NAVER Cloud (hereinafter the 'Company') is committed to protecting the rights and interests of its users by establishing a privacy policy based on relevant laws and regulations, including the Personal Information Protection Act.
This Privacy Policy applies to the services provided by the Company and covers the following.
Membership information, payment processing, inquiry response, and partnerships/proposals. ※ See the full Privacy Policy for details
Personal information is destroyed without delay when members withdraw their membership or when the purpose of use is fulfilled. However, we will keep it separately if we receive separate consent from the user or if it is necessary to comply with relevant laws. ※ See the full Privacy Policy for details
Provision of personal information is provided to a third party through a separate consent process ※ See the full Privacy Policy for details
We consign member services, inquiry response, and system operation to provide services according to procedures. ※ See the full Privacy Policy for details
We will handle complaints and damage remedies of information subjects without delay if you contact us at the following contact information. - 1544-5876 ※ See the full Privacy Policy for service-specific customer service information

The Company processes the following personal information for the following purposes.
The personal information processed will not be used for any purpose other than the following, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent based on relevant laws and regulations.
In principle, personal information is destroyed without delay when members withdraw their membership or when the purpose of use is fulfilled. However, if separate consent is obtained at the time of collecting personal information or if additional retention is required in accordance with relevant laws and regulations, personal information shall be processed and retained within the applicable personal information retention and use period.
A. NAVER MYBOX paid storage service(Hereinafter 'NAVER MYBOX')
Personal information items that are processed without the consent of the data subject
|
Legal basis |
Purpose of processing |
Processing items |
Retention period |
|
Article 15, Paragraph 1, Subparagraph 4 of the Personal Information Protection Act (Execution/Performance of Contracts) |
Member management for service provision
|
We collect the following personal information during the process of identification and age verification and consent of legal representative for children under 14 years of age.
It is available to 'NAVER member' and processes the following NAVER member information in the process of signing up for and using NAVER MYBOX service.
|
Upon membership withdrawal or fulfillment of the purpose of use |
|
Use for new service development, feature enhancements, marketing and advertising
|
The following information may automatically be created or additionally collected during service use or processing of service provision tasks.
| ||
|
Article 15, Paragraph 1, Subparagraph 2 of the Personal Information Protection Act (Compliance with Legal Obligations) |
Payment processing
|
|
5 years (Article 6 (Retention of Transaction Records, etc.) of the Act on Consumer Protection in Electronic Commerce, etc.; Article 6 (Scope of Transaction Records to Be Retained by Business Operators, etc.) of the Enforcement Decree) |
|
Inquiry response |
|
3 years (Article 6 (Retention of Transaction Records, etc.) of the Act on Consumer Protection in Electronic Commerce, etc.; Article 6 (Scope of Transaction Records to Be Retained by Business Operators, etc.) of the Enforcement Decree) | |
|
Article 15, Paragraph 1, Subparagraph 6 of the Personal Information Protection Act (Justifiable Interest) |
Prevention of fraudulent use |
Record of fraudulent use |
1 year |
Personal information items processed with the consent of the data subject
|
Legal basis |
Purpose of processing |
Processing items |
Retention period |
|
Article 15, Paragraph 1, Subparagraph 1 of the Personal Information Protection Act (Data Subject Consent) |
Marketing and promotional purposes, such as providing event information and opportunities to participate in events, and providing advertising information, provided we have obtained separate consent from the user |
We collect separately notified items of personal information, which are optional and the services can be used without consenting to their collection, and the consent status can be changed at any time. |
Upon membership withdrawal or fulfillment of the purpose of use |
|
Provision of recipient selection features (e.g., inviting members, sending gifts, etc.), provision of personalized services based on receipt notifications, forming relationships between users, and social networks |
Friend information from NAVER My friends service (name, NAVER ID, profile image, mobile phone number), birthday, directly entered recipient information (name, NAVER ID, (mobile) phone number) |
B. CLOVA CareCall
Personal information items that are processed without the consent of the data subject
|
Legal basis |
Purpose of processing |
Processing items |
Retention period |
|
Article 15, Paragraph 1, Subparagraph 4 of the Personal Information Protection Act (Execution/Performance of Contracts) |
Member management and inquiry response for service provision
|
|
Upon membership withdrawal or fulfillment of the purpose of use |
Personal information items processed with the consent of the data subject
|
Legal basis |
Purpose of processing |
Processing items |
Retention period |
|
Article 17, Paragraph 1, Subparagraph 1 of the Personal Information Protection Act (Data Subject Consent) |
Improving call quality and AI service quality through AI training |
Call content and health-related information within the content (pain location, condition, symptoms, medication status) |
3 years (de-identification applied) |
C. Robot Order Platform
Personal information items that are processed without the consent of the data subject
|
Legal basis |
Purpose of processing |
Processing items |
Retention period |
|
※stored solely in Saudi Arabia |
The 'Robot order Platform', its management, and providing services |
|
3 months |

