If the policies are revised, the foundation will inform you of the changes to the execution of personal information via the bulletin board on the website (or via individual notice).

Article 1. Purposes of Personal Information Management

The foundation manages personal information for the following purposes. Personal information will not be used beyond any stated purposes, and the foundation will seek prior-consent in case the purposes are changed.

Personal information is managed for the purpose of
a. the implementation of contract on service provisions and settlement of fees including provision of contents, purchasing and payment, products delivery, sending of receipts, personal certification (finance transactions, finance service)
b. personal identification confirmation related to the joining of membership and use of membership services, prevention of illegal use of inappropriate members and an unauthorized use, confirming user’s willingness to join the website, age certification, confirmation of legal representative for child 14 years and younger, history records for any dispute conciliations, service complaint handling, and announcement of any notices
c. marketing and promotional activities, development of new services(products) and provision of tailored services, offering information on events and promotions, offering service related to demographic features, checking of service validity, checking access frequency, and statistics on service use of members

Article 2. Items of Personal Information to Be Collected

For the provision of various services and membership, information items to be collected, and collection methods are as follows:

1. File name of personal information : a homepage member(a member of the website operated by the foundation)

. Personal information items : 이name, date and year of birth, gender, log-in ID, password, e-mail, contact number, address, cellphone number, log-in history, IP address, name of representative, phone number of representative, email of representative, contact number of representative

. Collection method : the website operated by the foundation

2. File name of personal information : information provider

. Personal information items : name, cellphone number, name, e-mail, company, company contact number, bank account number, payment history

. Collection method : paper form(application form)

Article 3. Period for Personal Information to be Held and Used

Personal information is destroyed once the purpose of the process is achieved. However, the following information is saved for the below-stated period for the following reasons.

1. File name of personal information : a member of the website (website operated by the foundation)

. personal information items : name, date and year of birth, gender, log-in ID, password, e-mail, contact number, address, cellphone number, log-in history, IP address, name of legal representative, phone number of legal representative, email of legal representative, contact number of legal representative

. collection condition : a user’s consent

. Collection period: from joining to withdrawal from membership (When payments and products transactions exist, information is saved for 5 years since the transaction date.)

2. File Name of personal information : information provider

. personal information items : name, cellphone number, name, e-mail, company, company contact number, bank account number, payment history

. collection condition : a consent of user

. collection period : 5 years from the latest provision

Article 4. Provision of Personal Information to a Third Party

The foundation manages users’ personal information within the stated scope of Article 1 (purpose of personal information management), and will not manage or provide the information to a third party beyond the scope without a prior-consent of the subject of the information except in the following circumstances:

1. Where the foundation obtained the consent of a user of information;

2. Where there exist special provisions in any Act;

3.Where it is deemed obviously necessary for physical safety and property interests of a user of information or a third person when the user of information or his or her legal representative cannot give prior consent because he/she is unable to express his/her intention or by reason of his/her unidentified address, etc.;

4. where personal information is necessary for compiling statistics, or scientific research purposes, etc., and the personal information is provided in a form by which a specific individual cannot be identified;

5.Where using personal information for any purpose other than the intended purpose or a failure to provide a third person with such information makes it impossible to perform affairs provided for in any other Act, and this has undergone deliberation and resolution by the Protection Committee;

6.Where it is necessary for providing a foreign government or international organization with personal information in order to implement a treaty or any other international agreement;

7. Where it is necessary for investigating a crime, and instituting and sustaining a public prosecution;

8. Where it is necessary for a court to perform its judicial affairs;

9. Where it is necessary for executing a punishment, care and custody or protective disposition.

The foundation provides personal information to the following organization or individuals for the following purposes.

A recipient organization of personal information : customers survey agency

Name of personal information file: information provider

Personal information items to be provided : name, cellphone number, company name, company phone number

Purpose for which personal information is provided : customers satisfaction survey conducted by nation

Period for which personal information is held : immediate destroy when the purpose of information provision is achieved

Article 5. Personal Information Entrustment of Affairs

The foundation entrusts a third party with the management affairs of personal information in order to achieve a smooth handling of affairs.

Company commissioned: Culture Tech Korea Inc.

Work for commission : theater ticketing via website operated by the foundation

When entrustment of information is needed, the foundation will clearly state the compliance of relevant personal information protection Act, prohibition and responsibility of provision of personal information to a third party, and store a contract in paper and online.
When any change is made in the work affairs and assignee, the changes must be disclosed immediately under the personal information regulations.

