Jeju Center for Creative Economy & Innovation (hereinafter referred to as the “Company”) establishes and discloses the following Personal Information Processing Policy in accordance with Article 30 of the Personal Information Protection Act to protect the personal information of data subjects and to promptly and efficiently handle related complaints.

Article 1 (Purpose of Processing Personal Information)

The Company processes personal information for the purposes described below. Personal information will not be used for purposes other than those specified herein, and in the event the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act.

1. Membership Registration and Management on the Website
To verify the intent to register as a member, identify and authenticate members for membership-based services, maintain and manage membership status, verify identity under the limited real-name verification system, prevent fraudulent use of services, confirm legal representative consent when processing personal information of children under 14, send notices and notifications, and handle complaints.

2. Provision of Goods or Services
To deliver goods, provide services, send contracts and invoices, provide content, offer customized services, verify identity and age, process payment and settlement, and collect receivables.

3. Handling of Complaints
To verify the identity of complainants, confirm the details of complaints, contact and notify for fact-checking, and provide notification of results.

Article 2 (Retention and Use Period of Personal Information)

① The Company processes and retains personal information within the retention and use period stipulated by law or the period consented to by the data subject when collecting the information.

② The processing and retention periods for each type of personal information are as follows:

1. Website Membership Registration and Management: Until withdrawal from the business/organization on website
However, in the following cases, retention shall continue until the reason no longer exists:

1) Until the completion of investigations or inquiries related to violations of applicable laws and regulations
2) Until the settlement of any remaining debts or credits arising from the use of the website


2. Retention of Communication Confirmation Data in accordance with Article 41 of the Protection of Communications Secrets Act
- Subscriber’s telecommunications date and time, start/end time, counterpart’s subscriber number, usage records, and originating base station location data: 1 year
- Computer communications, internet log records, and connection trace data: 3 months


Article 3 (Provision of Personal Information to Third Parties)

① The Company processes personal information only within the scope specified in Article 1 (Purpose of Processing Personal Information) and provides it to third parties only in cases falling under Article 17 or Article 18 of the Personal Information Protection Act, such as when the data subject has given consent or when permitted by special provisions of law. The Company does not otherwise provide personal information to third parties.

② For smooth service delivery, the Company may provide personal information to third parties only to the minimum extent necessary, after obtaining the data subject’s consent, pursuant to Article 17(1)1 of the Personal Information Protection Act.


Article 4 (Entrustment of Personal Information Processing)
① To ensure smooth processing of personal information, the Company entrusts certain personal information processing tasks as follows:
- Outsourcing Details
- Entrusted Party (Processor): Bros Group Co., Ltd.
- Details of Entrusted Tasks: Participant database management

② When concluding an entrustment contract, the Company specifies in writing (such as in a contract) the prohibition of processing personal information for purposes other than the entrusted work, technical and managerial protection measures, restrictions on re-entrustment, management and supervision of the entrusted party, and liability for damages, in accordance with Article 25 of the Personal Information Protection Act, and supervises the entrusted party to ensure safe processing of personal information.

③ If there are any changes to the entrusted tasks or the entrusted party, the Company will promptly disclose such changes through this Personal Information Processing Policy.


Article 5 (Rights of Data Subjects and Legal Representatives, and How to Exercise Them)

① Data subjects may exercise the following personal information protection rights against the Company at any time:

1. Request to access personal information

2. Request for correction of errors, etc.

3. Request for deletion

4. Request to suspend processing

② Rights under Paragraph 1 may be exercised against the Company via writing, telephone, email, FAX, or other equivalent means and the Company will take prompt action in response.

③ If a data subject requests correction or deletion of personal information due to an error, the Company will not use or provide the relevant personal information until the correction or deletion is completed.

④ Rights under Paragraph 1 may be exercised through the data subject’s legal representative or an authorized agent. In such cases, a power of attorney in the form set out in Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

⑤ Data subjects must not infringe upon their own or others’ personal information or privacy handled by the Company in violation of the Personal Information Protection Act or other relevant laws.

