Inisium Co., LTD. (hereinafter “Company”) values customers’ personal information highly and complies with laws, including the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc, the Protection of Consumers in e-commerce and Other Transactions Act, the Protection of Communication Secrets Act, the Telecommunications Business Act, the Personal Information Protection Act, and administrative guidelines issued by administrative agencies. The Company has also established the Guideline on Processing Personal Information in accordance with relevant statutes and protects the rights and interests of users. As the Company’s guideline on processing personal information may be changed, subject to changes in laws or guidelines related to the protection of personal information or the Company’s policies, customers are recommended to pay frequent visits to our website and check details. The Company’s Guideline on Processing Personal Information includes the following sections: 1. Personal Information Items Collected and Collection Method; 2. Purpose of Collecting and Using Personal Information; 3. Provision of Personal Information; 4. Outsourcing of Personal Information Processing; 5. Period of Retention and Use of Personal Information; 6. Procedure and Method for Destroying Personal Information; 7. Rights of Users and Legal Representatives and Methods for Exercising Their Rights; 8. Measures for Ensuring the Security of Personal Information; 9. Matters on the Installation and Operation of Personal Information Automatic Collection Devices (cookies) and Rejection of Cookies; 10. Chief Privacy Officer and Personal Information Handling Employees 11. Notices
1. Personal Information Items Collected and Collection Method;
A.Personal information items collected 1.The Company shall not collect any sensitive personal information which may lead to the infringement of human rights of users, including their race, ethnicity, ideas and creeds, place of birth and legal domicile, political orientations and criminal records, health status, and sexual life. 2.The Company shall collect and use the following essential personal information: 1)Verification of a user’s identity and his/her willingness to obtain membership - name, email address, password, cell phone number - corporate members: name of company, name of representative, business registration number, contact telephone number, place of workplace address, e-mail address, password, country of operation, cell phone number, secure password 2) Self-authentication for payments and funds withdrawals - name, date of birth, account number, a copy of an identification card (any remaining information masked except for date of birth), cell phone number, secure password. 3)Secure password initialization - name, e-mail address, cell phone number, a copy of an identification card (any remaining information masked except for date of birth), a facial photo 4)Prevention of use by fraudulent members and prevention of unauthorized use - users’ IP address and date and time of their visit to the Company’s website 5) Verification of users’ real name - name, date of birth, gender 3.The following information may be created and collected in the process of using or processing services: - Records on using services, payment records, records on the suspension and termination of services, access logs, cookies, users’ IP address, records on fraudulent or abnormal uses of services. B.Collection method The Company shall collect personal information through the following methods: - homepage, cell phone applications, cell phone web page, fax, telephone, consumer bulletin board, e-mail, and event application - Collection of personal information through a tool for collecting created information
2. Purpose of Collecting and Using Personal Information;
The Company shall collect and use customers’ personal information for the following purposes: A.Member management - Self-authentication for the use of membership-based services, verification of individuals’ identity - Prevention of use of services by fraudulent members and of unauthorized use - Verification of users’ willingness to obtain membership and limitation on membership and the number of obtaining membership - Identification of minors - Records retention for consulting with customers, acceptance and handling of customers’ complaints and disputes resolution - Delivery of notices B.Performance of agreements on the provision of services and payment of charges - Provision of services and contents, as well as tailored-made services - Payment and settlement of fees - Notification of the result of winning prizes at events/giveaways and delivery of products C.Use for marketing and advertisements - Providing optimized services for customers - Developing and specializing in new services (products) - Providing services and posting advertisements according to demographic traits - Identifying the frequency of access to the Company’s homepage - Statistics on the use of services - Mailing periodicals and offering guidance on new products or services - Planning web services and events that meet customers’ interests - Delivering information on advertisements, such as giveaways and events, and operation of member communities - Conducting customer questionnaire based survey
3. Provision of Personal Information;
The Company shall neither use nor provide customers’ personal information for any third party beyond the scope of which customers are notified upon collection of their information or the scope that is specified at the terms and conditions of the use of services, unless the customers agree or except for the following cases: A. Partnership: The Company may provide customers’ personal information for its partners or share such information with its partners for the provision of better services. In case the Company does the foregoing acts, individual customers shall be notified in advance of who are our partners, what kinds of personal information items are provided or shared and why such personal information should be provided or shared and until when such information should be protected and managed, either in writing or e-mail, and give their consent to the provision and sharing of their personal information. If customers do not agree, the Company shall neither provide for its partners nor share their personal information with its partners. If there is any change in or termination of the Company’s partnership, the Company shall notify customers of such change or termination or seek their consent through the same procedure as described above. B. Sale and merger and acquisition: If the Company sells its business, in whole or in part, or transfers and assumes the rights and obligations of any service roviders, due to mergers and inheritances, the Company shall be sure to notify customers of such mergers and inheritances to guarantee customers their right related to the protection of their personal information. C. Customers’ personal information is required for the performance of an agreement on the provision of services but it is significantly difficult to obtain customers’ ordinary consent due to economic and technological reasons. D. Customers’ personal information is required for payments of fees in return for services E. There is a special provision in other laws, such as the Protection of Communications Secrets Act, the Framework Act on National Taxes, the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc, the Act on Real Name Financial Transactions and Confidentiality, the Credit Information Use and Protection Act, the Framework Act on Telecommunications, the Telecommunications Business Act, the Local Tax Act, the Framework Act on Consumers, the Bank of Korea Act, the Criminal Procedure Act. However, even if there is a special provision in laws compelling the provision of customers’ personal information and customers’ personal information is requested by an administrative or investigation agency for administrative or investigative purposes, the Company shall not provide such personal information unconditionally but only do so in accordance with legal procedures, including by way of a writ or a written request affixed with a seal of head of such agency as stipulated in laws. F. A user inflicts mental and physical damage on others using the Company’s services and therefore, the Company has sufficient grounds to determine that such user’s personal information should be disclosed for the Company to take legal action against such infliction of harm.