The Company obtains the consent of a legal representative when collecting personal information about children under the age of 14 and collects the minimum amount of personal information necessary to perform the applicable service.
Required: Name of legal representative, duplicate registration identification information (DI), mobile phone number
The Company may require a minimum of information from the child's legal representative when collecting personal information from children under the age of 14, and will verify that a legal representative has provided consent in the following ways.
Require the legal representative to indicate whether they consent on the internet site where the consent is posted and verifying the legal representative's identity through mobile phone verification or I-PIN verification in the representative's name.
The user and their legal representative are guaranteed the following rights:
The user and the legal representative of the child under the age of 14 may request to view, correct, or terminate their personal information held by the Company.
The user may withdraw consent to the collection and use of personal information at any time through 'Unsubscribe'. For children under the age of 14, their legal representative has the right to view or correct their personal information and to withdraw consent to its collection and use.
If the user requests the correction of errors in personal information, the Company will not use or provide the personal information until the correction is completed. In addition, if the incorrect personal information has already been provided to a third party, the Company will notify the third party without delay of the results of the correction process so that the correction can be made.
※ This content only applies to NAVER MYBOX service.

The Company provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as prior consent of the user or special provisions of the law, and otherwise does not provide the user's personal information to third parties.
If the User have agreed in advance
|
Service |
Receiving party |
Purpose of provision |
Information provided |
Period of retention and use |
|
NAVER MYBOX |
NAVER Corp. |
Secure service operation and member management, provision of existing services (e.g., special moments, photo search) and customized services, and management of service usage records and statistics |
NAVER ID, NAVER MYBOX registration and usage date, NAVER` MYBOX service usage history, file meta information, capacity in use, type and number of files held, payment information (payment method, payment date and time, payment result, purchased product information, refund information), IP, cookies, device information |
Upon service termination |
|
OGQ Corp. |
Photo printing in products purchased from OGQ |
Photo |
Up to 6 months of purchase confirmation after ordering photo prints | |
|
NBT Inc. |
Event participation confirmation and prevention of duplicate prize provision, event recommendation and inquiry response |
Randomly generated separator |
1 year from the date of service termination or withdrawal of consent |
When required by law or by an investigative agency for investigative purposes in accordance with the procedures and methods prescribed by law
When providing processed data in a form that can't be used to identify specific individuals for the purpose of compiling statistics, conducting scientific research, or preserving public records

The Company consigns the processing of personal information as follows for efficient business processing.
When signing a consignment contract, matters related to liability, such as prohibition of processing personal information for purposes other than performing the consignment work, securing safety, restriction of re-consignment, management and supervision of the consignee, and compensation for damages, are specified in documents such as contracts in accordance with the Personal Information Protection Act, and the consignee is supervised to ensure that personal information is handled safely.
If the content of the consignment or the consignee changes, we will disclose it through this Privacy Policy without delay.
|
Consignee |
Consignment work details |
|
NAVER Corp. (link) |
System operation for service provision, identity verification |
|
NAVER FINANCIAL Corp. (link) |
Usage fee payment, prevention of payment theft |
|
inComms Corp. |
Customer Center, System operation for service provision |
|
NIT Service Corp. |
System operation for service provision |
|
N Tech Service Corp. |
Service development and testing |
|
InfoBank Corp. |
Text message delivery system operation |
|
NAVER WEBTOON Ltd. (link) |
Development/operation of digital content sales and settlement system |
|
OGQ Corp. |
Image tagging service operation |
|
Sejong Networks Co., Ltd(link) |
Customer inquiry response |
|
NAVER LABS Corp. |
Robot order platform system operation |
|
NICE Information Service Co., Ltd. |
Bond management |

