Privacy Policy

• ① Personal information being processed by KFPI will not be used for purposes other than the following, and if the purpose of use changes, necessary measures will be taken, such as obtaining separate consent from the information subject.
  • 1. Integrated membership registration and management
  • - We process personal information for the following purposes: Confirmation of intent to register as a member, identification and authentication of the member in accordance with the provision of membership services, maintenance and management of membership qualifications, Prevention of unauthorized use of services, confirmation of consent of legal representative when collecting personal information of children under the age of 14, various notifications and notices, complaint handling, and dispute resolution.
  • 2. Processing of civil affairs
  • - Personal information is processed for the following purposes: Confirmation of the identity of the complainant, confirmation of the civil affairs, contact/notification for fact-finding, notification of processing results
  • ※ The above indicates the general purpose of processing. For details on the purpose of processing, refer to Article 2 of this processing policy.

• ① KFPI processes and retains personal information within the personal information retention and use period in accordance with the law or within the personal information retention and use period agreed to when collecting personal information from the information subject.
• ② KFPI processes the collected personal information and the retention period to the minimum required to achieve the processing purpose.
• ③ KFPI processes the following personal information without the consent of the data subject based on legal grounds.

• ⑤ If there is no login record for more than 1 year, the account will be converted to a dormant account, and the integrated membership information of members who have not logged in for more than 1 year after conversion to a dormant account will be deleted.
• ⑥ For more detailed information on the processing of personal information other than what is described, you can check the list of personal information files disclosed by KFPI in accordance with the instructions in the <Personal Information File Registration Status> section below.

• ① Detailed information on personal information files held by KFPI can be found through the link below.

• ① KFPI processes the personal information of the data subject only within the scope specified in the purpose of processing personal information, and provides personal information to third parties only in cases corresponding to Articles 17 and 18 of the Personal Information Protection Act, such as consent from the data subject or special provisions of the law. In other cases, the personal information of the data subject is not provided to third parties.
• ② KFPI may provide personal information to third parties in the following cases.
  • 1. When separate consent is obtained from the information subject
  • 2. When there are special provisions in other laws
  • 3. When it is clearly deemed necessary for the urgent benefit of life, body, or property of the information subject or a third party.
  • 4. If personal information is used for purposes other than the intended purpose or does not provide it to a third party, it is impossible to perform the duties prescribed by other laws and the case has been reviewed and resolved by the Protection Committee.
  • 5. When necessary to provide information to foreign governments or international organizations for the implementation of treaties and other international agreements.
  • 6. When necessary for investigation of crime and filing and maintenance of indictment
  • 7. When necessary to carry out the court's judicial duties
  • 8. When necessary for the execution of punishment, custody, and protective measures
  • 9. In case of urgent need for public safety and security, such as public health
• ③ KFPI provides personal information to third parties as follows.

• ④ Information regarding the third-party provision of personal information that previously occurred at KFPI can be found on the following bulletin board.
Notice board for third-party provision of personal information
• ⑤ In accordance with the “Guidelines for the Processing and Protection of Personal Information in Emergency Situations” jointly announced by relevant government ministries, KFPI may provide personal information to relevant organizations without the consent of the information subject in the event of an emergency such as a disaster, infectious disease, an incident or accident that poses an imminent danger to life or body, or an imminent loss of property. For more information, please refer to the “Guidelines for the Processing and Protection of Personal Information in Emergency Situations.”
Personal information processing and protection rules in case of emergency

• ① KFPI may additionally use and provide personal information without the consent of the information subject in consideration of the matters under Article 14-2 of the Enforcement Decree of the Personal Information Protection Act in accordance with Article 15, Paragraph 3 and Article 17, Paragraph 4 of the Personal Information Protection Act.
• ② The following are the matters that KFPI considers for additional use/provision without the consent of the information subject.
  • 1. Whether the purpose of additional use/provision of personal information is related to the original purpose of collection
  • 2. Whether additional use/provision is predictable in light of the circumstances or processing practices in which the personal information was collected
  • 3. Whether additional use/provision of personal information unfairly infringes upon the interests of the information subject
  • 4. Whether necessary measures to ensure security, such as pseudonymization or encryption, have been taken

• ① In order to smoothly process personal information, KFPI entrusts the following personal information processing tasks.

