Privacy Policy
Effective Date: 2026-05-13
Last Updated: 2026-05-13
Version: 1.0
A Piece of Map Inc. ("APiM", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit apieceofmap.com (the "Website").
This Policy is designed to satisfy both:
- The Personal Information Protection Act of the Republic of Korea (PIPA), including the amendments effective 11 September 2026, and Article 30 disclosure requirements;
- The EU General Data Protection Regulation 2016/679 (GDPR) and the UK GDPR;
- The California Consumer Privacy Act / CPRA (CCPA/CPRA), to the extent applicable.
Important: A Piece of Map Inc. operates the Website for informational and business-development purposes. We do not sell products or accept payments through this Website. Distinct services such as APiM Galaxy (galaxy.apieceofmap.com) and Mapiker AI (mapiker.com) maintain their own privacy notices for their respective users.
1. Who We Are (Data Controller)
| Item | Detail |
|---|---|
| Legal entity | A Piece of Map Inc. |
| Country of incorporation | Republic of Korea |
| Registered office | 4,5F Greits Pangyo, 117 Bundangnaegok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do 13529, Republic of Korea |
| Website | https://apieceofmap.com |
| General contact | navigate@apieceofmap.com |
| Privacy contact (CPO) | Bo Kyung Choi, CEO — navigate@apieceofmap.com |
Chief Privacy Officer (CPO): Under PIPA Article 31 and the 2026 amendments, the CEO of A Piece of Map Inc. is the ultimate person responsible for the processing and protection of personal information. You may contact the CPO using the email address above.
EU / UK representative: We have not appointed a formal Data Protection Officer (DPO) under GDPR Article 37 because our processing does not meet the statutory thresholds. EU / UK data subjects may contact the CPO using the email above for all privacy-related requests.
2. Scope
This Policy applies to personal data we process through:
- The apieceofmap.com website (including the
/ko/path for Korean articles); - The Contact form at
/contact; - The Newsletter subscription form ("APiM Insights");
- Cookies and similar technologies on the Website;
- Direct correspondence with us by email or postal mail.
This Policy does not cover:
- Third-party websites linked from ours (LinkedIn, partner solution sites, referenced sources);
- Separate services with their own notices, including APiM Galaxy (galaxy.apieceofmap.com) and Mapiker AI (mapiker.com);
- Personal data we process as a service provider on behalf of business clients (governed by separate Data Processing Agreements).
3. What Personal Data We Collect
3.1 Data you provide
| Source | Data fields | Required / Optional |
|---|---|---|
Contact form (/contact) |
First and last name, business email, company name, job title, inquiry type, message content, optional marketing consent | Name, email, company, message required; role and consent optional |
| Newsletter subscription | Email address, locale preference (EN or KR) | Email required |
Direct email to navigate@apieceofmap.com |
Whatever you choose to include | — |
3.2 Data collected automatically
| Source | Data fields | Purpose |
|---|---|---|
| Vercel server access logs | IP address, user agent, requested URL, timestamp, referrer, HTTP status | Hosting operations, security, abuse prevention |
| Google reCAPTCHA v3 | Browser and device fingerprint, mouse and keyboard interaction signals, IP address (sent to Google) | Spam and bot prevention on Contact form and Beta sign-up |
| PostHog analytics (only with consent) | Anonymized pageview events, route changes, locale, no IP storage and no session recording | Aggregate site usage analytics |
| Google Maps embed (only with consent) | IP address and browser info (sent to Google when the Contact page office map loads) | Display office location |
We do not knowingly collect special categories of personal data (race, religion, political opinion, health, sexual orientation, etc.). We do not knowingly collect data from children — see §10.
3.3 Data we do not collect
- Payment card information (we do not process payments on this Website).
- Government-issued identifiers (resident registration number, passport number, driver licence, etc.).
- Biometric data.
- Precise geolocation data (we use only coarse country-level signals derived from IP for compliance).
4. Purpose and Legal Basis
We process personal data on the following lawful grounds.
| Purpose | Data used | GDPR legal basis | PIPA legal basis |
|---|---|---|---|
| Respond to your business inquiry | Contact form data | Art. 6(1)(b) pre-contractual steps + Art. 6(1)(f) legitimate interest in business communications | Article 15 §1.4 — necessary to fulfil contract, supplemented by consent at submission |
| Send the APiM Insights newsletter | Email address, locale, optional name | Art. 6(1)(a) consent | Article 15 §1.1 — consent of the data subject |
| Operate and secure the Website | Server access logs, security cookies, reCAPTCHA signals | Art. 6(1)(f) legitimate interest in service security and integrity | Article 15 §1.6 — legitimate interests of the controller (security, fraud prevention) |
| Measure aggregate Website usage | PostHog analytics events (post-consent) | Art. 6(1)(a) consent | Article 15 §1.1 — consent |
| Show office location map | Google Maps embed (post-consent) | Art. 6(1)(a) consent | Article 15 §1.1 — consent |
| Comply with legal obligations | Records as required by law | Art. 6(1)(c) legal obligation | Article 15 §1.2 — required by law |
Consent withdrawal: You may withdraw consent at any time by emailing navigate@apieceofmap.com or by clicking "Unsubscribe" in any newsletter. Withdrawal does not affect the lawfulness of processing before the withdrawal.
