Article 1 (Purpose of Handling Personal Data)

1. The SMG shall handle all personal data for the following purposes The SMG shall not handle personal data other than for the purpose stated hereinafter, and shall take necessary steps, including the acquisition of separate consent to such, pursuant to Article 18 of the Personal Information Protection Act in the event of a change in the purpose stated herein.

• 1) Newsletter
• ? Personal data is handled to confirm consent and delivery of newsletter subscription.
• 2) Global Monitoring Group
• ? Personal data is handled to confirm the identity of participants and delivery of emails.

Article 2 (Handling of Personal Data and Period of Retention)

1. The SMG shall handle all personal data within the period for retaining personal data stipulated in relevant laws or within the period consented to by data subjects when handling and retaining data.

2. The period of handling and retention of personal data is as follows.

• 1) Newsletter: Until cancellation of newsletter subscription.
• 2) Global Monitoring Group: Within 3 months of termination of monitoring group activities.

Article 4 (Consignment of Personal Data Handling)

1. The SMG consigns the handling of personal data for the smooth handling of personal data as follows.

• ? Consignee (Trustee): SUS4 inc.
• ? Consigned task details: Delivery of newsletter and global monitoring group operation

2. The SMG shall clearly state matters related to responsibilities such as prohibition of handling personal data other than for the purpose of consigned task execution, technical and managemental protection measures, reconsignment restrictions, management and supervision of consignees, and compensation for damages, among others, on documents such as contracts, and supervise the consignee for safe handling of personal data pursuant to Article 25 of the Personal Information Protection Act.

3. If the content of consignment or consignee is to change, the SMG shall notify of the fact through the Privacy Policy without delay.

Article 5 (Rights and Obligations of Data Subjects and Legal Representatives)

1. Data subjects may whenever exercise their right to browse, correct, delete, and terminate, etc. their personal data to the SMG.

2. Data subjects may exercise rights under Article 1 by filling out Form 8 of the Enforcement Decree of the Personal Information Protection Act pursuant to Article 41(1) of the Enforcement Decree of the Personal Information Protection Act and deliver via email, fax, etc., in which the SMG shall take appropriate measures without delay.

3. The rights stipulated in Article 1 can be exercised through a legal representative or an authorized representative, etc. of the data subject. In this case, a letter of attorney must be submitted following Form 11 of the Enforcement Decree of the Personal Information Protection Act.

4. The rights of data subjects may be restricted pursuant to Article 35(5) and 37(2) of the Personal Information Protection Act when demanding to view or terminate their personal data.

5. Data subjects may not demand the removal or correction of personal data if the personal data is stipulated as target for collection in other laws.

6. The SMG shall check if the subject who requested the viewing, correction, deletion, termination of personal data under the rights if the data subject is the data subject themself or a legal representative.

Article 6 (Handling of Personal Data Items)

1. The SMG handles the following personal data items.

Article 7 (Disposal of Personal Data)

1. The SMG disposes of the collected personal data of users without delay after the purpose of collection, period of use, and other matters have been fulfilled.

2. In the case of passing the period of personal data retention or fulfilling the purpose of its collection and use, etc. but is required to continue the retention of personal data following relevant laws, the personal data (or personal data file) is transferred to a separate database (DB) or a separate place of storage.

3. The procedures and method for personal data disposal is as follows.

• 1) Disposal procedure
• ? The SMG shall establish a personal data disposal plan to dispose of personal data (or personal data files) which needs to be disposed. The SMG shall select personal data (or personal data files) which needs to be disposed of and suspend the personal data (or personal data files) with the approval of the data subject.
• 2) Disposal method
• ? The SMG disposes of personal data saved in a digital format using methods that prevents the recovery of records including low level format, and personal data printed on paper is shredded or incinerated for disposal.

Article 8 (Protection of Personal Data)

1. The SMG takes the following measures to secure the protection of personal data.

• 1) Administrative measures: Establishment and implementation of internal management plan, regular staff training, etc.
• 2) Technical measures: Management of access rights such as personal data processing system, installation of access control system, encryption of unique identification information, installation of security program.
• 3) Physical measures: Access control of computer room, data storage room, etc.

Article 9 (Installation, Operation, and Rejection of Cookie Collection)

1. The SMG uses cookies which saves and constantly requests browsing history to provide a individually tailored experience to users.

2. Cookies are small pieces of data which the server used to operate the website sends to the user’s computer browser, and is sometimes saved in the storage of the user’s personal computer.

• A) Purpose of use of cookies: It is used to provide optimized data to the user by identifying browsing history, type of use, popular search terms, security access, etc. for each service and website visited by the user.
• B) Installation, operation, and refusal of cookies: Users can refuse the storage of cookies through the Tools > Internet Settings > Privacy menu on the top of the web browser.
• C) Users may experience difficulties in customized service usage upon refusal of cookies.

Article 10 (Privacy Officers)

1. The SMG designates a privacy officer stated hereinafter who is responsible for the handling of personal data and processing complaints and damage compensation related to personal data handling.

• 1) Privacy Officer
  • Dept.: Digital Policy Bureau
  • Contact: +82-2-2133-2971~2
  • Fax: +82-2-2133-1071
  • Email: privacy@seoul.go.kr
  • ※ You will be connected to the privacy department.
• 2) Privacy Manager
  • Dept.: Information System Division
  • Contact: +82-2-2133-2971~2
  • Fax: +82-2-2133-1071
  • Email: privacy@seoul.go.kr

2. Data subjects may inquire all matters related to data privacy when using the SMG’s services (or programs) such as inquiries, complaints, and damage compensation to the data privacy officer and data privacy department. The SMG shall respond and process inquiries by the data subject without delay.

Article 11 (Request to View Personal Data)

1. Data subjects may request to view personal data to the following departments pursuant to Article 35 of the Personal Information Protection Act. The SMG shall strive to allow prompt processing of data subjects’ request to view personal data.

• 1) Reception and processing department
  • Dept.: Information System Division
  • Contact: +82-2-2133-2971~2
  • Fax: +82-2-2133-1071
  • Email: privacy@seoul.go.kr

Article 12 (Compensation for Infringement of Rights and Interests)

1. Data subjects may inquire damage compensation and consultation for their privacy infringement to the institutions stated hereinafter.

• ? Please inquire the following institutions mentioned hereafter if the data subject is not satisfied with the results of the SMG’s response to complaints processing and damage compensation or require further assistance as it is a separate entity to the SMG.
• 1) Privacy Violation Report Center (Korea Internet & Security Agency)
  • Services: Reporting privacy violations, and request for consultation.
  • Website: privacy.kisa.or.kr
  • Contact: 118 (without area code)
  • Address: 3F, 9 Jinheung-gil, Naju-si, Jeollanam-do , 58324, Republic of Korea
• 2) Personal Information Dispute Mediation Committee (KOPICO)
  • Services: Request for personal data dispute resolution, and group (civil) dispute resolution.
  • Website: kopico.go.kr
  • Contact: 1833-6972 (without area code)
  • Address: 4F, 209 Sejong-daero, Jongno-gu, Seoul, 03171, Republic of Korea
• 3) Forensic Science Investigation Department (Prosecution Service)
  • Contact: +82-2-3480-3573
  • Website: spo.go.kr
• 4) Cyber Investigation Department (National Police Agency)
  • Contact: +82-182
  • Website: cyberbureau.police.go.kr

Article 14 (Changes in Privacy Policy)

1. This Privacy Policy takes effect on Jun.21, 2022.