This list forms part of Section 7 of the Theori Privacy Policy and has the same effect as the policy itself. It is published under Article 26(2) (disclosure of processing entrustment) and Article 28-8(2) (disclosure for cross-border transfers) of the Korean Personal Information Protection Act, and satisfies the recipient disclosure required by GDPR Art. 13(1)(e) and the CCPA.
When a service provider is added or changed, we update this list and record the change in the revision history on the Previous Policies page.
The sub-processors that process Customer Data are listed separately on our Trust Center, as provided in Section 7 of the DPA.
Questions about this list, or about a specific provider on it, go to privacy@theori.io. Each provider's own privacy notice is available from that provider; we will point you to it on request.
Last updated: August 13, 2026
1. Service Providers Processing Data in Korea
The following service providers process personal data within the Republic of Korea. We do not ourselves transfer this data outside Korea. Where a provider engages its own sub-processors or transfers data overseas to operate its service, we treat those third parties as subject to disclosure under Article 26(2) of the Personal Information Protection Act and add them to this list as they are identified.
1. Service Providers Processing Data in Korea
Service Provider
Processing Activities
Applicable Service
Amazon Web Services Korea LLC
Cloud infrastructure and data storage (Seoul Region)
Xint Web, aprism, Dreamhack, ChainLight
NICE Information Service Co., Ltd.
Mobile identity verification services
Dreamhack
Viva Republica, Inc. (Toss)
Payment processing services
Dreamhack
Korea Post
Delivery of CTF prizes and event rewards
Dreamhack
Kakao Corporation
Delivery of CTF prizes and event rewards
Dreamhack
Channel Corporation
Customer support (live chat)
Xint Web
inblog Inc.
Corporate blog platform operation and blog usage analytics
Theori blog
Doodlin Inc. (GreetingHR)
Recruitment application intake and hiring management
Theori careers site
2. Overseas Service Providers and Cross-Border Transfers
The following providers are organized by function. Each acts on our documented instructions under a written agreement requiring appropriate security measures.
Why some providers show "Republic of Korea" as the destination. Where a single function uses both Korean and overseas providers (for example, AWS Seoul and AWS US regions for cloud infrastructure), we list them side by side so you can see the actual data flow. Providers whose destination is the Republic of Korea are not cross-border transfers.
Advertising and marketing providers are engaged only where you have given prior consent — see our Cookie Policy.
(a) Inter-Entity Transfers (Theori Korea ↔ Theori, Inc.)
(a) Inter-Entity Transfers (Theori Korea ↔ Theori, Inc.)
Transfer Direction
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Korea → US
Theori, Inc.
United States
Personal data related to product inquiries
Overseas business entity (Theori, Inc.) operations
1 year after inquiry resolution
US → Korea
Theori Korea
Republic of Korea
Personal data related to product inquiries
Processing by Korea-based group security/support functions
1 year after inquiry resolution
(b) Cloud Infrastructure
(b) Cloud Infrastructure
Recipient
Destination Country
Data Transferred
Purpose
Retention Period
Amazon Web Services Korea LLC
Republic of Korea (Seoul)
Service data
Cloud infrastructure and data storage
Until service agreement terminates
Amazon Web Services, Inc.
United States (Virginia)
Service data
Cloud infrastructure and data storage
Until service agreement terminates
Webflow, Inc.
United States
Website access information
xint.io landing page hosting
Until service agreement terminates
When Korean users access Xint Code, data is transferred to the United States (Virginia). When US users access Xint Web or aprism, data is transferred to Korea (Seoul).