Personal Information Processing Policy

< iMOSS >('http://www.imoss.co.kr' hereinafter 'iMOSS') establishes and discloses personal information processing policy as follows to protect personal information and to ensure prompt handling of related predicament according to Section 30 of 「Personal Information Protection Act」.

○ This personal information processing policy is effective from November 11th, 2009.

Section 1 (Purpose of processing personal information).

processes personal information for the following purposes. Such personal information shall not be used for any other purposes. In case a change to the purpose of use occurs, necessary measures, such as receiving supplementary agreement, shall be executed according to Section 18 of 「Personal Information Protection Act」.

• Civil complaint processing
• Personal information shall be processed for confirmation of petitioner's indentity; verifying complaints; contacting and notifying petitioner for investigating such petitions; and notifying the results of such petitions.

Section 2 (Processing and possession period of personal information)

① shall process/possess personal information within the possession/utilization period of personal information according to the applicable law or the agreement received from the owner of such personal information.

② The possession or utilization period of personal information is as follows.

shall possess and utilize personal information regarding civil complaint for the said purposes until the agreed period of collection and utilization of personal information.

• Basis of possession : None
• Related legislation : Records of consumer complaints or disputes: 3 years
• Exception : None

Section 3 (Provision of personal information to third parties)

① shall process personal information according to the stated purposes in Section 1 and provide personal information to third parties if and only if applicable to Section 17 and 18 of 「Personal Information Protection Act」.

② provides personal information as follows.

• Recipient of personal information : government offices (National Tax Administration, Ministry of Labor, etc.) that require provision of personal information for compliance of legal obligations, advisory institutions that provides counsel on company affairs.
• Recipient's purpose of using personal information : To distinguish email adresses, phone numbers, names, and petioners.
• Possession and utilization period of personal information by the recipient : 3 years after conclusion of petitions

Section 4 (Rights, obligations and methods of their execution by information owner or his/her legal representative)

① Information owner can invoke his/her right, including but not limited to, to browse, correct, delete, suspend processing personal information toward iMOSS whenever the owner wishes.

② Executing rights according to Section 4.1 toward iMOSS can be processed in writing, emails, FAX, etc. as stated in Section 41 Article 1 of 「Personal Information Protection Act」, and iMOSS shall process such requests immediately upon receipt.

③ Executing rights according to Seciton 4.1 can be processed by legal representatives, authorized personnel, etc. of the information owner. In such cases, a power of attorney according to Enclosure 11 of "Notification on processing personal information (Issue 2020-7)" must be submitted.

④ Information owner's rights to browse or suspend processing personal information can be limited according to Section 35 Article 4 and Section 37 Article 2 of 「Personal Information Protection Act」.

⑤ Demand to correct or delete personal information shall not be processed if other legislation claims such information for collection.

⑥ shall verify whether the petioner that executes right to browse, correct, delete, suspend processing personal information is the information owner or a rightful legal representative.

Section 5 (List of processed personal information)

① The list of personal information that processes is as follows.

Civil complaints

• Compulsory : veryfing petitioner
• Optional : email address, phone number, name

Section 6 (Termination of personal information)

① shall immediately terminate personal information if such personal information becomes unnecessary to possess due to expiration of possession period of personal information, completion of information processing purpose, etc..

② If personal information must be continuously preserved due to other legislation despite expiration of possession period of personal information agreed by information owner or completion of information processing purpose, such personal information shall be transferred to a seperate databse(DB) or a different storage method.

1. Personal information to be preserved : bank account information, transaction date

③ Procedures and methods to terminate personal information is as follows.

1. Termination procedures

• shall select personal information to be terminated according to the termination policy and terminate such personal information upon approval of responsible officer of .

2. Termination methods

• Technical methods shall be used to render digital form of information unreadable.
• Personal information printed on paper shall be grinded or incinerated.

Section 7 (Measures to maintain security on personal information)

is taking following actions to maintain security on personal information.

1. Regular self-inspection

Regular (once a quarter) self-inspection to maintain security regarding personal information processing.

2. Minimization of personal information processing personnel and education

Only the appointed personnel has access to personal information and process personal information.

3. Establishment and execution of internal management plan

establishes and executes internal management plan to safely process personal information.

4. Limitation on access to personal information

Controlled access to personal information by assignment, alteration, termination of access to the database that processes personal information is taking action, and firwall system is being used to block external unauthorized access.

Section 8 (Installation, management and refusal of automatic personal information collection method)

does not utilize 'cookie' which saves and loads use information of the information owner at any time.

Section 9 (Personal information security officer)

① iMOSS has an appointed personal information security officer who governs overall personal information processing, handling complaints and damage relief regarding personal information. ▶ Personal information security officer

• Name : Yu, Jin-Young
• Position : Deputy department head
• Rank : Deputy department head
• Contact information :02-2626-6773, rjy@imoss.co.kr, 02-2066-2701

② The information owner can make inquiries regarding security on personal information, complaints, damage relief, etc. to personal information security officer or the responsible department. iMOSS shall immediately reply and handle such inquiries.

Section 10 (Personal information inspection request)

The information owner can request inspection on personal information to the following department according to Section 35 of 「Personal Information Protection Act」

shall try its best to swiftly handle such inspection request on personal information.

▶ Receiving/processing department regarding personal information inspection request

• Department name : Department of management support
• Responsible officer : Yu, Jin-Young
• Contact information: 02-2626-6773, rjy@imoss.co.kr, 02-2066-2701

Section 11 (Relief methods toward infringement on rights and interests)

The information owner can request consultation to 'Personal Information Dispute Mediation Committee', 'Personal Information Infringement Report Center' of 'Korea Internet & Security Agency', etc. in order to relief damage from personal information infringement. Report or consultation regarding infringement on personal information can also be processed with the following institutes.

• 1. Personal Information Dispute Mediation Committee : (No dialing code) 1833-6972 (www.kopico.go.kr)
• 2. Personal Information Infringement Report Center : (No dialing code) 118 (privacy.kisa.or.kr)
• 3. Supreme Prosecutors' Office : (No dialing code) 1301 (www.spo.go.kr)
• 4. The National Police Agency : (No dialing code) 182 (cyberbureau.police.go.kr)

An information owner can claim administrative judgment against infringement on rights and interests occured from disposal or forbearance according to Section 35 (Inspection on personal information), Section 36 (Alteration, termination of personal information), Section 37 (Suspension of processing personal information) of 「Personal Information Protection Act」 executed by a head of a goverment office.

※ Please refer to the homepage of Central Administrative Trial Committee (www.simpan.go.kr) for more information about administrative judgment.

Section 12 (Alteration of personal information processing policy)

① This personal information processing policy is effective from November 11th, 2009.