refun Privacy Policy
Asung Tax Corporation (the “Company”) values users’ personal information in operating the refun service and processes personal information lawfully and safely in compliance with the Personal Information Protection Act and other applicable laws.
The Company establishes and publishes this Privacy Policy as follows so that users can easily check for what purposes their personal information is processed and how it is protected.
Article 1 (Purposes and Items of Processing)
- The Company processes personal information, to the extent necessary to provide the service, for the following purposes.
- (1) Membership registration and user identification
- (2) Provision of Kakao or Google social login
- (3) Member management, identity verification and progress notices
- (4) Verification of sole proprietors and corporate businesses
- (5) Identity or business authentication using a joint certificate (digital certificate)
- (6) Retrieval of records from Hometax and the Korea Workers’ Compensation & Welfare Service (COMWEL) (employment and industrial accident insurance)
- (7) Verification of a foreign worker’s visa status and nationality (COMWEL record retrieval; Global Service)
- (8) Confirmation of tax filing and payment history
- (9) Refund eligibility analysis and calculation of the estimated refund
- (10) Review of eligibility for tax credits and reductions
- (11) Review by tax professionals
- (12) Performance of requests for correction (amended return claims) and related tax services
- (13) Refund-related work
- (14) Customer inquiries, consultation and complaint handling
- (15) Ensuring service stability, responding to errors and preventing misuse
- The personal information items the Company processes in the course of providing the service are as follows.
| Service | Purpose | Items | Required / Optional |
|---|---|---|---|
| Registration (Kakao login) | Registration, user identification and login | Kakao account identifier (member number), name, Kakao account (email), Kakao account (phone number), profile nickname, profile image | Required |
| Member information (entered directly) | Member management, identity verification, progress notices and contact | Name, mobile phone number, email (entered directly if not provided through Kakao login) | Required |
| Registration (Google login, Global Service) | Global Service registration, user identification and login | Google account identifier (unique ID), name, Google account (email) | Required (when using the Global Service) |
| Visa status verification and refund application (Global Service) | Verification of a foreign worker’s visa status and nationality, review of refund eligibility, receipt of the application and progress notices | Alien Registration Number (unique identifying information), name in English, and COMWEL retrieval results such as visa status, nationality and expiry date of the period of stay; pay and withholding-related documents submitted by the user | Required (when using the Global Service) |
| Inquiry contact details (including before registration) | Notice of review results, consultation and progress contact | Representative’s name, mobile phone number, email (optional), referral code (optional) | Required (when using the refund inquiry) |
| Refund inquiry and business verification | Verification of sole proprietors and corporate businesses, confirmation of refund eligibility | Hometax certificate of business registration: trade name, business registration number, corporate registration number, business type, business commencement and closure dates, business place address and phone number, business category, business item and industry code, whether a simplified taxpayer, representative’s name, representative’s address, mobile phone number and email | Required (when using the refund inquiry) |
| Joint certificate authentication and data linkage | Authentication with and record retrieval from Hometax and COMWEL (Employment & Industrial Accident Insurance Total Service) | Joint certificate information, authentication token | Required (when using the refund inquiry) |
| Hometax record retrieval and refund analysis | Confirmation of tax filing and payment history, calculation of the estimated refund, review of eligibility for credits and reductions | Tax filing records, payment records, notice-of-assessment records, refund records, income information, business information, tax amount information, information on credits and reductions | Required (when using the refund inquiry) |
| Employment and industrial accident insurance record retrieval (corporations) | Calculation of the number of full-time employees and review of employment-related tax credits (integrated employment, employment increase, social insurance premiums) | Workplace information (workplace management number, workplace name); employees’ names, Resident Registration Numbers, coverage acquisition dates, coverage loss dates and average monthly remuneration (COMWEL register of persons acquiring coverage at the workplace) | Required (when using the refund inquiry) |
| Refund analysis results | Notice of the estimated refund and eligible refund items | Estimated refund, eligible refund items, refund analysis results | Required (when using the refund inquiry) |
| Requests for correction and tax services | Tax filing support, review of credits and reductions, preparation and submission of requests for correction, and tax representation | Tax filing and payment records, income records, business information, documents on credits and reductions, supporting documents, and Resident Registration Numbers processed where required by applicable law in the course of performing tax services | Required (when commissioning tax services) |
| Refund-related work | Refund application and processing of refund-related work | Bank name, account number, account holder | Required (when applying for a refund) |
| Customer consultation and complaint handling | Handling of inquiries, consultation and complaints, and checking consultation history | Name, mobile phone number, email, consultation details | Required (when using consultation) |
- The Company processes personal information for marketing purposes as follows only where the user has separately consented.