4. Outsourcing of Personal Information Processing;
The Company may entrust the management of personal information to other entities to a limited extent to provide smooth and improved services. The following is a list of companies which are entrusted with the processing of personal information for the performance of service agreements with members. The Company stipulates matters required for the secure management of personal information upon execution of outsourcing agreements in accordance with relevant statutes. Verification of Outsourced Companies
Outsourced company Purpose of outsourcing Retention period
SUREM Co., Ltd. Send SMS Until the withdrawal of membership or the termination of outsourcing agreements or the time as stipulated by statutes
Nice information Service Simple verification of real names Do not Save Separately (Information of the certified service provider)
5. Period of Retention and Use of Personal Information;
A.Customers’ personal information shall be retained and used during a period when the Company provides services for customers. Upon a user’s withdrawal of membership, such user’s personal information shall be destroyed to ensure that his/her/its personal information is neither accessed nor used. However, if such user’s personal information needs to be retained in accordance with the provisions of relevant statutes, it shall be retained in accordance with the following provisions. Records on payments and the supply of goods: three (5) years - Records on payments and the supply of goods: three (5) years - Records on the handling of customers’ complaints and disputes: three (3) years B.If a customer demands access to transaction information that has been retained by the Company after obtaining the consent of such a customer, the Company shall immediately take a step to ensure that such information can be accessed and checked by such a customer. C.A customer may illegally or expediently receive economic benefits offered by the Company, such as discount coupons and event giveaways, or is likely to use another’s name by repeatedly re-obtaining and re-terminating membership after withdrawing his/her/its membership. Therefore, the Company shall retain members’ names, dates of birth, IDs, and passwords for one month after withdrawal of their membership for the purpose of preventing such illegal and expedient acts.
6. Procedure and Method for Destroying Personal Information;
Once the objectives of the collected personal information are fulfilled, "the Company" will destroy or store separately without hesitation said information according to the storage or usage terms. The process, time frame, and methods are as follows. A.Procedure and Timing for Destroying Personal Information The Company shall immediately destroy the personal information provided by customers to obtain membership after the purpose of using such information has been fulfilled, including termination of services, and a retention period of such information as stipulated by its internal guidelines and other relevant statutes (please, refer to the above period of retention and use of personal information) has elapsed. In general, if there is no remaining creditor and debtor relationship, the Company shall, upon withdrawal of membership, immediately delete any personal information that has been collected by the Company at the time of obtaining membership and afterwards managed in the form of electronic files. B.Destruction method Any person information printed out on papers shall be destroyed by being shredded through shredders or burnt or dissolved through chemical solutions and any personal information stored in electronic files shall be deleted through technological methods that cannot reproduce such files. C. Separate storage time frame and method As per the 'Personal information expiry system, a user account that has not used the service for 1 year will be switched to a dormant state. Dormant members' personal information are separately stored and managed with restricted access and security.
7. Rights of Users and Legal Representatives and Methods for Exercising Their Rights;
A. Users and legal representatives of children under fourteen years of age may, at any time, exercise the following rights to the personal information of themselves or such children that are registered at the Company. - Right to demand access to personal information - Right to demand correcting errors in personal information, if any - Right to demand the deletion of personal information - Right to demand the suspension of personal information processing B. Users and legal representatives of children under fourteen years of age may log into the Company’s homepage (www.inisium.com) and access or modify the personal information of themselves or such children in the Member’s Information Change menu or may do so by sending e-mails or written requests to a chief privacy officer at the Company. However, members’ ID and names may not be modified. C. Users and legal representatives of children under fourteen years of age may withdraw their consent to the ‘collection and use of personal information’ by e-mail, telephone or fax and in such case, shall reveal their or such children’s ID and e-mail address. D. If users and legal representatives of children under fourteen years of age request the correction and deletion of errors in their personal information, the Company shall neither use nor provide such personal information until such errors are corrected or deleted. The Company shall handle the personal information that is terminated or deleted at the request of such users and legal representatives in accordance with ‘Period of Retention and Use of Personal Information’ and prohibit such information from being accessed or used for any purposes other than those stipulated in the ‘Period of Retention and Use of Personal Information.’
