Ace Biopharm privacy policy

a. Online job applications and recruitment management

• The website has no member registration. Personal information is processed to verify the identity of online job applicants and to notify them of the outcome.

b. Handling of civil complaints

• Personal information is processed to verify the identity of the complainant, confirm the details of the complaint, contact and notify the complainant for fact-finding, and notify the outcome.

c. Provision of goods or services

• Personal information is processed for delivery of goods, provision of services, dispatch of invoices, identity verification, age verification, payment and settlement of charges, and debt collection.

d. Personal image information

• Personal information is processed for crime prevention and investigation, facility safety and fire prevention, traffic enforcement, and the collection, analysis and provision of traffic information.

1. File name: Ace Biopharm personal information collection file

• Items: name, phone number, email address. *These are the minimum items required to provide the service, so the service can be used only once consent is given.
• Method of collection: entered directly by the customer on the website
• Legal basis for retention: Credit Information Use and Protection Act
• Retention period: 3 years
• Related statutes:

1. <Credit rating agency>

• Recipient: credit information rating agency
• Purpose of use by the recipient: verification of transaction capacity through the resident registration number
• Retention and use period of the recipient: destroyed without delay

2. <Financial institution>

• Recipient: financial institution
• Purpose of use by the recipient: verification of transaction capacity through company name, position, company phone number, occupation, department, resident registration number and bank account details
• Retention and use period of the recipient: until expiry of the contract

3. <Investigative agency>

• Where an investigative agency makes a request for investigative purposes in accordance with the procedures and methods prescribed by law

1. Request to access personal information

2. Request for correction where there is an error

3. Request for deletion

4. Request to suspend processing

1. Rights under paragraph 1 may be exercised against the Company in writing, by email or by facsimile (fax) using Form No. 8 attached to the Enforcement Rules of the Personal Information Protection Act, and the Company will act on them without delay.
2. Where the data subject requests correction or deletion of an error in personal information, the Company does not use or provide the personal information concerned until the correction or deletion is complete.
3. Rights under paragraph 1 may be exercised through an agent such as the legal representative of the data subject or a duly authorised person. In that case, a power of attorney in Form No. 11 attached to the Enforcement Rules of the Personal Information Protection Act must be submitted.

Destruction procedure

• Information entered by the user is moved to a separate database once the purpose has been achieved (to a separate filing cabinet in the case of paper), and is then destroyed immediately or after being stored for a certain period in accordance with internal policy and other relevant statutes. Personal information moved to the database is not used for any purpose other than retention, except as required by law.

Deadline for destruction

• Where the retention period has elapsed, the user’s personal information is destroyed within 5 days from the end of that period. Where personal information becomes unnecessary because the purpose of processing has been achieved, the service has been discontinued or the business has ended, it is destroyed within 5 days from the date on which processing is recognised as no longer necessary.

Method of destruction

• Personal information stored as electronic files is deleted using a technical method that makes the records irreproducible. Personal information printed on paper is destroyed by shredding or incineration.

1. Minimising and training the staff who handle personal information

• The Company designates the staff who handle personal information and limits handling to those persons in charge, keeping their number to a minimum as a measure for managing personal information.

2. Regular internal audits

• The Company conducts internal audits on a regular basis (once every half year) to ensure security in the handling of personal information.

3. Establishment and implementation of an internal management plan

• The Company establishes an internal management plan for the safe processing of personal information.

4. Encryption of personal information

• Among users’ personal information, passwords are stored and managed in encrypted form so that only the individual knows them. For important data the Company uses separate security functions, such as encrypting files and transmitted data or using a file locking function.

5. Technical measures against hacking and the like

• To prevent the leakage or damage of personal information by hacking or computer viruses, the Company installs security programs and updates and inspects them periodically, installs its systems in areas where external access is controlled, and monitors and blocks access by technical and physical means.

6. Restriction of access to personal information

• The Company takes the measures necessary to control access to personal information by granting, changing and revoking access rights to the database system that processes personal information, and controls unauthorised external access using an intrusion prevention system.

7. Retention of access logs and prevention of forgery or alteration

• Access logs of the personal information processing system are retained and managed for at least 6 months, and security functions are used so that the logs are not forged, altered, stolen or lost.

8. Use of locking devices for document security

• Documents and auxiliary storage media containing personal information are kept in a secure place fitted with a lock.

9. Access control for unauthorised persons

• The Company maintains a separate physical storage location for personal information and establishes and operates access control procedures for it.

Purposes of using cookies

• Targeted marketing and personalised services based on analysing the access frequency and visit times of members and non-members, identifying users’ tastes and interests and tracking their trails, and measuring participation in events and the number of visits. You have the right to choose whether cookies are installed. You may therefore set an option in your web browser to allow all cookies, to confirm each time a cookie is stored, or to refuse the storage of all cookies.

