KOCA Privacy Policy

Last updated: 10/03/2026

This English translation is provided for convenience. If there is any inconsistency, the Traditional Chinese version prevails.

I. General Provisions

Welcome to KOCA – the K-pop Photocard and Merchandise Trading Platform (the "Platform"). The Platform is operated by KOCA INC. (Unified Business No.: 60656527; the "Company," "we," "us," or "our"). We respect users' privacy and protect your personal data in accordance with applicable laws and regulations. This Privacy Policy explains how we collect, use, store, and protect the personal data you provide during the seller identity verification process, as well as your rights with respect to that information.

This Policy applies to all personal data collected through our official website (www.koca.shop), our App Store app, our Google Play app, and any related services, sales, marketing, or events (collectively, the "Services"). By using our Services, you consent to our collecting and using your personal data in accordance with this Policy.

II. Personal Data We Collect

We collect the personal information you voluntarily provide when interacting with the Platform's services, including but not limited to your name, email address, uploaded photos, phone number, and conversation information (records generated when you communicate with other users, such as between a buyer and a seller, or with Platform customer support, including text, images, audio/video, and conversation times). In addition, our systems automatically collect information such as your IP address, browser type, and records of your visits to our Services, in order to improve the Platform user experience and security.

During the seller identity verification process, to ensure transaction security on the Platform and to comply with legal requirements, we may collect the following personal data from you:

1. Name
2. National ID card or other government-issued identity document (such as a passport or driver's license)
3. Contact information (such as phone number and email address)
4. Bank account information
5. Other data required by law or necessary to complete verification

You may choose whether to provide the personal data above; however, if you choose not to provide the data necessary to complete member registration or to use a particular service, the Platform may be unable to provide you with the corresponding service features.

III. Use of Personal Data

We collect your personal data only for the following purposes:

1. To verify your identity and ensure transaction security
2. To comply with the requirements of laws and regulatory authorities
3. Dispute handling and complaint adjudication: When a transaction dispute or a return/refund dispute arises between users, the Platform may retrieve the relevant conversation records as a basis for fact-finding.
4. Security monitoring and violation prevention: To detect fraud, illegal transactions, harassment, or violations of the Platform's Terms of Service, the Platform may review conversation content through automated system filtering or manual spot checks.
5. Other lawful purposes related to transactions and Platform operations, including but not limited to market research, service improvement, user communication, and security enhancement.

To improve the accuracy and information security of identity verification (KYC), the Platform may use Google Vertex AI artificial intelligence models and related technologies to assist in the identification and verification process.

Through this assisted mechanism, the Platform can more effectively identify impersonated, forged, or high-risk identity information, in line with Taiwan's regulatory requirements on platform risk management and identity verification. In this process, the Platform undertakes to maintain data encryption and access control standards and will not share KYC data in any unauthorized manner; it will also provide necessary cooperation as required by law or competent authorities. Where the use of Vertex AI involves Google Cloud identity and access management, model access permissions and information protection will be managed under Google Cloud IAM controls and authorization mechanisms.

In addition, in KYC review operations, the Platform uses Google Cloud Platform (GCP, with servers located in the United States) to support the operation of internal notification and review processes. Pursuant to Article 8 of the Personal Data Protection Act, the Platform provides the following notice regarding this cross-border transfer:

1. Category of personal data: your KYC review status and necessary identifying information.
2. Period of use: after the data is transferred to GCP, it is used only for immediate real-time processing and is deleted immediately once processing is complete, without being retained or backed up.
3. Region of use: the United States (where GCP data centers are located).
4. Recipient: Google Cloud Platform (Google LLC).
5. Manner of use: solely for the internal review notification system to read, compare, and record review results, and not for any other purpose; GCP performs its data protection obligations in accordance with its international information security standards and applicable regulations.

This cross-border transfer is carried out in accordance with Article 21 and Article 8 of the Personal Data Protection Act, and its legal basis is the consent you give when undergoing KYC.

If you do not consent to the cross-border transfer of your personal data, you may choose not to undergo seller identity verification, but you will then be unable to use the Platform's seller features.

IV. Storage and Protection of Personal Data

1. We will store your personal data securely as required by applicable laws and will take appropriate technical and administrative measures to protect your information against unauthorized access, disclosure, or misuse.
2. Your personal data will be stored on servers of the Platform or of qualified third parties entrusted by the Platform, and will be processed only to the extent permitted by law.
3. We will retain your personal data for the shortest period permitted by regulations or required by business needs, and after the purpose of collection has been fulfilled, will destroy or anonymize it appropriately in accordance with relevant regulations.
4. If your account has had transaction records, and all incomplete transactions, account balances, and other outstanding matters have been completed or properly resolved, you may apply to close your account and stop login and public display; however, this does not mean that all backend data will be deleted. In accordance with the Personal Data Protection Act and other applicable laws, or as necessary for business operations such as completing transactions, payment and settlement, handling disputes, risk management, and audits, the Platform will retain, on a restricted basis, only the minimum necessary account identification, KYC, transaction, payment/settlement, and accounting voucher records and related records. Retained data will be used only for the original purpose of collection, legal compliance, dispute handling, and verification, and not for any other purpose.
5. An account with no transaction records may be deleted, together with related personal data, once it is confirmed that there are no incomplete matters, disputes, statutory obligations, or other grounds requiring retention. Data that must still be retained by law or for necessary business operations will not be deleted immediately upon account deletion or closure; it will be deleted or anonymized after the retention period expires or retention is no longer necessary.
6. Under Article 38 of the Business Accounting Act, accounting vouchers must be retained for at least five years after the annual closing procedures are completed, and accounting books and financial statements for at least ten years. If anti-money-laundering retention rules applicable to third-party payment apply to a particular service or business, records necessary for the service must be retained for at least five years, and necessary data such as customer identity, bank account, and proof of payment must be retained for at least five years after the business relationship ends; where the law prescribes a longer retention period, that period applies. To prevent duplicate verification, the necessary identity information retained for an account with transaction records (such as identity document identification information, phone number, email address, or bank account) may not be used again to register on the Platform or to complete identity verification.

