In accordance with Article 30 of the Personal Information Protection Act, the company(hereinafter referred to as the "Company") establishes and discloses the following personal information processing guidelines in order to protect the personal information of data subjects and to promptly and smoothly process complaints related thereto.
Article 1 (Purpose of Processing Personal Information)
The company processes personal information for the following purposes. Personal information being processed will not be used for purposes other than the following, and if the purpose of use changes, necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act will be implemented.
1. Website membership registration and management
Personal information is processed for the purposes of confirming membership registration, identifying and authenticating the user in accordance with the provision of membership services, maintaining and managing membership qualifications, verifying the user’s identity in accordance with the implementation of the limited user identification system, preventing unauthorized use of services, verifying the consent of the legal representative when processing personal information of children under the age of 14, and handling various notifications, notices, and complaints
2. Provision of goods or services
We process personal information for the purposes of delivering goods, providing services, sending contracts and invoices, providing content, providing customized services, verifying identity, verifying age, paying and settling fees, and collecting debts.
3. Complaint Handling
Personal information is processed for the purposes of verifying the identity of the complainant, verifying the complaint, contacting and notifying for fact-finding, and notifying the processing results.
Article 2 (Processing and retention period of personal information)
①
The company processes and retains personal information within the retention and use period of personal information stipulated by law or within the retention and use period of personal information agreed upon by the information subject when collecting personal information.
② The processing and retention periods for each personal information are as follows.
1. Website membership registration and management: Until withdrawal from the business/organization website
However, in the following cases, until the end of the reason
1) In the case of an investigation or inquiry due to violation of relevant laws and regulations, until the end of the investigation or inquiry
2) In the case of remaining claims and debts due to website use, until the settlement of the claims and debts
2. Provision of goods or services: Until the completion of the supply of goods or services and completion of payment and settlement of fees. However, in the following cases, until the end of the relevant period.
1) 「Records of transactions such as display and advertisement, contract contents and performance according to the 「Act on Consumer Protection in Electronic Commerce, etc.」
- Records of display and advertisement: 6 months
- Records of contract or subscription withdrawal, payment, supply of goods, etc.: 5 years
- Records of consumer complaints or dispute resolution: 3 years
2) Retention of communication fact confirmation data according to Article 41 of the 「Communications Secrets Protection Act」
- Subscriber telecommunication date and time, start and end time, other party subscriber number, number of uses, base station location tracking data: 1 year
- Computer communication, Internet log records, access location tracking data: 3 months
Article 3 (Provision of personal information to third parties)
① The company processes the personal information of the data subject only within the scope specified in Article 1 (Purpose of processing personal information), and provides personal information to a third party only in cases that fall under Article 17 of the Personal Information Protection Act, such as consent from the data subject or special provisions of the law..
② The company provides personal information to third parties as follows.
- Recipient of personal information:
- Purpose of use of personal information by recipient:
- Personal information items provided:
- Retention and use period by recipient:
Article 4 (Entrustment of personal information processing)
①
In order to process personal information smoothly, the company entrusts the processing of personal information as follows.
- Trustee (Trustee): OOO Co., Ltd.
- Contents of the entrusted work: Provision of a system for shopping mall hosting services, mobile app services, marketing services and additional, affiliated services, and notification talk, friend talk, text message sending agency services, etc.
- Trustee (Trustee): OOO PG
- Contents of entrusted work: Payment and escrow work
- Consignee (Consignee): OOO Courier
- Contents of entrusted work: Product delivery work
- Trustee (Trustee): OOO Customer Center
- Contents of entrusted work: Customer service work
- Trustee (Trustee): OOO
- Contents of entrusted work: Identity verification work
② When concluding a consignment contract, the company states in a contract or other document matters related to responsibilities such as prohibition of processing personal information for purposes other than the performance of the consigned work, technical and administrative protection measures, restrictions on re-consignment, management and supervision of the consignee, and compensation for damages in accordance with Article 25 of the Personal Information Protection Act, and supervises whether the consignee safely processes personal information.
③ If the content of the entrusted work or the trustee changes, we will disclose it without delay through this personal information processing policy.
Article 5 (Rights of users and legal representatives and methods of exercising them)
① The data subject may exercise the following personal information protection rights against the company at any time.
1. Request to view personal information
2. Request for correction in case of errors, etc.
3. Request for deletion
4. Request for suspension of processing
② The rights under Article 1 may be exercised against the Company through writing, telephone, e-mail, facsimile transmission (FAX), etc., and the Company will take action without delay.
③ If the data subject requests correction or deletion of personal information due to errors, etc., the company will not use or provide the personal information until correction or deletion is completed.
