Privacy Policy
<NSE Technology Co., Ltd.>(hereinafter the "Company") has established the following privacy policy in accordance with the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information and rights of its users and to handle user grievances relating to personal information smoothly. If the Company amends this Privacy Policy, it will give notice through the notice section of its website (or by individual notice). This Policy is organized as follows.
General Provisions
Purposes and Items of Collection and Processing of Personal Information
Processing and Retention Periods of Personal Information
Procedures and Methods for the Destruction of Personal Information
Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
Provision of Personal Information to Third Parties and Entrustment of Processing
Installation, Operation and Refusal of Devices that Automatically Collect Personal Information
Measures to Ensure the Security of Personal Information
Chief Privacy Officer and Responsible Department
Remedies for Infringement of the Rights of Data Subjects
Amendment of the Privacy Policy
1. General Provisions
The terms used in this Policy to designate data subjects have the following meanings.
- User: a corporate entity, sole proprietor or individual that has entered into a paid or free service agreement with the Company and uses the Company's services.
- Member: an employee belonging to the User's business or organization who is covered by, and makes use of, the services contracted by the User.
- Data Subject: a collective term covering both Users and Members who have provided personal information.
- The website (membership registration, inquiry forms), e-mail, telephone and similar channels.
- Information generated and collected automatically in the course of service use (IP address, cookies, visit records, etc.).
2. Purposes and Items of Collection and Processing of Personal Information
The Company processes personal information for the purposes set out below. Personal information being processed is not used for any purpose other than those stated, and if the purpose of use is changed, the Company will obtain separate prior consent in accordance with Article 18 of the Personal Information Protection Act.
The Company collects and processes the minimum personal information necessary from Users and Members for the purposes of verifying the identity of persons requesting consultation, confirming complaints and inquiries, notifying the results of their handling, providing product materials, and providing services. The detailed purpose for each item is stated in the "Purpose of collection" column of the tables below. However, whether the "personal information for service use" is collected differs depending on the type of service contracted. In the On-Premise type, all information required for service use is stored on servers owned and managed by the User, and the Company therefore does not collect the "personal information for service use" described in this Article.
The Company collects and processes the minimum personal information necessary from Users and Members for the purposes of verifying the identity of persons requesting consultation, confirming complaints and inquiries, notifying the results of their handling, providing product materials, and providing services. The detailed purpose for each item is stated in the "Purpose of collection" column of the tables below. However, whether the "personal information for service use" is collected differs depending on the type of service contracted. In the On-Premise type, all information required for service use is stored on servers owned and managed by the User, and the Company therefore does not collect the "personal information for service use" described in this Article.
| Service type | Collection of the information under item ③ | Storage location of personal information used in the product |
|---|---|---|
| Cloud type | Collected | Servers owned and managed by the Company |
| On-Premise type | Not collected | Servers owned by each User |
① Personal information for promotion, consultation and contracting
| Category | Purpose of collection | Items collected | Retention and use period |
|---|---|---|---|
| Product brochure | Delivery of product introduction materials | (Required) Name, company name, e-mail | 3 months |
| Free trial | Free trial of the service | (Required) Name, e-mail | Until 30 days after termination of service use |
| Technical support inquiry | Technical support relating to the service | (Required) Name, telephone number, e-mail | 3 months |
| Development of new products and services | Delivery of information on seminars and new products | (Optional) Name, e-mail, contact number | Until withdrawal of membership or withdrawal of consent |
| Marketing and advertising | Provision of event and promotional information | (Optional) Name, e-mail, contact number | 1 year |
| Identity verification and adoption inquiries | Identity verification, consultation and inquiries regarding adoption, service consultation and guidance on the VERI service | (Required) Company name, name, telephone number, e-mail, industry sector, details of inquiry (Optional) Job grade / job title | 1 year from the date of collection |
※ Consent to the collection and use of personal information for the purposes of new product and service development and of marketing and advertising is optional. You will suffer no disadvantage in using the services if you do not give such consent, and even after consenting you may withdraw your consent at any time.
