Personal Information Protection Processing Policy

The Seoul Business Agency (hereinafter “Agency") values the protection of users' personal information and complies with the 『Personal Information Protection Act』 and related laws to ensure the protection of users' personal information. In accordance with Article 30 of the 『Personal Information Protection Act』, the Agency establishes and discloses the following privacy policy to protect the personal information of data subjects and to promptly and smoothly handle related complaints.

Article 1 (Purpose of Processing Personal Information)

The Agency processes personal information for the following purposes. The personal information being processed will not be used for any purpose other than those listed below, and in case of a change in the purpose of use, necessary measures, such as obtaining separate consent in accordance with Article 18 of the 『Personal Information Protection Act』, will be taken.

• Joining Trade On and service provision
  
  • Personal information is processed to confirm the intention to join Trade On, verify and authenticate the identity of the user, maintain and manage member qualifications, prevent improper use of services, send various notices and notifications, and to handle complaints.
• Civil petitions treatment
  
  • Personal Information is processed to identify civil petitioners, confirm the petition details, contact and notify for fact-finding, and to inform the results of processing.
• Export support service provision
  
  • The Agency processes personal information based on user information to provide online exhibitions, leasing, and advisory services, as well as buying offers and business matching consultations.
• Utilization for marketing and advertising
  
  • Personal information is processed for purposes such as providing new services and customized services, offering events and business information, verifying the effectiveness of services, understanding usage frequency, and providing statistics on users' service usage.
• The purpose of processing each data subject are as follows:

  	Subjects of personal information	Operational basis	Processing Purpose
  1	Trade On Exhibiting Company	Consent of the data subject	① Joining Trade On ② Civil petitions treatment ③ Export support services provision ④ Utilization for marketing and advertising
  2	Trade On Buyer	Consent of the data subject	① Joining Trade On ② Civil petitions treatment

Article 2 (Types of Personal Information Being Processed)

• For Trade On membership registration and provision of various services, the Agency processes the following types of personal information.

  	Subjects of personal information	Collection & Processing items of information
  1	Trade On Exhibiting Company	· Mandatory: Personal identification information and corporate information such as ID, password, name, gender, address, mobile phone number, company name, phone number, email address, and business registration number · Optional: Information provided by users other than personal information
  2	Trade On Buyer	· Mandatory: ID, password, country, name, company name, phone number, email address · Optional: Information provided by users other than personal information

Article 3 (Processing and Retention Period of Personal Information)

• The Agency processes and retains personal information within the retention and use period of personal information according to the relevant laws or that are agreed to by the subjects of information when collecting the information.
• The processing and retention periods for each type of personal information are as follows:
  • 1) Membership registration and management: From the member's registration date to the date of withdrawal
• However, personal information may be retained until the end of the following period for the following reasons:
  • 1) In cases where investigations or inquiries are being conducted due to a violation of relevant laws, it will be retained until the end of the investigation or inquiry
  • 2) In cases where there are remaining rights and obligations related to website usage, it will be retained until the settlement of the rights and obligations
  • 3) Records related to transactions, including display and advertising, contract details, and performance under the 「Electronic Commerce Consumer Protection Act」
    • Records related to display and advertising: 6 months
    • Records of contracts or subscription withdrawal, payment of fees, and supply of goods or services: 5 years
    • Records related to consumer complaints or dispute resolution: 3 years
  • 4) Preservation of communication data as required by the 「Act on Protection of Communication Secrets」
    • Date and time of initiation and termination of electronic communication, the counterparty's subscriber number, frequency of use, and location tracking data of the transmitting base station: 1 year
    • Computer communication, internet log records, access location tracking data: 3 months.

Article 4 (Provision of Personal Information to Third Parties)

The Agency processes the personal information of data subjects only within the scope specified in 'Article 1 - Purpose of Processing Personal Information.' Personal information will be provided to third parties only with the consent of the data subject, or when there are special regulations under Article 17 and Article 18 of the 『Personal Information Protection Act』, and in all other cases, personal information of the data subject will not be provided to third parties.

Article 5 (Consignment of Personal Information Processing)

• The Agency entrusts some personal information processing tasks as follows for the smooth personal information processing and provision of Trade On Services.

  	Consignment work	Name of trustee company	Information category	Period of retention and use
  1	Development, management and repair of system (DB Management)	With System Co., Ltd	User, Company, Product Information	Until the consignment contract is terminated
  2	Trade On service operations	Kompass Korea	User, Company, Product Information	Until the consignment contract is terminated

• For consignment agreements, the Agency complies with Article 26 of the 『Personal Information Protection Act』 by specifying in documents, such as contracts, matters related to the prohibition of processing personal information beyond the intended purpose, technical and administrative protective measures, restrictions on re-outsourcing, management and supervision of the trustee company, and liability for damages. The Agency also supervises whether the trustee company handles personal information securely.
• In the event of a change in the content of the consignment work or the trustee company, the Agency will promptly disclose such fact in compliance with Privacy Policy.

