MGC Global Privacy Policy
MGC Global Co., Ltd. (Mega MGC Coffee) Personal Information Management & Protection Standard
MGC Global Co., Ltd. (Mega MGC Coffee) (hereinafter, the "Company") lawfully processes and safely manages personal information in compliance with the Personal Information Protection Act and applicable laws and regulations in order to protect members' rights.
Pursuant to Article 30 of the Personal Information Protection Act, the Company establishes and discloses this Privacy Policy in order to inform members of the procedures and standards for the processing of personal information and to enable prompt and smooth handling of related grievances.
Article 1 (Consent to Collection and Use of Personal Information)
The Company has established procedures through which users may choose whether or not to consent to the Privacy Policy, and by selecting "Agree," the user shall be deemed to have consented to the collection and use of personal information, etc.
Article 2 (Purpose of Collection and Use of Personal Information)
The Company collects users' personal information to the minimum extent necessary, and the collected personal information is used for the following purposes.
The personal information collected shall not be used for any purpose other than those stated below, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, pursuant to Article 18 of the Personal Information Protection Act.
- ① Membership registration and management: Confirming intent to register, identifying and authenticating users for membership services, maintaining membership qualifications, preventing fraudulent use, verifying legal representative consent for children under 14, issuing notices, and handling grievances.
- ② Provision of goods or services: Service application, consultation, recovery from system failures, product development/improvement, customized advertising, contract/invoice dispatch, content delivery, identity/age verification, and fee settlement.
Article 3 (Items of Personal Information Collected and Methods of Collection)
① In order to provide appropriate membership services for membership registration, management, consultation, service application, system recovery, product/service development, and customized marketing, the Company collects the following categories of personal information.
a) Categories of personal information collected by the Company from users:
| Category | Purpose of Collection (Service Name) | Required Items | Optional Items | Retention Period |
|---|---|---|---|---|
| Member | Membership registration / identity verification / member information update / stamp accumulation / Mega Order / whole cake & MD reservation / Gifting | Name, date of birth, gender, ID, password, mobile phone number, email, UID (internal user identifier), social login account info (Kakao, Naver, Apple, Google: name, ID, email, phone number, gender, birth year, CI) | - | Immediately destroyed upon membership withdrawal, or retained for 5 years under the E-Commerce Act (Unique info retained for 30 days to prevent fraudulent re-registration) |
| Marketing | Marketing information (service improvement, product/event information notices) | - | Email, mobile phone number | Immediately destroyed upon withdrawal or consent revocation |
| Consultation | Member consultation / inquiries, complaint handling, customer feedback | Mobile phone number, visited store name, payment info (payment store, date/time, amount) | - | 3 years under the E-Commerce Act |
| Gifting | Prepaid card / gift card payment / gifting | Recipient name, recipient mobile phone number | - | 3 months |
| Group Order | Group Order AlimTalk message sending | Recipient mobile phone number | - | 1 year after completion of delivery |
| Temporary Member | Stamp accumulation | Mobile phone number | - | 6 months |
| Non-Member | Franchise inquiries, suggestions, partnerships / Group Order non-member ordering | Name, phone number, email / order information | - | 3 months / 5 years under E-Commerce Act |
| Affiliated Service | Identity verification for linking services with partners | CI, membership card number | - | Up to 30 days after unlinking membership |
| Cash Receipt | Cash receipt issuance | Cash receipt issuance number | - | 5 years under E-Commerce Act |
* Optional items may be left blank without restricting membership registration or service use.
* If a user enters false information by stealing another person's information, the Company may report such user under applicable laws and terminate membership.
b) Personal information collected automatically during service use:
Service use records, access logs, cookies, access IP information, records of suspended use, payment records, prepaid card recharge history, stamp/point accumulation history, purchase store, payment method, payment date/time, coupon use, and online consultation records.
c) Collection methods:
- Mobile smartphone applications (Mega MGC Coffee App)
- Website, consultation boards, telephone, fax, and event applications
- Automated collection through cookies
- Provision from third parties through partnerships with external service providers
Third-Party Provided Information Received by the Company:
| Provider | Items Provided | Purpose of Receipt |
|---|---|---|
| CJ OliveNetworks Co., Ltd. | CI | Member verification for use of CJ ONE membership services |
| SK Telecom Co., Ltd. | T Membership card number | T Universe Pass discount and refund |
| Kia Corporation | CI | Member discount for provision of Kia Members services |
| Kakao / Naver / Google / Apple | Profile info, name, email, mobile phone number, CI | Social easy login and membership registration/authentication |
② The Company does not collect sensitive personal information that may infringe upon fundamental human rights (such as race, ethnicity, criminal records, health condition, or political orientation).
③ This Privacy Policy is accessible at all times within the app and web pages.