8. Measures for Ensuring the Security of Personal Information;
The Company has implemented the following measures required for ensuring security under the Personal Information Protection Act: A. Protective measures for administrative purposes 1)Establishment and implementation of an internal management plan - Matters on the appointment of the chief privacy officer - Matters on roles and responsibilities of a chief privacy officer and a personal information- handling employee - Matters on measures for ensuring the security of personal information - Matters on training on the personal information handling employee and companies entrusted with personal information processing - Other matters required for the protection of personal information 2) Conducting its own internal audits - Matters on divisions of duties between the chief privacy officer and an auditor - Matters on roles and responsibilities of an auditor on personal information-related matters - Conducting regular internal audits for ensuring the security of personal information handling B. Technological protection measures 1) The Company operates a system designed to prevent the leakage of personal information in order to prevent the personal information-handling employee from leaking customers’ information. It also applies secure password algorithm to personal information that is transmitted via PCs and networks. 2) The Company grants each personal information handling employee one user account that has different functions and the least right to access a personal information handling system, which is required for performing his/her duties. If such personal information handling employee is replaced, the Company shall modify or delete his/her right to access the system and retain related records for at least five (5) years. In addition, the Company has established and applies a rule of creating a password for the personal information handling employee. 3) If the Company sends or receives individuals’ peculiar identification information and passwords via information communication networks or delivers them through supplementary storage mediums, it shall store them using commercial encryption software and encrypt passwords with secure password algorithms and store them in encrypted forms. 4) The Company retains and manages records on the personal information handling employee’ s access to the personal information processing system for at least six (6) months and securely stores such records to ensure that such records are not forged, modified, stolen or lost. 5) The Company installs and operates security programs, such as vaccine programs that can prevent or cure malicious programs in the personal information processing system or computers used for business purposes. It also conducts regular PC checkups by using the automatic update function of such security programs. C. Physical protective measures The Company has established and operates a procedure for controlling entry to and exit from physical sites where personal information is stored, such as computer rooms and archives. It also stores and manages documents and supplementary storage mediums containing personal information at locations secured with locks.
9. Matters on the Installation and Operation of Personal Information Automatic Collection Devices (cookies) and Rejection of Cookies;
A. The Company may install and operate cookies that store and frequently retrieve customers’ information through Internet services provided by the Company. Cookies mean a string of characters that a web server sends to a web browser to store it there and that is sent back to the server at the request of the server. If a customer accesses the Company’s website, the Company may read the contents of cookies stored at such a customer’s web browser and provide services by searching for additional information, without requiring such a customer to enter such additional information, including his/her/its name. B. The Company may use customers’ information collected through cookies for the following purposes: 1) Providing different information depending on individuals’ interests 2) Identifying users’ tastes and interests by analyzing the access frequency or staying time of members or non-members, and using them for target marketing. 3) Tracing the contents that users read attentively and providing tailor-made services in his/her next visit to the Company’s website. 4) Providing guidance on a use period in using paid services. 5) Analyzing customers’ habits and using them as a measure for the reshuffling of services. C. All customers have the right of choice over installation of cookies. They may accept or reject all cookies or receive notices whenever cookies are installed, by clicking “Tools>Internet Options> Personal Information > Advanced on the upper menu bar of a web browser. However, if a customer rejects the installation of cookies, he/she/it may have inconvenience or difficulty in using services. D. Cookies expire at the termination of a web browser or when users log out of services.
10. Chief Privacy Officer and Personal Information Handling Employees
A. The Company values the protection of customers’ personal information highly and does its best to ensure that their personal information is not damaged, compromised or leaked. However, the Company shall not be responsible for the information damaged by unexpected accidents that arise from basic dangers inherent at networks and all kinds of disputes that arise from postings made by visitors to the Company’s website, even though the Company has taken technological security measures. B. The Company’s customer center offers swift and sincere replies to customers’ inquiries about the protection of their personal information. In addition, customers who wish to contact the chief privacy officer at the Company may contact him/her at the below telephone number or by e-mail. We will answer your inquiries on the protection of personal information swiftly and sincerely. 1) Chief Privacy Officer - Name: SunSik Kong - Title: CEO - Telephone number: +82-2-557-2678 - E-mail: contact@inisium.co.kr 2) Personal Information Handling Employee - Name: CheolWon Choi - Title: General Manager - Telephone No.: +82-2-557-2678 - E-mail: contact@inisium.co.kr C. You may make inquiries to the Personal Information Dispute Mediation Committee, Supreme Prosecutors’ Office, Korea National Policy Agency, Korea Internet & Security Agency if you need consulting to seek remedies for your compromised personal information. 1. Personal Information Dispute Mediation Committee (www.kopico.go.kr): 02-2100-2499 2. Supreme Prosecutors’ Office, National Digital Forensic Center (http://www.spo.go.kr): 1301 3. Korea National Policy Agency, Cyber Bureau (http://cyberbureau.police.go.kr): 182 4. Personal Information Response Center (http://privacy.kisa.or.kr): 118
11. Notices
guideline that is caused by changes in the government’s policies or security technologies on the Notices menu on its homepage seven (7) days before the effectuation of such addition, deletion or modification. - Date of effectuation: February 22, 2019