Company name (hereinafter referred to as the “Company”) hereby establishes and publishes the following personal information processing policy, pursuant to Article 30 of the Personal Information Protection Act, in order to protect the personal information of data subjects and to handle related complaints promptly and smoothly.
Article 1 (Purposes of Processing Personal Information)
The Company processes personal information for the following purposes. The personal information being processed will not be used for any purpose other than those listed below. If the purpose of use changes, the Company will take the necessary measures, such as obtaining separate consent pursuant to Article 18 of the Personal Information Protection Act.
1. Website membership registration and management
Personal information is processed for purposes such as confirming the intent to register, identifying and authenticating members for the provision of member services, maintaining and managing membership status, verifying identity under the limited identity verification system, preventing fraudulent use of services, confirming the consent of a legal guardian when processing the personal information of children under the age of 14, sending various notices and notifications, and handling complaints.
2. Provision of goods or services
Personal information is processed for purposes such as delivery of goods, provision of services, sending of contracts and invoices, provision of content, provision of customized services, identity verification, age verification, payment and settlement of fees, and debt collection.
3. Handling of complaints
Personal information is processed for purposes such as verifying the identity of complainants, confirming the details of complaints, contacting and notifying them for fact-finding, and notifying them of the results.
Article 2 (Processing and Retention Period of Personal Information)
① The Company processes and retains personal information within the retention and use period required by law or the retention and use period to which the data subject consented when the personal information was collected.
② The processing and retention period for each category of personal information is as follows.
1. Website membership registration and management: Until withdrawal from the business/organization website
However, in the following cases, until the relevant reason ends:
1) If an investigation or inquiry into a violation of related laws is in progress, until that investigation or inquiry is concluded
2) If claims and obligations arising from use of the website remain outstanding, until those claims and obligations are settled
2. Provision of goods or services: Until the supply of goods or services and the payment and settlement of fees are complete
However, in the following cases, until the relevant period ends:
1) Records on transactions, such as labeling and advertising, contract details, and performance, under the “Act on the Consumer Protection in Electronic Commerce, etc.”
- Records on labeling and advertising: 6 months
- Records on contracts or withdrawal of offers, payment, and supply of goods, etc.: 5 years
- Records on consumer complaints or dispute resolution: 3 years
2) Retention of communication confirmation data under Article 41 of the “Protection of Communications Secrets Act”
- Subscriber's telecommunication date and time, start and end times, counterpart subscriber number, frequency of use, and location tracking data of the originating base station: 1 year
- Computer communication and internet log records, and access location tracking data: 3 months
Article 3 (Provision of Personal Information to Third Parties)
① The Company processes the personal information of data subjects only within the scope specified in Article 1 (Purposes of Processing Personal Information). The Company provides personal information to third parties only in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as with the consent of the data subject or under special provisions of law, and does not otherwise provide the personal information of data subjects to third parties.
② To ensure smooth service delivery, the Company may provide personal information to third parties in the following cases, with the consent of the data subject pursuant to Article 17, Paragraph 1, Subparagraph 1 of the Personal Information Protection Act and only to the minimum extent necessary.
- Recipient of personal information: <e.g., OOO Card Co., Ltd.>
- Recipient's purpose of use: <e.g., Business partnership such as co-hosting events and issuing co-branded credit cards>
- Items of personal information provided: <e.g., Name, address, phone number, email address, card payment account information>
- Recipient's retention and use period: <e.g., For the duration of the transaction under the credit card issuance agreement>
Article 4 (Entrustment of Personal Information Processing)
① To ensure smooth handling of personal information, the Company entrusts the processing of personal information as follows.
- Details of entrusted work
- Entrusted party (processor): Imweb Co., Ltd.
- Description of entrusted work: Providing the system for online store hosting services, mobile app services, marketing services and additional or affiliated services, sending messages on our behalf (Alimtalk, Friendtalk, and text messages), sales channel order integration services, etc.
- Entrusted party (processor): OOO PG
- Description of entrusted work: Payment and escrow services
- Entrusted party (processor): OOO Courier
- Description of entrusted work: Product delivery
- Entrusted party (processor): OOO Customer Center
- Description of entrusted work: Customer consultation
- Entrusted party (processor): OOO
- Description of entrusted work: Identity verification
- **Sub-entrusted parties**
- **Sub-entrusted party (processor): Imweb Co., Ltd. → Infobip LLC**
- **Description of entrusted work: Sending text messages and KakaoTalk Alimtalk (informational messages)**
- **Sub-entrusted party (processor): Imweb Co., Ltd. → Lunasoft Co., Ltd.**
- **Description of entrusted work: Sending text messages and KakaoTalk Alimtalk (informational messages) and Friendtalk**
② When entering into an entrustment agreement, in accordance with Article 25 of the Personal Information Protection Act, the Company specifies in writing matters such as the prohibition of processing personal information for any purpose other than the entrusted work, technical and managerial safeguards, restrictions on sub-entrustment, supervision of the processor, and liability for damages, and supervises whether the processor handles personal information securely.
③ If the details of the entrusted work or the processor change, the Company will promptly disclose the change through this Privacy Policy.
