Chapter 1 General Provisions

Article 1 (Purpose)  

The purpose of this Provision is to protect the personal information acquired from the website (www.cammsys.com) of CAMMSYS (hereinafter referred to as “Company”) in accordance with “Personal Information Protection Act” and related statutes and to handle the related complaints quickly and smoothly.

Chapter 2 Personal Information Management

Article 2 (Definitions)

The terms used in this Provision shall be defined as follows :

1. The term “Subject of Information” means a person who can be identified by the managed information and therefore is the subject of the given piece of information.

Article 3 (Purpose of Personal Information Management)

① The Company shall collect and use personal information through website. The personal information managed and kept by the Company shall not be used for the purposes other than the intended ones. Provided, where the Company changes the purpose of use, the Company shall take necessary measures according to Personal Information Protection Act and related statutes.

② Receipt and Management of Civil Petition

1. Verification on civil petition and notification on receipt;

2. Implementation of follow-up measures such as answering to civil petition;

3.Management of civil petition records

③ Receipt and Management of Recruitment Application

1. Verification on recruitment application and separate notification;

2. Implementation of follow-up measures such as notifying the application result;

3. Management of recruitment application records

Article 4 (Method of and Items of Personal Information Collection)

① The “Company” shall arrange technical measures necessary for the “Information Subject” to express his/her intention to consent on collection of personal information. Where the Information Subject consents on collection of personal information according to the technical measures, he/she is deemed to consent on the collection of personal information.

② The collection time, method, and item of personal information “Managed” by the “Company” to provide the service shall be as follows;

        1. Receipt and Management of Civil Petition

Collection Time	A time when “Information Subject” consented on provision of personal information, filled out personal information in civil application (electronic file), and submitted it
Collection Method	Receipt of civil application (electronic file) in website of “Company”
Collection Item(Required)	Name, phone number, email address, address
Collection Item (Optional)	Affiliation of the civil petitioner, etc.

 

        2. Receipt and Management of Recruit Application

Collection Time	A time when “Information Subject” consented on provision of personal information, filled out personal information in recruitment application (electronic file), and submitted it
Collection Method	Recruitment application (electronic file) provided in website
Collection Item	Name (Korean, English, Chinese Character), gender, date of birth, address, phone number, cell phone number, email address, hobby/specialty, academic background, GPA, foreign language proficiency, career, military service, training/volunteer activity, license, awards, papers, veterans, disabilities

         3. Where it is necessary to collect personal information for dealing other affairs, the Company shall notify the “Information Subject” of the personal

             information collection time, method, and item and shall obtain consents according to Personal Information  Protection Act and related statutes.

Article 5 (Personal Information Management and Retention Period)

① The “Company” shall hold the personal information consented from “Information Subject” until achieving the purpose of personal information management in Article 3. Where the Company achieves the purpose of management, the personal information shall be destroyed according to Article 6.

② Where the personal information is to be preserved pursuant to provisions of Personal Information Act and related statutes, the Company shall separately save the personal information of the “Information Subject” technically or physically for the specific period prescribed in related statutes as follows. 

1. Internet logs and access records of the User : 3 months (Protection of Communications Secrets Act)

2.Recruitment document of the “Applicant : 180 days from deciding whether to employ or not (Recruitment Procedure Act)

3.Other communication records : 12 months (Protection of Communications Secrets Act)

Article 6 (Destruction of Personal Information and Its Method)

① When the personal information management and retention period in Article 5 is expired, the “Company” shall destroy the personal information within 5 business days from the expiration date unless any justifiable ground exists otherwise.

② The procedure and method of personal information destruction shall be as follows;

1. Information in the format of electronic file shall be deleted permanently so that information cannot be restored. “Unable to Restore” means that the Company shall take measures so that personal information destroyed under socially accepted cost in the current technical level cannot be restored;

2. Personal information in prints shall be deleted by shredding in a shredder or incinerating;

3. Implementation and verification of personal information destruction shall be conducted under the responsibility of “Personal Information Protection Manager”;

4. “Personal Information Protection Manager” shall be responsible for recording and management of the matters regarding the personal information destruction and shall verify the destruction result after personal information destruction.