• ② When concluding a consignment contract, KFPI states in the contract or other documents matters related to responsibilities such as prohibition of processing personal information for purposes other than the performance of the consigned work, technical and administrative protection measures, restrictions on re-consignment, management and supervision of the consignee, and compensation for damages in accordance with Article 26 of the Personal Information Protection Act, and supervises whether the consignee safely processes personal information.

위탁계약

Prior to Consignment	Contractual period	In progress	End of Consignment
· Review the Necessity of Entrusting Personal Data Processing Tasks · Determine the Minimum Scope of the Entrustment · Establish a Personal Data Protection Plan for the Entrustee	· Prepare a Standard Personal Data Processing Entrustment Agreement · Obtain a Security and Confidentiality Pledge from the Entrustee · Provide Guidelines and Compliance Requirements to the Entrustee · Disclose Entrustment Details in the Privacy Policy · Obtain Separate Consent for Re-entrustment	· Conduct quarterly inspections and training sessions for entrustees	· Obtain a Certificate of Personal Data Destruction/Return and a Security Assurance Statement · Revoke the Entrustee’s Access Privileges

• ③ In the event that the content of the entrusted work or the entrustee changes, we will disclose it without delay through this personal information processing policy.
• ④ In the event of any changes to the details of the entrusted tasks or the entrustee, we will disclose such changes without delay through this personal information processing policy.

• ① KFPI, in principle, destroys personal information without delay once the purpose of processing the personal information has been achieved. The procedures, deadlines, and methods for destruction are as follows.
  • - Destruction Procedure
      Personal information is moved to a separate space immediately after the purpose is achieved and stored for a certain period of time in accordance with internal policies and other relevant laws and regulations before being destroyed. Personal information moved to a separate space will not be used for any other purpose unless required by law.
  • - Destruction period and method
      When personal information becomes unnecessary, such as when the retention period expires, the purpose of processing personal information is achieved, or the relevant business is abolished, it will be destroyed without delay. Personal information recorded and stored in electronic files will be destroyed so that the records cannot be reproduced, and personal information recorded and stored in paper documents will be destroyed by shredding or incineration.
• ② In cases where the retention period for personal information agreed upon by the data subject has expired or the processing purpose has been achieved, but personal information must be retained in accordance with other laws and regulations, the personal information will be transferred to a separate database (DB) or stored in a different location according to the following criteria.
  • 1. Records of transactions such as display, advertisement, contract contents and performance according to Article 6 of the Act on Consumer Protection in Electronic Commerce, etc.
    • - Records on display and advertising: 6 months
    • - Records on contracts or cancellation of subscriptions: 5 years
    • - Records on payment and supply of goods, etc.: 5 years
    • - Records on consumer complaints or dispute resolution: 3 years
• ③ You can check the items of personal information retained in accordance with other applicable laws and their respective retention periods in the Personal Information File Registration section of this Privacy Policy.

• ① The data subject (in the case of a person under the age of 14, the legal representative) may exercise the right to view, correct or delete personal information, suspend processing, withdraw consent, and refuse or explain automated decisions at any time (hereinafter referred to as “exercise of rights”).
  • 1. Request to view personal information
    The data subject may request to view personal information in accordance with Article 35 (Viewing personal information) of the Personal Information Protection Act.
  • 2. Request to correct or delete personal information
    The data subject may request to correct or delete personal information in accordance with Article 36 (Correction or deletion of personal information) of the Personal Information Protection Act.
  • 3. Request to suspend personal information processing and withdraw consent
    The data subject may request to suspend processing in accordance with Article 37 (Suspension of personal information processing, etc.) of the Personal Information Protection Act.
  • 4. Request to refuse or explain automated personal information processing
    The data subject may request to refuse or explain automated decisions in personal information processing in accordance with Article 37-2 (Data subject’s rights regarding automated decisions, etc.) of the Personal Information Protection Act.
• ② The procedures for viewing, correcting, deleting, and suspending processing of personal information are carried out according to the following procedures.
  • 1. The procedures for viewing, correcting, deleting, and suspending processing of personal information
    
  • 2. How to request access to personal information, etc.
        To exercise rights under Paragraph 1, you can apply online through the ‘Personal Information Portal(www.privacy.go.kr)’or apply offline to the department that handles and manages personal information files.

