CLASSUM CO., Ltd. (”CLASSUM”) operates a privacy policy (”Privacy Policy”) as shown below to protect the personal information of its data subjects (”Users”) and to process any related complaints in a prompt manner in accordance with applicable law. This Privacy Policy of CLASSUM may be amended from time to time subject to the changes in the applicable law, policy, or CLASSUM’s internal policy, etc., and any such changes to the Privacy Policy will be announced on the website so that Users may easily be informed of the changes.
This Privacy Policy will take effect from December 18, 2023 (”Effective Date”)
1. Purpose of Processing Personal Information
CLASSUM collects the minimum amount of personal information that is necessary to provide services to Users and obtains consent from Users for the collection of such information. The items of personal information that are collected are shown below, which are used only for the notified purposes. CLASSUM processes personal information for the following purposes and does not use it for any other purposes.
•
To perform obligations under the service agreement, settle charges for services rendered, purchase and pay for service, and manage membership;
•
To authenticate individuals prior to allowing the use of membership-based services for the management of Users, conduct personal identification, prevent illegal or unauthorized use by delinquent Users, confirm Users' intention to execute service agreements, verify age, handle complaints and other grievances, and provide notices to Users;
•
To develop and specialize new services (products) for marketing and advertisements, deliver advertising information, such as event information, etc., understand access frequency or compile statistics on Users' use of the services; and
•
To restrict the number of subscriptions, preserve records for dispute resolution, build a service environment to strengthen privacy protection, monitor Users' satisfaction with the service and goal satisfaction status, calculate statistics on lectures, classes, and interests, etc.
•
To verify the Users’ identification, contact the Users for confirmation of inquiry and/or verification of fact, respond to the Users’ inquiry
2. Items of Personal Information to be Processed
1. CLASSUM collects and uses the following items of personal information:
•
Required items: names, e-mail address
•
Optional items: affiliated institution, profile image, occupation, consent to receive marketing information; and
•
For children under the age of 14: Name of their legal guardian, contact information (collected directly from the child without the consent of the legal guardian pursuant to Article 22-2(2) of the Personal Information Protection Act).
•
CLASSUM may collect additional personal information if the User provides additional personal information to us to use the services.
2. Information, such as access IP addresses, advertising ID (AAID, IDFA, etc.), cookies, and access date/time, etc. may be automatically generated and collected to check whether any content has been used in the process of using the service or operating the business or other matters.
3. CLASSUM collects usage details of the Users, such as name, lecture name, and attendence rate(%) from the partner content provider when the User uses the content provided by such partner content provider.
4. CLASSUM collects the following personal information from a third party when an individual subscribes for a membership (or subscribes for service) through external platforms or by synchronizing accounts.
•
Google: Google ID, e-mail address;
•
Apple: Apple ID, e-mail address (if selected, collected only one initially); and
•
Membership through an institution partnered with CLASSUM: name, e-mail address registered with the partner institution, the name of the partner institution.
5. CLASSUM collects and processes each of the above items above, as well as any separate items necessary to process the User’s inquiry when responding to such inquiry.
3. Processing of Personal Information and Retention Period
1. CLASSUM processes and holds personal information for the period of retention and use to which Users consented when the personal information was collected or within the period of retention and use permitted under law.
2. The specific periods for processing and retaining personal information are as follows:
•
Prevention of fraudulent subscription and inappropriate use: If there is a record of inappropriate use of the service, such as fraudulent subscription, unauthorized disclosure of posts, or sharing of ID, etc., the authentication information of subscription (e-mail address or Facebook serial number, legal representative’s e-mail address and mobile phone number in the case of a User under the age of 14), among other personal information: for 1 year from the date of cancellation of User’s membership.
•
User subscription and management: Until the service agreement or membership is terminated. However, if there remain any receivables or debtor-creditor relationship, personal information of the User will be retained until such receivables are collected or the debtor-creditor relationship is settled.