Article 7 (Matters Regarding Entrustment of Personal Information Management)

① For a smooth “Management” of the personal information, the “Company” entrusts the personal information management affairs as follows;

Entrusted Affairs	Trustee
Operation and maintenance of website computer system

② In signing the entrustment contract, the “Company” shall specify the matters regarding the purpose of entrustment affairs, prohibition on personal information management, technical and administrative protection measures, restriction on re-entrustment, management and supervision on Trustee,

and responsibilities such as compensation for damage on the document and shall supervise the Trustee on safe management of the personal information.

③ When the Company changes the entrusted affairs or Trustee, the Company shall disclose it through Privacy Policy in the website immediately.

Article 8 (Measures for Securing Stability of Personal Information)

① To protect personal information from loss, theft, leakage, alteration or corruption in personal information management, the Company shall take technical, administrative, and physical measures to secure stability.

② Technical measures shall be as follows;

1. Personal Information of “Information Subject” shall be utilized and managed in the internet network which cannot be accessed or intruded from external network. The Company shall take encryption measures or file locking measures on files and transferred data to protect the important data through a separate security features;

2. The Company shall install a vaccine program to inspect and manage the attack of malicious programs such as computer virus and spyware on the information device used by the personal information management system and personal information handler for personal information management to take measures for prevention of personal information infringement; 

3. Vaccine program shall be updated on a regular basis. In cases of unexpected virus, the vaccine program shall apply the vaccine immediately to prevent the infringement of the personal information;

4. The Company shall utilize a security system which transfers personal information safely in the network by utilizing the encryption algorithm and shall also use firewall system in preparation for the external attack such as hacking to protect the internal network. The Company shall install the firewall system for each server to strengthen the security;  

5. When sending the personal information of “Information Subject” through website, the Company shall take the communication interval encryption measure to transfer the personal information safely through SSL.

③ The administrative measure and physical measures shall be as follows;

1. Regard to main system and facilities for the safe personal information protection, the Company shall establish and operate a personal information management system;

2. The Company shall arrange the measures necessary for access and management of personal information of the “Information Subject” and shall have the employees to be aware and comply with measures;

3. The Company shall limit the number of personal information protection manager to the minimum extent and the extent shall be as follows;

- Persons who are involved in the marketing affairs for “Information Subject” directly and indirectly;

- Persons such as personal information protection manager and recruitment applicant personal information protection manager who are involved in management and protection of the personal information;

- Persons who are inevitably involved in handling the personal information for other affairs.

4. When managing the personal information by using the computer, the Company shall designate a person who has the right to access personal information, grant ID and password, and update the password on a regular basis;

5. The Company shall implement in-company education or commissioned education on acquisition of new security technologies and duties of personal information protection for the employees in charge of handling personal information;

6. In hiring a new employee, the Company shall have the employee sign the personal information protection statement to prevent the information leakage by the employee. The Company shall arrange internal measures to inspect on fulfillment and compliance with Privacy Policy and shall implement such measures consistently. When the employee who handled the personal information of “Information Subject” leaves, the Company shall have the employee not to infringe, damage or reveal the personal information that came to his/her knowledge in the course of business;

7. The Company shall designate computer room and data archive as the special protection area and shall control access;

8. The duties of personal information handler are handed over under the thorough security and the Company shall clarify the responsibility for personal information infringement in joining and leaving the Company.

 

Chapter 3 Rights and Duties of Information Subject and Exercise Method

Article 9 (Rights and Duties of Information Subject and Legal Representative)

① “Information Subject” may exercise the right to request inspection, correction, deletion, and suspension from management of personal information readily. “Information Subject” may exercise the right by sending the email to personal information protection manager or employee in charge of personal information protection or other written measures.

② In exercising the right according to Paragraph 1, “Information Subject” may exercise the right via agents such as legal representative or trustee. Provided, the “Information Subject” shall submit the Power of Attorney according to the Annex Format No.11 under “Announcement on Personal Information Management Method”.

