Privacy Policy

The 'Privacy Policy' refers to the guidelines that the Company must adhere to to ensure users can use the service with peace of mind. The Company provides this Privacy Policy in compliance with relevant laws, personal information protection regulations, and guidelines of the Republic of Korea that personal information processors must observe. The Company collects, uses, and provides personal information based on the user's consent. To actively guarantee users' rights (the right to self-determination regarding personal information), the Company is making various efforts to provide the Privacy Policy in an easy-to-understand manner. As part of these efforts, the Company provides key information regarding personal information processing through labeling.

The Company collects the minimum amount of personal information necessary to provide services. During membership registration or the course of service usage, we collect the minimum necessary personal information through web pages or individual services. We obtain consent for the minimum information absolutely required for service provision as mandatory items, and for additional information collected to provide specialized services as optional items; if you do not consent to the optional items, you may be offered additional services.

Some services may obtain user consent and collect additional personal information to provide various specialized features.

View details of personal information items separately collected by the service

1. Member identification/verification of intent to join, identity/age verification
2. Handling inquiries or complaints, and delivering announcements
3. Transmission or delivery of content, etc., and fee settlement when using paid services
4. Prevention and sanctions against acts that hinder the smooth operation of the service (including account theft and fraudulent use).
5. Service usage records, access frequency, and statistics on service usage

The methods for collecting personal information are as follows.

In principle, when collecting personal information, we notify users of the fact in advance and obtain their consent, and we collect personal information through the following methods.

1. When a user agrees to the collection of personal information and directly enters information during the membership registration and service usage process
2. In cases where personal information is received from affiliated services or organizations, etc.
3. During the consultation process through the customer center, web pages, email, fax, telephone, etc.

Items of personal information processed without obtaining the data subject's consent

The company processes the following personal information items without the consent of the data subject.

If separate consent has been obtained from the user regarding the personal information retention period, or if laws and regulations impose an obligation to retain information for a certain period, we safely store the personal information for that period.
In addition, the personal information that must be retained for a certain period in accordance with laws and regulations is as follows.

View details on personal information storage in accordance with relevant laws

The company does not provide personal information without the user's consent, but may provide personal information in the following cases.

1. In cases where separate consent has been obtained from the data subject
2. Where there are special provisions in other laws
3. Cases where it is deemed clearly necessary for the urgent benefit of the life, body, or property interests of the data subject or a third party
4. Cases where duties prescribed by other laws cannot be performed unless personal information is used for a purpose other than the original purpose or provided to a third party, and where the Protection Commission has deliberated and resolved.
5. When necessary to provide to a foreign government or international organization for the implementation of a treaty or other international agreement
6. When necessary for the investigation of a crime and the filing and maintenance of a prosecution
7. When necessary for the performance of the court's judicial duties
8. When necessary for the execution of punishment, custody, or protective measures
9. In cases where it is urgently necessary for public safety and well-being, such as public health

View details on cases where Certpia provides personal information to third parties

To ensure the smooth processing of personal information, the Company entrusts personal information processing tasks to specific entities with the consent of subscribers. To entrust the processing of personal information, the Company notifies users in advance of the following and obtains their consent: ‘the party entrusted with the personal information, the purpose of use of the personal information by the entrusted party, the items of personal information provided, and the period of retention and use of the personal information by the recipient.’ Even after personal information has been provided, the party who provided the personal information—that is, the entrustor—bears the responsibility for management and supervision of the entrusted company.

View details on personal information processing entrustment status

The company destroys personal information without delay when it becomes unnecessary, such as when the retention period for personal information has expired or the purpose of processing has been achieved.

1. Destruction Procedure
Information entered by users for purposes such as membership registration is transferred to a separate database (or a separate filing cabinet in the case of paper documents) after the purpose is fulfilled. It is then destroyed after being stored for a certain period in accordance with internal policies and reasons for information protection under other relevant laws (refer to the retention and usage period). Personal information transferred to a separate database is not used for any purpose other than retention, unless required by law.

2. Method of Destruction
Personal information printed on paper is destroyed by shredding or incineration.
Personal information stored in the form of electronic files is deleted using technical methods that prevent the records from being reproduced.

Users may exercise the following rights.

