Privacy Policy

Article 1 Purposes of Processing Personal Information

The Korea Information Technology Promotion Agency (hereinafter the "Agency") processes personal information for the following purposes. The personal information being processed shall not be used for any purpose other than the following, and where the purpose of use is changed, the Agency will take necessary measures such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.
  1. Provision of services and performance of duties The Agency processes personal information for purposes related to the provision of services and performance of duties, including this Site, such as content provision, gathering of user opinions, statistical information, identity verification, delivery of notices, securing smooth communication channels, and issuance of certificates.
  2. Handling of civil complaints The Agency processes personal information for the purposes of verifying the identity of the complainant, confirming the details of the complaint, contacting and notifying for fact-finding investigation, and notifying the results of processing.

Article 2 Processing and Retention Period of Personal Information

The Agency processes personal information within the period of retention and use of personal information under statute, or the period of retention and use of personal information consented to at the time of collection from the data subject. The processing and retention period for each type of personal information is as follows.

1. Academic Research/Assessment and Competitions

  • Required items of collection: name, date of birth, address, mobile phone number, email
  • Purpose of retention: provision of academic research fields, assessment, and competition services
  • Retention period: semi-permanent

2. Handling of Civil Complaints

  • Required items of collection: name, mobile phone number, email
  • Purpose of retention: complaint handling
  • Retention period: 3 years after completion of complaint handling

Article 3 Procedures and Methods for Destruction of Personal Information

When personal information becomes unnecessary due to the expiration of the retention period, achievement of the purpose of processing, and the like, the Agency shall destroy the relevant personal information without delay. Where personal information must continue to be preserved pursuant to other statutes notwithstanding the expiration of the retention period consented to by the data subject or the achievement of the purpose of processing, the relevant personal information (or personal information file) shall be transferred to a separate database (DB) or preserved in a different storage location. The procedures and methods for destruction of personal information are as follows.

1. Destruction Procedure

The Agency establishes a personal information destruction plan and destroys personal information (or personal information files) that are to be destroyed. The Agency selects the personal information (or personal information files) for which a reason for destruction has arisen, and destroys the personal information (or personal information files) with the approval of the Agency's personal information protection officer.

2. Method of Destruction

The Agency destroys personal information recorded and stored in electronic file form in such a way that the records cannot be reproduced, and destroys personal information recorded and stored in paper documents by shredding with a shredder or by incineration.

Article 4 Measures to Ensure the Safety of Personal Information

The Agency takes the following measures to ensure the safety of personal information.
  1. Administrative measures: establishment and implementation of an internal management plan, periodic staff training
  2. Technical measures: management of access rights to the personal information processing system and the like, installation of access control systems, encryption of unique identification information and the like, installation of security programs
  3. Physical measures: access control of computer rooms, document storage rooms, and the like

Article 5 Matters Concerning the Installation, Operation, and Refusal of Automatic Collection Devices for Personal Information

Automatic Collection Devices for Personal Information Installed and Operated

The Agency uses "cookies" that store use information and retrieve it from time to time in order to provide individual services and convenience to users. A cookie is a small amount of information sent by the server (http) used to operate the website to the user's browser, and is stored on the user's PC or mobile device. The data subject may set options for allowing or blocking cookies through web browser option settings. Provided, however, that if cookie storage is refused, difficulty may arise in the use of customized services.

Matters Concerning the Collection, Use, Provision, and Refusal of Behavioral Information

The Agency, in the course of service use, uses cookies to collect and use behavioral information without identifying individuals in order to provide services optimized for the data subject. The Agency collects behavioral information as follows.
  • Items of behavioral information collected: website visit history
  • Method of collecting behavioral information: automatically collected when the user visits the website
  • Purpose of collecting behavioral information: recommendation of customized information
  • Retention and use period: semi-permanent
The Agency collects only the minimum behavioral information necessary for optimized services and the like, and does not collect sensitive behavioral information that may infringe upon an individual's rights, interests, or privacy, such as thoughts, beliefs, educational background, or medical history.

Article 6 Rights and Obligations of the Data Subject and Legal Representative, and Method of Exercise

  1. A data subject may, at any time, exercise the rights of viewing, correction, deletion, and suspension of processing of personal information, and withdrawal of consent, as well as refusal or demand for explanation regarding automated decisions, with respect to the Agency.
  2. The exercise of rights may be made to the Agency in writing, by email, by facsimile (FAX), and the like, pursuant to Article 41, Paragraph 1 of the Enforcement Decree of the "Personal Information Protection Act", and the Agency shall take measures thereon without delay.
  3. The exercise of rights may also be made through a legal representative of the data subject or an agent such as a delegated person. In this case, a power of attorney in the form of Attachment No. 11 of the "Notice on Methods of Personal Information Processing" shall be submitted.
  4. The right of the data subject to demand viewing and suspension of processing of personal information may be restricted pursuant to Article 35, Paragraph 4 and Article 37, Paragraph 2 of the "Personal Information Protection Act".
  5. Where other statutes specify that the personal information is a target of collection, the deletion of the relevant personal information may not be demanded.
  6. Where the data subject's consent has been obtained regarding the fact that an automated decision will be made, or where notice has been given in advance through a contract or the like, or where there is a clear provision in law, refusal of the automated decision is not recognized, and only a demand for explanation and review is possible. Furthermore, a demand for refusal or explanation regarding an automated decision may be rejected where there is a legitimate reason, such as the possibility of unjustifiably infringing upon the life, body, property, or other interests of another person.
  7. Upon receiving a demand for viewing, a demand for correction or deletion, a demand for suspension of processing, or a demand for refusal or explanation of an automated decision in accordance with the rights of the data subject, the Agency verifies whether the person who made the demand is the data subject or a legitimate agent.
  8. Requests for viewing personal information and the like may be made to the department below. The Agency will endeavor to process the data subject's request for viewing personal information promptly.

Article 7 Personal Information Protection Officer

The Agency assumes overall responsibility for personal information processing duties, and designates a personal information protection officer as follows to handle complaints and remedy damages of data subjects concerning personal information processing. Data subjects may inquire of the personal information protection officer and the responsible department regarding all matters concerning personal information protection, complaint handling, damage relief, and the like, arising in the course of using the Agency's services (or business). The Agency will respond to and process the data subject's inquiries without delay.

Personal Information Protection Officer

Personal Information Protection Department

Article 8 Methods of Remedy for Infringement of Rights and Interests

Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Korea Internet & Security Agency's Personal Information Infringement Report Center, and the like, in order to obtain remedy for personal information infringement. For other inquiries concerning reports and consultations on personal information infringement, please contact the institutions below.
  1. Personal Information Dispute Mediation: (no area code) 1833-6972 (www.kopico.go.kr)
  2. Personal Information Infringement Report Center: (no area code) 118 (privacy.kisa.or.kr)
  3. Supreme Prosecutors' Office: (no area code) 1301 (www.spo.go.kr)
  4. National Police Agency: (no area code) 182 (ecrm.cyber.go.kr)
The Agency guarantees the data subject's right to self-determination of personal information, and endeavors to provide consultation and remedy for damages resulting from personal information infringement. If a report or consultation is needed, please contact the department below.
A person whose rights or interests have been infringed by a disposition or omission by the head of a public institution with respect to a demand under Article 35 (Viewing of Personal Information), Article 36 (Correction and Deletion of Personal Information), or Article 37 (Suspension of Processing of Personal Information, Etc.) of the "Personal Information Protection Act" may file an administrative appeal in accordance with the Administrative Appeals Act.
  • Central Administrative Appeals Commission: (no area code) 110 (www.simpan.go.kr)