③ In the request on inspection and suspension from management of personal information, the rights of the “Information Subject” may be limited under the related statutes including Paragraph 4, Article 35, Paragraph 2, Article 37 of the Personal Information Protection Act. When the personal information is specified as the item to be collected, the “Information Subject” may not request on deletion of the personal information. If “Information Subject” requests so regardless of Paragraph 3, the personal information handler may reject the request as prescribed by the related statutes.

Article 10 (Rights and Duties of Recruitment Applicant)

① “Applicant” may exercise the right to request “Management” of the recruitment application he/she registered or submitted.

② To exercise the right in Paragraph 1, the “Applicant” shall request “Recruitment Application Personal Information Protection Manager” on inspection, correction, or deletion of the personal information via email or other written measures. In receiving the request, the personal information protection manager or employee in charge of personal information shall take measures within 14 days.

③ The “Applicant” may request on inspection, correction, and deletion of the recruitment application-related information until the deadline of the application. Provided, the “Company” may restrict on inspection, correction, and deletion of the information for the fairness and smooth recruitment procedures after the deadline and may hold the personal information of the Applicant for the period specified in Article 5.

Article 11 (Rights and Duties of Recruitment Applicant)

The “Company” shall not use “Cookie” which saves and loads the usage information of the “Information Subject”

Article 12 Personal Information Manager and Recruitment Applicant Personal Information Manager

① To protect the personal information of the “Information Subject” and handle the complaints regarding the personal information, the “Company” shall designate the related department, personal information protection manager, and recruitment applicant personal information protection manager as follows;

② The personal information manager shall be as follows;

1. Name : Shin Tae-pyeong

2. Position : Director

3. Department : Department of Management Innovation

4. Contact : 070-4680-4256

③ The employee in charge of personal information protection shall be as follows;

1. Name : Lee Woo-yong

2. Position : Manager

3. Department : Department of Management Innovation

4. Contact : 070-4680-4485

④ The recruitment applicant personal information protection manager shall be as follows;

1. Name :

2. Position :

3. Department :

4. Contact :

⑤ The employee in charge of recruitment applicant personal information protection shall be as follows;

1. Name :

2. Position :

3. Department :

4. Contact :

Article 13 Duties of Personal Information Protection Manager and Recruitment Applicant Personal Information Protection Manager

① To protect the personal information of “Information Subject” and handle the complaints regarding the personal information, the “Company” shall designate “Personal Information Protection Manager” and “Recruitment Applicant Information Protection Manger”.

② “Personal Information Protection Manager” shall conduct the following affairs;

1. Establishing and implementing a personal information protection plan;

2. Periodically investigating and improving personal information management;

3. Handling complaints concerning the management of personal information and remedying damage therefrom;

4. Establishing an internal control system to prevent the leakage and misuse of personal information;

5. Establishing and implementing an education plan for the protection of personal information;

6. Protecting, administering and supervising personal information files;

7. Other duties prescribed by Personal Information Protection Act and related statutes for the management of personal information.

③ “Recruitment Applicant Personal Information Protection Manager” shall conduct the following affairs;

1. Establishing and implementing a personal information protection plan of “Applicant”;

2. Periodically investigating and improving personal information management of “Applicant”;

3. Handling complaints concerning the management of personal information and remedying damage therefrom of “Applicant”;

4. Establishing an internal control system to prevent the leakage and misuse of personal information of “Applicant”“

5. Protecting, administering and supervising personal information files of “Applicant”

6. Other affairs prescribed by Act on Fairness of the Recruitment Procedures, Personal Information Protection Act and related statutes.

Article 14 Infringement on Rights of Information Subject and Remedy Method

The “Information Subject” may contact the following institutes to report or consult about other personal information infringements, consult on dissatisfaction over the personal information complaint handling and damage remedy procedures by “Company”, and request detailed helps. 

1. Personal Information Infringement Report Center (Ran by Korea Internet & Security Agency)

- Affairs : Report and consulting on personal information infringement

- Website : http://privacy.kisa.or.kr

- Contact : 118 without Area Code

- Address : Personal Information Infringement Report Center, Korea Internet & Security Agency , 135, Jundae-ro, Songpa-gu, Seoul, Korea

2. Personal Information Dispute Mediation Committee (Ran by Korea Internet & Security Agency)

- Affairs : Application on dispute mediation and collective dispute mediation on personal informati