Nevv Privacy Policy
Effective date: October 15, 2026
Nevv (the "Company") processes the minimum personal information necessary to provide its cloud server hosting sales and operation services, and complies with the Personal Information Protection Act (개인정보 보호법) and other applicable laws.
※ This Policy reflects the amended Personal Information Protection Act that took effect on September 11, 2026 (including the introduction of notification of possible leaks, strengthened responsibilities of the representative and the chief privacy officer, and enhanced notice of overseas transfers). If detailed standards are additionally established in the Enforcement Decree, this Policy may be updated.
1. Purposes of Processing Personal Information
The Company processes personal information for the following purposes.
- Confirming the intention to register as a member, email verification and account management
- Server ordering, provisioning and renewal, notices of expiry and traffic usage, and payment processing
- Responding to customer inquiries and chat support, handling dedicated server purchase inquiries, and concluding and performing dedicated server contracts
- Processing refund, work and tax invoice requests and add-on service applications, and keeping records of consent to the terms
- Identity verification and responding to outages and disputes
- Preventing fraudulent use, managing access records and ensuring service stability
- Sending advertising information (only to members who have consented to receive it)
2. Personal Information Items Processed
- Membership registration and account management (required): email address, name, mobile phone number, password (stored encrypted)
- Membership registration (optional): whether consent to receive marketing information has been given
- When using 2-step verification: 2-step verification (OTP) settings
- Orders and payments: order history, payment amount and status, information on servers in use, refund processing records (payment method information such as card numbers is processed by the payment service provider, and the Company does not store it)
- Dedicated server purchase inquiries (including non-members): name, contact information (phone number or email), product of interest, inquiry details
- Refund requests: bank, account number and account holder for the refund, reason for and details of the request
- Tax invoice applications: business registration number, company name, representative's name, email address to receive the tax invoice
- Work requests: type and details of the requested work
- Add-on service applications: the service applied for, the target server, request details, depositor name, and records of deposit confirmation and processing. If a security check is applied for, the check results sent by the member (server settings, account names, access records, etc.)
- Records of consent to the terms (at membership registration, ordering and submission of request forms): date and time of consent, version of the terms consented to, access IP and browser information
- Dedicated server contracts (including non-members): name, contact information, email, date and time of consent to and signing of the contract, access IP and browser information at the time of signing (retained for 5 years as contract records)
- Chat support: email address, name, consultation details
- When using coupons: email address (to check coupon usage conditions)
- Automatically generated and collected in the course of using the service: IP address at registration, IP address and browser information at login, cookies, access date and time, usage records, server order and management history
- Security and operations management: abnormal access detection information, authentication history, records of administrator actions, service restriction history
The Company does not accept membership registration from children under the age of 14 and confirms at registration that the user is 14 years of age or older.
3. Methods of Collecting Personal Information
The Company collects personal information in the course of membership registration, ordering and payment, chat support, dedicated server purchase inquiries and use of the service, either by users entering it directly or through automatic generation.
4. Retention and Use Period of Personal Information
The Company destroys personal information without delay once the purpose of processing has been achieved. Member information is retained until membership withdrawal. However, in the following cases, the information is retained for the period specified.
| Basis for retention | Items retained | Retention period |
|---|---|---|
| E-Commerce Consumer Protection Act (전자상거래법) | Records of contracts or withdrawal of subscriptions, etc. | 5 years |
| Framework Act on National Taxes (국세기본법) | Transaction evidence such as tax invoice issuance | 5 years |
| E-Commerce Consumer Protection Act (전자상거래법) | Records of payment and of the supply of goods, etc. | 5 years |
| E-Commerce Consumer Protection Act (전자상거래법) | Records of consumer complaints or dispute resolution | 3 years |
| Protection of Communications Secrets Act (통신비밀보호법) | Communication confirmation data such as access logs | 3 months |
| Internal company policy (preventing fraudulent use, responding to requests to restore withdrawn accounts) | Email address, name, mobile phone number and registration date of withdrawn members | 2 years from the date of withdrawal |
| Internal company policy (handling consultations) | Details of dedicated server purchase inquiries | 1 year from the date of receipt (if a contract is concluded, the contract records are retained for the E-Commerce Consumer Protection Act period above) |
To prevent fraudulent use, respond to disputes, verify unsettled transactions and ensure service stability, the Company may additionally retain the minimum necessary logs and history information to the extent permitted by law.
5. Provision of Personal Information to Third Parties
As a rule, the Company does not provide users' personal information to outside parties. However, this does not apply where the user has given prior consent, where there are special provisions in laws, or where an investigative agency makes a request in accordance with the procedures prescribed by law.
6. Entrustment of Personal Information Processing
To provide the service smoothly, the Company entrusts personal information processing tasks as follows, and when entrusting such tasks, implements the necessary protective measures in accordance with applicable laws and manages and supervises the trustees.
| Trustee | Entrusted tasks |
|---|---|
| Toss Payments Co., Ltd. (토스페이먼츠 주식회사) | Payment processing and payment method verification |
| Server infrastructure partner | Server provision, checking coupon usage conditions |
| Codelounge Co., Ltd. (주식회사 코드라운지) | Operation of the chat support system |
| Google LLC | Sending verification and notification emails |
| Discord Inc. | Internal operational notifications of payments made and inquiries received |
| Cloudflare, Inc. | Website traffic delivery and security (attack blocking) |
If the entrusted tasks or the trustees change, the Company will disclose this through this Policy.