The Company will destroy the personal information without delay when the personal information becomes unnecessary due to the elapse of the personal information retention period or the achievement of the purpose of processing.
If the personal information must be retained in accordance with other laws, the personal information will be processed and retained within the applicable period.
|
Grounds for retention |
Information retained |
Retention period |
|
Act on Consumer Protection in Electronic Commerce, etc. |
Contract or subscription withdrawal records |
5 years |
|
Records on payment or supply of goods and others |
5 years | |
|
Customer complaints or dispute handling records |
3 years | |
|
Protection of Communications Secrets Act |
Login records |
3 months |
The Company's personal information destruction procedure is as follows.
Discarding procedure
Personal information collected is destroyed after being stored for a certain period of time according to internal policies and relevant laws and regulations after the purpose has been achieved.
Even for information that the law requires to be preserved, it is destroyed without delay and in a way that makes it impossible to restore or reproduce it after the relevant period has elapsed.
Destruction methods
Personal information printed on paper will be destroyed by shredding or incinerating.
Personal information saved in electronic formats will be deleted via a technical deletion method that destroys data permanently.
However, the Robot Order Platform is a service provide in Saudi Arabia and is not subject to the Korea legal preservation obligation.

|
Service |
How to access 'Member information' |
|
NAVER MYBOX |
|
|
CLOVA CareCall |
|
|
Robot Order Platform |
|
The data subject may, at any time, exercise their rights to access, correct, delete, and request the suspension of processing personal information, as well as to withdraw consent, reject automated decision-making, or request an explanation ("Exercise of rights").
Requests to access or otherwise handle personal information regarding children under the age of 14 may be made by a legal representative. In the case of minors aged 14 or older, the minor may exercise these rights personally or through a legal representative.
The user may view or modify their personal information directly at any time on the "Member Information" page for each service, or request access to or deletion of their information via Contact us.
The user may request to suspend their account at any time, and if they no longer wish to use the service, they may request to "withdraw their membership."
Exercise of rights may be carried out through a representative, such as a legal representative or an authorized agent. In such cases, you must submit a power of attorney in accordance with the form specified in [Appendix No. 11] of the "Notice on Personal Information Processing Methods."
The user’s right to request access to or suspension of the processing of personal information may be restricted pursuant to Article 35, Paragraph 4, and Article 37, Paragraph 2, of the Personal Information Protection Act.
If other laws specify that the personal information must be collected, deletion of the relevant personal information may not be requested.
The company verifies whether the person exercising their rights is the data subject or a legitimate representative, and users may exercise their rights through the "personal information security officer or the "department responsible for receiving and processing requests for access to personal information."

The Company does its best to safely manage the personal information of users (including pseudonymized information) and protects personal information to a level higher than that required by the Personal Information Protection Act.
The Company has established and is implementing an internal management plan for the protection of personal information.
The Company is taking measures to control access to personal information and restrict access permissions.
The Company takes encryption measures to safely store and transmit personal information.
The Company takes measures to retain the personal information access records and prevent forgery and alteration.
The Company installs and updates security programs for personal information.
The Company takes physical measures to ensure the safe storage of personal information.
The Company has established and operates a detailed plan to be implemented in the event of a crisis situation caused by a disaster or other emergency.
The Company manages printed and copied materials containing personal information securely.
The Company destroys personal information that has achieved its intended purpose in a way that makes it impossible to restore or reproduce it.
The Company operates a dedicated organization for the protection of personal information.
The Company is verified by domestic and international certification bodies for its user information protection and personal information protection activities.
For more information, please visit the Privacy Center's information protection certification page.

The Company uses 'cookies' that save and frequently retrieve usage information to provide personalized and customized services.
Cookies are very small text files that are stored on the user's PC by the user's web browser when the user accesses a website. When the user visits the website again, the website server reads the contents of the cookies stored on the user's PC to maintain the service environment set by the user, enabling convenient use of the Internet service.
The user has the option to set the browser options to allow all cookies, check each time a cookie is saved, or refuse to save all cookies.
Cookies do not automatically or actively collect information that identifies individuals, and the user can refuse to store or delete these cookies at any time.
However, if the user refuses to store cookies, it may be difficult to use customized services.
How to allow/block cookies in web browsers
Chrome: Web browser settings > Privacy and security > Delete browsing data
Edge: Web browser settings > Cookies and site permissions > Manage and delete cookies and site data
How to allow/block cookies in mobile browsers
Chrome: Mobile browser settings > Privacy and security > Delete browsing data
Safari: Mobile device settings > Safari > Advanced > Block all cookies
Samsung Internet: Mobile browser settings > Internet usage history > Delete internet usage history

