Privacy Policy

Fincatch (the “Company”) establishes and discloses the following privacy policy in accordance with Article 30 of the Personal Information Protection Act in order to protect the personal information of data subjects and to handle related grievances promptly and smoothly.

The Company processes personal information for the following purposes. Personal information being processed will not be used for any purpose other than those stated below, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

1. Website membership registration and management

Personal information is processed to confirm intent to register, identify and authenticate members for member-only services, maintain and manage membership, verify identity under the limited identity verification system, prevent fraudulent use of services, confirm legal guardian consent when processing the personal information of children under 14, deliver notices, and handle grievances.

2. Provision of goods or services

Personal information is processed for purposes such as delivering goods, providing services, sending contracts and invoices, providing content, providing customized services, identity verification, age verification, payment and settlement of fees, and debt collection.

3. Grievance handling

Personal information is processed to verify the identity of complainants, confirm complaint details, contact and notify for fact-finding, and communicate results.

① The Company processes and retains personal information within the retention and use period prescribed by law or the period agreed upon when collecting personal information from the data subject.

② The processing and retention periods for each category of personal information are as follows.

1. Website membership registration and management: until withdrawal from the business/organization website

However, where any of the following applies, until the relevant matter is concluded:

1) Where an investigation or inquiry into a violation of applicable law is in progress, until the investigation or inquiry is concluded

2) Where claims or obligations arising from use of the website remain, until such claims or obligations are settled

① The Company processes personal information only within the scope specified in Article 1 (Purposes of Processing Personal Information), and provides personal information to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the data subject’s consent or under a specific provision of law.

② Where the Company provides personal information to a third party, it informs the data subject of the recipient, the purpose, the categories of personal information provided and the retention and use period, and obtains separate consent.

① The Company may outsource personal information processing to external parties for the smooth handling of personal information, and where it does so, discloses the outsourced work and the processor through this privacy policy.

② When entering into outsourcing agreements, the Company specifies in the contract, pursuant to Article 25 of the Personal Information Protection Act, matters such as the prohibition on processing personal information for purposes other than the outsourced work, technical and administrative safeguards, restrictions on sub-outsourcing, management and supervision of the processor, and liability for damages, and supervises whether the processor handles personal information safely.

③ Any change in the outsourced work or the processor will be disclosed without delay through this privacy policy.

① Data subjects may exercise the following rights relating to personal information protection with the Company at any time.

1. Request access to personal information

2. Request correction where errors exist

3. Request deletion

4. Request suspension of processing

② Rights under paragraph 1 may be exercised in writing, by telephone, by e-mail or by fax, and the Company will act on them without delay.

③ Where a data subject requests correction or deletion of errors in personal information, the Company will not use or provide that personal information until the correction or deletion is complete.

④ Rights under paragraph 1 may be exercised through an agent such as the data subject’s legal representative or a person with delegated authority. In such cases, a power of attorney in the form prescribed in Annex Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.

⑤ Data subjects must not infringe upon their own or others’ personal information or privacy processed by the Company in violation of the Personal Information Protection Act or other applicable laws.

The Company processes the following categories of personal information.

1. Website membership registration and management

Required: name, date of birth, user ID, password, address, telephone number, gender, e-mail address, i-PIN number

Optional: marital status, areas of interest

2. Provision of goods or services

Required: name, date of birth, user ID, password, address, telephone number, e-mail address, i-PIN number, and payment information such as credit card number and bank account details

Optional: areas of interest, purchase history

3. The following personal information may be generated and collected automatically in the course of using internet services.

IP address, cookies, MAC address, service usage records, visit records, records of improper use, etc.

① When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the processing purpose, the Company destroys it without delay.

② Where personal information must continue to be preserved under other laws even though the agreed retention period has expired or the processing purpose has been achieved, the Company moves it to a separate database or stores it in a separate location.

③ The procedures and methods for destroying personal information are as follows.

1. Destruction procedure

The Company selects personal information for which grounds for destruction have arisen and destroys it with the approval of the Company’s privacy officer.

2. Destruction method

Personal information stored in electronic files is destroyed using methods such as low-level formatting so that the records cannot be recovered, and personal information recorded on paper is shredded or incinerated.

The Company takes the following measures to ensure the security of personal information.

1. Administrative measures: establishing and implementing an internal management plan, regular staff training, etc.

2. Technical measures: managing access rights to personal information processing systems, installing access control systems, encrypting unique identifiers, installing security software

3. Physical measures: access control for server rooms and data storage rooms

① The Company uses cookies, which store and retrieve usage information, to provide individually customized services to users.

② A cookie is a small piece of information sent by the server (http) operating the website to the user’s browser, and may be stored on the hard disk of the user’s computer.

A. Purpose of cookies: cookies are used to identify users’ visiting and usage patterns across services and websites, popular search terms, secure connection status and the like, in order to provide optimized information.

B. Installation, operation and refusal of cookies: users may refuse to store cookies through the option settings under Tools > Internet Options > Privacy in the web browser.

C. Refusing to store cookies may make it difficult to use customized services.

① The Company designates the following privacy officer to take overall responsibility for personal information processing and to handle complaints and remedies for data subjects related to personal information processing.

▶ Privacy Officer

Name: Soohyun Lim

Title: CEO

Contact: support@fincatch.co.kr

※ Inquiries are routed to the personal information protection team.

② Data subjects may direct all inquiries, complaints and requests for remedy relating to personal information arising from use of the Company’s services (or business) to the privacy officer and the responsible team. The Company will respond to and handle such inquiries without delay.

Data subjects may submit requests for access to personal information under Article 35 of the Personal Information Protection Act to the department below. The Company will endeavor to process such requests promptly.

▶ Department receiving and processing access requests

Department: CSC

Contact: support@fincatch.co.kr

Data subjects may contact the following organizations for remedies or counseling regarding personal information infringement.

▶ Personal Information Infringement Report Center (operated by the Korea Internet & Security Agency)

- Responsibilities: reporting personal information infringements, requesting counseling

- Website: privacy.kisa.or.kr

- Telephone: 118 (no area code)

- Address: Personal Information Infringement Report Center, 3F, 9 Jinheung-gil (301-2 Bitgaram-dong), Naju-si, Jeollanam-do 58324

▶ Personal Information Dispute Mediation Committee

- Responsibilities: personal information dispute mediation, collective dispute mediation (civil resolution)

- Website: www.kopico.go.kr

- Telephone: 1833-6972 (no area code)

- Address: 4F, Government Complex Seoul, 209 Sejong-daero, Jongno-gu, Seoul 03171

▶ Supreme Prosecutors’ Office Cyber Crime Investigation Unit: 02-3480-3573 (www.spo.go.kr)

▶ Korean National Police Agency Cyber Bureau: 182 (http://cyberbureau.police.go.kr)