites that the User connects to through the Service, the content that the User views, or domain name system (DNS) query records. However, for the provision and quality management of the Service, the Company records the connection time, the disconnection time, the server connected to and the volume of data transmitted. These records are retained for three months from the date of creation and are then destroyed.
Article 1. Purposes of Processing and Items of Personal Information Collected
(1) The Company processes personal information for the purposes set out below. The Company does not use personal information for any purpose other than those purposes, and where the purpose of use is changed, the Company will take the necessary measures, including obtaining separate consent as required by applicable law.
- Membership registration and management: verification of the User for the use of membership services, performance of the service agreement, prevention of improper use of the Service, restriction of re-registration by improper means, handling of inquiries and complaints, and delivery of notices
- Provision of the Service: provision of virtual private network (VPN) connections, maintenance and management of connection quality, and identification of and response to faults
- Provision of Paid Services: confirmation of subscription status and processing of payments and refunds
- Marketing and advertising: information on new services and events
(2) The items of personal information collected by the Company are as follows.
- Mandatory items collected upon membership registration: email address and password
- Optional item: whether the User consents to receive advertising information
- Items generated and collected automatically in the course of using the Service: the service use identifier (a value randomly generated by the application), service use records (connection time, disconnection time, the server connected to, and the volume of data transmitted), and the token used to send application notifications
- Items received from a payment provider when Paid Services are used: transaction identifier, product information, subscription status, payment amount, and payment date and time. Where included in the information transmitted by the payment provider, the name of the payer, email address, the last four digits of the card number, and the billing address
- Items collected when the User makes an inquiry or exercises a right: email address, the content of the inquiry or request, and materials submitted by the User (including materials for verifying that the person is the User or a duly authorized agent)
(3) Even where the User does not consent to the optional item, there is no restriction on the use of the Service.
(4) The Company does not collect sensitive information or government-issued identification numbers.
Article 2. Retention and Use Period of Personal Information
(1) The Company processes and retains personal information within the retention and use period prescribed by applicable law or the retention and use period consented to by the User at the time of collection.
(2) The retention and use period for each category of personal information is as follows.
- Personal information collected upon membership registration: until withdrawal of membership
- Service use records and the service use identifier: three months from the date of creation
- Consent to receive advertising information: until withdrawal of membership or withdrawal of consent
- Information on payment for and subscription to Paid Services: 180 days from the date of creation, provided that items retained under applicable law are governed by Article 6
- Information relating to inquiries and the exercise of rights: until the processing is completed, provided that items retained under applicable law are governed by Article 6
(3) Even after withdrawal of membership, the Company retains a value converted from the email address into an unrecoverable form for one year from the date of withdrawal, in order to prevent re-registration by improper means and improper use of the Service, and destroys that value thereafter.
(4) The Company may use, without limitation as to period, information such as the number of connections and the total volume of data transmitted which has been aggregated across all servers and produced in a form in which no individual can be identified, for the purpose of managing the quality of the Service.
(5) The grounds for retention and the items retained where retention is required by applicable law are set out in Article 6.
Article 3. Provision of Personal Information to Third Parties
(1) The Company does not provide the User’s personal information to third parties.
(2) Notwithstanding Paragraph (1), the Company may provide personal information as permitted by applicable law in any of the following cases.
- Where the User has given prior consent
- Where there is a special provision of law, or where provision is unavoidable in order to comply with a legal obligation
- Where an investigative authority so requests for the purpose of an investigation, in accordance with the procedures and methods prescribed by law
(3) Payment for Paid Services is made between the User and the app market operator or the payment service provider, and the Company does not provide the User’s personal information to those operators for the purpose of processing payment. The items of information that the Company receives from a payment provider are as set out in Article 1.
Article 4. Entrustment of the Processing of Personal Information
(1) The Company entrusts the processing of personal information as follows for the provision of the Service.
Entrusted party | Entrusted work |
Akamai Technologies International AG | Hosting of the servers and databases used to operate the Service |
Google LLC | Delivery of application notifications |
Zendesk, Inc. | Receipt and handling of customer inquiries |
(2) The retention and use period for the entrusted personal information is until the termination of the entrustment agreement or the achievement of the purpose of the entrusted work.