Article 5 (Rights of Data Subjects and Legal Representatives and How to Exercise Them)
① Data subjects may exercise the following rights relating to personal information protection against the Company at any time.
1. Request access to personal information
2. Request correction of any errors
3. Request deletion
4. Request suspension of processing
② The rights under Paragraph 1 may be exercised against the Company in writing, by phone, by email, or by fax, and the Company will take action without delay.
③ If a data subject requests correction or deletion of an error in their personal information, the Company will not use or provide that personal information until the correction or deletion is completed.
④ The rights under Paragraph 1 may be exercised through an agent, such as the data subject's legal representative or a person authorized by the data subject. In this case, you must submit a power of attorney using Form No. 11 of the Enforcement Rules of the Personal Information Protection Act.
⑤ Data subjects must not infringe upon the personal information or privacy of themselves or others that the Company is processing, in violation of the Personal Information Protection Act and other relevant laws and regulations.
Article 6 (Personal Information Items Processed)
The Company processes the following personal information items.
1. Website membership registration and management
Required items: <e.g., name, date of birth, user ID, password, address, phone number, gender, email address, i-PIN number>
Optional items: <e.g., marital status, areas of interest>
2. Provision of goods or services
Required items: <e.g., name, date of birth, user ID, password, address, phone number, email address, i-PIN number, payment information such as credit card number and bank account details>
Optional items: <areas of interest, past purchase history>
Article 7 (Destruction of Personal Information)
① When personal information becomes unnecessary, such as when the retention period has expired or the purpose of processing has been achieved, the Company destroys that personal information without delay.
② If personal information must continue to be retained under other laws and regulations even though the retention period consented to by the data subject has expired or the purpose of processing has been achieved, the Company moves that personal information to a separate database (DB) or stores it in a different location.
③ The procedure and method for destroying personal information are as follows.
1. Destruction procedure
The Company selects the personal information for which grounds for destruction have arisen and destroys it with the approval of the Company's Chief Privacy Officer.
2. Destruction method
Personal information recorded and stored in electronic file format is destroyed in such a way that the records cannot be recovered, and personal information recorded and stored on paper documents is destroyed by shredding or incineration.
Article 8 (Measures to Ensure the Security of Personal Information)
The Company takes the following measures to ensure the security of personal information.
1. Administrative measures: Establishing and implementing an internal management plan, regular employee training, etc.
2. Technical measures: Managing access rights to personal information processing systems, installing access control systems, encrypting unique identification
information, etc., and installing security programs
3. Physical measures: Controlling access to computer rooms, data storage rooms, etc.
Article 9 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)
① To provide users with individually customized services, the Company uses “cookies,” which store usage information and retrieve it from time to time.
② Cookies are small amounts of information that the server (http) used to operate a website sends to the user's computer browser, and they are stored on the user's PC or mobile device.
③ Data subjects can allow or block cookies through their web browser settings. However, if you refuse to store cookies, you may have difficulty using customized services.
▶ Allowing/blocking cookies in your web browser
- Chrome: Browser settings > Privacy and security > Clear browsing data
- Edge: Browser settings > Cookies and site permissions > Manage and delete cookies and site data
▶ Allowing/Blocking Cookies in Mobile Browsers
- Chrome: Mobile browser Settings > Privacy and security > Clear browsing data
- Safari: Mobile device Settings > Safari > Advanced > Block All Cookies
- Samsung Internet: Mobile browser Settings > Browsing history > Delete browsing history
④ The Company collects and uses information on the services and websites that users visit, including visit and usage patterns, popular search terms, and whether a secure connection is used, in order to provide users with optimized information.
Article 10 (Chief Privacy Officer)
① The Company is responsible for overseeing all matters relating to personal information processing. To handle complaints from data subjects and provide remedies for damages related to personal information processing, the Company has designated a Chief Privacy Officer as below.
▶ Chief Privacy Officer
Name: OOO
Title: OOO
Contact: <phone number>, <email>, <fax number>
※ You will be connected to the privacy protection department.
▶ Privacy Protection Department
Department: OOO Team
Contact: <phone number>, <email>, <fax number>
② Data subjects may direct all inquiries, complaints, and requests for remedies related to personal information protection that arise while using the Company's services (or business) to the Chief Privacy Officer and the responsible department. The Company will respond to and process data subjects' inquiries without delay.
Article 11 (Requests to Access Personal Information)
Data subjects may submit a request to access their personal information under Article 35 of the Personal Information Protection Act to the department below. The Company will make every effort to process such requests promptly.
▶ Department Handling Requests to Access Personal Information
Department: OOO
Contact: <phone number>, <email>, <fax number>
Article 12 (Remedies for Infringement of Rights)
Data subjects may contact the agencies below for remedies, counseling, and other assistance regarding personal information infringement.
1. Personal Information Dispute Mediation Committee: 1833-6972 (no area code) (www.kopico.go.kr)
2. Personal Information Infringement Report Center: 118 (no area code) (privacy.kisa.or.kr)
3. Supreme Prosecutors' Office: 1301 (no area code) (www.spo.go.kr)
4. National Police Agency: 182 (no area code) (ecrm.police.go.kr/minwon/main)
Article 13 (Enforcement and Amendment of the Privacy Policy)
This Privacy Policy applies from 20XX. X. X.
