KOCA 隱私權政策 Privacy Policy

最後更新：2026/08/28

一、總則

歡迎使用 KOCA – Kpop 小卡、周邊交易平台（以下簡稱「本平台」）。本平台由酷卡宇宙股份有限公司（統一編號：60656527，以下簡稱「公司」、「我們」或「我方」）所營運。我們致力於致力於尊重用戶的隱私權，並依據適用法律及相關規定，保護您的個人資料。本隱私權政策說明我們如何蒐集、使用、存儲及保護您在賣家實名認證過程中提供的個人資料，以及您對此資訊的相關權利。

本政策適用於通過我們的官方網站（www.koca.shop）、App Store 應用程式、Google Play 應用程式及任何相關服務、銷售、市場行銷或活動（以下統稱為「服務」）收集的所有個人資料。使用我們的服務，即表示您同意我們按照本政策收集和使用您的個人資料。

二、蒐集之個人資料

您在與本平台的服務互動時所自願提供的個人資訊，包括但不限於您的姓名、電子郵件地址、上傳之照片、電話號碼及對話資訊（您在平台內與其他用戶（如買家與賣家之間）或與本平台客服進行溝通時所產生的文字、圖片、影音及對話時間等紀錄）。此外，系統將自動收集您的 IP 地址、瀏覽器類型、造訪我們服務的紀錄等資訊，以優化平台使用體驗與安全性。

於賣家實名認證過程中，為確保平台交易安全並符合法規要求，我們可能會向您蒐集以下個人資料：

1. 姓名
2. 身分證或其他政府核發之身分證明文件（如護照、駕照）
3. 聯絡資訊（如電話號碼、電子郵件地址）
4. 銀行帳戶資訊
5. 其他依據法律規範或完成認證所需之資料

您得選擇是否提供上述個人資料；惟如您選擇不提供完成會員註冊或使用特定服務所需之必要資料，本平台將可能無法為您提供相對應之服務功能。

三、個人資料的使用

我們蒐集您的個人資料僅用於以下目的：

1. 驗證您的身分，以確保交易安全
2. 符合法律與監管機構的要求
3. 爭議處理與申訴裁決： 當用戶間發生交易糾紛、退貨退款爭議時，本平台得調閱相關對話紀錄作為事實認定之依據。
4. 安全監控與違規防範： 為偵測詐欺、非法交易、騷擾行為或違反平台服務條款之情事，本平台得透過系統自動化過濾或人工抽查之方式審閱對話內容。
5. 其他與交易及平台運營相關的合法用途，包括但不限於市場研究、服務改善、用戶溝通及安全性強化。

為提升實名認證（KYC）之準確性與資安防護，本平台可能採用 Google Vertex AI 之人工智慧模型及相關技術協助辨識與驗證流程。

透過此輔助機制，本平台得更有效辨識冒用、偽造或高度風險身分資訊，以配合台灣關於平台風險管理與實名認證之監理要求。於此過程中，平台承諾維持資料加密與存取控制標準，不會以未經授權之方式分享 KYC 資料；並依法律或主管機關要求提供必要協力。如使用 Vertex AI 時涉及 Google Cloud 身份與存取管理，將依 Google Cloud IAM 控制與授權機制管理模型存取權限與資訊保護。

此外，於 KYC 審核作業中，本平台使用 Google Cloud Platform（GCP，伺服器位於美國）協助內部通知與審核流程之運作。依《個人資料保護法》第 8 條規定，本平台就此跨境傳輸告知事項如下：

1. 個人資料之類別：您的 KYC 審核狀態及必要識別資訊。
2. 利用之期間：資料傳輸至 GCP 後，僅用於當下之即時處理，處理完成後立即刪除，不予保留或備份。
3. 利用之地區：美國（GCP 資料中心所在地）。
4. 利用之對象：Google Cloud Platform（Google LLC）。
5. 利用之方式：僅供內部審核通知系統讀取、比對與記錄審核結果，不作其他用途；GCP 依其國際資安標準及適用法規履行資料保護義務。