    • 개인정보 신청 방법

      Online (Internet)

      offline (in writing)

      1. Access the ‘Personal Information Portal’ website (www.privacy.go.kr) 2. Click on ‘Personal Information Viewing Request’ in Civil Complaints Center 3. Verify your identity using i-PIN or mobile phone authentication 4. Click on ‘Personal Information File List Search’ to select the organization name and personal information file name 5. Click on ‘Personal Information File List Search’ to select the organization name and personal information file name 6. Fill out the request form and submit the civil complaint

      1. Fill out the personal information access request form and submit it to the personal information file management department ※ When filling out the application form, confirm and write down the name of the personal information file you wish to access and the name of the processing department 2. You must present an ID card such as a resident registration card, driver's license, or passport to verify the information subject ※ If applying through a proxy, you must submit a 'power of attorney'

    • ※ [Personal Information Protection Commission’s Notice on Personal Information Processing Methods, Appendix 8] Personal Information Access Request Form
    Download the Personal Information Access Request Form
    • ※ [Personal Information Protection Commission’s Notice on Personal Information Processing Methods, Appendix 11] Power of Attorney
    Download the power of attorney
• ③ When requesting access, correction/deletion, or suspension of processing in accordance with information subject rights, KFPI verifies whether the person making the request is the person himself or a legitimate agent.
• ④ If the data subject is dissatisfied with the measures taken, such as refusal to exercise rights or partial inspection, he or she may file an objection by submitting an objection application within 30 days from the date of receiving the notification result.
  
  Form of objection to measures such as viewing of personal information
• ⑤ Information subjects using services that involve membership registration may withdraw consent to the collection and use of personal information related to membership registration at any time through ‘Membership Withdrawal’.
• ⑥ If the information subject's consent to the fact that an automated decision will be made has been obtained or has been notified in advance through a contract, etc., or if it is clearly stipulated in the law, refusal of the automated decision is not recognized and only a request for explanation and review is allowed. I do.
• ⑦ KFPI does not process any personal information by means of automated decision-making at present.
  • 1. Restrictions on requests to view personal information
    • 1) When access is prohibited or restricted by law
    • 2) When there is a risk of harm to another person's life or body or unfair infringement on another person's property or other interests
    • 3) In the event that a public institution causes significant disruption when performing the following tasks
      • a. Tasks related to tax imposition, collection, or refund
      • b. Tasks related to performance evaluation or selection of students at schools of all levels under the Elementary and Secondary Education Act and the Higher Education Act, lifelong education facilities under the Lifelong Education Act, and other higher education institutions established under other laws
      • c. Tasks related to examinations and qualification examinations related to academic ability, skills, and employment
      • d. Tasks related to ongoing evaluation or judgment regarding calculation of compensation and benefits, etc.
      • e. Tasks related to audits and investigations in progress under other laws
  • 2. Restrictions on requests for correction/deletion of personal information
    • 1) In cases where special procedures are stipulated in other laws regarding correction or deletion of personal information
  • 3. Restrictions on requests to suspend personal information processing and withdraw consent
    • 1) When there is a special provision in the law or it is inevitable to comply with legal obligations
    • 2) When there is a risk of harm to another person's life or body or a risk of unfairly infringing upon another person's property or other interests
    • 3) When a public institution cannot perform its duties stipulated in other laws if it does not process personal information
    • 4) When it is difficult to fulfill a contract, such as when it cannot provide the service agreed upon with the information subject if it does not process personal information, and the information subject has not clearly expressed its intention to terminate the contract
  • 4. Restrictions on requests for automated personal information rejection, explanation, etc.
    • 1) If the personal information subject to the notification request is included in a personal information file that falls under any of the items in Article 32, Paragraph 2
    • 2) If there is a risk of harm to another person's life or body due to the notification, or a risk of unfairly infringing upon another person's property or other interests

• ① KFPI is taking the following safety measures in accordance with Article 29 (Duty of Safety Measures) of the Personal Information Protection Act, such as establishing an internal management plan and keeping access records, to prevent personal information being lost, stolen, leaked, forged, altered or damaged.