PIPA separate consent: Where Korean law requires separate consent for distinct processing categories (e.g., marketing, international transfers), we present those choices individually rather than as a single blanket consent.
5. Retention Periods
| Data | Retention |
|---|---|
| Contact inquiries — unconverted leads | Up to 3 years from last contact, then deleted |
| Contact inquiries — active client relationship | Contract term + 5 years after termination (Korean Commercial Code Article 33) |
| Newsletter subscribers — active | Until unsubscribe |
| Newsletter subscribers — after unsubscribe | 12 months for suppression and re-consent records, then permanent deletion |
Cookie consent records (in localStorage) |
12 months, after which renewed consent is requested |
| Vercel server access logs | 30 days (Vercel default), then rotated and deleted |
| PostHog analytics events (anonymized) | 12 months rolling, then deleted |
| reCAPTCHA verification logs | Processed transiently by Google; we retain only a pass/fail outcome (no retention beyond logging server) |
After the applicable period, data is irreversibly deleted or fully anonymized.
6. Who We Share Data With (Sub-processors)
We share personal data only with the service providers listed below, who act under written Data Processing Agreements (DPAs). We do not sell personal data, and we do not use your data for advertising retargeting or to train AI or machine-learning models.
| Service provider | Role | Primary location | Transfer mechanism |
|---|---|---|---|
| Vercel Inc. | Website hosting, edge delivery, server logs | United States, global edge | EU-US Data Privacy Framework + Standard Contractual Clauses (DPA at vercel.com/legal/dpa) |
| Cloudflare, Inc. | Authoritative DNS service for the apieceofmap.com domain (DNS-only mode; proxy, CDN, WAF, and Bot Management are not enabled) | Global, primary United States | EU-US Data Privacy Framework + Standard Contractual Clauses (DPA at cloudflare.com/cloudflare-customer-dpa) |
| Ghost Foundation (self-hosted) | Newsletter list management, member database, content management | European Union region | Self-managed by us; DPA available on request |
| Resend.com | Transactional email delivery (auto-replies, admin notifications) | United States | Standard Contractual Clauses (DPA at resend.com/legal/dpa) |
| PostHog Inc. (EU Cloud) | Anonymized website analytics | European Union (Frankfurt) | No third-country transfer for EU users; DPA at posthog.com/dpa |
| Google LLC | reCAPTCHA v3 anti-spam, Google Maps embed, Google Workspace inbox for navigate@apieceofmap.com | United States, global | EU-US Data Privacy Framework + Standard Contractual Clauses |
Each sub-processor list reflects our current operations as of the Effective Date. We will update this Policy if we materially change our sub-processors.
7. International Data Transfers
Because some of our sub-processors operate outside the Republic of Korea and the EU / EEA, your personal data may be transferred across borders.
7.1 GDPR — transfers from the EU / EEA / UK
We rely on the following safeguards:
- EU-US Data Privacy Framework for certified U.S. recipients (Vercel, Cloudflare, Resend, Google);
- Standard Contractual Clauses (Module 2 — controller to processor) where the Framework does not apply;
- Supplementary measures including encryption in transit (TLS 1.2+) and least-privilege access controls;
- For PostHog analytics, EU users' data remains in the European Union (Frankfurt) and is not transferred outside the EU.
7.2 PIPA — transfers from the Republic of Korea
In line with PIPA Article 28-8 (overseas transfer notification), we disclose:
- Recipients: Vercel Inc. (US), Cloudflare, Inc. (US), Resend.com (US), PostHog Inc. (EU Cloud), Google LLC (US), Ghost Foundation (EU);
- Purposes: Web hosting and logs; authoritative DNS; email delivery; analytics; spam prevention and map display; newsletter management;
- Data items transferred: Items listed in §3 of this Policy;
- Retention by recipient: As specified in the recipient's DPA, not exceeding our own retention periods;
- Refusal right: You may refuse the transfer by not submitting forms, not subscribing to the newsletter, and rejecting non-essential cookies. Refusal after submission can be exercised by contacting us; some Website features may then become unavailable to you.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data.
| Right | What it means | Applicable jurisdictions |
|---|---|---|
| Access | Receive a copy of the personal data we hold about you | PIPA, GDPR, UK GDPR, CCPA/CPRA |
| Rectification | Correct inaccurate or incomplete data | PIPA, GDPR, UK GDPR |
| Erasure | Request deletion ("right to be forgotten") | GDPR, UK GDPR; PIPA (request to cease processing) |
| Restriction | Ask us to pause processing | GDPR, UK GDPR |
| Portability | Receive your data in a machine-readable format | GDPR, UK GDPR, PIPA Article 35-2 |
| Objection | Object to processing based on legitimate interest, or to direct marketing | GDPR, UK GDPR |
| Withdrawal of consent | Revoke previously granted consent | PIPA, GDPR, UK GDPR |
| Non-automated decisions | We do not subject you to automated decisions producing legal effects | GDPR Art. 22; PIPA Art. 37-2 |
| Opt-out of sale or sharing | We do not sell or share personal data for cross-context behavioural advertising | CCPA/CPRA |
8.1 How to exercise your rights
Email navigate@apieceofmap.com with subject line "Privacy Request — [Access / Delete / Correct / Object / …]".
