Privacy Policy
This policy sets out the rights, obligations, and responsibilities between HyFace Co., Ltd. ("the Company"), which operates SOSCUT ("the Service"), and its members and users.
In accordance with Article 30 of the Personal Information Protection Act, SOSCUT establishes and discloses the following privacy policy to protect the personal information of data subjects and to ensure that related grievances are handled promptly and smoothly.
Purpose of Processing Personal Information
Article 1. Purpose of Processing Personal Information
SOSCUT processes personal information for the following purposes. The information is not used for any purpose other than those stated below, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.
1. Grievance Handling: Personal information is processed to verify the identity of complainants, confirm the details of complaints, contact/notify parties for fact-finding, and notify processing results.
2. Statistical Analysis: Personal information is processed for statistical analysis to improve and supplement the website, and to facilitate smooth communication with users, in order to provide better services.
3. Promotion: Email and phone number are used to deliver notices and provide the latest information, such as new services, new products, and event information.
Processing and Retention Period of Personal Information
Article 2. Processing and Retention Period of Personal Information
SOSCUT processes and retains personal information within the retention period required by law or the period consented to by the data subject at the time of collection. The retention periods for each category are as follows.
1. Website Membership Registration and Management From the time of membership registration until withdrawal. However, in the following cases, information is retained until the relevant reason ends:
- If an investigation is underway due to a violation of relevant laws: until the investigation is concluded
- If a claim/debt relationship remains from use of the website: until the claim/debt is settled
- For corporate members: retained for 3 months after the date of withdrawal (subscription cancellation) for settlement and post-withdrawal dispute handling, then destroyed
2. Provision of Goods or Services Until the goods/services are fully supplied and payment is settled. However, the following periods apply where relevant:
1) Records related to transactions under the Act on Consumer Protection in Electronic Commerce, Etc.:
- Records of labeling/advertising: 6 months
- Records of contracts, withdrawal of subscription, payment settlement, and supply of goods: 5 years
- Records of consumer complaints or dispute resolution: 3 years
2) Retention of communication confirmation data under Article 41 of the Protection of Communications Secrets Act:
- Subscriber's call date/time, start/end time, other party's subscriber number, usage frequency, originating base station location tracking data: 1 year
- Computer communication and internet log records, access location tracking data: 3 months
3) Retention of identity verification information under Article 29 of the Enforcement Decree of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.: 6 months after the information is removed from the bulletin board
3. Personal Information Processing Operations Until the Service is discontinued.
Rights and Obligations of Data Subjects and How to Exercise Them
Article 3. Rights and Obligations of Data Subjects and How to Exercise Them
Data subjects may exercise the following rights regarding personal information protection with SOSCUT at any time:
1. Request to access personal information
2. Request to correct errors, etc.
3. Request to delete personal information
4. Request to suspend processing
These rights may be exercised with SOSCUT in writing, by email, or by fax, using the form set out in Annex 8 of the Enforcement Rules of the Personal Information Protection Act, and SOSCUT will take action without delay.
If a data subject requests correction or deletion of erroneous personal information, SOSCUT will not use or provide the relevant personal information until the correction or deletion is complete.
These rights may also be exercised through a legal representative or an authorized agent of the data subject. In this case, a power of attorney using the form set out in Annex 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.
Categories of Personal Information Processed
Article 4. Categories of Personal Information Processed
SOSCUT processes the following categories of personal information:
1. Website Membership Registration and Management (once membership registration is offered)
Required: Name, password, email address, occupation
2. Information Automatically Generated and Collected During Use of Internet Services
IP address, cookies, MAC address, service usage records, visit history, records of improper use, etc.
3. Provision and Outsourcing of Personal Information
| Recipient | Outsourced Task | Outsourcing Period |
|---|---|---|
| Toss Payments Co., Ltd. | Provision of electronic payment services including credit cards and easy payment, and payment processing, cancellation, refund, and related payment operations | Until termination of the outsourcing agreement. If retention is required under applicable laws, until the end of the legally required retention period. |
Destruction of Personal Information
Article 5. Destruction of Personal Information
SOSCUT destroys personal information without delay once it becomes unnecessary, such as upon expiration of the retention period or achievement of the processing purpose.
If personal information must continue to be retained under other applicable laws even after the consented retention period has expired or the processing purpose has been achieved, the information is transferred to a separate database (DB) or stored in a separate location.
Destruction procedure and method:
1. Procedure: SOSCUT identifies personal information subject to destruction and destroys it upon approval from SOSCUT's Chief Privacy Officer.
2. Method: Personal information stored electronically is destroyed using methods that prevent the records from being reproduced. Personal information recorded on paper is destroyed by shredding.
Measures to Ensure the Security of Personal Information
Article 6. Measures to Ensure the Security of Personal Information
SOSCUT takes the following measures to ensure the security of personal information:
1. Administrative measures: Establishing and implementing an internal management plan, regular employee training, etc.
2. Technical measures: Managing access rights to the personal information processing system, installing an access control system, encrypting unique identification information, operating security programs, etc.
3. Physical measures: Access control for server rooms, data storage rooms, etc.
Chief Privacy Officer
Article 7. Chief Privacy Officer
SOSCUT designates a Chief Privacy Officer who has overall responsibility for personal information processing and handles complaints and remedies for data subjects related to personal information processing, as follows:
■ Personal Information Protection Department and Officer
• Officer: Sungkyung Jung
• Contact: +82-2-6241-3890
• Email: soscut@hyface.com
Data subjects may direct any inquiries, complaints, or requests for remedy related to personal information protection arising from use of SOSCUT's services (or business) to the Chief Privacy Officer and the responsible department above.