② Personal information for contracting [in writing]
| Category | Purpose of collection | Items collected | Retention and use period |
|---|---|---|---|
| Contract | Conclusion of a service agreement | (Required) Company name, contract period, product information (type, etc.) | 1 year |
③ Provision of the service
| Category | Purpose of collection | Items collected | Retention and use period |
|---|---|---|---|
| Membership registration and management (account information) | Confirmation of the intention to register, identification and authentication of the individual in providing membership-based services, maintenance and management of membership status, and prevention of fraudulent use of the service | (Required) ID, password, name, e-mail (Optional) Telephone number | Until withdrawal of membership |
| Service subscription and payment | Payment of service fees, registration and modification of payment methods, and management of payment records | (Required) Name, e-mail, payment approval information (approval number, type of payment method, date and time of payment, payment amount) ※ Card information such as credit card numbers is collected and processed directly by the payment gateway (PG) provider and is not stored by the Company. | Until 6 months after termination, so that billing and settlement disputes can be addressed; where amounts remain unpaid, until the matter is resolved |
| Initial administrator registration | Registration of the product administrator | (Required) Administrator ID, administrator e-mail, password | Until 30 days after termination of service use |
| Service use | Management of service use records, prevention of fraudulent use, and improvement of service quality | (Required – automatically collected) IP address, cookie (ID), date and time of access, service use records, records of improper or fraudulent use | Until 30 days after termination of service use. However, service access records (log records) are retained for 3 months in accordance with the Protection of Communications Secrets Act |
④ Personal information of children under 14 years of age The Company does not collect the personal information of children under 14 years of age and does not provide services directed at such children. To this end, the Company maintains a procedure to verify at the time of membership registration that the registrant is at least 14 years old. If it is confirmed that the personal information of a child under 14 has been collected, the Company will destroy that personal information without delay.
3. Processing and Retention Periods of Personal Information
The Company processes and retains personal information within the retention and use period prescribed by statute, or within the retention and use period consented to by the data subject at the time of collection. When the purpose of collection, or the purpose for which the information was provided, has been achieved, the Company destroys the personal information without delay. However, where the information needs to be retained for a certain period for the reasons set out below, it is retained for that period and then destroyed. Even where the retention and use period specified in "2. Purposes and Items of Collection and Processing of Personal Information" has elapsed, personal information that must be preserved under the relevant statutes listed in item (a) below is preserved for the period prescribed by those statutes; in that case, the personal information is stored and managed in a separate database or storage location, apart from other personal information, and is not used for any purpose other than the preservation purpose prescribed by law.
Where a User makes use of an external service integration feature, the Company receives and processes personal information from the relevant service as follows.
| Source | Items received | Purpose of use | Retention and use period |
|---|---|---|---|
| Slack | Workspace ID, bot user ID, bot access token, user ID, e-mail, channel / file ID | Provision of notifications and creation of reviews | For the duration of the integration |
| Telegram | Chat ID, username | Sharing of review information | For the duration of the integration |
Data subjects have the right to request from the Company the source of the above personal information, the purpose of its processing, and the suspension of its processing. The above information is received only where the User has directly activated the relevant integration feature.
a. Preservation pursuant to relevant statutes Where information needs to be preserved in order to verify rights and obligations relating to transactions, or for similar reasons, under relevant statutes such as the Act on the Consumer Protection in Electronic Commerce, Etc. and under the Company's internal policies, the Company retains the personal information for the period prescribed by those statutes.
