A Piece of Map

Privacy Policy

Effective Date: 2026-05-13
Last Updated: 2026-05-14
Version: 1.1

A Piece of Map Inc. ("APiM", "we", "us", or "our") respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, share, and protect personal information when you visit apieceofmap.com (the "Website").

This Policy is designed to satisfy both:

  • The Personal Information Protection Act of the Republic of Korea (PIPA), including the amendments effective 11 September 2026, and Article 30 disclosure requirements;
  • The EU General Data Protection Regulation 2016/679 (GDPR) and the UK GDPR;
  • The California Consumer Privacy Act / CPRA (CCPA/CPRA), to the extent applicable.

Important: A Piece of Map Inc. operates the Website for informational and business-development purposes. We do not sell products or accept payments through this Website. Distinct services such as APiM Galaxy (galaxy.apieceofmap.com) and Mapiker AI (mapiker.com) maintain their own privacy notices for their respective users.

1. Who We Are (Data Controller)

Item Detail
Legal entity A Piece of Map Inc.
Country of incorporation Republic of Korea
Registered office 4,5F Greits Pangyo, 117 Bundangnaegok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do 13529, Republic of Korea
Website https://apieceofmap.com
General contact navigate@apieceofmap.com
Privacy contact (CPO) Bo Kyung Choi, CEO — navigate@apieceofmap.com

Chief Privacy Officer (CPO): Under PIPA Article 31 and the 2026 amendments, the CEO of A Piece of Map Inc. is the ultimate person responsible for the processing and protection of personal information. You may contact the CPO using the email address above.

EU / UK representative: We have not appointed a formal Data Protection Officer (DPO) under GDPR Article 37 because our processing does not meet the statutory thresholds. EU / UK data subjects may contact the CPO using the email above for all privacy-related requests.

2. Scope

This Policy applies to personal data we process through:

  • The apieceofmap.com website (including the /ko/ path for Korean articles);
  • The Contact form at /contact;
  • The Newsletter subscription form ("APiM Insights");
  • Cookies and similar technologies on the Website;
  • Direct correspondence with us by email or postal mail.

This Policy does not cover:

  • Third-party websites linked from ours (LinkedIn, partner solution sites, referenced sources);
  • Separate services with their own notices, including APiM Galaxy (galaxy.apieceofmap.com) and Mapiker AI (mapiker.com);
  • Personal data we process as a service provider on behalf of business clients (governed by separate Data Processing Agreements).

3. What Personal Data We Collect

3.1 Data you provide

Source Data fields Required / Optional
Contact form (/contact) First and last name, business email, company name, job title, inquiry type, message content, optional marketing consent Name, email, company, message required; role and consent optional
Newsletter subscription Email address, locale preference (EN or KR) Email required
Direct email to navigate@apieceofmap.com Whatever you choose to include —

3.2 Data collected automatically

Source Data fields Purpose
Server access logs IP address, user agent, requested URL, timestamp, referrer, HTTP status Hosting operations, security, abuse prevention
Anti-spam service (reCAPTCHA) Browser and device signals, mouse and keyboard interaction signals, IP address (sent to the provider) Spam and bot prevention on Contact form and Beta sign-up
Analytics service (only with consent) Anonymized pageview events, route changes, locale; no IP storage and no session recording Aggregate site usage analytics
Embedded map (only with consent) IP address and browser info (sent to the map provider when the Contact page office map loads) Display office location

The current list of providers behind these sources, with their roles, locations, and transfer mechanisms, is published at /sub-processors.

We do not knowingly collect special categories of personal data (race, religion, political opinion, health, sexual orientation, etc.). We do not knowingly collect data from children — see §10.

3.3 Data we do not collect

  • Payment card information (we do not process payments on this Website).
  • Government-issued identifiers (resident registration number, passport number, driver licence, etc.).
  • Biometric data.
  • Precise geolocation data (we use only coarse country-level signals derived from IP for compliance).

We process personal data on the following lawful grounds.