本跨境傳輸係依《個人資料保護法》第 21 條及第 8 條規定辦理，並以您進行 KYC 時所為之同意為法律基礎。

如您不同意個人資料跨境傳輸，可選擇不進行賣家實名認證，惟將無法使用本平台賣家功能。

四、個人資料的儲存與保護

1. 我們將依據適用法律的要求，安全地存儲您的個人資料，並採取適當的技術與管理措施保護您的資訊，防止未經授權的存取、洩露或濫用。
2. 您的個人資料將儲存於本平台或本平台委託的合格第三方伺服器，並僅在法律允許的範圍內進行處理。
3. 我們將在法規允許或業務需要的最短期間內保留您的個人資料，並於達成蒐集目的後，依據相關規定適當銷毀或匿名化處理。
4. 如果您的帳號曾有交易紀錄，且未完成交易、帳戶餘額及其他未結事項均已完成或妥善處理，您可以申請關閉帳號並停止登入及對外顯示；但這不代表所有後端資料均會刪除。本平台將依《個人資料保護法》及其他適用法令，或因完成交易、付款與結算、處理爭議、風險管理及查核等必要業務，限制保存最低必要的帳號識別、KYC、交易、付款／結算、會計憑證及相關紀錄。保留資料僅用於原蒐集目的、法令遵循、爭議處理及查驗，不作其他用途。
5. 無交易紀錄的帳號，於確認沒有未完成事項、爭議、法定義務或其他必要保存事由後，可以刪除帳號及相關個人資料。依法或因必要業務仍須保存的資料，不因刪除或關閉帳號而立即刪除；保存期間屆滿或無必要後，將刪除或匿名化。
6. 依《商業會計法》第38條，會計憑證於年度決算程序辦理終了後至少保存五年，會計帳簿及財務報表至少保存十年；如第三方支付相關洗錢防制保存規範適用於特定服務或業務，服務必要紀錄至少保存五年，客戶身分、銀行帳戶、支付證明等必要資料至少保存至業務關係結束後五年；法律另有較長保存期間者，從其規定。為防止重複認證，交易帳號所保留的必要身分識別資訊（如身分證件識別資訊、電話、電子信箱或銀行帳戶）不得再次用於本平台註冊或實名認證。

五、個人資料的分享與揭露

我們不會將您的個人資料提供、出售、交換或出租給任何無關的第三方，但以下情況除外：

1. 依法令要求，或應司法機關、政府機構或其他監管機關之要求提供時。
2. 為完成支付交易，需與金融機構或支付服務供應商共享必要資訊時。
3. 為防止詐欺、維護交易安全或執行平台規範所需，本平台得依《個人資料保護法》第 20 條規定，於必要時提供相關個人資訊予執法機構，以協助調查非法行為。
4. 其他經您明確同意之情況。
5. 委外處理：為維護本平台系統穩定及各項服務之正常運作，本公司得將您的個人資料提供予受本公司委託辦理資訊系統開發、維護、金流串接、客服系統或資料處理等業務之關係企業艾斯特網路有限公司及其他第三方委外廠商。前述受託處理之公司均負有與本公司相同之個人資料保護及保密義務，且僅得於受託業務範圍內處理您的個人資料，不得移作他用。

六、兒童隱私保護

本平台非常重視兒童的隱私保護，並依據適用法律制定以下政策：

1. 未滿十八歲之未成年人，應依本平台服務條款之規定，經法定代理人閱讀、瞭解並同意後，方得註冊為一般會員並使用本平台服務（包括瀏覽及購買商品）；本平台僅蒐集完成交易所需之最小必要個人資料。
2. 唯有持有中華民國國民身分證或居留證、且年滿十八歲者，方得於本平台申請賣家實名認證或建立賣場；未持有前述證件或未滿十八歲者不得申請賣家實名認證。本平台不開放未成年實名認證，亦不為該目的蒐集未滿十八歲申請人之身分證件及銀行帳戶資料；未滿十八歲者請由法定代理人以其本人之身分證件及銀行帳戶完成認證。
3. 若兒童使用者之法定代理人（父母或監護人）就其個人資料之蒐集、使用有疑義或要求刪除，本平台將於確認身分後盡速處理。