| Category | Purpose | Items | Required / Optional | Retention and Use Period |
|---|---|---|---|---|
| Collection and use of personal information for marketing purposes | Notices about the services of refun and the Company, and information on events and benefits | Name, mobile phone number, email | Optional | Until withdrawal of marketing consent or membership withdrawal |
- Consent to the collection and use of personal information for marketing purposes under paragraph 3 is optional, and even if the user does not consent, this does not affect the use of the refund inquiry, requests for correction or other basic services of refun.
- The Company does not use, without the user’s separate consent, tax filing and payment information, income information, employment and industrial accident insurance employee registers, estimated refunds, information on credits and reductions or Resident Registration Numbers processed in the course of the refund inquiry and tax services for marketing purposes.
- Joint certificate passwords are processed only temporarily during authentication and are not stored separately.
- Where processing of a Resident Registration Number is necessary in the course of tax filing support, requests for correction and tax representation, the Company processes it to the minimum extent necessary to perform that work within the scope permitted by applicable law. Resident Registration Numbers are used only to the extent necessary for inquiries, filings, applications, submissions and the like with Hometax and other relevant institutions, are not stored separately, and are destroyed without delay after that processing is complete.
- In the Global Service, the Company processes the Alien Registration Number (unique identifying information) with the user’s separate consent in order to verify a foreign worker’s visa status and to receive refund applications. The Alien Registration Number is used only to the extent necessary for COMWEL record retrieval and refund application work, is stored in encrypted form, and records of viewing by personal information handlers are kept. One Alien Registration Number is linked to only one member account.
- The Company processes personal information only to the extent necessary for the above purposes and, if a purpose of processing changes, takes the measures required by applicable law.
Article 2 (Methods of Collecting Personal Information)
- The Company collects or processes personal information by the following methods.
- (1) Receiving from Kakao, with the user’s consent during Kakao social login, the Kakao account identifier (member number), name, Kakao account (email), Kakao account (phone number), profile nickname and profile image
- (2) Receiving from Google, with the user’s consent during Google social login, the Google account identifier (unique ID), name and Google account (email) (Global Service)
- (3) The user entering directly on the service screen the name, mobile phone number and email not provided during Kakao login
- (4) The user entering directly on the refun service screens the information necessary for the refund inquiry and service use
- (5) Retrieving records of relevant institutions such as Hometax and COMWEL at the user’s request and through joint certificate authentication
- (6) Logging in to COMWEL’s Employment & Industrial Accident Insurance Total Service with the workplace joint certificate submitted by a corporate user, and obtaining and reviewing the register of persons acquiring coverage at the workplace
- (7) In the Global Service, retrieving visa status, nationality and the like from COMWEL’s Employment & Industrial Accident Insurance Total Service using the Alien Registration Number entered by the user
- (8) The user providing related documents in the course of requests for correction, refund applications and tax services
- (9) The user providing information in the course of customer inquiries and complaint handling
- (10) Automatic generation of access information and the like in the course of service use
- (11) The user separately consenting to the collection and use of personal information for marketing purposes
- When retrieving records of relevant institutions such as Hometax and COMWEL, the Company processes personal information to the extent necessary for the refund inquiry, visa status verification and tax services requested by the user.