  개인정보의 안전성 확보 조치

  Classification	Categories	Main points
  Administrative	Establishing and implementing an internal management plan	Establishing and implementing an internal management plan for the safe processing of personal information.
  	Minimization and education of personal information handlers	The person in charge of handling personal information is designated and managed only for the necessary personnel, and education for safe management is provided for handlers.
  	Conducting regular self-inspection	In order to secure stability related to the handling of personal information, we conduct regular inspections to protect personal information.
  Technical	Restrictions on Access to Personal Information	We take necessary measures to control access to personal information by granting, changing, and canceling access to database systems that process personal information, and use intrusion prevention systems to control unauthorized access from outside.
  	Keeping and preventing forgery of access records	We keep and manage records (logs) accessed to the personal information processing system for at least a year, and use security functions to prevent forgery, theft, and loss of access records.
  	Encrypting personal information	The data subject's unique identification information and password are encrypted and managed. It also has separate security features, such as encrypting and using sensitive data when stored and transferred.
  	Technical countermeasures against hacking	In order to prevent leakage and damage of personal information by hacking or com puter viruses, security programs are installed, periodic updates/inspection is conducted, systems are installed in areas where access is controlled from the outside, and technical/physical monitoring and blocking are provided.
  Physical	Access control for unauthorized persons	A separate physical storage place for the personal information system that stores personal information is established and operated with access control procedures for access control are established and operated.

• ① In order to provide individual services and convenience to information subjects, the agency stores usage information and uses "cookie" from time to time.
• ② Cookies are information sent by the server (http) used for website operation to the information subject's browser and are stored on the information subject's computer or mobile, and are automatically transmitted from the information subject's browser to the server when accessing the website.
• ③ The information subject can set settings such as allow cookies, block cookies, etc. through browser option settings.
• ▷ Allow/Block Cookies in Web Browser

• ▷ Allow/Block Cookies in Mobile Browser

• ① KFPI is responsible for overall management of personal information processing and has designated a personal information protection officer as follows to handle complaints and provide remedies to data subjects related to personal information processing.

  • 개인정보 보호책임자

    Classification	Department	Name	Contact Information
    Chief Privacy Officer	IT Security Task Force	Kim Hee Soo	Tel	02-6320-8435
    Personal Information Protection Manager	IT Security Task Force	Park Bo Mi	Tel	02-6320-8437
    			Fax	02-6320-8499
    			Email	parkbm@hansik.or.kr

  • ② The data subject may inquire about all personal information protection-related matters, such as damage relief, that arise while using KFPI’s services to the personal information protection officer and the department in charge. KFPI will respond to and process the data subject’s inquiries without delay.

• ① KFPI strives to guarantee the information subject's right to self-determination of personal information and to provide consultation and relief for damage caused by personal information infringement. If you need to report or consult, please contact the department in charge below.

• Article 13 Methods of redress for infringement of rights

  Classification	Department	Name	Contact Information
  Personal Information Protection Manager	IT Security Task Force	Park Bo Mi	Tel	02-6320-8437
  			Fax	02-6320-8499
  			Email	parkbm@hansik.or.kr

• ② The data subject may apply for dispute resolution or consultation to an external organization other than KFPI to receive relief for personal information infringement. For reports or consultations regarding personal information infringement, please contact the organizations below.

• 개인정보 침해 신고 기관 정보

  Name of institution	Responsibilities	Contact Information	Website
  Kopico	Report of personal information infringement, request for consultation	(no area code) 1833-6972	www.kopico.go.kr
  Personal Information Infringement Report Center	Request for personal information dispute mediation, collective dispute mediation (civil)	(no area code) 118	privacy.kisa.or.kr
  Electronic Cybercrime Report & Management system	Investigation of crime related to personal information infringement	(no area code) 182	ecrm.police.go.kr

• ③ A person whose rights or interests have been infringed due to a disposition or omission (failure to do something that should be done) by the head of a public institution in response to a request pursuant to the provisions of Articles 35, 36, and 37 of the Personal Information Protection Act shall be subject to the Administrative Appeals Act. Administrative judgment may be requested in accordance with the provisions hereof.

• 행정심판위원회

  Name of institution	Responsibilities	Contact Information	Website
  Administrative Appeal	Support for citizens whose rights and interests have been infringed upon by illegal or unfair administrative actions to easily obtain relief	(no area code) 110	www.simpan.go.kr

③ KFPI has taken the following improvements based on the results of the 2024 privacy level evaluation.

- Added guidance on the 'right to reject consent' in the consent form for collecting and using personal information on the homepage (subscription of the magazine)