七、您的權利

依據適用法律，您對您的個人資料擁有以下權利：

1. 查詢、請求閱覽或請求製給您個人資料之複製本。
2. 請求更正或更新您的個人資料。
3. 請求刪除您的個人資料；無交易紀錄且確認沒有未完成事項、爭議、法定義務或其他必要保存事由者，得申請刪除帳號及相關個人資料；有交易紀錄者，於未完成交易、帳戶餘額及其他未結事項均已完成或妥善處理後，得申請關閉帳號並停止登入及對外顯示，惟依法或因必要業務需留存者除外。
4. 請求限制或拒絕本平台對您的個人資料進行處理。
5. 撤回先前對個人資料處理的同意，惟不影響撤回前基於您的同意所進行之資料處理。

八、隱私權政策的變更

本平台保留隨時修改本政策之權利，並於變更後公告於本平台，變更後之內容將於公告時生效。

九、聯繫我們

如果您對我們的隱私政策有任何疑問或建議，請隨時透過 [email protected] 與我們聯繫。

1. General Provisions

Welcome to KOCA – the K-pop Photocard and Merchandise Trading Platform (hereinafter referred to as the "Platform"). The Platform is operated by KOCA INC (hereinafter referred to as "Company," "we," "our," or "us"). We are committed to respecting your privacy and protecting your personal data in accordance with applicable laws and regulations. This Privacy Policy outlines how we collect, use, store, and safeguard the personal information you provide during the seller identity verification process, as well as your related rights.

This Policy applies to all personal information collected through our official website (www.koca.shop), applications available on the App Store and Google Play, and any related services, sales, marketing, or promotional activities (collectively, the “Services”). By using our Services, you agree to the collection and use of your personal data as described in this Policy.

2. Collection of Personal Data

We collect the personal data you voluntarily provide when interacting with the Platform, including but not limited to your name, email address, uploaded images, and phone number. Additionally, our systems automatically collect information such as your IP address, browser type, and records of your visits to the Services to enhance user experience and platform security.

As part of the seller identity verification process, and to ensure transaction security and legal compliance, we may collect the following personal data:

• Full name
• Government-issued identification documents (e.g., national ID card, passport, driver’s license)
• Contact information (e.g., phone number, email address)
• Bank account information
• Other information required under applicable laws or necessary to complete the verification process

You may choose whether to provide the personal data listed above; however, if you choose not to provide the information necessary to complete member registration or use a specific service, the Platform may be unable to provide you with the corresponding service.

3. Use of Personal Data

We use the personal data we collect for the following purposes:

• To verify your identity and ensure the security of transactions
• To comply with applicable legal and regulatory requirements
• To prevent fraud and maintain the integrity of the Platform
• To provide customer support and related services
• For other lawful purposes related to transactions and Platform operations, including but not limited to market research, service improvements, user communication, and security enhancements

In addition, during the KYC review process, the Platform uses Google Cloud Platform (GCP, with servers located in the United States) to support internal notification and review operations. In accordance with Article 8 of Taiwan's Personal Data Protection Act, the Platform hereby discloses the following regarding this cross-border transfer:

1. Category of personal data: your KYC review status and necessary identifying information
2. Period of use: after transfer to GCP, the data is used only for real-time processing and is deleted immediately upon completion, without retention or backup
3. Region of use: United States (location of GCP data centers)
4. Recipient: Google Cloud Platform (Google LLC)
5. Manner of use: solely for internal review and notification systems to read, compare, and record review results, and not used for any other purpose; GCP fulfills its data protection obligations in accordance with applicable laws and internationally recognized security standards

This cross-border transfer is conducted in accordance with Article 21 and Article 8 of Taiwan's Personal Data Protection Act, based on your consent provided upon initiating the KYC process.

If you do not consent to the cross-border transfer of your personal data, you may choose not to complete seller identity verification; however, seller features on the Platform will be unavailable.

4. Storage and Protection of Personal Data

We store your personal data securely in accordance with applicable laws and implement appropriate technical and organizational measures to protect your information from unauthorized access, disclosure, or misuse.

Your personal data may be stored on servers operated by us or by qualified third-party service providers entrusted by us, and will only be processed within the bounds of the law.

We will retain your personal data only for the minimum period necessary to fulfill the purposes for which it was collected, or as required by law. Upon completion of those purposes, we will properly delete or anonymize the data in accordance with relevant regulations.