Article 3 (Retention and Use Period of Personal Information)
- The Company retains and uses personal information for the period necessary for the purposes of processing, and the basic retention and use periods are as follows.
| Category | Retention and Use Period |
|---|---|
| Kakao login and member information | Until membership withdrawal |
| Google login and member information (Global Service) | Until membership withdrawal |
| Access records (login and viewing records, IP) | 2 years |
| Inquiry contact details (including before registration) | Until notice of review results and consultation are complete (if the person becomes a member, until membership withdrawal) |
| Refund inquiry and business information | 90 days from the date the inquiry is completed |
| Hometax inquiry records | 90 days from the date the inquiry is completed |
| Employment and industrial accident insurance inquiry records (employee register) | 90 days from the date the inquiry is completed |
| Estimated refund and refund analysis results | 90 days from the date the inquiry is completed |
| Customer consultation and inquiry records | 1 year from the date the consultation is completed |
| Personal information for marketing purposes | Until withdrawal of marketing consent or membership withdrawal |
| Joint certificate password | Not stored separately |
| Temporary joint certificate authentication information and authentication tokens | Destroyed without delay after authentication and retrieval are complete |
| Resident Registration Number | Not stored separately, and destroyed without delay after the relevant inquiry, filing, application, submission or other processing is complete |
| Alien Registration Number and visa status information (Global Service) | Until membership withdrawal or the end of the refund application work (where there is a retention obligation under applicable law, for that period) |
| Request for correction and tax service records | Until completion of the work or termination of the contract |
| Refund account information | Until refund-related work is complete |
- The Company may retain and use personal information processed in the course of the free refund inquiry for 90 days from the date the inquiry is completed, for purposes such as notice of the estimated refund, re-confirmation of inquiry results, re-analysis of refund eligibility, response to service errors and handling of user inquiries.
- Where the user applies for a request for correction or related tax services during the retention period under paragraph 2, only the information necessary to perform that work is converted into tax service processing records and processed until completion of the work or termination of the contract.
- Name, mobile phone number and email processed for marketing purposes are used while the user’s marketing consent remains in effect, and if the user withdraws marketing consent, that information is no longer used for marketing purposes.
- When the retention period of personal information has expired or the purpose of processing has been achieved so that the personal information is no longer needed, it is destroyed without delay, except where there is a retention obligation under other laws.
- Where there is personal information or transaction records that must be retained for a certain period under other laws, only that information is kept for the period prescribed by those laws.
- Where the Act on Consumer Protection in Electronic Commerce, Etc. applies to the relevant transaction between the Company and the user, related records are kept as follows.
| Records to Be Retained | Retention Period |
|---|---|
| Records on labeling and advertising | 6 months |
| Records on contracts, withdrawal of subscription and the like | 5 years |
| Records on payment and supply of goods, services and the like | 5 years |
| Records on consumer complaints or dispute handling | 3 years |
- Where an obligation to retain books, supporting documents and the like under tax laws and other applicable laws applies to the Company, only the materials actually subject to statutory retention are kept for the period prescribed by applicable law.
- Personal information that must continue to be retained under applicable law is stored and managed separately from other personal information.
Article 4 (Provision of Personal Information to Third Parties)
- The Company processes users’ personal information within the scope of the purposes set out in Article 1 and does not provide it to third parties except in the following cases.
- (1) Where the user has consented to the provision of personal information to a third party
- (2) Where there is a special provision in law
- (3) Other cases where personal information may be provided under applicable law
- Tax accountants and staff belonging to the Company process personal information to the extent necessary to perform the refund inquiry, requests for correction and tax services requested by the user.
- Where the user has commissioned the Company with tax services such as a request for correction, the Company may submit returns, applications and related documents to relevant institutions such as Hometax and the competent tax office to the extent necessary to perform that work.
- In the Global Service, to verify the user’s visa status and nationality, the Company transmits the Alien Registration Number entered by the user to COMWEL’s Employment & Industrial Accident Insurance Total Service for retrieval. The information provided in this case is as follows.
| Recipient | Purpose of Provision | Items Provided | Retention and Use Period |
|---|---|---|---|
| Korea Workers’ Compensation & Welfare Service (COMWEL) | Retrieval of a foreign worker’s visa status and nationality | Alien Registration Number | Until the purpose of retrieval is achieved (subject to COMWEL’s privacy policy) |
- Where personal information is provided to external tax accountants, tax corporations, partner businesses or the like, the Company informs the user of the recipient, purpose of provision, items provided, retention and use period and the like in accordance with applicable law and carries out the required procedures.
