Personal Information Processing Policy

The Company will handle personal information for the following purposes. The personal information which is being processed will not be used for any other purpose than the purposes described below. If the purpose of use is changed, required measures will be taken such as obtaining additional consent based on Article 18 of “Personal Information Protection Act.”

1. Provision of service

   Personal information is handled for the purposes of providing services, contents, and customized services.

2. Resolving issues

   Personal information is handled for the purposes of identifying the person filing the appeal, confirming the appeal details, contacting the person to investigate factual grounds, and sending notices and result notifications.

3. The Company handles personal information for the purpose of “implementing tasks which require handling of personal information.”

①With regard to handling and retention of personal information, the Company retains and/or uses personal information for a period prescribed by law or duration of retention and/or use consented by the information provider at the time of collecting personal information.

②The handling and retention period of personal information are as follows.

①The information provider can exercise one’s rights at any time by making requests to the Company related to viewing, correcting, deleting, suspending the processing of the personal information.

②When exercising the rights based on Paragraph 1, a request can be made to the Company via written statement, email, or fax as per Article 41 Paragraph 1 of the Enforcement Ordinance of the Personal Information Protection Act and the Company will take relevant measures immediately.

③When exercising the rights based on Paragraph 1, this action can be taken by a representative including the legally acceptable representative or a delegated person of the information provider. In this case, a power of attorney must be submitted using the Appendix Form No. 11 of “Notification related to handling personal information (No. 2020-7).”

④Based on Article 35 Paragraph 4 and Article 37 Paragraph 2 of the Personal Information Protection Act, the information provider’s rights may be restricted when making a request to suspend the access and handling of personal information.

⑤Request for correction and deletion of personal information may not be processed if the applicable personal information is subject to collection as prescribed by other laws.

⑥The Company checks the legitimacy of the person or a representative making a request involving access, correction, deletion, and suspension of information processing based on the rights of the information provider.

The Company handles the following personal information.

The following personal information may be automatically generated and collected when using the internet service.

• Accessed IP address, cookies, record of service use, login access

①The Company immediately destroys the applicable personal information when it is no longer required including when the personal information retention period has passed or purpose of handling the personal information has been fulfilled.

②If the retention of personal information has to be continued due to other laws even though the personal information retention period consented by the information provider has passed or purpose of handling the personal information has been fulfilled, the personal information is transferred to a different database (DB) or retained in a different location.

1. Rationale based on the law
2. Retained personal information: Name, email address, company name

The procedures and methods of destroying personal information are as follows.

1. Destroying procedure

   The Company chooses the personal information with reasons to be destroyed and destroys the personal information after obtaining approval from the personal information protection manager at the Company.

2. Destroying method

   The Company destroys personal information recorded and saved in electronic form so that it cannot be regenerated and destroys personal information recorded and saved in paper form by incinerating it or shredding it using a paper shredder.

The Company is taking the following measures to secure safety of personal information.

1. Measures related to management : internal management plans are established and implemented; employee training is conducted regularly, etc.
2. Measures related to technology : Authorization for personal information processing system is managed, access control system is installed, identifiable information is encrypted, and security system are installed.
3. Physical measures : System is installed for areas restricted from external access.

①The Company has designated a department responsible for personal information protection as below to take general responsibility for duties related to handling personal information and processing complaints from the information provider and mitigating damages related to handling of personal information.

②The information provider may submit inquiries to the personal information protection manager and/or department in charge pertaining to any questions related to personal information protection, processing of complaints, and relief of damages while using the Company’s service (or business). The Company will respond to the information provider’s inquiry and take appropriate action immediately.

The information provider may submit a request to the department below to access personal information based on Article 35 of “Personal Information Protection Act.” The Company will strive to process the information provider’s request to access personal information as soon as possible.

The information provider may submit a request related to resolving disputes or consultations to the Personal Information Dispute Mediation Committee, KISA Personal Information Infringement Reporting Center to receive relief from infringement on personal information rights. For other reports related to personal information infringement, please contact the institutions below.

1. Personal Information Dispute Mediation Committee: (Without area code) 1833-6972 (www.kopico.go.kr)
2. Personal Information Infringement Reporting Center: (Without area code) 118 (privacy.kisa.or.kr)
3. Supreme Prosecutors’ Office: (Without area code) 1301 (www.spo.go.kr)
4. National Police Agency: (Without area code) 182 (cyberbureau.police.go.kr)

If a person’s right or benefit has been infringed due to disposition or nonfeasance by the head of government office related to a request based on Article 35 (access of personal information), Article 36 (Correction and/or deletion of personal information), and Article 37 (Suspension of personal information processing, etc.) of the “Personal Information Protection Act,” he/she may file an administrative appeal as defined by the Administrative Appeals Act.

※ For more information on administrative appeals, please visit the website, Central Administrative Appeals Commission (www.simpan.go.kr)

①This Personal Information Processing Policy is effective from March 1, 2022.