If your account has transaction records, and all pending transactions, account balances, and other outstanding matters have been completed or properly resolved, you may request account closure and the cessation of login and public display. This does not mean that all backend records will be deleted. Under Taiwan's Personal Data Protection Act and other applicable laws, or where necessary to complete transactions, process payments and settlements, handle disputes, manage risks, or conduct audits, we will retain only the minimum necessary account-identifying, KYC, transaction, payment/settlement, accounting-voucher, and related records. Retained data will be used only for the original collection purposes, legal compliance, dispute handling, and verification, and will not be used for other purposes.

An account with no transaction records may be fully deleted, including related personal data, after we confirm that there are no pending matters, disputes, legal obligations, or other necessary grounds for retention. Data that must continue to be retained by law or for necessary business purposes will not be deleted immediately upon account deletion or closure; it will be deleted or anonymized when the applicable retention period ends or retention is no longer necessary.

Under Article 38 of Taiwan's Business Accounting Act, accounting vouchers must be retained for at least five years after completion of the annual final accounts process, and accounting books and financial statements for at least ten years. If third-party-payment anti-money-laundering retention rules apply to a particular service or business, necessary service records must be retained for at least five years, and necessary customer identity, bank-account, and payment-proof information must be retained for at least five years after the business relationship ends. Where the law requires a longer retention period, the longer period applies. To prevent duplicate identity verification, necessary identity information retained for an account with transaction records (such as identification-document identifiers, phone number, email address, or bank-account details) may not be used again to register for or complete identity verification on the Platform.

5. Sharing and Disclosure of Personal Data

We do not sell, rent, trade, or otherwise provide your personal data to unrelated third parties, except under the following circumstances:

• Where required by law, or in response to a lawful request by judicial, governmental, or regulatory authorities
• Where necessary to complete a payment transaction, we may share relevant information with financial institutions or payment service providers
• Where necessary to prevent fraud, ensure transaction security, or enforce Platform policies, the Platform may, pursuant to Article 20 of Taiwan's Personal Data Protection Act, provide relevant personal information to law enforcement authorities to assist in the investigation of unlawful conduct
• Where we have received your explicit consent to do so
• Outsourced Processing: To maintain the stability of the Platform's systems and ensure the proper operation of our services, we may provide your personal data to Assetflow Co., Ltd., an affiliated company entrusted by us to handle information system development, maintenance, payment integration, customer service systems, or data processing, as well as other third-party service providers engaged for outsourced operations. Such entrusted parties are subject to the same personal data protection and confidentiality obligations as the Company, and may only process your personal data within the scope of the entrusted services, without repurposing it for any other use.

6. Protection of Children’s Privacy

We take children’s privacy very seriously and adopt the following policies in accordance with applicable laws:

• Minors under the age of 18 may register as a general member and use the Platform's services (including browsing and purchasing products) only after their legal representative has read, understood, and agreed to the Platform's Terms of Service, as required therein; the Platform collects only the minimum personal data necessary to complete a transaction
• Only users who hold a Taiwan National ID card or an Alien Resident Certificate (ARC) and are 18 years of age or older may apply for seller identity verification or open a store on the Platform; users without such identification, or who are under 18, may not apply. The Platform does not accept KYC applications from minors and does not collect identity documents or bank-account data from under-18 applicants for that purpose. A legal representative should complete verification using their own identification documents and bank account.
• If a child user's parent or legal guardian has concerns about the collection or use of the child's personal data, or requests its deletion, the Platform will address the request promptly after verifying identity

7. Your Rights

In accordance with applicable laws, you have the following rights regarding your personal data:

• The right to access, review, or request a copy of your personal data
• The right to request correction or update of your personal data
• The right to request deletion of your personal data. If you have no transaction records and we confirm that there are no pending matters, disputes, legal obligations, or other necessary grounds for retention, you may request deletion of your account and related personal data. If your account has transaction records, once all pending transactions, account balances, and other outstanding matters have been completed or properly resolved, you may request account closure and the cessation of login and public display, except for data that must be retained by law or for necessary business purposes.
• The right to restrict or object to the processing of your personal data
• The right to withdraw your consent to data processing at any time, provided that such withdrawal does not affect the legality of processing based on consent prior to its withdrawal

8. Changes to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time. Any changes will be posted on the Platform and shall become effective upon publication. We encourage you to review the Policy periodically to stay informed about how we protect your information.

9. Contact Us

If you have any questions, concerns, or suggestions regarding this Privacy Policy, please contact us at:
Email: [email protected]