1. Request to view personal information
2. Request for Correction/Deletion of Personal Information
3. Request to suspend personal information processing
4. Request for withdrawal of consent to personal information and withdrawal

You may exercise your rights pursuant to the above matters by completing Form No. 8 attached to the Notification on Methods of Personal Information Processing and submitting it in writing, via email, or by fax, and the Company will take action without delay. If a request is made for the correction or deletion of errors in a user's personal information, the Company will not use or provide the relevant personal information until the correction or deletion is completed. The right to request access to personal information and suspension of processing may be restricted pursuant to Article 35, Paragraph 5 and Article 37, Paragraph 2 of the Personal Information Protection Act. A request for correction or deletion of personal information cannot be made if such personal information is explicitly designated as a subject of collection under other laws. Upon receiving a request for access, correction/deletion, or suspension of processing in accordance with the rights of the data subject, the Company will verify whether the person making the request is the principal or a legitimate representative.

[Attachment No. 8 to the Notification on Methods of Processing Personal Information] Access, Correction, Deletion, etc. of Personal Information

You may exercise your rights pursuant to the above matters by completing Form No. 8 attached to the Notification on Methods of Personal Information Processing and submitting it in writing, via email, or by fax, and the Company will take action without delay. If a request is made for the correction or deletion of errors in a user's personal information, the Company will not use or provide the relevant personal information until the correction or deletion is completed. The right to request access to personal information and suspension of processing may be restricted pursuant to Article 35, Paragraph 5 and Article 37, Paragraph 2 of the Personal Information Protection Act. A request for correction or deletion of personal information cannot be made if such personal information is explicitly designated as a subject of collection under other laws. Upon receiving a request for access, correction/deletion, or suspension of processing in accordance with the rights of the data subject, the Company will verify whether the person making the request is the principal or a legitimate representative.

[Attachment No. 11 to the Notice on Personal Information Processing Methods] Power of Attorney

The Company operates 'cookies' which frequently store and retrieve user information, in order to provide specialized, customized services to users. A cookie is a small amount of information sent by the server used to operate the website to a user's computer browser and is stored on the user's computer hard drive. The Company uses cookies for the following purposes.

1. Purpose of Using Cookies, etc.
To provide targeted marketing and personalized services by analyzing the access frequency and visit duration of members and non-members, identifying users' preferences and interests, tracking their browsing history, and determining the level of participation in various events and the number of visits.

Users have the option to choose whether or not to install cookies. Therefore, by setting options in their web browser, users can choose to allow all cookies, be prompted for confirmation whenever a cookie is saved, or refuse to save all cookies.

2. How to Refuse Cookie Settings
You can refuse cookie settings by selecting options in your web browser to allow all cookies, confirm whenever a cookie is saved, or refuse the storage of all cookies.
Setting method (for Edge, Chrome): Tools > Internet Options > Privacy at the top of the web browser
However, if you refuse the installation of cookies, there may be difficulties in providing some services that require a login.

In handling users' personal information, the Company is taking the following technical and administrative measures to ensure safety and prevent the loss, theft, leakage, alteration, or damage of personal information.

1. Password Encryption
User ID passwords are encrypted and stored and managed so that only the user knows them, and verification and modification of personal information are possible only by the user who knows the password.

2. Measures Against Hacking, etc.
The Company is doing its utmost to prevent the leakage or damage of users' personal information due to hacking, computer viruses, etc. To prepare for potential damage to personal information, we frequently back up data, use the latest antivirus programs to prevent the leakage or damage of users' personal information or data, and ensure the secure transmission of personal information over networks through encrypted communication.

Furthermore, we control unauthorized access from the outside using an intrusion prevention system, and we are striving to implement all possible technical measures to ensure systemic security.

3. Minimization and Training of Handling Staff
The Company limits the handling of personal information to designated personnel and assigns separate passwords for this purpose, which are regularly updated. Furthermore, the Company consistently emphasizes compliance with its personal information handling policy through frequent training of these personnel.

4. We are making efforts to immediately correct and rectify any issues discovered by verifying the implementation of the company's personal information handling policy and compliance by personnel through the in-house personal information protection organization, etc.

However, the Company bears no responsibility whatsoever for any problems arising from the leakage of personal information, such as ID and password, due to the user's own negligence or issues on the Internet.