| Content | Retention period | Relevant statute |
|---|---|---|
| Records on contracts or the withdrawal of subscriptions | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Records on payment and the supply of goods and services | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Records on consumer complaints or the handling of disputes | 3 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Books and supporting documents on all transactions prescribed by tax law | 5 years | Framework Act on National Taxes |
| Records on electronic financial transactions | 5 years | Electronic Financial Transactions Act |
| Records on the collection, processing and use of credit information | 3 years | Act on the Use and Protection of Credit Information |
| Records on labelling and advertising | 6 months | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Service visit records | 3 months | Protection of Communications Secrets Act |
4. Procedures and Methods for the Destruction of Personal Information
a. Destruction procedure
When personal information becomes unnecessary, for example because the retention period has expired or the purpose of processing has been achieved, the Company destroys it without delay. The Company selects the personal information for which grounds for destruction have arisen and destroys it upon the approval of the Company's Chief Privacy Officer.
Where a member requests termination of membership or loses membership status, information that can uniquely identify the individual is deleted immediately and is processed so that it cannot be restored or used by any means.
In the case of paying members, automatic termination may cause problems in providing customer support relating to use of the product; such cases may therefore be handled individually, with guidance on the applicable termination procedure provided by the relevant department of the Company.
In all other cases, the Company also destroys members' personal information without delay once the purpose of collection or the purpose for which it was provided has been achieved.
b. Destruction method
Personal information recorded and stored in electronic file form is permanently deleted using technical or physical methods that make the records irreproducible. Personal information recorded and stored on paper is destroyed by shredding or incineration.
When personal information becomes unnecessary, for example because the retention period has expired or the purpose of processing has been achieved, the Company destroys it without delay. The Company selects the personal information for which grounds for destruction have arisen and destroys it upon the approval of the Company's Chief Privacy Officer.
Where a member requests termination of membership or loses membership status, information that can uniquely identify the individual is deleted immediately and is processed so that it cannot be restored or used by any means.
In the case of paying members, automatic termination may cause problems in providing customer support relating to use of the product; such cases may therefore be handled individually, with guidance on the applicable termination procedure provided by the relevant department of the Company.
In all other cases, the Company also destroys members' personal information without delay once the purpose of collection or the purpose for which it was provided has been achieved.
b. Destruction method
Personal information recorded and stored in electronic file form is permanently deleted using technical or physical methods that make the records irreproducible. Personal information recorded and stored on paper is destroyed by shredding or incineration.
5. Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them
As data subjects, Users may exercise the following rights relating to the protection of personal information at any time.
① A data subject may at any time exercise the rights to request access to, correction of, deletion of, and suspension of the processing of their personal information, and to withdraw consent.
② The rights under paragraph ① may be exercised in writing, by e-mail, by facsimile or by similar means in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.
③ The rights under paragraph ① may also be exercised through an agent, such as the data subject's legal representative or a person duly authorized by the data subject. In such case, a letter of authority in the form of Annex Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.
④ Requests for access to personal information and for suspension of processing may be restricted pursuant to Article 35(5) and Article 37(2) of the Personal Information Protection Act.
⑤ Where personal information is expressly designated as subject to collection under other statutes, its deletion cannot be requested. Accordingly, the Company may refuse access to, correction of, or deletion of all or part of the personal information in the following cases.
① A data subject may at any time exercise the rights to request access to, correction of, deletion of, and suspension of the processing of their personal information, and to withdraw consent.
② The rights under paragraph ① may be exercised in writing, by e-mail, by facsimile or by similar means in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.
③ The rights under paragraph ① may also be exercised through an agent, such as the data subject's legal representative or a person duly authorized by the data subject. In such case, a letter of authority in the form of Annex Form No. 11 of the Enforcement Rules of the Personal Information Protection Act must be submitted.
④ Requests for access to personal information and for suspension of processing may be restricted pursuant to Article 35(5) and Article 37(2) of the Personal Information Protection Act.
⑤ Where personal information is expressly designated as subject to collection under other statutes, its deletion cannot be requested. Accordingly, the Company may refuse access to, correction of, or deletion of all or part of the personal information in the following cases.
- 1) Where access is prohibited or restricted by law.
