Privacy Policy of Coway Co., Ltd.


 

Coway legally processes and safely manages personal information in compliance with the Personal Information Protection Act and related statutes to protect the freedom and rights of data subjects. Accordingly, in order to guide data subjects on personal information processing and standards in accordance with Article 30 of the Personal Information Protection Act and deal with complaints related to this promptly and smoothly, Coway establishes and discloses the following privacy policy:


 

1. Purpose of Processing Personal Information

2. Personal Information Processing and Retention Period

3. Items of Personal Information to be Processed

4. Matters Concerning the Processing of Personal Information of Children under the Age of 14

5. Provision of Personal Information to Third Parties

6. Consignment of Personal Information Processing

7. Destruction of Personal Information

8. Measures Regarding the Destruction of Personal Information of Non-Users

9. Rights and Obligations of Data Subjects and Legal Representatives and Exercise Methods

10. Measures to Ensure the Safety of Personal Information

11. Installation, Operation, and Denial of Automatic Collection Tools for Personal Information

12. Privacy Officer

13. Rights to Request Accessing Personal Information and Remedy for the Infringement of Rights 

14. Changes in Privacy Policy


 

1. Purpose of Processing Personal Information

Coway processes personal information for the following purposes: Personal information being processed is not used for any purpose other than the following, and if the use purpose is changed, Coway will take necessary measures, such as obtaining separate consent in accordance with Article 18 of the Personal Information Protection Act.

1. Sign-up for membership and management

Coway processes personal information for the confirmation of the intention to sign up for membership, identification/authentication for the provision of membership service, maintenance/management of membership status, prohibition against unjust use of services, confirmation of children under the age of 14, various notices/notifications, and grievance handling purposes. 

2. Service Provision

Coway processes personal information for the service provision, content provision, customized service provision, identity verification, and age verification.


 

2. Personal Information Processing and Retention Period

① Coway processes and retains personal information within the period of retention and use of personal information in accordance with statutes or within the period of retention and use of personal information consented to when collecting personal information from data subjects.

② Each personal information processing and retention period is as follows:

1. Sign-up for membership and management: until account is closed

   However, in the following reason, until the cause ends

   1) Where an investigation or examination is in progress due to a violation of relevant statutes, until the end of the investigation or examination

2. Service provision: until service completion

   However, in any of the following reasons, until the period ends

   1) Records under the Act on the Consumer Protection in Electronic Commerce

        - Records on labeling and advertising: six months

        - Records on consumer complaints or dispute processing: three years

   2) Retention of data for confirmation of the fact of communications under the Protection of Communications Secrets Act

       - Web/app access log data: three months


 

3. Items of Personal Information to be Processed

Coway processes the following personal information items:

1. Sign-up for membership and management

• Required items: (For associate members) name, member ID (email address or mobile number), password, and nation information 
(For full members) name, sex, citizen/foreigner, date of birth, password, member ID (email address or mobile number), email address, carrier, mobile number (mobile phone number), personally identifiable information (connecting information (CI)), duplication information (DI), required collection of (customer) identification KEY values from product-using customers, and nation information 
(Social media sign-up) Facebook, Google, and Apple: email address; Kakao: name, email address, and phone number; Naver and Line: identification values

• Optional items: email address (when signing up with a mobile phone), products interested in, family composition, features interested in


 

2. IoCare Service Provision

• Required items: a required collection of mobile phone number and address (including dong) when registering a product

                

3. In the process of using the service, an IP address, cookie, service use record, device information, and location information may be generated and collected. The collected information may or may not correspond to personal information depending on whether it is linked to personal information.


 

4. Matters Concerning the Processing of Personal Information of Children under the Age of 14

Membership is available to people aged 14 years or older. The minimum personal information necessary for the service provision is classified as required, and any other personal information is classified as optional, providing a separate consent procedure for such items.

The Company shall not refuse to provide services on the grounds that personal information other than the necessary minimum has not been provided.

 

 

5. Provision of Personal Information to Third Parties

Coway processes the personal information of data subjects only within the scope specified in the purpose of processing personal information and provides personal information to third parties only when it falls under Articles 17 and 18 of the Personal Information Protection Act, such as the consent of the data subject and special provisions of laws, and does not provide the personal information of data subjects to third parties other than that; provided that Coway provides minimum information pursuant to the applicable laws in any of the following:

※ Identification Service Agencies 

- Identification service agencies pursuant to Article 23-2 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, Etc.

