Privacy Policy
This English translation is provided for convenience. The Korean version is legally binding, and it prevails if the two differ.
ECHOIT Co., Ltd. (the "Company") has established this privacy policy in accordance with the Personal Information Protection Act to protect the personal information and rights of users and to handle users' concerns about personal information promptly and smoothly.
When the Company amends this privacy policy, it will give notice through announcements on its website (or by individual notice).
This policy takes effect on June 1, 2022.
01 Purposes of Processing Personal Information
The Company processes personal information for the following purposes. Personal information processed will not be used for any purpose other than those below, and the Company will seek prior consent if the purpose of use changes.
① Handling inquiries and complaints
The Company processes personal information to verify the identity of the person making an inquiry, confirm the details of the inquiry, contact and notify them for fact-finding, and report the outcome.
② Providing goods or services
The Company processes personal information to provide free versions and respond to customer questions.
③ Marketing and advertising
The Company processes personal information to develop new services (products) and provide customized services, provide event and promotional information and opportunities to participate, provide services and display advertisements based on demographic characteristics, verify the effectiveness of services, measure access frequency, and compile statistics on members' use of services.
02 Processing and Retention Period
① The Company processes and retains personal information within the retention and use period prescribed by law or the retention and use period agreed to by the data subject when the personal information was collected.
② The processing and retention period for personal information under Article 1 ① and ② is one year.
③ The processing and retention period for personal information under Article 1 ③ is six months.
03 Rights and Obligations of Data Subjects and How to Exercise Them
As data subjects, users may exercise the following rights.
① Data subjects may exercise the following rights related to the protection of personal information against the Company at any time.
- a) Request to access personal information
- b) Request to correct errors
- c) Request to delete
- d) Request to suspend processing
② The rights under paragraph 1 may be exercised in writing, by email, or by fax, using Form No. 8 of the Enforcement Rules of the Personal Information Protection Act, and the Company will take action without delay.
③ If a data subject requests correction or deletion of errors in their personal information, the Company will not use or provide that personal information until the correction or deletion is complete.
④ The rights under paragraph 1 may be exercised through a representative, such as the data subject's legal representative or a person authorized by them. In this case, a power of attorney in the format of Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.
04 Personal Information Processed
The Company processes the following items of personal information.
| Category | Items collected |
|---|---|
| a) Online inquiries and consulting requests | Name / Affiliation / Email / Phone number / Cookies / IP address |
| b) Handling inquiries and complaints | Name / Affiliation / Email / Phone number / Cookies / IP address |
| c) Marketing and advertising | Name / Affiliation / Email / Phone number / Cookies / IP address |
05 Destruction of Personal Information
In principle, the Company destroys personal information without delay once the purpose of processing has been achieved. The procedure, deadline, and method of destruction are as follows.
① Procedure
After the purpose has been achieved, information entered by users is moved to a separate database (or a separate file, in the case of paper) and is destroyed immediately or after being stored for a certain period in accordance with internal policies and other applicable laws. Personal information moved to the database is not used for any other purpose unless required by law.
② Deadline
When the retention period has expired, users' personal information is destroyed within five days from the end of the retention period. When personal information is no longer needed — because the purpose of processing has been achieved, the service has been discontinued, or the business has ended — it is destroyed within five days from the date its processing is deemed unnecessary.
③ Method
Information in electronic file form is destroyed using technical methods that make the records impossible to reproduce. Personal information printed on paper is destroyed by shredding or incineration.
06 Measures to Ensure the Security of Personal Information
In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following technical, administrative, and physical measures necessary to ensure security.
① Regular internal audits
② Minimizing and training staff who handle personal information
The Company designates the staff who handle personal information, limits handling to those staff, and keeps their number to a minimum.
③ Establishing and implementing an internal management plan
The Company has established and implements an internal management plan for the safe processing of personal information.
④ Technical measures against hacking
To prevent leakage and damage of personal information from hacking or computer viruses, the Company installs security programs, updates and inspects them regularly, places systems in areas with controlled external access, and monitors and blocks threats technically and physically.
⑤ Encryption of personal information
Users' passwords are stored and managed in encrypted form, so only the user knows them. Important data is protected with additional security features, such as encrypting files and transmitted data or using file-locking functions.
⑥ Retaining access logs and preventing tampering
The Company retains and manages records of access to the personal information processing system for at least six months, and uses security features to prevent access records from being forged, altered, stolen, or lost.
⑦ Restricting access to personal information
The Company takes the measures necessary to control access to personal information by granting, changing, and revoking access rights to the database systems that process it, and uses an intrusion prevention system to block unauthorized access from outside.
⑧ Locking devices for document security
Documents and auxiliary storage media containing personal information are kept in secure locations with locking devices.
⑨ Access control for unauthorized persons
The Company maintains a separate physical storage location for personal information and has established and operates access control procedures for it.
07 Chief Privacy Officer
① The Company has designated the Chief Privacy Officer below to take overall responsibility for personal information processing and to handle data subjects' complaints and remedies for damages related to personal information processing.
Chief Privacy Officer
| Item | Details |
|---|---|
| Name | Seunghee Hwang |
| Title | Group Leader |
| Department | Management Planning Group |
| Contact | +82-2-6342-8021, hwang.sh@echoit.co.kr |
※ You will be connected to the department in charge of personal information protection.
② Data subjects may direct any inquiries, complaints, or requests for remedies related to personal information protection arising from their use of the Company's services (or products) to the Chief Privacy Officer and the responsible department. The Company will respond to and handle such inquiries without delay.
08 Requests to Access Personal Information
The Company will make every effort to process data subjects' requests to access personal information promptly.
① Data subjects may submit a request to access personal information under Article 35 of the Personal Information Protection Act to the department below.
Department receiving and handling access requests
| Item | Details |
|---|---|
| Department | Management Planning Group |
| Contact person | Seunghee Hwang |
| Contact | +82-2-6342-8021, hwang.sh@echoit.co.kr |
② In addition to the department in paragraph 1, data subjects may also submit access requests through the Ministry of the Interior and Safety's Personal Information Protection Portal (www.privacy.go.kr).
Ministry of the Interior and Safety Personal Information Protection Portal → Personal information complaints → Request for access, etc. (an i-PIN is required for identity verification)
09 Reporting Privacy Violations
The organizations below are independent of the Company. If you are not satisfied with the Company's own handling of complaints or remedies, or need further help, please contact them.
Privacy Violation Report Center (operated by KISA)
- Responsibilities : Reports of privacy violations, counseling requests
- Website : privacy.kisa.or.kr
- Phone : 118 (no area code)
- Address : 3F Privacy Violation Report Center, 9 Jinheung-gil (301-2 Bitgaram-dong), Naju-si, Jeollanam-do (58324)
Personal Information Dispute Mediation Committee
- Responsibilities : Dispute mediation, collective dispute mediation (civil resolution)
- Website : www.kopico.go.kr
- Phone : 1833-6972 (no area code)
- Address : 4F Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul (03171)
Supreme Prosecutors' Office Cyber Crime Investigation Division
- Phone : 02-3480-3573
- Website : www.spo.go.kr
Korean National Police Agency Cyber Bureau
- Phone : 182
- Website : cyberbureau.police.go.kr
10 Changes to This Privacy Policy
This privacy policy applies from its effective date. If there are additions, deletions, or corrections under laws or policies, the Company will give notice through announcements starting seven days before the changes take effect.
| Item | Date |
|---|---|
| Privacy policy announcement date | 2022/05/25 |
| Privacy policy effective date | 2022/06/01 |