2) Where there is a risk of harm to the life or body of another person, or of unjustly infringing the property or other interests of another person.
In addition, personal information that has been deleted, or whose processing has been suspended, at the request of a data subject or legal representative is handled as set out in "3. Processing and Retention Periods of Personal Information" and is processed so that it cannot be accessed or used for any other purpose.
6. Provision of Personal Information to Third Parties and Entrustment of Processing
(Provision to third parties) The Company processes the personal information of data subjects only within the scope of the stated purposes of processing, and provides personal information to third parties only where Article 17 or Article 18 of the Personal Information Protection Act applies — for example, with the consent of the data subject or under a special provision of law. Otherwise, the Company does not provide personal information to third parties. However, personal information may be provided without a separate consent procedure where required by law, where unavoidable in order to comply with a legal obligation, or where a public institution requests it in order to perform duties within its jurisdiction as prescribed by statute.
(Entrustment) In order to provide smooth and improved services, the Company entrusts the processing of personal information to third parties, and supervises and monitors those parties to ensure that they comply with the relevant statutes. The entrusted parties and the scope of the entrusted work are as follows.
(Entrustment) In order to provide smooth and improved services, the Company entrusts the processing of personal information to third parties, and supervises and monitors those parties to ensure that they comply with the relevant statutes. The entrusted parties and the scope of the entrusted work are as follows.
| Entrusted party | Entrusted work | Items provided | Retention and use period |
|---|---|---|---|
| Toss Payments Co., Ltd. | Payment of service fees and management of payment records | Payment information | Until withdrawal of membership or termination of the entrustment agreement |
| Amazon Web Services, Inc. | Provision of cloud services for data storage (Seoul region, Republic of Korea) | Data relating to the provision of the Company's services | Until withdrawal of membership or termination of the entrustment agreement |
※ The Company uses the cloud services of Amazon Web Services, Inc. for the secure storage of data, and users' personal information is stored on servers located within the Republic of Korea (AWS Seoul region). The Company does not transfer users' personal information overseas.
7. Installation, Operation and Refusal of Devices that Automatically Collect Personal Information
① The Company uses "cookies", which store and retrieve usage information from time to time in order to provide individually tailored services. A cookie is a small text file stored in the browser of the user's computer when the user accesses the Company's site. Cookies remain stored in the browser until the user deletes them directly through the browser settings or until the cookie expires (up to 7 days).
② Information generated in the course of service use, such as IP addresses, dates and times of access and service use records, is stored on the Company's servers separately from cookies, and its retention period follows item ③ of "2. Purposes and Items of Collection and Processing of Personal Information" of this Policy and the relevant statutes, including the Protection of Communications Secrets Act.
Data subjects may allow or block cookies through their web browser settings. However, refusing to store cookies may make it difficult to use customized services.
▶ Allowing / blocking cookies in a desktop browser
- Chrome: Browser settings > Privacy and security > Delete browsing data
- Edge: Browser settings > Cookies and site permissions > Manage and delete cookies and site data
- Internet Explorer: Browser Tools > Internet Options > Privacy > Advanced
▶ Allowing / blocking cookies in a mobile browser
- Chrome: Mobile browser settings > Privacy and security > Delete browsing data
- Safari: Device settings > Safari > Advanced > Block all cookies
- Samsung Internet: Mobile browser settings > Browsing history > Delete browsing data
③ The rights under paragraph ① may be exercised in writing, by e-mail, by facsimile or by similar means in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.
② Information generated in the course of service use, such as IP addresses, dates and times of access and service use records, is stored on the Company's servers separately from cookies, and its retention period follows item ③ of "2. Purposes and Items of Collection and Processing of Personal Information" of this Policy and the relevant statutes, including the Protection of Communications Secrets Act.
Data subjects may allow or block cookies through their web browser settings. However, refusing to store cookies may make it difficult to use customized services.