- Where an external business receives users’ personal information for the purpose of promoting its own products or services, the Company, distinguishing this from processing of personal information for service provision, obtains the user’s separate consent where required by applicable law.
- Even if the user does not consent to the provision of personal information to third parties for marketing purposes, this does not affect the use of refun’s basic services not directly related to that provision to third parties.
Article 5 (Outsourcing of Personal Information Processing)
- The Company outsources personal information processing work as follows for smooth and stable service operation.
| Processor | Outsourced Work | Retention and Use Period |
|---|---|---|
| Asung Labs Co., Ltd. | Operation of the refun service, system development and maintenance, and customer support (service operation delegated by the Company) | Until the end of the personal information retention period or the end of the outsourced work |
| AWS | Provision of cloud servers, data storage and service infrastructure | Until the end of the personal information retention period or the end of the outsourced work |
- When outsourcing personal information processing work, the Company manages matters necessary for the protection of personal information, such as prohibition of processing personal information for purposes other than performing the outsourced work, ensuring the security of personal information, and management and supervision of the processor.
- Where a processor re-outsources the personal information processing work entrusted to it with the Company’s approval, the Company carries out the management and supervision required by applicable law.
- Where a processor or outsourced work is added or changed, the Company discloses the change through this Privacy Policy.
Article 6 (Cross-border Transfer of Personal Information)
- The Company uses AWS to operate the service infrastructure.
- Where users’ personal information is provided, outsourced for processing or stored in a country other than the Republic of Korea in the course of using AWS, the Company carries out the cross-border transfer procedures required by applicable law.
- Where a cross-border transfer of personal information occurs, the Company discloses the following matters in this Privacy Policy, according to the actual processing status of personal information, or notifies users by the method prescribed by applicable law.
- (1) Items of personal information transferred abroad
- (2) Country to which, and time and method by which, personal information is transferred
- (3) Name and contact details of the recipient of personal information
- (4) Purpose of use of personal information by the recipient
- (5) Retention and use period of personal information
- (6) Where required by applicable law, the method and procedure for refusing the cross-border transfer and the effect of refusal
- Where personal information is stored and processed only within the Republic of Korea so that no cross-border transfer occurs, the content of this Article is changed according to the actual operating status.
- Google social login is a service provided by Google LLC (United States), and the user’s Google account information in the course of login is processed under Google’s privacy policy. The Company processes only the account identifier, name and email received as a result of login.
Article 7 (Procedures and Methods of Destroying Personal Information)
- The Company destroys the relevant personal information without delay when the retention period of personal information has expired or the purpose of processing has been achieved so that the personal information is no longer needed.
- The Company destroys personal information according to the following standards.
- (1) Joint certificate passwords are processed only temporarily during authentication and are not stored separately.
- (2) Authentication tokens and temporary authentication information are destroyed without delay after authentication and record retrieval are complete.
- (3) Resident Registration Numbers are not stored separately and are destroyed without delay after the relevant processing, such as inquiries, filings, applications or submissions with Hometax and other relevant institutions, is complete.
- (4) Free refund inquiry data, Hometax and employment and industrial accident insurance inquiry records, and refund analysis results are destroyed when 90 days have passed from the date the inquiry was completed.
- (5) Customer consultation and inquiry records are destroyed when 1 year has passed from the date the consultation was completed, except for information subject to retention under applicable law.
- (6) Member information is destroyed without delay upon membership withdrawal, except for information that other laws require to be retained.
- (7) Name, mobile phone number and email processed for marketing purposes are no longer used for marketing purposes when the user withdraws marketing consent or withdraws membership, and are destroyed according to the required procedures, except where separate retention is necessary under applicable law.
- (8) Alien Registration Numbers and visa status information are destroyed without delay upon membership withdrawal or the end of the refund application work, except for information subject to retention under applicable law.
- Where personal information must be retained for a certain period under other laws, that personal information is stored and managed separately from other personal information.
