PRIVACY · KOREA

Korea (PIPA): Delegation, Not Transfer

For clients in South Korea, our model is aligned with the Personal Information Protection Act (PIPA). Our approach uses the legal framework of “delegation” of data-processing tasks — not a transfer of control.

Controller and trustee

Under PIPA, when a client uses our infrastructure services, you are considered the “information handler” (the data controller), and we act as the “trustee” (the data processor) — acting solely on your behalf and under your instructions.

How delegation works

Processes are delegated. PIPA permits the “delegation of processing or storage” without separate consent from data subjects where the arrangement is necessary to perform the service and the details are disclosed in the privacy policy. Our service fits this definition of “delegation” — not a transfer of control.

You retain supervisory rights. Our agreement specifies the purpose and scope of our work, and it permits you to supervise our compliance — a requirement under PIPA.

Written agreement and disclosure. We will execute a written agreement that meets PIPA requirements — including processing scope, security measures, and supervision arrangements. We will also work with you to ensure the required public notices are made, as PIPA requires disclosure of the outsourcing arrangement.

Control stays with you

We build and maintain your datacenter, but as the data controller you retain full, exclusive control over the VMs and data. This mirrors our standard model — every server we deploy is owned by the client, and access is governed through Kratos, our access platform.

This page describes how Vavelio’s service model relates to PIPA as we understand it. It is provided for information and is not legal advice. Clients should seek qualified counsel for their specific circumstances.

Last updated: August 2026

Loading…