Privacy Policy

MONA Co., Ltd. ("MONA", "we", "us") respects your privacy. We process personal information in accordance with the Personal Information Protection Act of the Republic of Korea (PIPA) and other applicable laws.

This Privacy Policy explains what personal information we collect through our website (the "Website"), why we use it, how long we keep it, who we share it with and what rights you have. It applies to everyone who visits the Website or contacts us through it.

We collect only the information needed for the purposes described in this policy.

Enquiry and request forms (contact, free assessment, pricing and ESG programme requests): name, email address, company or organisation name, phone number (optional) and the details you give about your request, such as surplus type, location, volume, frequency, programme format, number of participants and your message.

Applications from charities and nonprofit organisations to receive food and supplies: organisation name and type, contact person's name, email address, phone number, region and information about your organisation and its needs.

Job and volunteer applications sent by email: name, contact details, CV and any other information you choose to send.

Collected automatically when you use the Website: IP address, browser and device type, pages visited, date and time of visits and cookie identifiers.

We do not ask for sensitive information or unique identification information (such as resident registration numbers) through the Website. Please do not include it in free-text fields.

We use personal information to:
• answer your enquiries, prepare assessments and quotes, and provide our services;
• review applications from charities and nonprofit organisations and match them with available donations;
• arrange ESG education programmes and volunteer activities;
• review job applications;
• keep the Website secure, prevent misuse and understand how the Website is used so we can improve it.

We do not use personal information for any other purpose. If a purpose changes, we will ask for your consent where the law requires it. We do not send marketing messages unless you have separately agreed to receive them.

We keep personal information only for as long as it is needed for the purpose it was collected for, and then destroy it without delay.
• Enquiries and assessment requests: 3 years after our last contact with you, or until you ask us to delete them.
• Charity and nonprofit applications: while your organisation takes part in the MONA programme and for 3 years after it ends.
• Job applications: 1 year after the hiring decision, unless you ask us to delete them sooner.

Where a law requires us to keep information for longer, we keep it for the period set by that law, for example:
• records of contracts or withdrawal of offers: 5 years, records of payment and supply of goods or services: 5 years, records of consumer complaints and dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, etc.);
• website visit records: 3 months (Protection of Communications Secrets Act).

We do not provide your personal information to third parties, except in the following cases:
• With your consent. When we match a donating business with a charity or nonprofit, we share the organisation name, the contact person's name and contact details with the matched partner so that they can arrange a pickup or delivery. We ask for your consent before we do this and tell you who will receive the information.
• When required by law, for example when an investigative authority requests information following the procedures and methods set out in the law.

We use the following service provider to process personal information on our behalf:

Tilda Platform Cloud Services Co. LLC — website building and hosting, storage of information submitted through Website forms.

Under Article 26 of PIPA, our contracts with service providers require them to process personal information only for the entrusted work, to protect it with appropriate safeguards and not to pass it on to others. We supervise how they handle the information. If we add or change service providers, we will update this policy without delay.

The Website is hosted by a provider that stores data on servers outside the Republic of Korea. The transfer is necessary to run the Website and is made under the entrustment described in section 5.

• Recipient: Tilda Platform Cloud Services Co. LLC (privacy contact: dpo@tilda.cc)
• Countries: United Arab Emirates (registered office); data is stored in member states of the European Union and the United States
• Information transferred: information you submit through Website forms and website access logs (IP address, browser and device type, visit date and time)
• When and how: sent over an encrypted connection each time you submit a form or visit the Website
• Purpose: website hosting and storage of form submissions
• Retention: the periods described in section 3, or until the end of our contract with the provider

If you do not want your information transferred abroad, you can contact us by email at contact@monaofficial.co instead of using the Website forms. This does not affect your access to the Website, but we cannot receive requests through the forms without the transfer.

When the retention period ends or the purpose has been achieved, we destroy personal information without delay.
• Electronic files are deleted using methods that make them impossible to restore.
• Paper records are shredded or incinerated.

If a law requires us to keep information after the purpose has been achieved, we move it to a separate database or storage location and keep it only for the period required by that law.

You, or your legal representative, can at any time:
• ask to see the personal information we hold about you;
• ask us to correct or delete it;
• ask us to stop processing it;
• withdraw your consent.

To make a request, email contact@monaofficial.co or write to us at the address in section 12. We will verify your identity and respond without delay, within 10 days of receiving your request. If you ask us to correct or delete information, we will not use or provide it until the request has been handled.

You can also make a request through a representative, such as a legal representative or a person you have authorised. In that case, please send a power of attorney in the form set out in the Notice on Personal Information Processing Methods.

Some requests may be limited where a law requires us to keep the information or where granting the request could harm another person's life, body or property. If we refuse a request, we will tell you why and how you can object.

We take the following measures to keep personal information safe:
• Administrative: an internal management plan, access limited to staff who need it for their work, and regular training for those staff.
• Technical: access control on systems that store personal information, encrypted transmission (HTTPS), security updates and keeping records of access to personal information.
• Physical: restricted access to offices and to places where documents containing personal information are stored.

Cookies are small text files that your browser stores when you visit a website. We use them to make the Website work properly, remember your settings and understand how visitors use the Website.
• Essential cookies keep the Website and its forms working and secure. They cannot be switched off on our side.
• Analytics cookies count visits and show which pages are used most, so we can improve the Website. They do not identify you by name.

How to refuse cookies. You can block or delete cookies in your browser settings:
• Chrome: Settings → Privacy and security → Third-party cookies
• Safari: Settings → Privacy → Block all cookies
• Edge: Settings → Cookies and site permissions
• Firefox: Settings → Privacy & Security → Cookies and Site Data

If you block cookies, some parts of the Website may not work as expected.

The Website is meant for businesses, organisations and adults. We do not knowingly collect personal information from children under 14. If we learn that we have collected such information without the consent of a legal representative, we will delete it without delay.

We have appointed a Privacy Officer who is responsible for personal information processing and for handling complaints and requests about it.

Privacy Officer: Phan Quynh, Representative Director
Email: contact@monaofficial.co
Address: MONA Co., Ltd., 5F, 172 Yeoksam-ro, Gangnam-gu, Seoul, Republic of Korea

Please contact the Privacy Officer with any questions, complaints or requests about your personal information. We will answer without delay.

If you need help with a privacy issue or want to report a violation, you can also contact the following organisations:
• Personal Information Dispute Mediation Committee: www.kopico.go.kr, phone 1833-6972
• Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, phone 118
• Supreme Prosecutors' Office: www.spo.go.kr, phone 1301
• Korean National Police Agency, Cyber Bureau: ecrm.police.go.kr, phone 182

This Privacy Policy takes effect on 28 October 2026.

If we change it, we will post the updated version on this page at least 7 days before the change takes effect, or at least 30 days before if the change significantly affects your rights. Previous versions are available on request.