•
Records of e-commerce contracts and withdrawal of e-commerce subscription, payment records and records of supply of goods, etc.: for 5 years
•
Records of consumer complaints or dispute settlements: for 3 years
•
Records of User access logs (communication confirmation data): for 3 months
•
Records of signing up for free trials and webinars: 5 years
•
Records of subscribing newsletters: upon withdrawal of consent or termination of service
4. Providing Personal Information to a Third Party
1. CLASSUM does not provide the personal information of its Users to a third party unless it is specifically permitted by law, such as when it obtains consent from Users in accordance with Article 17 of the Personal Information Protection Act or when the personal information is used for statistical, academic, research, or market survey purposes, etc. pursuant to Article 28-2 of the Personal Information Protection Act after being anonymized with the removal of all personally identifiable information.
2. CLASSUM Provides personal information to third parties as follows:
Receiver | Purpose | Items | Retention Period |
client company that the User is affiliated too (the list will be posted in the business site) | To provide training management functions for the User who is affiliated with the client company | Attendance history | 5 years after the end of the service |
partner content provider who provides course content used by the User (list will be posted on the business site) | To sign up for the partner content provider and to provide course content | Email, name | Until the User withdraws from the partner content provider; provided that if the partner content provider has a separate privacy policy for the retention period, such period shall apply |
5. Entrustment of Personal Information Processing
1.
CLASSUM entrusts the processing of the following personal information in order to facilitate the processing of personal information.
Entrusted entity | Entrusted Operation | Privacy Policy of the Entrusted Entity |
humusOn Inc. | Sending service-related e-mails | |
Stibee Corp. | Sending service-related e-mails | |
Channel Corp. | Customer Consultation | |
Doodlin Corp. | Hiring |
2.
CLASSUM, through contracts such as outsourcing agreements, provides regulations on the compliance of laws related to personal information protection, confidentiality of personal information, prohibition on the provision of personal information to third parties, liability in the event of incidents, duration of the outsourcing, and obligations to return or destroy personal information after the end of processing, and ensures the compliance of these regulations.
6. International Transfer of Personal Information
1. CLASSUM provides personal information to an overseas entity as follows:
Receiver | Country | Items | Transfer Period and Method | Retention Period and Purpose |
Amazon Web Service Inc. (aws-korea-privacy@amazon.com) | Tokyo, Japan | Information CLASSUM collects when the User uses the services | Transferring over the network when the User uses the services | Retention Period: The retention period prescribed in Section 3 shall apply.
Purpose: Data storage and infrastructure operations |
7. Rights and Obligations of Users and Their Legal Representatives, and Methods of Exercising their Rights.
1. The User may, at any time, exercise the right to peruse, correct, delete, and suspend the processing of his/her personal information against CLASSUM.
2. The User may exercise the right under Section 7.1. in writing, by phone, or by e-mail and CLASSUM respects the User’s request without delay.
3. The User may exercise the right under Section 7.1. through the agents such as a legal representative or a delegate, in which case the User will be required to submit a power of attorney to CLASSUM confirming such delegation.
4. The privacy rights under Section 7.1. may be restricted in accordance with applicable laws such as the Personal Information Protection Act.
5. A request for the correction or deletion of personal information cannot be made if the personal information has to be preserved under another law.
6. CLASSUM will confirm whether the person who made the request pursuant to Sections 7.1. holds such a right or is a legitimate agent.
7. In some regions, the User may have certain further rights under applicable data protection laws, and the User may contact us at the contact point as set out below to exercise such rights. CLASSUM will consider and act upon any such request in accordance with applicable data protection laws.
8. Destruction of Personal Information
If personal information becomes unnecessary because the retention period of the personal information has passed or the purpose of processing the personal information has been accomplished, etc., CLASSUM will destroy the personal information without delay in the manner set forth below.
1. Process of destruction: The information entered by Users is transferred to a separate DB (in the case of paper documents, to a separate file) after the purpose of the information has been served and is destroyed immediately or after being stored for a certain period in accordance with internal policy and other applicable laws. The personal information that is transferred to a separate DB will not be used for any purposes except as required by law.
2. Destruction period: The personal information of Users must be destroyed within 5 days from the last date of the retention period if the retention period for the personal information has passed; and within 5 days from the date the processing of the personal information is determined to be unnecessary, if the processing of personal information is so determined to be unnecessary due to the purpose being served, such as the discontinuance of the relevant service or the termination of the business, etc.
3. Destruction method: Information in electronic files must be destroyed using technical methods that prevent the reproduction of the record. Personal information printed out on paper must be destroyed by shredding it in a shredder or incinerating it.
