Korea Conformity Laboratories

[Article 1 (Personal Information Collection Category, and the Purpose of Handling Personal Information) ]

The category of personal information collected under the consent from the users who signed up for the membership, on the Website of the laboratories, is as follows.

Name of Website : The Website of the CEO, On-Line Application System, Education, Electronic Bidding, Recruitment, Skills Operation Center

Required Category	Selective Category
Name, Genders, Date of Birth, E-Mail Address, Mobile Phone Number, Password	Name of Business, Business Number, Name of Company, Phone Number of Company, Name of CEO

[Article 2 (How to Collect Personal Information)]

[Article 3 (Period of Treatment, Retention and Depletion of Personal Information) ]

The period of retention of personal information that the laboratories maintain is as follows.

Name of Personal Information	Period of Retention	Remarks
Information about Application Of Test Inspection	Five years	Personal Information in relation to KC Safety Certification shall be kept until the certificate is either deleted or cancelled
Period of Information related to Contract	Five years
Information about the Membership of Website	Until the period of company withdrawal
Visitor Information	Five years
Information about handling the payment for income tax	Five years
Information about Personal Video	30 days

In case when the period of retention of personal information lapses, or the purpose of treatment of personal information is attained, the laboratories shall, in principle, delete personal information ,without delay.
The procedures, period, and methods of deleting personal data are as follows

Procedures of Deleting Personal Information

Personal data that has attained its original purpose shall be moved to an independent space and shall be deleted, according to the internal guidelines or any related legislations. The personal data that has been moved to an independent space shall not be used for other purposes but those specified in the act, unless otherwise prescribed.

Period and Methods of Deleting Personal Data

In case when the period of retention of personal data comes to an end, or the personal data is unnecessary, by the attaining of its original purpose, the eliminating of corresponding works and others, corresponding personal information shall be deleted without delay. Information in an electronic file form shall be handled, through technological method not to reproduce recording data. Personal data printed in papers shall be deleted by either a crusher or incinerator.

[Article 4 (Providing Personal Information to the Third Party)]

Legal Validity for Providing Personal Information

In case when getting the special consent from the information subject of Section 2 (2) of Article 18 in 「Personal Information Protection Act」, and in case when there are special regulations in other legislations.

• In case when the information subject or the agent cannot express his/her opinions, or when a prior consent is impossible, due to the unidentified address, personal information can be disclosed, under the terms and conditions that the third party is admitted of getting such information, for the sake of his/her urgent life, physical or property interests

• In case when it is necessary to disclose personal data to the third party, for the purpose of preparing statistical reports and academic research, under the terms and conditions of providing personal information in the form that cannot identify particular individuals

• In case when it is impossible to perform affairs specified in other legislations, when personal information is not used for other purposes than those prescribed in the act, or when personal information is not provided to the third party, under the terms and conditions that there are the deliberation and resolution from the Personal Information Protection Commission

• In case when it is necessary to provide personal data, for the compliance to the treaty and any other international agreements, or for the provision to foreign governments or international organizations

• In case when it is necessary to provide personal data, for the purpose of prosecuting and maintaining crime investigations and cases

• In case when it is necessary to provide personal data, for the purpose of executing the court’s judgment affairs

• In case when it is necessary to provide personal data, for the purpose of executing care, custody, protective disposition of crime

The laboratories shall provide personal information to the third party, as follows

1.National Tax Service

1. Object of Personal Information : National Tax Service
2. Purpose of Using Personal Information : For a Report of Tax Withheld to Customers
3. Category of Personal Information : name, ID
4. Period of Retention and Usability of Personal Information : until the purpose of using personal information is attained
5. Disagreement to Provide Personal Information and Disadvantage from the Disagreement to Provide Personal Information : Any personal information provider can have his/her right to disagree to provide personal information. But if he/she disagrees to provide personal information, the return of income tax is not filed to National Tax Service.

[Article 5 (How to Exercise the Right and Obligation of Information Subject) ]

Request for Identifying Personal Information

Personal data that the laboratories maintain allows to request for identifying personal information, as prescribed in Article 35 (Identifying Personal Information) in 「Personal Information Protection Act」.
But, the request for identifying personal information can be limited, according to the terms and conditions of Article 35-5, as follows.

• In case when it is either prohibited or limited, according to the legislations

• In case when it is feared to hurt other people’s life or physical bodies, or to unjustly infringe other people’s properties or any other interests

• In case when any information subject does not articulate his/her intent to cancel the contract, under the terms and conditions that the contract can hardly be fulfilled, for example, that it is impossible to provide services agreed with the information subject, if personal information is left untreated.

Request for the Cessation of Maintaining Personal Information

Personal data that the laboratories maintain allows to request for the cessation of managing personal information, as prescribed in Article 37 (Cessation of managing Personal Information) in 「Personal Information Protection Act」. But, the request for the cessation of managing personal information can be rejected, according to Article 37-2 of Personal Information Protection Act.

• In case when there are special law regulations pursuant to those measures of the cessation, or it is inevitable in compliance to legislative ordinance

• In case when it is feared to hurt other people’s life or physical bodies, or to unjustly infringe other people’s properties or any other interests

• In case when any information subject does not articulate his/her intent to cancel the contract, under the terms and conditions that the contract can hardly be fulfilled, for example, that it is impossible to provide services agreed with the information subject, if personal information is left untreated.

[Article 6 (Measures to Secure the Safety of Personal Information)]

Minimization and Training of Personal Information Handlers

• Personal information handlers shall be specified and managed, under the terms and conditions of the absolutely required number of personnel. Training targeting personal information handlers shall be provided, for safe management of personal information.

Limit of Access to Personal Information

• Necessary measures for controlling an access to personal information are taken, by offering, changing, and repealing the right to access the data system for personal information. Unauthorized access from the outside is controlled, through the firewall management system.

Maintenance of Access Record

• The access record (web log, summary information, and others) connected to personal data processing system shall be maintained and maintained, for more than six months, at least. The half yearly access record of personal data processing system shall be investigated, in order to respond to the leaked, fabricated, and damaged personal data.

Encoding of Personal Identification Information

• Personal identification information shall be kept and maintained, through the encoding system. Also, the security function is being utilized, through transfer encoding type.

Establishment of Security Programs and Regular Checkup and

• The security programs shall be established, regenerated and checked, on a regular basis, in order to prevent personal information from being leaked and damaged by hacking or computer viruses.

Control on the access to Unauthorized Persons

• The physical storage place for personal information data shall be established independently, and the procedures of control on the access shall be established and operated.

Regular Internal Checkup

• Regular personal information protection management checkup is being conducted, in order to secure the stability in dealing with personal information

Establishment and Implementation of Internal Management Planning

• Internal management planning is established and implemented, in order to safely deal with personal information.

[Article 7 (Personal Information Protection Officer)]

[Article 8 (Rectification of Human Rights Violation)]

[Article 9 ( Change of Privacy Policy )]