Purpose Data used GDPR legal basis PIPA legal basis
Respond to your business inquiry Contact form data Art. 6(1)(b) pre-contractual steps + Art. 6(1)(f) legitimate interest in business communications Article 15 §1.4 — necessary to fulfil contract, supplemented by consent at submission
Send the APiM Insights newsletter Email address, locale, optional name Art. 6(1)(a) consent Article 15 §1.1 — consent of the data subject
Operate and secure the Website Server access logs, security cookies, anti-spam signals Art. 6(1)(f) legitimate interest in service security and integrity Article 15 §1.6 — legitimate interests of the controller (security, fraud prevention)
Measure aggregate Website usage Analytics events (post-consent) Art. 6(1)(a) consent Article 15 §1.1 — consent
Show office location map Embedded map (post-consent) Art. 6(1)(a) consent Article 15 §1.1 — consent
Comply with legal obligations Records as required by law Art. 6(1)(c) legal obligation Article 15 §1.2 — required by law

Consent withdrawal: You may withdraw consent at any time by emailing navigate@apieceofmap.com or by clicking "Unsubscribe" in any newsletter. Withdrawal does not affect the lawfulness of processing before the withdrawal.

PIPA separate consent: Where Korean law requires separate consent for distinct processing categories (e.g., marketing, international transfers), we present those choices individually rather than as a single blanket consent.

5. Retention Periods

Data Retention
Contact inquiries — unconverted leads Up to 3 years from last contact, then deleted
Contact inquiries — active client relationship Contract term + 5 years after termination (Korean Commercial Code Article 33)
Newsletter subscribers — active Until unsubscribe
Newsletter subscribers — after unsubscribe 12 months for suppression and re-consent records, then permanent deletion
Cookie consent records (browser storage) 12 months, after which renewed consent is requested
Server access logs Short rolling retention by our hosting provider (typically 30 days), then deleted
Analytics events (anonymized) 12 months rolling, then deleted
Anti-spam verification logs Processed transiently by the provider; we retain only a pass/fail outcome

After the applicable period, data is irreversibly deleted or fully anonymized.

6. Who We Share Data With (Sub-processors)

We share personal data only with sub-processors acting on our behalf under written Data Processing Agreements (DPAs), for the following categories of services:

  • Website hosting and content delivery — to serve apieceofmap.com to your browser;
  • Authoritative DNS — to resolve our domain name to our origin server;
  • Newsletter and content management — to deliver the APiM Insights newsletter and host article content;
  • Transactional email — to send auto-replies, admin notifications, and inquiry confirmations;
  • Anonymized website analytics — to measure aggregate site usage (only with your consent);
  • Anti-spam and embedded map services — to prevent abuse of our forms and (with your consent) display our office location.

We do not sell personal data, and we do not use your data for advertising retargeting or to train AI or machine-learning models.

The current list of sub-processors — including each recipient's identity, role, primary processing location, and applicable transfer mechanism — is published at /sub-processors and is updated whenever our stack materially changes. Keeping the operational list on a separate page lets us reflect changes promptly without re-versioning this Policy.

7. International Data Transfers

Because some of our sub-processors operate outside the Republic of Korea and the EU / EEA, your personal data may be transferred across borders.

7.1 GDPR — transfers from the EU / EEA / UK

We rely on the following safeguards:

  • EU-US Data Privacy Framework for certified U.S. recipients, where applicable;
  • Standard Contractual Clauses (Module 2 — controller to processor) where the Framework does not apply;
  • Supplementary measures including encryption in transit (TLS 1.2+) and least-privilege access controls;
  • For our analytics service, EU users' data remains in the European Union and is not transferred outside the EU.

The specific recipients, countries, and transfer mechanisms applicable to each service are listed at /sub-processors.

7.2 PIPA — transfers from the Republic of Korea

In line with PIPA Article 28-8 (overseas transfer notification):

  • Recipients, countries of transfer, purposes, and data items: published at /sub-processors and kept current as our stack changes;
  • Retention by recipient: as specified in each recipient's DPA, not exceeding the retention periods in §5 above;
  • Refusal right: you may refuse the transfer by not submitting forms, not subscribing to the newsletter, and rejecting non-essential cookies. Refusal after submission can be exercised by contacting us; some Website features may then become unavailable.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data.