④ The rights under Article 1 may be exercised through a proxy, such as the data subject's legal representative or authorized person. In this case, a power of attorney in the format of Appendix 11 of the Enforcement Regulations of the Personal Information Protection Act must be submitted.
⑤
The data subject must not infringe upon the personal information or privacy of the data subject or others that the company is processing in violation of the Personal Information Protection Act or other related laws.
Article 6 (Items of personal information being processed)
The company is processing the following personal information items.
1. Website membership registration and management
Required items:
Optional items:
2. Provision of goods or services
Required items:
Optional items:
3. The following personal information items may be automatically generated and collected during the use of Internet services: IP address, cookies, MAC address, service usage history, visit history, bad usage history, etc.
Article 7 (Destruction of personal information)
①
The company destroys personal information without delay when the personal information becomes unnecessary, such as when the retention period for personal information expires or the processing purpose is achieved.
② In cases where the retention period for personal information agreed upon by the data subject has expired or the processing purpose has been achieved, but personal information must be retained in accordance with other laws and regulations, the personal information is transferred to a separate database (DB) or stored in a different location.
③ The procedures and methods for destroying personal information are as follows:
1. Destruction Procedure
The company selects personal information for which a reason for destruction has occurred and destroys the personal information after receiving approval from the company's personal information protection officer.
2. Destruction Method
The company destroys personal information recorded and stored in electronic file formats using methods such as low-level formatting so that the records cannot be reproduced, and destroys personal information recorded and stored in paper documents by shredding or incineration.
Article 8 (Measures to ensure the safety of personal information)
The company is taking the following measures to ensure the safety of personal information.
1. Administrative measures: Establishment and implementation of an internal management plan, regular employee training, etc.
2. Technical measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, etc., installation of security programs
3. Physical measures: Access control to computer rooms, data storage rooms, etc.
Article 9 (Matters concerning installation/operation and refusal of automatic personal information collection devices)
① The company uses ‘cookies’ to store and periodically retrieve usage information in order to provide personalized services to users.
②
Cookies are small pieces of information that the server (http) used to operate the website sends to the user's computer browser and may also be stored on the user's computer's hard disk.
A. Purpose of cookie use: Used to provide optimized information to users by identifying the visit and usage patterns, popular search terms, and whether or not the user has accessed each service and website.
B. Installation/operation and rejection of cookies: You can reject cookie storage by setting options in the Tools>Internet Options>Privacy menu at the top of the web browser.
C. If you reject cookie storage, you may experience difficulties using customized services.
Article 10 (Personal Information Protection Manager)
① The company is responsible for overall management of personal information processing, and has designated a personal information protection officer as follows to handle complaints and provide remedies to data subjects related to personal information processing.
▶ Personal Information Protection Officer
Name: OOO
Position: OOO
Contact: , ,
※ Connected to the Personal Information Protection Department
▶ Personal Information Protection Department
Department Name: OOO Team
Person in Charge: OOO
Contact: , ,
② The information subject may inquire about all personal information protection-related matters, such as complaints, damage relief, etc., that arise while using the company's services (or business) to the personal information protection officer and the department in charge. The company will respond to and process the information subject's inquiries without delay.
Article 11 (Request to view personal information)
The data subject may request to view personal information in accordance with Article 35 of the Personal Information Protection Act to the department below. The company will endeavor to promptly process the data subject's request to view personal information.
▶ Personal Information Access Request Reception and Processing Department
Department Name: OOO
Person in Charge: OOO
Contact: , ,
Article 12 (Methods of Redress for Infringement of Rights)
Data subjects may inquire about redress for damages and consultations for infringement of personal information to the following institutions.
▶ Personal Information Infringement Report Center (Operated by Korea Internet & Security Agency)
- Responsibilities: Reporting personal information infringement, requesting consultation
- Website: privacy.kisa.or.kr
- Phone: (without area code) 118
- Address: (58324) 3rd floor, Personal Information Infringement Report Center, 9 Jinheung-gil, Naju-si, Jeollanam-do (301-2 Bitgaram-dong)
▶ Personal Information Dispute Mediation Committee
- Responsibilities: Personal Information Dispute Mediation Application, Group Dispute Mediation (Civil Resolution)
- Website: www.kopico.go.kr
- Phone: (without area code) 1833-6972
- Address: (03171) 4th floor, Government Seoul Building, 209 Sejong-daero, Jongno-gu, Seoul
▶ Supreme Prosecutors' Office Cyber Crime Investigation Division: 02-3480-3573 (www.spo.go.kr)
▶ National Police Agency Cyber Safety Bureau: 182 (http://cyberbureau.police.go.kr)
Article 13 (Implementation and Change of Personal Information Processing Policy) This personal information processing policy is effective from 20XX. X. X.
