Gamdo (hereinafter referred to as "the Company") actively protects the personal information of data subjects it handles and has established and implemented this privacy policy to comply with the Personal Information Protection Act and to protect the rights and interests of data subjects as well as to facilitate the resolution of any grievances related to personal information. The Company’s privacy policy may change in accordance with relevant laws, guidelines, and internal operational policies, and when the privacy policy is changed, it will be disclosed in accordance with the methods stipulated by relevant laws.

This privacy policy will take effect from September 18, 2024, and contains the following contents:

Article 1 (General Provisions)

• Purpose of handling personal information and the items of personal information handled

• Retention period and destruction of personal information

• Rights and obligations of data subjects and how to exercise them

• Rights of legal representatives of children under 14 years of age

• Measures to ensure the safety of personal information

• Collection of opinions and handling of complaints

Article 2 (Purpose of Handling Personal Information and Items of Personal Information Handled)

[General Personal Information]

Article 3 (Mandatory Items)

1. Items of Personal Information Handled:

   • Name, email, mobile phone number, company name

2. Purpose of Handling Personal Information:

   • To provide services, manage customers, and for sales and marketing purposes

3. Automatic Email Subscription:

   • For notifications, guidance, and marketing purposes

Article 4 (Optional Items)

1. Items of Personal Information Handled:

   • Industry, title, address, role, company number

2. Purpose of Handling Personal Information:

   • To provide services, manage customers, and for sales and marketing purposes

Article 5 (Retention Period and Destruction of Personal Information)

a. Retention Period of Personal Information

• The Company will destroy personal information without delay when the purpose of handling the information is achieved and it is no longer necessary. However, if the data subject has given prior consent or if other laws require the retention of the data subject's personal information, the Company may retain the relevant personal information.

b. Destruction of Personal Information

1. When the Company destroys personal information, it will take measures to ensure that the information cannot be restored or regenerated.

2. If the Company does not destroy the personal information but retains it, it will store and manage the information separately from other personal data.

3. When destroying personal information in electronic file form, the Company will issue a deletion command in a way that it cannot be restored programmatically. If all personal information must be destroyed, it will be permanently deleted using a physical method that prevents recovery.

4. If the personal information to be destroyed is in the form of records, printed materials, written documents, or other recording media, the Company will shred or incinerate them.

Article 6 (Rights and Obligations of Data Subjects and How to Exercise Them)

a. Access to Personal Information

1. Data subjects can request access to their personal information handled by the Company. In this case, the data subject must submit a personal information access request form indicating the specific items and contents of personal information, the purpose of collection and use, the retention and use period, the status of third-party provision, and the consent to handle personal information.

2. The Company will allow the data subject to access their personal information within 10 days of receiving the access request. If there is a legitimate reason for not being able to allow access within this period, the Company will notify the data subject of that reason and may delay the access. When the reason is resolved, access will be provided without delay.

3. The Company may refuse to grant access and will inform the data subject of the reason in the following cases:

   1. If access is prohibited or restricted by law

   2. If there is a risk of harming another person's life or body or unjustly infringing upon another person's property or other interests

b. Correction and Deletion of Personal Information

1. Data subjects who have accessed their personal information can request the Company to correct or delete their information. In this case, the data subject must submit a personal information correction/deletion request form or provide proof of their identity.

2. The Company will investigate the correction/deletion request within 10 days of receiving it and take necessary measures as requested. The Company will notify the data subject of the actions taken, and if it does not comply with the deletion request due to other legal requirements, it will inform the data subject of that fact, the reasons, and how to file an objection.

3. When the Company deletes personal information at the request of the data subject, it will ensure that it cannot be restored or regenerated.

c. Suspension of Handling Personal Information

1. Data subjects wishing to request the suspension of the handling of their personal information must submit a personal information handling suspension request form.

2. The Company may refuse the request for suspension in the following cases:

   1. When there are special provisions in law or if compliance with legal obligations is unavoidable

   2. If there is a risk of harming another person's life or body or unjustly infringing upon another person's property or other interests

   3. If not handling the personal information would make it difficult to fulfill a contract with the data subject, provided the data subject has not clearly expressed their intention to terminate the contract

3. The Company will notify the data subject of the result of their request for suspension within 10 days. If the request is not complied with, the Company will inform the data subject of the reasons and how to file an objection.

4. The Company will promptly take necessary measures, such as destroying the suspended personal information.

d. Method and Procedure for Exercising Rights

1. Requests for access, correction, deletion, and suspension of handling of personal information can be made by the data subject, their legal representative, or someone authorized by the data subject. However, if the legal representative or authorized person is acting on behalf of the data subject, they must submit a power of attorney form.

2. A fee and postage may be charged to those making requests for access, correction, deletion, and suspension as specified by the Company.

3. The Company will retain the personal information access request forms or proof of identity for 90 days after the request is received and will dispose of them afterward.

Article 7 (Rights of Legal Representatives of Children Under 14 Years of Age)

Legal representatives of children under 14 years of age can request access, correction, deletion, processing, or suspension of the child’s personal information.

Article 8 (Measures to Ensure the Safety of Personal Information)

The Company takes the following technical, managerial, and physical measures to ensure that personal information is not lost, stolen, leaked, altered, or damaged.

a. Establishment and Implementation of an Internal Management Plan for Safe Handling of Personal Information

• The Company has established and implemented an internal management plan that includes:

  1. Designation of a personal information handling officer

  2. Roles and responsibilities of the personal information handling officer and handlers

  3. Necessary measures to ensure the safety of personal information

  4. Training for personal information handlers

  5. Other necessary matters for handling personal information

b. Access Control and Limitation of Access Rights

1. The Company grants access rights to the personal information handling system to employees based on the minimum scope necessary for their job responsibilities and promptly changes or revokes access rights when there are personnel changes.

2. When issuing user accounts for the personal information handling system, the Company issues one user account per handler, ensuring accounts are not shared.

3. The Company has established and applies password creation rules.

4. To prevent unauthorized access and infringement through information and communication networks, the Company limits access rights to the personal information handling system by IP address and other means.

5. If personal information handlers access the Company's personal information handling system from outside, secure access methods like VPNs or dedicated lines are applied to prevent unauthorized access or leakage of personal information.

c. Application of Encryption Technologies for Safe Storage and Transmission of Personal Information

1. The Company encrypts unique identification information and passwords when transmitting or receiving them via communication networks or auxiliary storage media.

2. The Company stores passwords encrypted and applies one-way encryption to prevent decryption.

d. Measures for Storing Access Records and Preventing Forgery and Alteration

1. The Company securely stores access records of personal information handlers to prevent alteration, theft, or loss.

e. Installation and Updating of Security Programs

• The Company installs and operates security programs, such as antivirus software, to prevent and cure malicious programs, and complies with:

  1. Using automatic update functions or updating at least once a day

  2. Immediately updating in response to security alerts related to malicious programs or announcements from software vendors regarding security updates

f. Physical Measures for Safe Storage of Personal Information

1. The Company has established and operates access control procedures for physical storage locations of personal information.

2. The Company stores documents and auxiliary storage media containing personal information in secure locations with locking mechanisms.

Article 9 (Collection of Opinions and Handling of Complaints)

Data subjects can raise complaints related to personal information handling to the personal information handling officer or responsible department. The Company will provide prompt and sufficient responses to the grievances of data subjects.

[Personal Information Handling Officer]
Name: Kyuseung Kyoung
Email: beyond-chapter@beyond-chapter.com

​

* This translation could be incorrect