※ Alternative sign-up tool service agencies instead of Resident Registration Numbers

- Alternative sign-up tool service agencies instead of Resident Registration Numbers pursuant to Article 24-2 of the Personal Information Protection Act


 

6. Consignment of Personal Information Processing

① Coway entrusts the following personal information processing work for smooth personal information processing, and the entrusted company retains and uses personal information for the consigned purpose until the end of the contract.

② When entering into a consignment contract, Coway stipulates in the contract or other documents matters concerning the prevention of personal information processing for purposes other than the entrusted purpose, technical and managerial safeguards, restrictions on re-consignment, management and supervision of consignees, compensation, and other obligations pursuant to Article 26 of the Personal Information Protection Act, and supervises consignees to ensure they handle personal information in a safe manner.

③ Coway will disclose without delay pursuant to this Privacy Policy when the details of consignment work or a consignee is changed.


 

7. Destruction of Personal Information

① Coway destroys personal information without delay when personal information becomes unnecessary, such as when the personal information retention period has elapsed or the purpose of processing has been achieved.

② Even though the purpose of processing has been achieved, in cases where the personal information retention period agreed upon by a data subject has elapsed or where personal information must be retained in accordance with other statutes, Coway transfers the personal information to a separate database (DB) or preserves it in a different storage location.

③ The personal information destruction procedure and method are as follows:

1. Destruction procedure

Coway moves the personal information for which the reason for destruction has occurred to a separate DB or table after the purpose is achieved, retains it for a certain period of time pursuant to internal policies and other relevant statutes, and then destroys it.

2. Destruction method

Coway destroys personal information recorded and stored in the form of electronic files so that the records cannot be reproduced, and in paper documents, by shredding or incinerating them.


 

8. Measures Regarding the Destruction, Etc. of Personal Information of Non-Users 

① Coway converts users who have not used the service for one year to dormant accounts and keeps personal information separately. The separately stored personal information is stored for four years and then destroyed without delay.

② Coway notifies members whose accounts will be dormant the fact of separate preservation, scheduled date of dormancy, and items of personal information that are separately stored by email, text message, etc., until 30 days prior to converting them to dormancy.

③ If a user does not want to switch to a dormant account, he or she can log in to the service before converting to a dormant account. Also, even if an account has been converted to a dormant one, if the user logs in, he or she can use the normal service by restoring the dormant account following his or her consent.


 

9. Rights and Obligations of Data Subjects and Legal Representatives and Exercise Methods

① Data subjects can exercise the rights such as a request for the access, correction, or erasure of personal information or suspension of its processing at any time.

② The exercise of rights can be done in writing, email, or fax in accordance with Article 41 (1) of the Enforcement Decree of the Personal Information Protection Act, and Coway will take action without delay.

③ Rights may be exercised by a representative, such as a legal representative of the data subject or a person who has been delegated. In such cases, a power of attorney in accordance with Attached Form No. 11 of the "Notice on How to Process Personal Information (No. 2020-7)" must be submitted.

④ A request for access to and the suspension of processing personal information may be restricted in accordance with Article 35 (4) and Article 37 (2) of the Personal Information Protection Act.

⑤ For the request for a correction or erasure, the erasure is not permitted where the personal information shall be collected by other statutes.

⑥ Upon a request for the access, correction, or erasure of personal information or suspension of its processing based on the rights of the data subject, Coway verifies whether the person making the request, such as access, is the relevant person or a legitimate representative.


 

10. Measures to Ensure the Safety of Personal Information

Coway takes the following measures to ensure the safety of personal information:

1. Administrative measures: establishment and implementation of the internal management plan, operation of a dedicated organization, and regular employee training;

2. Technical measures: management of access rights including personal information processing system, installation of an access control system, encryption of personal information, and installation and renewal of security program;

3. Physical measures: access control for the computer room, data storage room, etc.

To ensure the safety of personal information, Coway receives regular verification of Coway's information protection activities from external organizations in addition to the matters stipulated by statutes through ISO/IEC 27001, international information protection certification, and ISMS-P, a domestic information protection certification. 


 

11. Installation, Operation, and Refusal of Automatic Collection Procedures

① Coway uses 'cookies' that store and retrieve usage information from time to time in order to provide personalized services to users.

② Cookies are small blocks of data that a server (http) sends to a user's computer browser to monitor and remember certain information about the user. They may also be saved to the hard disk of the user's personal computer.

A. Purpose for cookies: Cookies are used to identify the patterns of visits and usage of each service and website visited by the user, popular search words, secure access, etc., which are used to provide optimized information to users.