▶ Allowing / blocking cookies in a desktop browser
- Chrome: Browser settings > Privacy and security > Delete browsing data
- Edge: Browser settings > Cookies and site permissions > Manage and delete cookies and site data
- Internet Explorer: Browser Tools > Internet Options > Privacy > Advanced
▶ Allowing / blocking cookies in a mobile browser
- Chrome: Mobile browser settings > Privacy and security > Delete browsing data
- Safari: Device settings > Safari > Advanced > Block all cookies
- Samsung Internet: Mobile browser settings > Browsing history > Delete browsing data
③ The rights under paragraph ① may be exercised in writing, by e-mail, by facsimile or by similar means in accordance with Article 41(1) of the Enforcement Decree of the Personal Information Protection Act, and the Company will act on such requests without delay.
8. Measures to Ensure the Security of Personal Information
In accordance with Article 29 of the Personal Information Protection Act, the Company takes the following technical, administrative and physical measures necessary to ensure security.
- Administrative measures: establishment and implementation of an internal management plan, operation of a dedicated organization, and regular staff training.
- Technical measures: management of access rights to the personal information processing system and similar systems, installation of an access control system, encryption of personal information, and installation and updating of security programs.
- Physical measures: access control for server rooms and similar facilities.
9. Chief Privacy Officer and Responsible Department
In order to protect customers' personal information and to handle complaints relating to personal information, the Company has designated a Chief Privacy Officer as follows.
▶ Chief Privacy Officer
- Name / Title: Jonggil Lee, Group Leader
- Telephone: 070-7805-8055
- E-mail: jklee@nsetec.com
▶ Department responsible for personal information protection
- Department: Technical Support Team
- Telephone: 070-7805-8055
- E-mail: jklee@nsetec.com
▶ Chief Privacy Officer
- Name / Title: Jonggil Lee, Group Leader
- Telephone: 070-7805-8055
- E-mail: jklee@nsetec.com
▶ Department responsible for personal information protection
- Department: Technical Support Team
- Telephone: 070-7805-8055
- E-mail: jklee@nsetec.com
10. Remedies for Infringement of the Rights of Data Subjects
Data subjects may report any complaint relating to the protection of personal information arising from their use of the Company's services (or business) to the Chief Privacy Officer or the responsible department. The Company will respond promptly and fully to such reports.
For other reports of, or consultation on, infringements of personal information, please contact the organizations below.
For other reports of, or consultation on, infringements of personal information, please contact the organizations below.
| Organization | Website | Telephone |
|---|---|---|
| Personal Information Dispute Mediation Committee | http://www.kopico.go.kr | 1833-6972 (no area code) |
| Privacy Infringement Report Center | http://privacy.kisa.or.kr | 118 (no area code) |
| Cyber Investigation Division, Supreme Prosecutors' Office | http://www.spo.go.kr | 1301 (no area code) |
| Cyber Investigation Bureau, Korean National Police Agency | http://ecrm.cyber.go.kr | 182 (no area code) |
11. Amendment of the Privacy Policy
Where content is added to, deleted from or modified in this Privacy Policy, notice will be given through the notice section of the website (or by individual notice) at least 7 days before the change takes effect. However, where the change materially affects the rights of data subjects — for example a change in the items of personal information collected or in the purpose of use — notice will be given at least 30 days before it takes effect.
This Policy takes effect on September 1, 2026.
Previous revision date: September 1, 2025
Previous revision date: October 1, 2024
This is an English translation of the Korean-language privacy policy of NSE Technology Co., Ltd., provided for the convenience of readers. In the event of any discrepancy between this translation and the Korean original, the Korean original shall prevail.
This Policy takes effect on September 1, 2026.
Previous revision date: September 1, 2025
Previous revision date: October 1, 2024
This is an English translation of the Korean-language privacy policy of NSE Technology Co., Ltd., provided for the convenience of readers. In the event of any discrepancy between this translation and the Korean original, the Korean original shall prevail.