7. Overseas Transfer of Personal Information
The Company transfers personal information overseas (entrustment of processing and storage) through some of the trustees above, as follows. This is necessary for the performance of the service contract and is disclosed in this Policy in accordance with the Personal Information Protection Act.
| Recipient (contact) | Destination country | Items transferred | Purpose of transfer | Date, time and method of transfer | Retention and use period |
|---|---|---|---|---|---|
| Google LLC ([email protected]) | United States | Recipient's email address, name, email content | Sending verification and notification emails | Transmitted over the network when an email is sent | Until the entrustment contract ends |
| Discord Inc. ([email protected]) | United States | Email addresses of paying members; names, contact information and inquiry details of dedicated server inquirers | Internal operational notifications | Transmitted over the network when a payment is confirmed or an inquiry is received | Until the purpose of the notification is achieved |
| Cloudflare, Inc. ([email protected]) | The United States and other countries where the Cloudflare network is located | Information transmitted when using the website (IP address, request content, etc.) | Website traffic delivery and security | Transmitted over the network when the website is used | The period necessary for transmission processing |
Users may refuse the overseas transfer, in which case they may stop the transfer by making a request to customer support or by withdrawing from membership. However, since the above transfers are essential for providing the service, such as email verification and website access, use of the service may be restricted if the transfer is refused.
The Company's server infrastructure is currently operated in Korea. If overseas transfers are added in the future, such as by introducing regions outside Korea, the Company will notify users in advance of the items transferred, the country, the date, time and method, the recipient, the purpose and the retention period in accordance with applicable laws, and will obtain consent where necessary.
8. Rights of Users
Users may at any time request access to, correction of, deletion of or suspension of processing of their personal information, and may withdraw their consent by withdrawing from membership. The Company will take the necessary measures without delay, except for information that it is required by law to retain. However, the handling of some requests may be restricted or deferred in the case of orders whose contract is being performed, unfinished settlement, ongoing disputes, or where there is a legal obligation to retain the information.
9. Procedures and Methods for Destroying Personal Information
Personal information whose retention period has expired or whose purpose of processing has been achieved is destroyed without delay. Electronic files are deleted in a manner that makes recovery impossible, and paper documents are destroyed by shredding or incineration.
10. Measures to Ensure the Security of Personal Information
- One-way encrypted storage of passwords
- Encryption of personal information in transit (HTTPS/TLS)
- Provision of account protection measures such as email verification and 2-step verification (OTP)
- Management and minimization of access rights, retention of access records and prevention of their forgery or alteration
- Operation of security updates and a system for blocking abnormal access
11. Notification and Reporting of Personal Information Leaks, etc.
If the Company becomes aware of the loss, theft or leakage of personal information, as well as of its forgery, alteration or damage, the Company will, without delay and in accordance with the procedures prescribed by applicable laws, notify the data subjects and report to the relevant authorities, counting from the time it becomes aware of the possibility thereof. The notification will inform data subjects of the items of personal information leaked, etc., the time and circumstances, ways to minimize damage, the measures data subjects can take (including how to exercise legal rights such as claiming damages and applying for dispute mediation), the Company's response measures and contact information.
12. Transmission of Advertising Information and Consent to Receive It
When sending advertising information for commercial purposes, such as events, discounts and new product announcements, the Company obtains the member's consent in advance, and members may withdraw their consent at any time through the Management Console or the unsubscribe link. Essential transaction-related information, such as notices regarding payment, provisioning, expiry and traffic, does not constitute advertising information and may therefore be sent without separate consent.
13. Cookies and Other Automatic Collection Tools
- The Company uses cookies to keep users logged in and for security. Users may refuse the storage of cookies through their browser settings, but in that case logging in, proceeding with payments and use of the Management Console will be restricted.
- The Company stores screen settings such as "Don't show again today" for pop-up notices only in the user's browser storage, and this information is not transmitted to the Company's servers.
14. Chief Privacy Officer
The Company designates its representative as the person ultimately responsible for the safe processing of personal information and the protection of the rights of data subjects, and has designated a Chief Privacy Officer as follows to oversee related tasks.
- Chief Privacy Officer: 최강 (Representative)
- Email: [email protected]
- Contact: chat support or customer support via the KakaoTalk channel
Inquiries regarding the processing of personal information may be submitted to the contacts above, and the Company will endeavor to respond without delay after receipt.
15. Remedies for Infringement of Rights
Users who need to report or seek advice regarding an infringement of personal information may contact the following organizations.
- Personal Information Dispute Mediation Committee (kopico.go.kr / 1833-6972, no area code)
- Personal Information Infringement Report Center (privacy.kisa.or.kr / 118, no area code)
- Supreme Prosecutors' Office Cyber Crime Investigation Unit (spo.go.kr / 1301, no area code)
- Korean National Police Agency Cyber Investigation Bureau (ecrm.police.go.kr / 182, no area code)
16. Changes to the Privacy Policy
This Policy may be revised in accordance with changes in laws and service policies, and in the event of a change, the effective date and the reasons for the change will be announced from 7 days before the change takes effect. The Company keeps previous versions for a certain period so that the revision history can be checked, and provides them upon request.
- Current version: effective October 15, 2026
- Previous version: effective July 17, 2026