How to refuse cookies

• Example: to refuse cookies you may select an option in the web browser you use to allow all cookies, to confirm each time a cookie is stored, or to refuse the storage of all cookies.
• Example of how to set it (Internet Explorer): Tools at the top of the web browser > Internet Options > Privacy
• However, if you refuse the installation of cookies there may be difficulties in providing the service.

1. The Company designates a personal information protection officer as set out below, who takes overall responsibility for work relating to the processing of personal information and for handling complaints and remedies for data subjects in connection with such processing.

Personal information protection officer

• Name: Jae-Yang Ryu, Director
• Phone: 070-4349-3007
• Department: Management Division

Personal information protection manager

• Name: Sung-Bin Lim, Assistant Manager
• Phone: 070-4349-3338
• Department: Support Team

2. Data subjects may direct any enquiry, complaint or request for remedy relating to the protection of personal information that arises while using the Company’s services (or business) to the personal information protection officer or the department in charge. The Company will answer and handle such enquiries without delay.

1. Data subjects may submit a request to access personal information under Article 35 of the Personal Information Protection Act to the department below. The Company will endeavour to process such requests promptly.

Contact for receiving and handling access requests

• Officer: Sung-Bin Lim, Assistant Manager
• Phone: 070-4349-3338
• Department: Support Team

2. In addition to the department for receiving and handling access requests in paragraph 1, data subjects may also submit access requests through the ‘Privacy Protection Comprehensive Support Portal’ website of the Ministry of the Interior and Safety (www.privacy.go.kr).

Ministry of the Interior and Safety, Privacy Protection Comprehensive Support Portal → Personal information complaints → Request to access personal information (an I-PIN is required for identity verification)

The organisations below are separate from <business/organisation name>. If you are not satisfied with the Company’s own handling of a personal information complaint or with the remedy provided, or if you need more detailed assistance, please contact them.

Privacy Infringement Report Center (operated by the Korea Internet & Security Agency)

• Responsibilities: reports of personal information infringement, requests for consultation
• Website: http://privacy.kisa.or.kr
• Phone: 118 (no area code)
• Address: Privacy Infringement Report Center, Korea Internet & Security Agency, 135 Jungdae-ro, Songpa-gu, Seoul (138-950)

Personal Information Dispute Mediation Committee (operated by the Korea Internet & Security Agency)

• Responsibilities: applications for personal information dispute mediation, collective dispute mediation (civil resolution)
• Website: http://privacy.kisa.or.kr
• Phone: 118 (no area code)
• Address: Privacy Infringement Report Center, Korea Internet & Security Agency, 135 Jungdae-ro, Songpa-gu, Seoul (138-950)

Supreme Prosecutors’ Office Cyber Crime Investigation Unit: 02-3480-3573 (http://www.spo.go.kr)

National Police Agency Cyber Crime Investigation Unit: 1566-0112 (http://netan.go.kr)

1. Legal basis and purpose of installation

• To set out the matters the Company must observe in installing and operating closed-circuit television (CCTV) for facility safety, fire prevention and crime prevention, and in protecting the image data, so that these are carried out properly and operated lawfully.

2. Number of units, locations and filming range

• Units installed: 22
• Locations: lobby, exterior, car park, corridors, inside and outside the warehouse
• Filming range: 360 degrees across the entire facility

3. Person responsible, department in charge and those authorised to access the image data

• Person responsible: Support Team
• Officer: Sung-Bin Lim
• Departments and persons with access: head office, logistics center
• Facility management / Plant - production planning, facility management

4. Filming hours, retention period, storage location and processing method

• Filming hours: 24 hours
• Retention period: 30 days from filming
• Storage location: within the CCTV recording storage device

5. How and where image data may be checked

• Requests by data subjects are handled using the form prescribed by the Company.
• The rights a data subject may exercise are viewing, replay and provision.
• Requests by data subjects are processed and provided with the approval of the officer in overall charge.
• Viewing and replay of image data are limited to the place where the recording equipment is installed.

6. Measures in response to requests by data subjects to view image data

• An application must be made using a request form for viewing or confirming the existence of personal image data. Viewing is permitted only where the data subject is the person filmed, or where it is clearly necessary for the life, body or property interests of the data subject.

7. Technical, administrative and physical measures to protect image data

• Viewing, replay and provision of image data must be recorded in a register kept with the storage device.
• The place where CCTV recording equipment is installed is fitted with a lock and designated a controlled area; where this is difficult, at least the recording equipment itself is locked.

* Privacy policy version: V 1