Article 6 (Items of Personal Information Processed)

The Company processes the following personal information items:

1. Membership Registration and Management on the Website
Required Items: Name, affiliation, job title, contact information, and email address


Article 7 (Destruction of Personal Information)

① The Company destroys personal information without delay when the retention period has expired or the processing purpose has been achieved, making the information no longer necessary.

② If personal information must be retained under other laws even after the retention period consented to by the data subject has expired or the processing purpose has been achieved, the Company stores such information in a separate database or keeps it in a different storage location.

③ The procedures and methods for destroying personal information are as follows:

1. Destruction Procedure
The Company selects personal information subject to destruction and destroys it with the approval of the Personal Information Protection Officer.

2. Destruction Method
Personal information recorded/stored in electronic files is destroyed so that the records cannot be restored, and personal information in paper documents is shredded or incinerated.


Article 8 (Measures to Ensure the Safety of Personal Information)

The Company takes the following measures to ensure the safety of personal information:

1. Administrative Measures: Establishment and implementation of internal management plans, regular employee training, etc.

2. Technical Measures: Management of access rights to personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs

3. Physical Measures: Access control for computer rooms, data storage rooms, etc.


Article 9 (Matters Concerning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

① The Company uses “cookies” to store and retrieve user information in order to provide personalized services.

② A cookie is a small piece of data sent by the server (HTTP) operating the website to the user’s computer browser and stored on the user’s PC or mobile device.

③ Data subjects can set their web browser options to allow or block cookies. However, rejecting cookies may cause difficulties in using personalized services.

▶ Allow/Block Cookies in Web Browsers
- Chrome: Browser settings > Privacy and security > Clear browsing data
- Edge: Browser settings > Cookies and site permissions > Manage and delete cookies and site data

▶ Allow/Block Cookies in Mobile Browsers
- Chrome: Mobile browser settings > Privacy and security > Clear browsing data
- Safari: Mobile device settings > Safari > Advanced > Block all cookies
- Samsung Internet: Mobile browser settings > Browsing history > Delete browsing history

④ In the course of service use, the Company collects and uses information such as the services and websites visited by the user, usage patterns, popular search terms, and whether secure access was used, in order to provide optimized information to the user.



Article 10 (Personal Information Protection Officer)

① The Company appoints the following Personal Information Protection Officer (PIPO) who takes overall responsibility for handling personal information and for addressing complaints and remedying damages related to personal information processing.

▶ Personal Information Protection Officer
Name: Gunui Lee
Position: Director
Contact: plan@broslab.co.kr
※ This connects to the department in charge of personal information protection.

▶ Department in Charge of Personal Information
Department Name: Planning Office
※ This connects to the department in charge of personal information protection.

② Data subjects may contact the Personal Information Protection Officer or the relevant department for all inquiries, complaints, or damage relief matters related to personal information protection arising during the use of the Company’s services (or business). The Company will respond to and process such inquiries without delay.


Article 11 (Request for Access to Personal Information)

Data subjects may submit a request for access to personal information under Article 35 of the Personal Information Protection Act to the department listed below. The Company will make every effort to process requests promptly.

▶ Department for Receiving and Processing Requests for Access
Department Name: Planning Office
Contact: plan@broslab.co.kr


Article 12 (Remedies for Rights Infringements)

Data subjects may contact the following institutions for relief from damages, consultation, and other matters related to the infringement of personal information:

1. Personal Information Dispute Mediation Committee: 1833-6972 (without area code) / www.kopico.go.kr

2. Personal Information Infringement Report Center: 118 (without area code) / privacy.kisa.or.kr

3. Supreme Prosecutors’ Office: 1301 (without area code) / www.spo.go.kr

4. National Police Agency: 182 (without area code) / ecrm.police.go.kr/minwon/main