B. Cookie installation, operation, and refusal: A user can refuse to save cookies by setting options in the Tools>Internet Options>Personal Information menu at the top of the web browser.

C. If a user refuses to save cookies, he or she may experience difficulties in using customized services.


 

12. Privacy Officer

Coway has designated a person in charge of personal information protection to be responsible for supervising personal information processing and to handle complaints and damage remedy for data subjects in relation to personal information processing as follows:

※ Coway's location information manager is concurrently serving as the privacy officer.

‣ Privacy officer: Kim Dong-Hyun, Managing Director, DX Center 

‣ Privacy department: Information Security Team

Contact: 02-2163-4308, privacy@coway.co.kr, FAX 02-6480-8240

The above contact number/email address is a dedicated channel for urgent support regarding personal information.

For general after-sales support/consultations, please use our general number (1588-5200). If you cannot get through to urgent support, please contact our customer center (1588-5200) or Kakao Coway customer center and we will assist you as quickly as possible.


 

13. Processing of Personal Location Information

Coway IoCare manages personal location information safely according to the Act on The Protection and Use of Location Information.

‣ Processing purpose and retention period of personal location information

Coway IoCare uses personal location information in most location-based services on a one-off basis or tentatively and then immediately destroys it. However, GPS information that was collected for providing information on products and outdoor air quality of a user's location shall be stored until the products are returned or users withdraw their membership.

‣ Retention basis and period of data verifying the collection, use, and provision of location information

According to Article 16, Paragraph 2 of the Act on The Protection and Use of Location Information, data verifying the collection, use, and provision of location information to be automatically recorded and preserved for six months or longer in a location information system.

‣ Destruction procedure and methods of personal location information

When processing the purpose of the personal location information provider is attained, personal location information is destroyed in a safe and non-renewable way. Electronic files are destroyed in a technical way that cannot be restored or reproduced, while printouts are shredded or burned.

‣ Matters on the supply or notice of personal location information to a third party

Personal location information shall not be provided to a third party without the prior consent of users, and when personal location information is provided to a third party designated by users, such personal location information subjects shall be immediately notified of the third party that receives the information, the provision time, and purposes for retention.

‣ Rights and duties of legal guardians of children under the age of 8, etc. and exercise methods thereof

If legal guardians of the persons who fall under (Hereinafter "Children under the age of 8, etc.") agree with the use or provision of personal location information for protecting the life and health of Children under the age of 8, etc., it is considered by the Company that Children under the age of 8, etc. have agreed to such use and/or provision.

Legal guardians of Children under the age of 8, etc. who want to agree with the use or provision of personal location information for protecting the life or health of such children shall attach written evidence proving that they are Persons responsible for protective custody or care on a written agreement and submit it to the Company.

If legal guardians of Children under the age of 8, etc., agree with the use or provision of personal location information, such legal guardians may exert all rights of personal location information subjects.


 

‣  Information of location information manager

Coway IoCare's location information manager is concurrently serving as the personal information manager.


 

14. Rights to Request Accessing Personal Information and Remedy for the Infringement of Rights

① Data subjects may request to access personal information in accordance with Article 35 of the Personal Information Protection Act to the following departments:

‣ Personal information access request reception and processing department

Department name: Coway Customer Support

Contact: 1588-5200, privacy@coway.co.kr, FAX 02-6480-8240

② Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the KISA Privacy Center, etc., to receive remedy from personal information infringement. In addition, please contact the following entities for reporting or consulting of other personal information infringement:

1. Personal Information Dispute Mediation Committee: (without exchange code) 1833-6972 (www.kopico.go.kr)

2. KISA Privacy Center: (without exchange code) 118 (privacy.kisa.or.kr)

3. Supreme Prosecutors' Office: (without exchange code) 1301 (www.spo.go.kr)

4. National Police Agency: (without exchange code) 182 (ecrm.cyber.go.kr)

③ Any person whose rights or interests have been infringed due to a disposition or omission made by the head of a public institution in response to a request under Articles 35 (Access to Personal Information), Article 36 (Rectification or Erasure of Personal Information), and Article 37 (Suspension of Processing of Personal Information) of the Personal Information Protection Act may request an administrative appeal in accordance with the Administrative Appeals Act.

▸ Central Administrative Appeals Commission: (without exchange code) 110 (www.simpan.go.kr)


 

15. Changes in Privacy Policy

 This Privacy Policy is effective from February 23, 2023.