TKG SOLMICS Co., Ltd. (hereinafter referred to as the “company”) established the following policy to protect users’ personal information and rights and facilitate the handling of users’ difficulties regarding personal information:
The company shall notify by posting a notice on the website (or separate notifications) if there are any revisions to the privacy policy.
ο This policy is effective as of January 1, 2021.
1. Purpose of processing personal information: The company processes personal information for the following purposes: Processed personal information will not be used for purposes other than those specified, and prior consent will be obtained if the purposes change.
A. Website user registration and management
Personal information is processed for identity verification for membership services, identity verification under the restricted verification system, and prevention of misuse of services.
B. Administrative affairs to handle complaints
Personal information is processed to verify the identity of the complaint submitter, confirm the details of the complaint, contact the submitter to notify investigations, and notify the processing results.
C. Provision of goods or services
Personal information is processed to provide goods and/or services.
D. Marketing and advertisements
Personal information is processed to verify the effectiveness of services, identify access frequency, and collect statistics on members’ use of services.
2. Status of personal information files
• 1. File name of personal information: Personal information
• Included personal information: Email, mobile phone number, work phone number, position, department, company name, access log, access IP information, and name of legal representative
• Collection method: Website
• Basis for retention: Consent to personal information collection and use
• Retention period: 3 years
• Related laws: Records on the collection/processing and use of credit information: 3 years; Records on consumer complaints or dispute settlement: 3 years; Records on contracts or withdrawal of offers: 5 years
3. Processing and retention period of personal information ① The company will only provide personal information to a third party in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as consent of the data subject or special provisions in the act.
② The retention and use period of each personal information is as follows:
• 1. Administrative affairs to handle complaints
• Personal information for will be retained and used for the stated purposes up to <3 years> from the date of consent to the collection and use of personal information.
• Basis for retention: Consent to the collection and use of personal information
• Related laws: 1) Records on consumer complaints or dispute settlement: 3 years
4. Provision of personal information to a third party ① The company will only provide personal information to a third party in cases falling under Articles 17 and 18 of the Personal Information Protection Act, such as consent of the data subject or special provisions in the act.
② The company provides personal information to a third party as follows:
• 1. The company
• Recipient of personal information: The company
• Recipient’s purpose of using personal information: Email, mobile phone number, gender, date of birth, name, work phone number, position, department, company name, and name and mobile phone number of the legal representative
• Recipient's retention and use period: 3 years
5. Rights and obligations of data subjects and their legal representative, including how to exercise them: As personal data subjects, users can exercise the following rights:
① Data subjects have the right to request access, correct, delete, and suspend the processing of personal information at any time to the company.
② To exercise the rights specified in (1), the request may be sent to the company via written letter, email, or fax pursuant to Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and the company will accept the request without delay.
③ The rights specified in (1) may be exercised through a representative such as the data subject’s legal representative or those who have been delegated. In this case, a power of attorney shall be submitted using attached Form 11 of the Enforcement Rules to Personal Information Protection Act.
④ The data subjects’ right to request access or suspend the processing of personal information may be limited as per Article 35 (5) and Article 37 (2) of the Personal Information Protection Act.
⑤ Requests to delete personal information may not be accepted if other laws specify the personal information to be collected.
⑥ The company verifies whether the requester of access, correction, deletion, and suspension of processing personal information is the data subject or his/her representative.
6. Processed personal information ① The company processes the following personal information:
• 1. Administrative affairs to handle complaints
• Required information: Email, mobile phone number, work phone number, position, department, company name, and name and mobile phone number of the legal representative
7. Destruction of personal information: In principle, the company destroys personal information without delay if the purpose of processing personal information has been fulfilled. The procedure, deadline, and method for destruction are as follows:
- Destruction procedure
The information entered by the user is transferred to a separate DB after the purpose has been fulfilled (separate documents in the case of hard copy) and will be destroyed immediately or after retention for a certain period as per internal policy and other related laws. Personal information transferred to a DB will not be used for any other purpose except as required by law.
- Deadline for destruction
Once the retention period of personal information has lapsed, the users’ personal information will be destroyed within 5 days of the end of the retention period or within 5 days of the date the personal information is rendered unnecessary if processing the personal information is deemed unnecessary, e.g., the purpose of processing personal information has been fulfilled, the service has been discontinued, or the business has ended.
- Destruction method
Information in electronic file format shall be destroyed using techniques that prevent the recovery of records.
8. Installation and operation of automatic collection devices for personal information and refusal thereof
The company does not use cookies to store and retrieve browsing activities of data subjects frequently.
9. Chief privacy officer
① The company assumes responsibility for overseeing all aspects of personal information processing and designates the following chief privacy officer to handle complaints and remedies for data subjects related to personal information processing:
• ▶ Chief privacy officer
• Name: Lee Chang-seon
• Position: Team Leader
• Phone number: +82-31-660-8492
② The data subjects may contact the chief privacy officer and responsible department for inquiries on personal information protection and matters regarding complaint handling and remedies while using the company’s services (or businesses). The company will respond to and handle inquiries from data subjects promptly.
10. Changes in privacy policy
① This privacy policy is effective as of the effective date, and changes, deletions, or corrections due to amendments in laws or policies will be announced through a notice 7 days before they take effect.
11. Measures for ensuring the security of personal information: The company takes technical, administrative, and physical measures necessary to ensure security as per Article 29 of the Personal Information Protection Act.
1. Minimization of personnel handling personal information, and training
An employee will be designated to handle personal information, and minimal responsible personnel will be designated. The following measures are implemented to manage personal information:
2. Technical measures in case of hacking
The company installs security programs to prevent leaks and damage of personal information caused by hacking or computer viruses. The company also regularly renews and inspects the program and installs systems in restricted areas to monitor and block unauthorized access technically and physically.
3. Encryption of personal information
The users’ personal information is stored and managed with password encryption known only to the user. Important data are protected with separate security measures such as encryption of files and transmission data or by file locking.
4. Retention of access logs and prevention of tampering
Records of accessing personal information processing systems are retained and managed for at least 6 months, with a security function used to prevent tampering, theft, and loss of access records.
5. Access control of unauthorized persons
Personal information is stored in a separate location, with an access control procedure established and implemented.
