HiFi Plaza Privacy Policy

Effective Date: May 26, 2026  |  Last updated: May 26, 2026

This Privacy Policy explains what personal data we collect when you use HiFi Plaza, why we collect it, how we use it, who we share it with, and the rights you have over your data. We comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and other applicable laws.
1. Who We Are (Controller)

The data controller for HiFi Plaza is Audio Market, operating under the brand HiFi Plaza, based in the Republic of Korea.

For all privacy questions, contact privacy@hifiplaza.co.kr.

2. Data We Collect

2.1 Account Data

  • Email address (required for sign-in and account recovery)
  • Display name / nickname
  • Hashed password (we never see your plain password)
  • Country of residence (selected by you)
  • Optional profile photo

2.2 Social Sign-In Data

If you sign in with Apple, Google, Kakao, or Naver, we receive a unique provider identifier and (depending on your choice) your email and name. We do not access other data from these providers.

2.3 Content You Provide

  • Listings (text, photos, brand, model, price, location)
  • Chat messages (including images you share)
  • Reviews, reports, keyword alerts you create

2.4 Device and Usage Data

  • Device platform (iOS/Android), app version, language
  • Push notification token (FCM/APNs) — to deliver alerts
  • IP address (server logs, retained briefly for security)
  • Approximate timestamps of activity (login, listing creation)

2.5 Business Verification Data (Optional)

If you upgrade to a business account, we may collect business registration details and contact information for verification.

We do NOT collect: precise GPS location, financial card details (payments, if any, are processed by Apple or future payment partners), advertising IDs without consent.

3. How We Use Your Data (Purposes & Legal Bases)
PurposeLegal Basis (GDPR)
Provide the marketplace (display listings, enable chat)Contract (Art. 6(1)(b))
Account authentication and securityContract / Legitimate Interest (Art. 6(1)(b)/(f))
Send push notifications you opted intoConsent (Art. 6(1)(a))
Machine-translate chat messages between languagesContract (Art. 6(1)(b))
Detect fraud, abuse, or violationsLegitimate Interest / Legal Obligation (Art. 6(1)(f)/(c))
Comply with tax, accounting, and law-enforcement requestsLegal Obligation (Art. 6(1)(c))
4. Sharing with Third Parties

We share data only with the following categories of processors, each bound by data-processing agreements:

  • Apple (iCloud, Sign in with Apple, APNs) — authentication and push delivery (Apple Inc., USA / EU)
  • Google (Firebase Cloud Messaging, Google Sign-In) — push delivery and authentication (Google LLC, USA / EU)
  • Kakao / Naver — social sign-in (Republic of Korea)
  • Microsoft Azure (Translator) — machine translation of chat messages (multi-region)
  • Hosting provider — server infrastructure (Republic of Korea)
  • Law enforcement — only when legally required (court order, subpoena)

We do not sell your personal data, and we do not share it for third-party advertising.

5. International Transfers

Our primary servers are located in the Republic of Korea. If you use the Service from outside Korea, your data will be transferred to and processed in Korea.

Korea has been recognized by the European Commission as providing an adequate level of data protection (Adequacy Decision of 17 December 2021). This means EU/EEA data may be transferred to Korea without additional safeguards.

Some processors (Apple, Google, Microsoft) may transfer data to the United States. They maintain Standard Contractual Clauses (SCCs) and other safeguards as required by GDPR.

6. Data Retention
DataRetention
Active account dataUntil you delete your account
Chat messages (after deletion)Visible to other participant as "Deleted User"; 90 days then anonymized
Translation cache1 year, or until source message deleted
Push devices (inactive)90 days after last seen, then deleted
Moderation history (reports, suspensions)3 years (legitimate interest in safety)
Server access logs30 days
Tax / business recordsAs required by Korean tax law (typically 5 years)
7. Your Rights

You have the following rights regarding your personal data:

  • Access — request a copy of your data
  • Rectification — correct inaccurate data (most editable in-app)
  • Erasure — delete your account in-app (Settings → Delete Account), or request server-side deletion
  • Restriction — limit how we process your data
  • Portability — receive your data in a machine-readable format
  • Objection — object to processing based on legitimate interest
  • Withdraw consent — for processing based on consent (e.g., push notifications)
  • Complain — lodge a complaint with your local data-protection authority (in the EU, you can find your authority at edpb.europa.eu)

To exercise these rights, email privacy@hifiplaza.co.kr. We respond within 30 days.

8. Children

The Service is not directed to children under 16. If we learn we have collected data from a child under 16 without verifiable parental consent, we will delete it promptly. Contact privacy@hifiplaza.co.kr if you believe this has occurred.

9. Security

We implement appropriate technical and organizational measures to protect your data, including HTTPS in transit, password hashing, role-based access controls, and routine security review. No system is 100% secure; we encourage strong passwords and notifying us at security@hifiplaza.co.kr of any suspected breach.

10. Cookies and Tracking

The mobile app does not use cookies. We do not use third-party advertising trackers. We do not implement Apple's App Tracking Transparency (ATT) prompt because we do not track users across other companies' apps and websites.

11. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you. Content moderation involves human review for material decisions.

12. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified in-app or by email at least 30 days before they take effect. Continued use after the effective date constitutes acceptance.

13. Contact

Privacy questions: admin@hifiplaza.co.kr
Security incidents: admin@hifiplaza.co.kr
General support: admin@hifiplaza.co.kr

EU/UK users — for EU-specific representative arrangements under Article 27 GDPR, contact us at admin@hifiplaza.co.kr.

Controller: Audio Market (HiFi Plaza)
Jurisdiction: Republic of Korea
Adequacy: EU Commission Adequacy Decision (Dec 2021)
Contact: privacy@hifiplaza.co.kr