We respond within:
- 10 days under PIPA (Enforcement Decree Article 41), extendable once with notice;
- 30 days under GDPR / UK GDPR, extendable by an additional 60 days for complex requests with notice;
- 45 days under CCPA/CPRA, extendable by an additional 45 days with notice.
We may ask for reasonable verification of identity to prevent unauthorized requests, in line with PIPA Enforcement Decree Article 41.
8.2 Right to lodge a complaint
You may also contact the supervisory authority in your jurisdiction:
- Republic of Korea — Personal Information Protection Commission (PIPC), https://www.pipc.go.kr (call 182 within Korea);
- Republic of Korea — KISA Privacy Infringement Reporting Center, https://privacy.kisa.or.kr (call 118);
- Republic of Korea — Personal Information Dispute Mediation Committee, https://www.kopico.go.kr (call 1833-6972);
- EU / EEA — your national Data Protection Authority, list at https://edpb.europa.eu/about-edpb/about-edpb/members_en;
- United Kingdom — Information Commissioner's Office, https://ico.org.uk;
- California, USA — California Privacy Protection Agency, https://cppa.ca.gov.
9. Security
We apply organizational, technical, and physical measures appropriate to the risk of processing.
- Encryption in transit: TLS 1.2 or higher for all Website traffic;
- Encryption at rest: applied at the sub-processor layer (Vercel, Ghost host, PostHog EU);
- Access control: least-privilege role assignments; multi-factor authentication for administrator accounts;
- Vulnerability management: regular dependency updates and patching cycles;
- Anti-spam: Google reCAPTCHA v3 plus honeypot field on public forms;
- Logging and monitoring: server access logs reviewed for anomalous activity;
- Retention discipline: automated and manual deletion routines aligned with §5.
No system is completely secure. If we become aware of a personal data breach affecting your data, we will notify the relevant supervisory authority and, where required, affected individuals:
- Within 72 hours of becoming aware (GDPR Article 33 / 34);
- Without delay (PIPA Article 34) and, for breaches of 1,000 or more data subjects, within 72 hours of becoming aware.
10. Children
The Website is a B2B platform and is not directed to children. We do not knowingly collect personal data from:
- Children under 14 years of age (Republic of Korea, under PIPA Article 22-2);
- Children under 16 years of age (EU / EEA, under GDPR Article 8);
- Children under 13 years of age (United States, under COPPA).
If you believe we have inadvertently collected such data, please contact navigate@apieceofmap.com for prompt deletion.
11. Cookies
Our use of cookies and similar technologies is described in the Cookie Policy. The cookie banner appears on first visit and lets you accept or reject non-essential cookies (analytics, Google Maps). You can change your choice at any time via the "Cookie Preferences" link in the Website footer.
12. Automated Decisions and Profiling
We do not use the Website's personal data to make automated decisions producing legal or similarly significant effects. PostHog analytics events are aggregated and not used to make individual decisions.
13. AI and Machine Learning
We do not use personal data submitted through this Website to train artificial-intelligence or machine-learning models. This applies to Contact form content, newsletter subscriber lists, and analytics events alike. We honour standard signals (robots.txt directives, noai and noimageai meta tags) to discourage unauthorized scraping for AI training, and our Terms of Service §3 prohibit such use.
14. Changes to this Policy
We may update this Policy from time to time to reflect changes in our practices, services, or legal requirements. When we do, we will:
- Update the "Last Updated" and, where applicable, "Effective Date" at the top of this page;
- For material changes that affect your rights or our processing, publish a banner notice on apieceofmap.com and, where appropriate, notify active newsletter subscribers by email.
Prior versions are archived and available on request.
15. Governing Law and Jurisdiction
This Policy is governed by the laws of the Republic of Korea. Any dispute arising out of or relating to this Policy is subject to the exclusive jurisdiction of the Seongnam Branch of Suwon District Court, Republic of Korea.
Nothing in this clause limits the mandatory consumer-protection rights of EU / EEA, UK, or other data subjects under the laws of their country of residence.
16. Contact
For any privacy question or to exercise your rights, please contact us:
- Email: navigate@apieceofmap.com
- Subject prefix: "Privacy Request — …"
- Post: A Piece of Map Inc., 4,5F Greits Pangyo, 117 Bundangnaegok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do 13529, Republic of Korea
This Policy is published in English. A Korean translation may be made available; in case of any discrepancy with the Korean version under matters of Korean law, the Korean version prevails. For all other purposes, the English version is authoritative.