- Personal information in the form of electronic files is deleted by a secure method that makes recovery or reproduction difficult.
- Personal information in the form of paper documents, if any, is destroyed by shredding or another method that makes recovery difficult.
Article 8 (Rights and Obligations of Data Subjects and Legal Representatives and How to Exercise Them)
- Users may exercise the following rights in relation to their personal information within the scope prescribed by applicable law.
- (1) Request access to personal information
- (2) Request correction or deletion of personal information
- (3) Request suspension of processing of personal information
- (4) Withdraw consent to the processing of personal information
- (5) Withdraw consent to the collection and use of personal information for marketing purposes
- (6) Withdraw consent to receiving advertising information
- (7) Withdraw membership
- Users may exercise their rights relating to personal information through methods provided by the Company, such as in writing, by phone or by email, and the Company takes the necessary measures as prescribed by applicable law.
- Users may withdraw consent to the collection and use of personal information for marketing purposes and consent to receiving advertising information, each separately, without withdrawing membership.
- Even if the user withdraws consent to the collection and use of personal information for marketing purposes or to receiving advertising information, this does not affect the use of refun’s basic services such as the refund inquiry and requests for correction.
- When sending advertising information, the Company informs users of the method by which they can refuse to receive advertising information or withdraw consent to receive it.
- Where the user’s legal representative or a person delegated by the user exercises rights on the user’s behalf, the Company may verify whether that person has lawful authority of representation.
- Where other laws require the relevant personal information to be retained, requests for deletion or suspension of processing may be limited within the scope prescribed by those laws.
- The Company may verify whether a person who has requested access, correction, deletion, suspension of processing or the like of personal information is the data subject or a lawful representative.
- Users must keep their personal information up to date and must not misappropriate or infringe the personal information of others.
Article 9 (Measures to Ensure the Security of Personal Information)
- The Company implements the technical, administrative and physical security measures required by applicable law so that users’ personal information is not lost, stolen, leaked, forged, altered or damaged.
- The Company implements the following measures to the extent necessary for the protection of personal information.
- (1) Operation of a management system for the safe processing of personal information
- (2) Management of access rights to personal information processing systems
- (3) Access control over personal information
- (4) Protective measures for personal information in transmission and in storage
- (5) Generation, retention and review of access records
- (6) Minimization, management and training of personal information handlers
- (7) Protective measures against malicious programs, external intrusion and the like
- (8) Operation of a response system for incidents such as personal information leaks
- Joint certificate passwords are not stored separately in the service database or elsewhere.
- As a rule, the Company does not store Resident Registration Numbers separately. However, where Resident Registration Numbers must be kept under applicable law, the Company applies the security measures required by applicable law, such as encryption.
- The Company stores Alien Registration Numbers in encrypted form, keeps records of personal information handlers’ viewing of Alien Registration Numbers and visa status retrievals, and reviews them regularly.
- The Company securely retains and manages access records of its personal information processing systems for the period required by applicable law and personal information protection standards.
Article 10 (Installation and Operation of Devices That Automatically Collect Personal Information and Refusal Thereof)
- In the course of service use, the following information may be generated automatically for service provision, system operation, security, incident response and the like.
- (1) IP address
- (2) Access date and time
- (3) Service usage records
- (4) Error and incident records
- (5) Browser and device information
- The Company processes the information in paragraph 1 to the extent necessary for service provision, ensuring system stability, response to errors and incidents, prevention of misuse and the like.
- The Company may use cookies and other browser storage technologies to keep users logged in and to provide the basic functions of the service.
- Users may allow or refuse the storage of cookies and delete stored cookies through their web browser settings. However, if the storage of cookies is restricted, the use of some services may be limited.
- The Company processes the automatically generated information in paragraph 1 for purposes such as current service provision, system operation, security and incident response.
Article 11 (Marketing and Advertising Information)
- The Company processes personal information for the following purposes using the user’s name, mobile phone number and email only where the user has separately consented to the collection and use of personal information for marketing purposes.