9. Measures to Ensure the Safe Protection of Personal Information
1. CLASSUM takes the following measures to ensure that the User’s personal information is safely protected.
•
Management measures: CLASSUM establishes and implements internal management plans and provides regular training for its employees and staff.
•
Technical measures: CLASSUM manages access privileges by setting passwords on computers where personal information is stored, installs security programs such as vaccine software, etc., and encrypts files containing personal information.
2. Notwithstanding the foregoing, no electronic transmission over the Internet or information storage technology can be guaranteed 100% secure, so CLASSUM cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat CLASSUM’s security and improperly collect, access, steal, or modify the User’s information. Although CLASSUM will endeavor its best to protect the User’s personal information, the transmission of personal information to and from the website is at the User’s own risk. Further, the User should only access the website within a secure environment.
10. Matters Concernning the Installation, Operation, and Refusal of Automatic Personal Information Collection Devices
1. CLASSUM uses cookies to store and retrieve User data in order to provide customized services for each User.
2. A cookie is a small piece of data sent by the server used to operate the website to the User’s computer browser, which may be stored in the hard disk of the User’s PC.
•
Purpose of cookies: Cookies are used to identify the various services and websites visited by the Users, the type of use, frequently used search terms, use of a secure connection, etc., in order to provide the Users with optimized information.
•
Refusal of installation and operation of cookies: The Users have a choice about the installation of cookies and thus, the Users may disable cookies at Tools at the top of the web browser → Internet Option → Option in the Personal Information menu.
•
Refusing to store cookies may cause some interference in using CLASSUM’s customized services.
11. Using and Providing Personal Information Within the Scope Reasonably Related to the Purpose of Collection
CLASSUM may use or provide personal information to a third party without consent from the Users, in consideration of the following criteria and within the scope reasonably pertinent to the original purpose of collecting the personal information.
•
Whether it is related to the original purpose of collection: This is determined by considering whether the original purpose is related to the purpose of additionally providing or using personal information in terms of nature or tendency.
•
Whether the additional use or provision of personal information to a third party is predictable in light of the circumstances of collection or processing practices: This is determined by considering the relationship between the personal information controller and the User, the level of technology and speed of technological advancement, general circumstances (practice) established over a considerable period of time.
•
Whether the interest of the User is unfairly infringed upon: This is determined by considering whether the interest of the User is substantively infringed upon in related to the purpose of the additional use of personal information and whether the infringement of interest if justifiable.
•
Whether necessary measures have been taken to ensure safe protection of personal information, including the pseudonymization or encryption of information, etc.: This is determined by considering whether safety measures have been taken in proportion to the possibility of infringement.
12. Matters Concerning the Processing of Personal Information for Children Under the Age of 14
1.
In the event CLASSUM collects personal information of children under the age of 14, CLASSUM collects the minimum amount of personal information necessary to perform the services and obtains the consent of the child’s legal guardian.
Required items: Name of the legal guardian, relationship, contact information.
2.
When collecting personal information of children under the age of 14, CLASSUM may require the child to provide minimum information, such as the name and contact information of his/her legal guardian and confirm that the legal guardian has provided consent.
13. Chief Privacy Officer
CLASSUM appoints the Chief Privacy Officer and Privacy Officer, as shown below, to oversee the processing of personal information and to respond to the User complaints and remedies in connection with the processing of personal information. CLASSUM will respond to the User’s complaint about personal information, at the latest, not more than 45 days from the receipt of the User’s complaints.
Chief Privacy Officer
Name: Youjin Choi
Title: Director (CEO)
Contact: privacy@classum.com
Privacy Officer
Name: Jihye Kang
Title: Product Manager
Contact: privacy@classum.com
The Users may contact the Chief Privacy Officer and the department in charge for all inquiries about the protection of personal information, processing of complaints, and remedies for any damage, etc. that Users may have while using the service provided by CLASSUM. CLASSUM will promptly respond and process the User inquires.
14. Amendment of Privacy Policy
This Privacy Policy takes effect from the Effective Date. CLASSUM will notify, through its notifications, Users of any addition, deletion, or modification to the Privacy Policy made in accordance with law and policies 7 days prior to the date when the change is to take effect.