Article 4 (Retention/Use Period and Destruction of Personal Information)
① Where a member requests withdrawal, withdraws consent, or where the retention period expires, the Company destroys personal information without delay. However, statutory obligations require retention for specified periods:
- Service access logs: 3 months (Protection of Communications Secrets Act)
- Records on labeling and advertising: 6 months (E-Commerce Act)
- Records on contracts or subscription withdrawal: 5 years (E-Commerce Act)
- Records on payment and supply of goods: 5 years (E-Commerce Act)
- Records on consumer complaints & dispute resolution: 3 years (E-Commerce Act)
Article 5 (Processing of Personal Information of Children Under 14)
① When collecting personal information of children under 14, the Company obtains consent from the legal representative (Required items: legal representative name, relationship, contact info).
② Verification of legal representative consent is conducted through mobile SMS notification, credit/debit card authorization, mobile phone identity verification, or written signed document.
Article 6 (Provision of Personal Information to Third Parties)
① The Company provides personal information to third parties only with data subject consent or under legal obligations pursuant to Articles 17 and 18 of the Personal Information Protection Act.
| Recipient | Purpose of Provision | Information Provided | Retention Period |
|---|---|---|---|
| CJ OliveNetworks Co., Ltd. | Payment service processing (credit card/simple payment), settlement, payment system support | Payment records, order info (product name, amount, store name, date/time), mobile number, cash receipt info | 5 years after payment completion |
| Mega MGC Coffee Franchise Stores | Order processing, provision of goods/services, customer service | Customer name, phone number, order history (product, payment amount, date/time) | 6 months after service provision |
| NHN KCP Co., Ltd. | Real-name / identity verification, fraud prevention | Name, date of birth, mobile phone number, CI | Up to 30 days after withdrawal |
Article 7 & 8 (Outsourcing & Re-Outsourcing of Personal Information Processing)
To ensure smooth service provision, personal information processing is outsourced and re-outsourced under strict data protection agreements:
| Processor / Sub-processor | Outsourced / Re-outsourced Tasks | Retention & Use Period |
|---|---|---|
| CJ OliveNetworks Co., Ltd. | App development/operation, membership management, messaging, prepaid card management | Until membership withdrawal & contract termination |
| Amazon Web Services (AWS) | Cloud server hosting & secure data storage | Until contract termination |
| Braze Inc. | Marketing automation & customized notification dispatch | Until contract termination or consent revocation |
| Kakao Corp. | KakaoTalk AlimTalk message delivery | 1 year after delivery completion |
| Korea Information & Communications (KICC) | Mega prepaid card issuance, settlement, and customer support | Until contract termination |
Article 9 (Matters Concerning Overseas Transfer of Personal Information)
Due to global cloud computing infrastructure, personal information processing tasks are stored and managed over secure encrypted networks as follows:
| Cloud Provider | Country | Purpose of Transfer | Transferred Items | Retention Period |
|---|---|---|---|---|
| Google LLC | USA | App user analytics platform (Google Analytics/Firebase) | Visit date/time, app use records, access IP, cookies | Per Provider Privacy Policy |
| Amazon AWS | USA | Data storage and cloud computing infrastructure | Encrypted account data, order/payment records | Per Provider Privacy Policy |
| Braze Inc. | USA | Customized marketing messages & push notifications | App service records, push tokens, device ID | Until contract termination / consent withdrawal |
Article 10 (Procedures and Methods for Destruction of Personal Information)
Personal information is destroyed without delay when no longer necessary. Electronic files are permanently destroyed using non-restorable technical deletion algorithms, and physical documents are shredded or incinerated.
Article 11 (Rights of Data Subjects and Legal Representatives)
Data subjects and legal representatives may at any time exercise rights to access, correct, delete, or suspend processing of their personal information directly through the app settings or by contacting our Privacy Protection Officer.
Article 12 (Measures to Ensure Safety of Personal Information)
The Company implements technical, administrative, and physical safety measures including password encryption, SSL/TLS data transmission encryption, access control policies, regular security audits, and firewall installation.
Article 13 & 15 (Cookies & Behavioral Information)
The app and web services may use cookies and behavioral analysis tools to provide personalized user experience. Users can configure browser or mobile device settings to block or allow cookie tracking.
Article 17 & 18 (Privacy Protection Officer & Customer Support)
For any privacy inquiries, grievance handling, or rights requests, please contact our designated Privacy Officers:
Government Privacy Relief & Consultation Agencies:
- Personal Information Infringement Report Center: 118 (privacy.kisa.or.kr)
- Personal Information Dispute Mediation Committee: 1833-6972 (kopico.go.kr)
- Supreme Prosecutors' Office Cyber Investigation: 1301 (spo.go.kr)
- National Police Agency Cyber Bureau: 182 (ecrm.cyber.go.kr)
Article 20 (Duty to Notify & Revision History)
This Privacy Policy takes effect on March 10, 2026. Any future modifications will be notified at least 14 days prior to the effective date via app notices or SMS.
Previous Policy Versions:
- 2026. 01. 30 ~ 2026. 03. 09
- 2026. 01. 07 ~ 2026. 01. 29
- 2025. 10. 19 ~ 2026. 01. 06
- 2024. 06. 24 ~ 2025. 10. 18
- 2019. 08. 01 ~ 2024. 06. 23