- (1) Notices about the services of refun and the Company
- (2) Provision of information on events and benefits
- Consent to the collection and use of personal information for marketing purposes is not a required condition for using refun’s basic services, and users may decline to consent.
- The Company may provide advertising information through the transmission methods to which the user has consented only where the user has separately consented to receiving advertising information.
- The Company operates the following consents separately.
- (1) Consent to the processing of personal information necessary for service use
- (2) Consent to the collection and use of personal information for marketing purposes
- (3) Consent to receiving advertising information
- Users may at any time withdraw consent to the collection and use of personal information for marketing purposes or consent to receiving advertising information, each separately.
- The Company provides a method by which users can easily refuse to receive advertising information or withdraw consent to receive it.
- Even if the user withdraws consent to the collection and use of personal information for marketing purposes or consent to receiving advertising information, this does not affect notices necessary for member management, identity verification, the refund inquiry, requests for correction, the progress of tax services and other service use.
- Where the Company provides personal information to an external business for the purpose of promoting that business’s products or services, the Company, distinguishing this from processing of personal information for service provision, obtains separate consent where required by applicable law.
- Where personal information is provided to third parties for marketing purposes under paragraph 8, the Company informs users so that they can check the recipient, purpose of provision, items of personal information provided, retention and use period and the like.
Article 12 (Privacy Officer and Requests for Access to Personal Information)
- The Company designates a privacy officer or a department in charge of personal information protection to oversee work relating to personal information processing and to handle users’ inquiries, complaints, remedies for damage and the like relating to personal information processing.
- Contact information for personal information protection is as follows.
| Category | Details |
|---|---|
| Privacy officer | |
| Department in charge of personal information protection | |
| Phone | 02-508-6211 |
| tax@stnasung.com |
- Users may make requests to exercise rights relating to personal information, such as access, correction, deletion, suspension of processing and withdrawal of consent, and inquiries about personal information protection, through the above officer or department.
- The Company takes the measures necessary so that requests for access to personal information and inquiries relating to personal information are handled promptly.
- The Company’s basic information is as follows.
- (1) Company name: Asung Tax Corporation
- (2) Representative: Han Jun-young
- (3) Business registration number: 726-86-03535
- (4) Address: 11 Yeoksam-ro 12-gil, Gangnam-gu, Seoul (Asung Tower)
- (5) Main phone: 02-508-6211
- (6) Fax: 02-508-6212
- (7) Main email: tax@stnasung.com
- (8) Service operation (outsourced): Asung Labs Co., Ltd.
Article 13 (Remedies for Infringement of Rights and Interests)
- Users may request consultation or remedies for damage from the Company in relation to infringement of personal information.
- Where a report or consultation on personal information infringement is needed, users may use the following specialized institutions.
- (1) Personal Information Infringement Report Center: 118 (no area code)
- (2) Personal Information Dispute Mediation Committee: 1833-6972
Article 14 (Changes to This Privacy Policy)
- The Company may change this Privacy Policy when applicable law, the service content or the personal information processing status changes.
- When this Privacy Policy is changed, the Company publishes the changes and the effective date through its website or the like so that users can easily check them.
- Where there is a material change in the personal information processing status, such as the purposes of processing, items processed, retention period, provision to third parties, outsourcing of processing or cross-border transfer, the Company carries out the procedures required by applicable law.
- Where a previous privacy policy exists, the Company may publish the previous version so that users can check the history of changes.
- The announcement date and effective date of this Privacy Policy are as follows.
- (1) Announcement date: August 26, 2026
- (2) Effective date: August 26, 2026
- (3) Amendment announcement and effective date: September 29, 2026 (Addition of matters relating to the Global Service: Google login, processing of Alien Registration Numbers and COMWEL record retrieval)
- (4) Amendment announcement and effective date: October 6, 2026 (Addition of retrieval of the COMWEL employment and industrial accident insurance register of persons acquiring coverage at the workplace for corporate refund inquiries, deletion of health insurance record retrieval, and addition of collection of inquiry contact details before registration)
This English version is a machine translation provided for convenience. If it differs from the Korean original, the Korean original prevails. Korean original · See also: Terms of Service