(3) When entering into an entrustment agreement, the Company sets out in the agreement or in an equivalent document, as required by applicable law, matters including the prohibition of processing personal information for any purpose other than the performance of the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the entrusted party, and liability for damages.
(4) Where the content of the entrusted work or the entrusted party is changed, the Company will disclose the change without delay through this Privacy Policy.
Article 5. Transfer of Personal Information Overseas
(1) The Company transfers personal information overseas as follows for the provision of the Service. These transfers constitute the entrustment and storage of personal information necessary for the performance of the service agreement and for the enhancement of the User’s convenience, and are carried out without separate consent by disclosing in this Article the matters required by applicable law.
Transferee (contact) | Country | Items of personal information transferred | Time and method of transfer |
Akamai Technologies International AG (support@linode.com, +1 609-380-7100) | Japan | Email address, service use identifier (a value randomly generated by the application), service use records (connection time, disconnection time, the server connected to, and the volume of data transmitted) | Transmitted over the information and communications network when the Service is used |
Google LLC (support@google.com, +1 650-253-0000) | The United States and other countries in which Google operates data centers | The token used to send application notifications | Transmitted over the information and communications network when a notification is sent |
Zendesk, Inc. (privacy@zendesk.com, +1 888-851-9456) | The United States | Email address and the content of the inquiry | Transmitted over the information and communications network when an inquiry is received |
(2) The purposes for which the transferees use personal information are the same as the entrusted work set out in Article 4, and the retention and use period is until the termination of the entrustment agreement or the achievement of the purpose of the entrusted work.
(3) The User may refuse the transfer of personal information overseas by withdrawing membership. Because the transfers set out above are essential to the provision of the Service, a User who refuses them cannot use the Service.
Article 6. Destruction of Personal Information
(1) Where the retention period has expired or the purpose of processing has been achieved so that the personal information is no longer necessary, the Company destroys the personal information without delay.
(2) The destruction procedure is as follows.
- The Company identifies the personal information in respect of which a ground for destruction has arisen.
- The Company destroys the personal information upon the approval of the Personal Information Protection Officer.
(3) The methods of destruction are as follows.
- Personal information stored in the form of an electronic file is permanently deleted by a method that renders it unrecoverable.
- Personal information printed on paper is shredded or incinerated.
(4) The grounds for retention and the items retained where retention is required under applicable consumer protection law are as follows.
Records subject to retention | Items retained | Retention period |
Records on contracts and withdrawal of purchase | Email address, transaction identifier, product information, subscription status, and the date and time of the contract and of the withdrawal | 5 years |
Records on payment and the supply of goods or services | Email address, transaction identifier, payment amount, payment date and time, and the type of payment method | 5 years |
Records on consumer complaints and the handling of disputes | Email address and the content of the inquiry | 3 years |
(5) The Company stores and manages the personal information retained under Paragraph (4) separately from other personal information.
Article 7. Rights and Obligations of the User and How to Exercise Them
(1) The User may exercise the following rights against the Company at any time.
- The right to request access to personal information
- The right to request correction or deletion of personal information
- The right to request suspension of the processing of personal information
- The right to withdraw consent to the processing of personal information
(2) The rights under Paragraph (1) may be exercised in writing, by email or by similar means through the settings screen of the application or the contact point set out in Article 10, and the Company will take action without delay.
(3) The rights under Paragraph (1) may also be exercised through an agent, such as a legal representative or a duly authorized person. In that case, a power of attorney in the form prescribed by applicable law must be submitted.
(4) The right to request access to personal information and the right to request suspension of processing may be restricted as provided by applicable law.
(5) Where another law expressly provides that particular personal information is to be collected, the User may not request the deletion of that personal information.
(6) The Company verifies whether a person exercising a right under Paragraph (1) is the User or a duly authorized agent.
Article 8. Measures to Ensure the Security of Personal Information
(1) The Company takes the following measures to ensure the security of personal information.
- Administrative measures: establishment and implementation of an internal management plan, and regular training of the personnel who handle personal information
- Technical measures: management of access rights to the personal information processing system, installation and operation of an access control system, one-way encryption of passwords, and encryption of personal information in transmission
- Physical measures: control of access to the work areas in which personal information is handled
(2) The Company retains and regularly reviews the access records of the personnel who handle personal information in respect of the personal information processing system.