Article 6 (Rights, Obligations, and Methods of Exercising Rights of Data Subjects and Legal Representatives)

• Data subjects have the right to request access, correction, deletion, and processing suspension of their personal information from the Agency at any time.
• The exercise of rights under paragraph 1 can be made through a written form, email, fax or other means in accordance with Article 41, paragraph 1 of the 『Enforcement Decree of the Personal Information Protection Act』, and the Agency will promptly take action.
• The exercise of rights under paragraph 1 can be done through a legal representative or a proxy. In this case, a power of attorney in accordance with the form provided in Attachment 11 of the "Guidelines for Personal Information Processing Methods" must be submitted.
• The right to access personal information and request processing suspension may be limited in accordance with Article 35, paragraph 4 and Article 37, paragraph 2 of the 『Personal Information Protection Act』.
• Requests for correction and deletion of personal information cannot be made when the personal information is specified as a collection target under other laws.
• The Agency verifies whether the requester of an access request, correction or deletion request, or processing suspension request is the data subject or a legitimate representative when such requests are made in accordance with data subject rights.

Article 7 (Procedure and Method of Personal Information Destruction)

• When personal information becomes unnecessary, due to the reasons such as expiration of retention period or achievement of purpose of its processing, relevant personal information shall be destroyed promptly.
• If personal information must be retained due to other laws, despite the expiration of the agreed retention period or the achievement of the processing purpose, the Agency moves the personal information to a separate database(DB) or retains it in a different location.
• The procedure and method of personal information destruction are as follows
  • 1) Destruction Procedure
    The Agency establishes a plan for the destruction of personal information (or personal information files). The Agency selects the personal information (or personal information files) for destruction, and with the approval of the Agency's Personal Information Protection Manager, proceeds with the destruction of personal information.
  • 2) Destruction Method
    Information in the form of an electronic file shall be destroyed via technical methods that will prevent its recovery, and printed version of personal information shall be shredded or incinerated.

Article 8 (Measures for the Protection of Personal Information)

The Agency takes the following measures to protect personal information.

• Administrative measures: Establishment and implementation of internal management plans, regular employee training, etc.
• Technical measures: Access control management of personal information processing systems, installation of access control systems, encryption of unique identification information, installation of security programs, etc.
• Physical measures: Access control to computer rooms, data storage rooms, etc.

Article 9 (Installation, Operation, and Refusal of Automatic Personal Information Collection Devices)

• The Agency uses "cookies" to store and imports information of users frequently to provide individualized services to users.
• Cookies are small pieces of information sent to the user’s computer browser and may be stored on the user’s PC hard disk by the server(http) to operate the website.
  • a. Purpose of using cookies: Cookies are used to understand users' visiting and usage patterns on various services and websites they visit, as well as their security access status, in order to provide optimized information to users.
  • b. Installation, operation, and refusal of cookies: Users can refuse to store cookies by setting options in the Tools > Internet Options > Privacy menu at the top of their web browser.
  • c. If you refuse to store cookies, it may cause difficulties in using customized services.

Article 10 (Personal Information Protection Manager)

• The Agency assigns a personal information protection manager who oversees personal information processing, handles complaints from the subjects of information, and relieves their damage as follows.
  • ▸ Personal Information Protection Manager
    - Name: Kim Seong-min
    - Title: Head of Marketing Division
    - Contact: 02-2657-5800
  • ▸ Personal Information Protection Department
    - Department Name: Global Marketing Team
    - Responsible Person: Seo Ji-min
    - Contact: 02-2657-5729
• Subjects of information may make inquiries about any matters related to personal information protection, complaints, damage relief, etc., arising from using the Agency's services (or projects) to personal information protection manager or department. The Agency shall reply to and handle the inquiries from data subjects immediately.

Article 11 (Request for Access to Personal Information)

Data subjects can request access to personal information in accordance with Article 35 of the 『Personal Information Protection Act』 to the following department. The Agency will make efforts to process data subject's requests for access to personal information promptly.

• ▸ Personal Information Access Request Reception and Processing Department
  - Department Name: Global Marketing Team
  - Responsible Persons: Seo Ji-min / Lee Hae-yeon
  - Contact: 02-2657-5729 / 02-2657-5727

Article 12 (Remedies for Violation of Rights)

Data subjects can seek remedies, such as dispute resolution or counseling, for damages resulting from personal information violations through the Personal Information Dispute Mediation Committee, Personal Information Infringement Report Center of Korea Internet&Security Agency, and other relevant agencies. For reporting and counseling on personal information infringements and other matters, please contact the following organizations.

• Personal Information Dispute Mediation Committee: 1833-6972 (www.kopico.go.kr)
• Personal Information Infringement Reporting Center: 118 (privacy.kisa.or.kr)
• Supreme Prosecutors' Office: 1301 (www.spo.go.kr)
• Korean National Police Agency: 182 (ecrm.cyber.go.kr)

In the case of requests made under Article 35 (Access to Personal Information), Article 36 (Correction and Deletion of Personal Information), and Article 37 (Processing Suspension of Personal Information) of the 『Personal Information Protection Act』 for which rights or interests have been infringed due to dispositions by heads of public institutions or other official actions, data subjects can request administrative adjudication in accordance with the Administrative Adjudication Act.

※ For more information on administrative adjudication, please refer to the website of the Central Administrative Appeals Commission (www.simpan.go.kr).

Article 13 (Changes to the Privacy Policy)

This Privacy Policy is effective from November 6, 2023.
You can review the previous Privacy Policy as follows:

• - From March 15, 2021, to November 5, 2023 (Click to see the Trade On Privacy Policy)