In accordance with Article 30 of the Korean Personal Information Protection Act (PIPA), Uideokwon Social Welfare Foundation Gyeryong Hyo Center (the "Center") establishes and discloses the following Privacy Policy in order to protect the personal data of data subjects and to handle related grievances promptly.
Article 1 (Purposes of Processing Personal Data)
The Center processes personal data for the following purposes. Personal data is not used for any purpose other than those below; where a purpose changes, the Center takes the necessary steps, including obtaining separate consent under Article 18 of PIPA.
- Online enquiries — checking and answering enquiries, managing consultation records
- Donation consultation requests — explaining the donation process, consultation, and donation-related contact
- Board operation — managing postings and preventing misuse
- Service improvement — measuring access frequency and statistical analysis
Article 2 (Categories of Personal Data Processed and Retention Periods)
The Center collects and uses personal data as set out below, and processes and retains it within the retention and use period required by law or consented to by the data subject.
| Category | Data collected | Method | Retention |
|---|---|---|---|
| Online enquiry | Name, e-mail, phone, enquiry content (automatic) IP address, time of receipt | Website enquiry form | 3 years from receipt |
| Donation consultation | Name (or organisation), mobile, e-mail, donation method and amount, message (automatic) IP address, time of receipt | Website donation form | 5 years after the donation ends |
| Board use | Author name, password (encrypted), IP address | When writing a post | Until the post is deleted |
| Access logs | IP address, access date and time, browser information | Generated automatically | 3 months |
※ The Center does not collect resident registration numbers, bank account numbers or other unique identifiers or financial information through this website.
Information needed for an automatic transfer (CMS) application is handled on a separate paper form rather than on the website, and our staff will guide you individually.
Article 3 (Provision of Personal Data to Third Parties)
The Center processes personal data only within the scope specified in Article 1, and provides personal data to a third party only where Article 17 or 18 of PIPA applies, such as with the data subject’s consent or under a special provision of law.
At present the Center does not provide any personal data collected through the website to third parties.
Article 4 (Outsourcing of Personal Data Processing)
For the smooth handling of personal data, the Center outsources processing work as follows.
| Processor | Outsourced work |
|---|---|
| Simplexi Internet Co., Ltd. (Cafe24) | Website server operation and data storage |
When concluding an outsourcing contract, the Center specifies in the contract, in accordance with Article 26 of PIPA, the prohibition on processing personal data beyond the purpose of the outsourced work, technical and administrative safeguards, restrictions on re-outsourcing, and liability including damages, and supervises whether the processor handles personal data safely.
Article 5 (Rights and Obligations of Data Subjects and How to Exercise Them)
(1) A data subject may exercise the following data protection rights against the Center at any time.
- Request access to personal data
- Request correction where there is an error
- Request deletion
- Request suspension of processing
(2) The rights under paragraph (1) may be exercised in writing, by telephone or by e-mail, and the Center will act without delay.
(3) Where a data subject requests correction or deletion on the ground of an error, the Center will not use or provide the personal data concerned until the correction or deletion is complete.
(4) The rights may be exercised through a legal representative or an authorised agent, in which case a letter of authority must be submitted.
Article 6 (Destruction of Personal Data)
(1) Where personal data is no longer needed — because the retention period has passed or the purpose of processing has been achieved — the Center destroys it without delay.
(2) The destruction procedure and method are as follows.
- Procedure — the Center identifies the personal data for which grounds for destruction have arisen and destroys it with the approval of the Data Protection Officer.
- Method — electronic files are deleted securely so that they cannot be recovered or reproduced; paper documents are shredded or incinerated.
Article 7 (Measures to Ensure the Security of Personal Data)
The Center takes the following measures to ensure the security of personal data.
- Administrative — minimising and training staff who handle personal data, establishing and implementing an internal management plan
- Technical — managing access rights to the processing system, storing passwords in encrypted form, keeping access logs, installing and updating security software
- Encryption in transit — applying HTTPS across the whole website to protect information in transmission
- Physical — storing documents and auxiliary storage media in a locked location
Article 8 (Installation and Operation of Automatic Data Collection Devices, and Refusal)
(1) The Center uses cookies, which store and retrieve usage information, in order to provide users with individually tailored services.
(2) A cookie is a small amount of information sent by the server operating the website to the user’s browser and stored on the user’s computer. The Center uses cookies only to the minimum extent needed to provide the service, such as keeping the user signed in and remembering the language setting.
(3) Users may refuse the storage of cookies through their browser settings. However, refusing cookies may make some services difficult to use.
Article 9 (Data Protection Officer)
The Center designates a Data Protection Officer as set out below, to take overall responsibility for personal data processing and to handle complaints and remedies for data subjects in relation to that processing.
| Item | Details |
|---|---|
| Data Protection Officer | Facility Director Kim Yeon-sook |
| Contact | TEL 042-551-5629 / FAX 042-551-5631 / krhyocenter@hanmail.net |
| Address | 1380-49, Daedun-ro, Duma-myeon, Gyeryong-si, Chungcheongnam-do, Republic of Korea |
Data subjects may direct to the Data Protection Officer any enquiry, complaint or request for remedy relating to personal data protection that arises while using the Center’s services. The Center will respond and act without delay.
Article 10 (Remedies for Infringement of Rights)
To obtain relief for an infringement of personal data rights, data subjects may apply to the following bodies for dispute resolution or advice.
- Personal Information Dispute Mediation Committee — 1833-6972 (www.kopico.go.kr)
- Privacy Infringement Report Center — 118 (privacy.kisa.or.kr)
- Supreme Prosecutors’ Office, Cyber Investigation Division — 1301 (www.spo.go.kr)
- National Police Agency, Cyber Investigation Bureau — 182 (ecrm.police.go.kr)
Article 11 (Changes to this Privacy Policy)
This Privacy Policy applies from its effective date. Where content is added, deleted or corrected in line with legislation or policy, the Center will give notice through the website’s announcement board from seven days before the change takes effect.
Effective date : 27 August 2026