V. Sharing and Disclosure of Personal Data

We will not provide, sell, exchange, or rent your personal data to any unrelated third party, except in the following circumstances:

1. When provision is required by laws or regulations, or at the request of judicial authorities, government agencies, or other regulatory authorities.
2. When necessary information must be shared with financial institutions or payment service providers to complete a payment transaction.
3. To prevent fraud, maintain transaction security, or enforce Platform rules, the Platform may, where necessary and pursuant to Article 20 of the Personal Data Protection Act, provide relevant personal information to law enforcement agencies to assist in investigating unlawful conduct.
4. Other circumstances to which you have given explicit consent.
5. Outsourced processing: To maintain the stability of the Platform's systems and the normal operation of its services, the Company may provide your personal data to its affiliate Assetflow Co., Ltd. and other third-party outsourced vendors that the Company has entrusted with information system development, maintenance, payment integration, customer support systems, data processing, or similar work. The foregoing entrusted companies bear the same personal data protection and confidentiality obligations as the Company, and may process your personal data only within the scope of the entrusted work and may not use it for any other purpose.

VI. Protection of Children's Privacy

The Platform takes children's privacy very seriously and has adopted the following policies in accordance with applicable laws:

1. A minor under the age of eighteen may register as a general member and use the Platform's services (including browsing and purchasing listings) only after their legal representative has read, understood, and agreed to the Platform's Terms of Service as required thereunder; the Platform collects only the minimum personal data necessary to complete transactions.
2. Only persons aged eighteen or older who hold a Republic of China (Taiwan) national ID card or resident certificate may apply for seller identity verification or set up a shop on the Platform; persons who do not hold such a document or are under eighteen may not apply for seller identity verification. The Platform does not offer identity verification to minors and does not collect identity documents or bank account data from applicants under eighteen for that purpose; persons under eighteen should have their legal representative complete verification using the legal representative's own identity document and bank account.
3. If the legal representative (parent or guardian) of a child user has questions about the collection or use of the child's personal data or requests its deletion, the Platform will handle the matter as soon as possible after verifying identity.

VII. Your Rights

Under applicable law, you have the following rights with respect to your personal data:

1. To inquire about, request to review, or request a copy of your personal data.
2. To request correction or updating of your personal data.
3. To request deletion of your personal data; if there are no transaction records and it is confirmed that there are no incomplete matters, disputes, statutory obligations, or other grounds requiring retention, you may apply to delete your account and related personal data; if there are transaction records, once all incomplete transactions, account balances, and other outstanding matters have been completed or properly resolved, you may apply to close your account and stop login and public display, except for data that must be retained by law or for necessary business operations.
4. To request that the Platform restrict or cease processing of your personal data.
5. To withdraw your prior consent to the processing of personal data, without affecting processing carried out on the basis of your consent before the withdrawal.

VIII. User Personal Data Protection Guidelines

Pursuant to Article 13, Paragraph 3, Subparagraph 2 of the Regulations Governing Security and Maintenance of Personal Data Files for Digital Economy-Related Industries, the Platform establishes the following User Personal Data Protection Guidelines, which all Platform users are required to comply with when using the Platform's services:

1. You acknowledge and agree that, during transactions, for purposes such as payment, shipping, or customer service contact, the Platform may provide your name, contact information, delivery address, and other personal data, to the extent necessary, to the other party to the transaction, payment service providers, logistics service providers, or other third parties contracted with the Company.
2. If, in the course of Platform transactions, you obtain another user's name, contact information, delivery address, or other personal data for purposes such as order placement, shipping, or customer service contact, you may use it only to the extent necessary to perform that transaction.
3. You may not use another user's personal data obtained through the Platform for marketing, harassment, resale, or any other purpose unrelated to the transaction, nor provide it to any third party.
4. After a transaction is completed, if there is no need to retain the personal data you obtained, you should delete or destroy it in a timely manner.
5. If you discover that personal data has been improperly used or is at risk of disclosure, you should notify the Company's customer support immediately so that it can assist with follow-up handling.
6. For violations of these Guidelines, the Company may take measures such as warnings, service restrictions, or other necessary measures in accordance with the Platform's Terms of Service.

These Guidelines are established pursuant to Article 5 and Article 20, Paragraph 1 of the Personal Data Protection Act and Article 13, Paragraph 3, Subparagraph 2 of the Regulations Governing Security and Maintenance of Personal Data Files for Digital Economy-Related Industries, and serve as the basis for the Platform's notice to users and its obtaining of their consent.

IX. Changes to This Privacy Policy

The Platform reserves the right to modify this Policy at any time. Changes will be announced on the Platform, and the changed content will take effect upon announcement.

X. Contact Us

If you have any questions or suggestions about our Privacy Policy, please contact us at any time at [email protected].