The following is a notice in accordance with Article 21-2 of the Act on the Protection and Use of Location Information(hereinafter 'Location Information Act').
The Company provides the following location-based services when the personal location information subject uses the service using a mobile device by receiving location information from the location information provider.
|
Service |
Collected personal information items |
|
Geo Tagging service |
The location information of the personal location information subject or mobile device included in the content is stored together with the content. |
|
Service that provides search results using location information |
When requesting information search or providing the location information of a personal location information subject or a mobile device, search results and surrounding results (such as photos taken nearby) using the location information are presented. |
Purpose of processing personal location information and retention period
The Company retains and uses the personal location information for the minimum period required to provide location-based services.
In principle, the Company destroys personal location information without delay when the period required to provide location-based services ends. However, if the user posts or stores personal location information along with posts or content on the NAVER service, such as the 'GeoTagging' service, the personal location information may be stored along with the posts or content for the duration of the posts or content.
Basis for and retention period of storage of data confirming collection, use, and provision of personal location information
The Company retains and provides personal location information within the scope notified in Article 6 of the 'Location-based Service Terms and Conditions' and immediately notifies the subject of personal location information of the relevant content in accordance with Article 8 of the 'Location-based Service Terms and Conditions'.
Procedures and methods for destruction of personal location information
The Company destroys personal location information without delay and in a way that makes it impossible to restore or reproduce it after the purpose of processing the information has been achieved.
Items related to the provision of personal location information to third parties
The Company does not provide personal location information to a third party without the consent of the subject of personal location information. If the Company provides a third party provision service, then the Company notifies the subject of personal location information in advance and obtains consent.
Rights·duties of guardians of children under the age of 8, etc. under Article 26-1 of the Location Information Act and how to exercise them
If the person responsible for the protection of a person falling under the following cases (hereinafter 'child at the age of 8 or under, etc.') agrees to the use or provision of personal location information for the protection of the lives or physical safety of a child at the age of 8 or under, etc., the Company deems to have consent of the person themselves.
1. Child at the age of 8 or under
2. Adult ward
3. Person with a mental disability in accordance with Article 2, Paragraph 2, Subparagraph 2 of the Act On Welfare Of Persons With Disabilities who is deemed to be a person with a severe disability in accordance with Article 2, Subparagraph 2 of the Act On The Employment Promotion And Vocational Rehabilitation Of Persons With Disabilities (It is only applicable for those who registered as a person with disability under Article 32 of Act On Welfare Of Persons With Disabilities.)
The person responsible for the protection of a child at the age of 8 or under, etc., who would like to consent to the use or provision of personal location information for the protection of the life or physical safety of the child must submit written consent with a document proving that they are the person responsible for that child's protection. The person responsible for the protection of the child at the age of 8 or under may exercise the entirety of rights of subjects of personal location information if they consent to the use or provision of personal location information of the child.
Location Information Security Officer information and contact information
Location Information Security Officer is a concurrent position with the Personal Information Security Officer.

The Company designates persons in charge of personal information protection as follows to take overall responsibility for the processing of personal information and to handle user complaints and damage relief related to the processing of personal information.
You can contact the Personal Information Security Officer and the department in charge of all matters related to the protection of personal information, including inquiries, complaints, and damage relief, that arise while using the service.
The Company will respond to and handle users' inquiries without delay in accordance with the relevant laws and regulations.
You can contact the Personal Information Security Officer and the department in charge of all matters related to the protection of personal information, including inquiries, complaints, and damage relief, that arise while using the service.
The Company will respond to and handle users' inquiries without delay in accordance with the relevant laws and regulations.

If you need to report or consult about a personal information infringement, you can contact the following organizations.
Personal Information Dispute Mediation Committee : (Without area code) 1833-6972 (www.kopico.go.kr)
Personal Information Infringement Report Center: (Without area code) 118 (privacy.kisa.or.kr)
National Police Agency: (Without area code) 182 (ecrm.police.go.kr)

If there are additions, deletions, or modifications to the content of the Privacy Policy, the Privacy Center will provide prior notice at least seven days before the revision.
However, the Company will make an announcement at least thirty days in advance if there is an important change in the Customer's rights, and the Company can obtain the Customer's consent again if necessary.
This Privacy Policy will be effective from June 30th, 2026.