Article 9. Installation and Operation of Devices that Automatically Collect Personal Information, and Refusal Thereof
(1) The Company does not install or operate any device, such as cookies, that automatically collects the User’s usage information in the Service.
(2) The items of personal information that are generated and collected automatically for the provision of the Service are as set out in Article 1.
(3) The User may refuse to receive application notifications through the settings of the User’s device. Because the collection of the service use identifier and of service use records is essential to the provision and quality management of the Service, no means of refusing them individually is provided; a User who wishes to refuse them may do so by discontinuing use of the Service or by deleting the application.
Article 10. Personal Information Protection Officer and Department Receiving and Handling Requests for Access
(1) The Company has designated a Personal Information Protection Officer as set out below, who takes overall charge of matters relating to the processing and protection of personal information and who handles complaints and provides remedies for Users in connection with the processing of personal information.
- Personal Information Protection Officer
- Name: Taejoon Jung
- Title: Executive Director
- Contact: tjjung@pentasecurity.com
(2) The User may request access to personal information from the following department.
- Department receiving and handling requests for access
- Department: Business Planning Team
- Contact: cloudbricvpn@pentasecurity.com
(3) The User may direct to the Personal Information Protection Officer or to the department set out in Paragraph (2) any inquiry, complaint or request for remedy relating to the protection of personal information that arises in the course of using the Service. The Company will respond to and handle such inquiries without delay.
Article 11. Remedies for Infringement of Rights
(1) In order to obtain a remedy for an infringement of personal information, the User may apply for dispute resolution or consultation to the following organizations in the Republic of Korea.
- Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
- Privacy Infringement Report Center: 118 (privacy.kisa.or.kr)
- Cyber Investigation Bureau, Korean National Police Agency: 182 (ecrm.police.go.kr)
Article 12. Changes to this Privacy Policy
(1) This Privacy Policy takes effect on 23 November 2026.
(2) Where the Company changes this Privacy Policy, it will announce the content of the change and the effective date within the Service or on the Company’s website from seven days before the effective date.
(3) Previous versions of this Privacy Policy are available within the Service or on the Company’s website.
(4) In the event of any discrepancy between the Korean version and this English version of this Privacy Policy, the Korean version shall prevail.
Privacy Policy
Penta Security Inc. (the “Company”) regards the protection of customers’ personal information as important and complies with the “Act on Promotion of Information and Communications Network Utilization and Information Protection.” Through this Privacy Policy, customers are informed of how their personal information is collected, used, and protected, as well as the measures taken for personal information protection. Individual notices (or app notices) will be announced when revising the Privacy Policy. This privacy policy will be effective as of May 15, 2024.
Collection and Use of Personal Information
The Cloudbric VPN maintains a strict No-log policy, meaning it does not collect, use, or share any personal data or browsing activity while customers use the Service. Customers’ privacy is of utmost importance to the Company, and it is committed to ensuring the confidentiality and security of their information. However, for record-keeping for dispute resolution and handling complaints, the following information may be collected:
• Information Collected: Email address
• Collection Method: Sign up
Retention and Use Period of Personal Information
The Company promptly destroys collected information once the purpose of collection is achieved. However, if retention is required by relevant laws and regulations, the Company will retain the information for a certain period as prescribed by law.
Procedure and Method of Personal Information Destruction
The Company promptly destroys personal information once the purpose of collection is achieved. Personal information stored in electronic file format is completely deleted using technology that makes it impossible to recover the record.
Provision of Personal Information to Third Parties
The Company generally does not provide customers’ personal information to external parties. However, exceptions may be made in the following cases:
• When customers have given prior consent.
• When required by law or requested by investigative agencies according to legal procedures and methods for investigation purposes.
• In accordance with relevant statutory regulations or other company policies, circumstances may arise necessitating the preservation of data.
Personal Information Complaint Service
The Company designates a personal information protection manager and department to protect customer personal information and handle complaints related to personal information as follows:
Position: Senior Director[Personal Information Protection Department]Department Name: Business Planning Team
Email: fsb_pd_bp@pentasecurity.com
Ensuring the Security of Personal Information
The Company implements administrative, technical, and physical safeguards to ensure the security of personal information.
Privacy Policy Version: v.1.0