Article 6. the Rights and Duties of a Subject of Information, and How to Exercise them

A subject of information (legal deputy for 14 years and younger) can exercise the right to the following personal information protection.

a. a request to inspect personal information

b. a request to revise information if there is errors

c. a request to destroy information

d. a request to suspense the use of personal information

The right stated under the Article 1 can be exercised through various ways of paper, emails, and fax under the attachment form 8 of the Enforcement Rules to Personal Information Protection Act, and the foundation will handle the requests immediately.

When a subject of information makes a request to revise or destroy personal information, the foundation will neither use nor provide the personal information until the request is handled.

The right stated under the Article 1 can be exercised through his/her legal representative. In this case, a carte blanche must be presented under the attachment form 11 of the Enforcement Rules to Personal Information Protection Act.

A request to inspect and suspend the use of personal information can be limited under clause 5 of Article 35, and clause 2 of Article 37 of Personal Information Protection Act.

A request to revise and destroy personal information cannot be made if the information is the subject of collection under the other legislations.

When a request to inspect, revise, destroy information and suspend the use the information is made, the foundation will check who the person is making the request: whether the person is him/herself or a legal representative.

The subject of information has the right to refuse information collection, use, and the provision to a third party. However, in such case, a user will be informed that joining membership of the homepage and using of the service will not be possible.

Article 7 Destruction of Personal Information

When a management purpose is achieved, the foundation will destroy personal information without delay. Procedures, period, and methods of destruction are as follows:

A. Destruction Procedure

When a purpose is achieved, the information provided by users is moved to separate database or document in paper, to be destroyed without delay or to be destroyed after a certain period of time, under the foundation’s regulations or other relevant legist rations. The information in a separate database will not be used for other purposes beyond the cases stated under the legislation.

B. Destruction Period

When the holding period of users’ personal information is expires, the information will be destroyed within 5 days of the expiration. When personal information becomes unnecessary because the purpose is achieved, the service is ended or the foundation is closed, the information will be destroyed within 5days of the day when the information become unnecessary.

C. Destruction Methods

The printed personal information will be grinded or burned, and the information in electronic file will be destroyed with technical methods to be irreversible.

Article 8. Information Safety Measures

The foundation does the following measures in order to gain safety under the Article 29 of Personal Information Protection Act.

a. Administrative measures : Planning and execution of the management, regular employee trainings, et cetera.

b. technical measures : access limit of personal information handling system, installation of access control system, coding of individual identification information, installation of security program

c. physical measures : limit an access to data processing room, data storage room and et cetera.

Article 9. Personal Information Protection Managers

The foundation designates managers who take overall responsibility for the information protection and persons who handle the personal information, to process any personal information related complaints. (Personal information protection managers under the article 31 of Personal Information Protection Act)

Personal Information Protection Manager : Kim Young-kyun of Business Planning Team, 02-2077-2900 young0055@nmf.or.kr
A person in charge of personal information protection : Ha Hoon, Business Planning Team, 02-2077-2904 harang@nmf.or.kr

The Article 10. Changes in Personal Information Management Policies

Personal information management policies will be effective starting on March, 25. 2016.

Previous personal information management policies can be checked below.

- February 6, 2014 – March 16, 2014 applied policies

- March 16, 2014 – August 31, 2014 applied policies

- September 1, 2014 – March 25, 2016 applied policies

Article 11. Remedy Procedures of Violation of Rights

The subject of personal information can make a request of remedying damages, consulting, and others, when personal information is infringed.

Personal Information Mediation Committee(run by Korea Internet & Security Agency)

- duty: request on mediation on personal information dispute, group dispute mediation(civil case)

- website : privacy.kisa.or.kr

- phone : (+82) 118

- address : Mediation Committee of Korea Internet & Security Agency 135, Joongdae-ro, Songpa-gu, Seoul

Personal Information Infringement Reporting Center ( run by the Korea Internet & Security Agency)

- duty: personal information infringement reporting, consultation request

- website : www.kopico.go.kr

- phone : (+82) 118

- address : Personal Information Infringement Reporting Center of Korea Internet & Security, 135 Joongdae-ro, Songpa-gu, Seoul, 138-950

Cyber Security Capacity team of Supreme Prosecutors’ Office Republic of Korea : (+82)- 02-3480-3578 (www.spo.go.kr)

Cyber Terror Response Center, National Police Agency : 1566-0112(www.netan.go.kr)

In addition, when any measure and action made as a response to the requests of inspection, revision, destroying and suspending the use of personal information does harm to rights and interests of the subject of the personal information, he or she can request administration trials of Administration Appeals Committee (www.simpan.go.kr) under the Administrative Trials Act.