Privacy Policy

Article 1 (Purposes of Processing Personal Data)

The Organization processes personal data for the purposes set out below. Personal data is not used for any purpose other than these, and where a purpose changes, the Organization takes the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Membership enquiries and delivery of application forms — verifying the applicant organization, confirming ownership of the email address, providing the application form matching the membership type, and communicating the status of the application process.
2. Member management — maintaining and administering membership, providing member-only materials and services, and sending notices.
3. Newsletter delivery — providing standards news and event information that subscribers have consented to receive. (Planned)
4. Service operation and security — preventing abuse, limiting request rates and protecting administrator accounts.

Purposes marked "(Planned)" apply from the date the corresponding feature is released. At present, the data actually being collected is the "Application form request" and "Web account registration" sets described in Article 2.

Article 2 (Categories of Personal Data Processed)

The Organization processes the following categories of personal data with the consent of the data subject.

In addition, an IP address, browser and operating system information, access time and cookies may be generated and collected automatically while the service is used. Article 8 explains this in detail.

The Organization does not collect sensitive data such as beliefs, health or sexual life, nor unique identifiers such as resident registration numbers. The service is not directed at children under 14, and the Organization does not knowingly collect their personal data.

Article 3 (Processing and Retention Periods)

The Organization processes and retains personal data within the retention period required by law, the period consented to by the data subject at the time of collection, or a period set under another lawful basis for processing under the Personal Information Protection Act.

Where a law requires retention, the relevant data is kept for the period prescribed by that law and destroyed thereafter.

Article 4 (Procedure and Method of Destruction)

The Organization destroys personal data without delay once it is no longer needed — for example, when the retention period has elapsed or the purpose of processing has been achieved.

Procedure

Data due for destruction is identified and destroyed after confirmation by the Data Protection Officer. Data that must be retained under law is moved to separate storage and is not used for any purpose other than that retention.

Method

• Data in electronic form: the record is deleted from the database and permanently erased by a method that makes recovery or reproduction impossible. Data contained in backups is destroyed in sequence as the backup retention cycle elapses.
• Data printed on paper: shredded or incinerated.

Article 5 (Outsourcing of Processing)

The Organization outsources parts of its personal data processing as set out below. When concluding an outsourcing agreement, the safeguards for personal data are specified in writing, and the Organization supervises whether the processor handles personal data securely.

The email delivery processor is Plus Five Five, Inc. (operating as Resend), located in San Francisco, California, United States.

Any change to the outsourced work or to the processors will be published through this Policy.

Article 6 (Cross-Border Transfer of Personal Data)

The Organization stores the system of record for member and application data in a region within the Republic of Korea, and the web application is also executed in a region within the Republic of Korea. Email is both sent and received through service providers outside Korea, so personal data is processed outside Korea in the course of email delivery and receipt. Application documents received by email are deleted from the mailbox after the secretariat has completed its own record-keeping, and those documents are retained by the secretariat within the Republic of Korea.

Storage in Korea

The database and file storage are located in Supabase's Seoul region (ap-northeast-2). The original member and application records are held in that storage, and only the minimum information necessary for a given purpose is passed to external services.

Transfers outside Korea

Data subjects may refuse the transfer of their personal data outside Korea. Please note that refusing may restrict the use of services that depend on such a transfer, such as delivery of the application form by email. To object, please contact the Data Protection Officer named in Article 10.

The Organization may use external artificial intelligence services for internal work such as content translation, but does not transmit the personal data of members or applicants to those services.

Article 7 (Rights of Data Subjects and How to Exercise Them)

Data subjects may exercise the following rights in relation to the Organization at any time.

1. The right to request access to their personal data
2. The right to request correction where there is an error
3. The right to request deletion
4. The right to request suspension of processing
5. The right to withdraw consent to the collection, use or provision of personal data

These rights may be exercised in writing or by email to the Data Protection Officer named in Article 10, and the Organization will act on the request without delay. Where a data subject requests correction or deletion, the Organization will not use or provide the personal data concerned until the correction or deletion is complete.

Data subjects may exercise their rights through a representative, such as a legal guardian or a duly authorized agent. In that case a power of attorney in the form prescribed by the Notification on Methods of Personal Data Processing (Annexed Form No. 11) must be submitted.

A request for deletion may be restricted where other legislation expressly requires the collection of the personal data concerned.

Article 8 (Automatic Collection Devices, Including Cookies)

The Organization uses cookies to the extent necessary to provide the service. The cookies currently in use are limited to the following strictly necessary cookies.

• Login session cookie — maintains the signed-in state of members and administrators.
• Administrator two-factor session cookie — confirms that a session accessing the admin area has completed two-factor authentication.

The Organization does not currently use advertising identifiers or behavioural analytics tools, or any other cookie intended to track users. Language selection is determined by the URL path (/ko, /en) rather than by a cookie.

Users may refuse the storage of cookies through their browser settings. Refusing strictly necessary cookies may, however, restrict the use of services that require signing in.

Access records such as IP address, access time and browser information may be generated by the hosting platform and servers while the service operates. The Organization does not write personal data — request bodies, email addresses or authentication tokens — to application logs.

Article 9 (Measures to Ensure the Security of Personal Data)

The Organization takes the following measures to keep personal data secure.

Administrative measures

• Access to personal data is restricted to the minimum number of people required for the work.
• Member and application data can be viewed and administered only with site administrator privileges.

Technical measures

• All communication between users and the service is encrypted with HTTPS, and transport security response headers are applied.
• Passwords are stored encrypted in a form that cannot be decrypted.
• Administrator accounts can sign in only after two-factor authentication (TOTP); the authentication secret is stored encrypted and recovery codes are stored hashed.
• Private files such as application forms are never given a public URL and are delivered only through signed URLs that expire within 48 hours.
• Email addresses and IP addresses used for rate limiting are stored only as hash values, never in the clear.
• Bot protection and request rate limits are applied to prevent automated sign-ups and bulk requests.

Physical measures

The physical facilities where personal data is stored are managed in the data centres of the cloud providers acting as processors, and the Organization verifies their level of protection through the outsourcing agreements.

Article 10 (Data Protection Officer)

The Organization designates a Data Protection Officer, as set out below, who has overall responsibility for personal data processing and for handling complaints and remedying damage in relation to it.

Requests for access to personal data are received and handled at the same contact point.

Data subjects may direct any enquiry, complaint or request for remedy arising from their use of the service to the Data Protection Officer. The Organization will respond and act without delay.

Article 11 (Remedies for Infringement of Rights)

Data subjects may apply to the following bodies for dispute resolution or advice in order to obtain redress for a personal data infringement. These bodies are independent of the Organization; please contact them if you are not satisfied with the Organization's own handling of a complaint or need further assistance.

• Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
• Privacy Infringement Report Centre — 118 (privacy.kisa.or.kr)
• Cybercrime Investigation Division, Supreme Prosecutors' Office — 1301 (www.spo.go.kr)
• Cybercrime Reporting System, Korean National Police Agency — 182 (ecrm.police.go.kr)

Article 12 (Changes to this Privacy Policy)

This Privacy Policy applies from its effective date. Where content is added, deleted or amended in response to changes in law, policy or security technology, the change will be announced on this website at least seven days before it takes effect.

Revision history