Right What it means Applicable jurisdictions
Access Receive a copy of the personal data we hold about you PIPA, GDPR, UK GDPR, CCPA/CPRA
Rectification Correct inaccurate or incomplete data PIPA, GDPR, UK GDPR
Erasure Request deletion ("right to be forgotten") GDPR, UK GDPR; PIPA (request to cease processing)
Restriction Ask us to pause processing GDPR, UK GDPR
Portability Receive your data in a machine-readable format GDPR, UK GDPR, PIPA Article 35-2
Objection Object to processing based on legitimate interest, or to direct marketing GDPR, UK GDPR
Withdrawal of consent Revoke previously granted consent PIPA, GDPR, UK GDPR
Non-automated decisions We do not subject you to automated decisions producing legal effects GDPR Art. 22; PIPA Art. 37-2
Opt-out of sale or sharing We do not sell or share personal data for cross-context behavioural advertising CCPA/CPRA

8.1 How to exercise your rights

Email navigate@apieceofmap.com with subject line "Privacy Request — [Access / Delete / Correct / Object / …]".

We respond within:

  • 10 days under PIPA (Enforcement Decree Article 41), extendable once with notice;
  • 30 days under GDPR / UK GDPR, extendable by an additional 60 days for complex requests with notice;
  • 45 days under CCPA/CPRA, extendable by an additional 45 days with notice.

We may ask for reasonable verification of identity to prevent unauthorized requests, in line with PIPA Enforcement Decree Article 41.

8.2 Right to lodge a complaint

You may also contact the supervisory authority in your jurisdiction:

9. Security

We apply organizational, technical, and physical measures appropriate to the risk of processing.

  • Encryption in transit: TLS 1.2 or higher for all Website traffic;
  • Encryption at rest: applied at the sub-processor layer;
  • Access control: least-privilege role assignments; multi-factor authentication for administrator accounts;
  • Vulnerability management: regular dependency updates and patching cycles;
  • Anti-spam: industry-standard anti-spam service plus honeypot field on public forms;
  • Logging and monitoring: server access logs reviewed for anomalous activity;
  • Retention discipline: automated and manual deletion routines aligned with §5.

No system is completely secure. If we become aware of a personal data breach affecting your data, we will notify the relevant supervisory authority and, where required, affected individuals:

  • Within 72 hours of becoming aware (GDPR Article 33 / 34);
  • Without delay (PIPA Article 34) and, for breaches of 1,000 or more data subjects, within 72 hours of becoming aware.

10. Children

The Website is a B2B platform and is not directed to children. We do not knowingly collect personal data from:

  • Children under 14 years of age (Republic of Korea, under PIPA Article 22-2);
  • Children under 16 years of age (EU / EEA, under GDPR Article 8);
  • Children under 13 years of age (United States, under COPPA).

If you believe we have inadvertently collected such data, please contact navigate@apieceofmap.com for prompt deletion.

11. Cookies

Our use of cookies and similar technologies is described in the Cookie Policy. The cookie banner appears on first visit and lets you accept or reject non-essential cookies (analytics, embedded map). You can change your choice at any time via the "Cookie Preferences" link in the Website footer.

12. Automated Decisions and Profiling

We do not use the Website's personal data to make automated decisions producing legal or similarly significant effects. Analytics events are aggregated and not used to make individual decisions.

13. AI and Machine Learning

We do not use personal data submitted through this Website to train artificial-intelligence or machine-learning models. This applies to Contact form content, newsletter subscriber lists, and analytics events alike. We honour standard signals (robots.txt directives, noai and noimageai meta tags) to discourage unauthorized scraping for AI training, and our Terms of Service §3 prohibit such use.

14. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, services, or legal requirements. When we do, we will:

  • Update the "Last Updated" and, where applicable, "Effective Date" at the top of this page;
  • For material changes that affect your rights or our processing, publish a banner notice on apieceofmap.com and, where appropriate, notify active newsletter subscribers by email.

Prior versions are archived and available on request.

15. Governing Law and Jurisdiction

This Policy is governed by the laws of the Republic of Korea. Any dispute arising out of or relating to this Policy is subject to the exclusive jurisdiction of the Seongnam Branch of Suwon District Court, Republic of Korea.

Nothing in this clause limits the mandatory consumer-protection rights of EU / EEA, UK, or other data subjects under the laws of their country of residence.

16. Contact

For any privacy question or to exercise your rights, please contact us:

  • Email: navigate@apieceofmap.com
  • Subject prefix: "Privacy Request — …"
  • Post: A Piece of Map Inc., 4,5F Greits Pangyo, 117 Bundangnaegok-ro, Bundang-gu, Seongnam-si, Gyeonggi-do 13529, Republic of Korea

This Policy is published in English. A Korean translation may be made available; in case of any discrepancy with the Korean version under matters of Korean law, the Korean version prevails. For all other purposes, the English version is authoritative.